@ewhauser/world-celld 0.1.0

package/CHANGELOG.md

@@ -0,0 +1,11 @@
+# Changelog
+
+All notable changes to this project will be documented in this file.
+
+## 0.1.0 - 2026-08-15
+
+- Initial `@workflow/world` implementation backed by celld Durable Objects.
+- Durable workflow storage, streams, queues, retries, deduplication, and dead
+  letters.
+- Authenticated fleet RPC, deployable worker bundle, local development fleet,
+  conformance tests, and the MinIO performance and loss harness.

package/LICENSE

@@ -0,0 +1,201 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        <http://www.apache.org/licenses/>
+
+TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+1.  Definitions.
+
+    "License" shall mean the terms and conditions for use, reproduction,
+    and distribution as defined by Sections 1 through 9 of this document.
+
+    "Licensor" shall mean the copyright owner or entity authorized by
+    the copyright owner that is granting the License.
+
+    "Legal Entity" shall mean the union of the acting entity and all
+    other entities that control, are controlled by, or are under common
+    control with that entity. For the purposes of this definition,
+    "control" means (i) the power, direct or indirect, to cause the
+    direction or management of such entity, whether by contract or
+    otherwise, or (ii) ownership of fifty percent (50%) or more of the
+    outstanding shares, or (iii) beneficial ownership of such entity.
+
+    "You" (or "Your") shall mean an individual or Legal Entity
+    exercising permissions granted by this License.
+
+    "Source" form shall mean the preferred form for making modifications,
+    including but not limited to software source code, documentation
+    source, and configuration files.
+
+    "Object" form shall mean any form resulting from mechanical
+    transformation or translation of a Source form, including but
+    not limited to compiled object code, generated documentation,
+    and conversions to other media types.
+
+    "Work" shall mean the work of authorship, whether in Source or
+    Object form, made available under the License, as indicated by a
+    copyright notice that is included in or attached to the work
+    (an example is provided in the Appendix below).
+
+    "Derivative Works" shall mean any work, whether in Source or Object
+    form, that is based on (or derived from) the Work and for which the
+    editorial revisions, annotations, elaborations, or other modifications
+    represent, as a whole, an original work of authorship. For the purposes
+    of this License, Derivative Works shall not include works that remain
+    separable from, or merely link (or bind by name) to the interfaces of,
+    the Work and Derivative Works thereof.
+
+    "Contribution" shall mean any work of authorship, including
+    the original version of the Work and any modifications or additions
+    to that Work or Derivative Works thereof, that is intentionally
+    submitted to Licensor for inclusion in the Work by the copyright owner
+    or by an individual or Legal Entity authorized to submit on behalf of
+    the copyright owner. For the purposes of this definition, "submitted"
+    means any form of electronic, verbal, or written communication sent
+    to the Licensor or its representatives, including but not limited to
+    communication on electronic mailing lists, source code control systems,
+    and issue tracking systems that are managed by, or on behalf of, the
+    Licensor for the purpose of discussing and improving the Work, but
+    excluding communication that is conspicuously marked or otherwise
+    designated in writing by the copyright owner as "Not a Contribution."
+
+    "Contributor" shall mean Licensor and any individual or Legal Entity
+    on behalf of whom a Contribution has been received by Licensor and
+    subsequently incorporated within the Work.
+
+2.  Grant of Copyright License. Subject to the terms and conditions of
+    this License, each Contributor hereby grants to You a perpetual,
+    worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+    copyright license to reproduce, prepare Derivative Works of,
+    publicly display, publicly perform, sublicense, and distribute the
+    Work and such Derivative Works in Source or Object form.
+
+3.  Grant of Patent License. Subject to the terms and conditions of
+    this License, each Contributor hereby grants to You a perpetual,
+    worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+    (except as stated in this section) patent license to make, have made,
+    use, offer to sell, sell, import, and otherwise transfer the Work,
+    where such license applies only to those patent claims licensable
+    by such Contributor that are necessarily infringed by their
+    Contribution(s) alone or by combination of their Contribution(s)
+    with the Work to which such Contribution(s) was submitted. If You
+    institute patent litigation against any entity (including a
+    cross-claim or counterclaim in a lawsuit) alleging that the Work
+    or a Contribution incorporated within the Work constitutes direct
+    or contributory patent infringement, then any patent licenses
+    granted to You under this License for that Work shall terminate
+    as of the date such litigation is filed.
+
+4.  Redistribution. You may reproduce and distribute copies of the
+    Work or Derivative Works thereof in any medium, with or without
+    modifications, and in Source or Object form, provided that You
+    meet the following conditions:
+
+    (a) You must give any other recipients of the Work or
+    Derivative Works a copy of this License; and
+
+    (b) You must cause any modified files to carry prominent notices
+    stating that You changed the files; and
+
+    (c) You must retain, in the Source form of any Derivative Works
+    that You distribute, all copyright, patent, trademark, and
+    attribution notices from the Source form of the Work,
+    excluding those notices that do not pertain to any part of
+    the Derivative Works; and
+
+    (d) If the Work includes a "NOTICE" text file as part of its
+    distribution, then any Derivative Works that You distribute must
+    include a readable copy of the attribution notices contained
+    within such NOTICE file, excluding those notices that do not
+    pertain to any part of the Derivative Works, in at least one
+    of the following places: within a NOTICE text file distributed
+    as part of the Derivative Works; within the Source form or
+    documentation, if provided along with the Derivative Works; or,
+    within a display generated by the Derivative Works, if and
+    wherever such third-party notices normally appear. The contents
+    of the NOTICE file are for informational purposes only and
+    do not modify the License. You may add Your own attribution
+    notices within Derivative Works that You distribute, alongside
+    or as an addendum to the NOTICE text from the Work, provided
+    that such additional attribution notices cannot be construed
+    as modifying the License.
+
+    You may add Your own copyright statement to Your modifications and
+    may provide additional or different license terms and conditions
+    for use, reproduction, or distribution of Your modifications, or
+    for any such Derivative Works as a whole, provided Your use,
+    reproduction, and distribution of the Work otherwise complies with
+    the conditions stated in this License.
+
+5.  Submission of Contributions. Unless You explicitly state otherwise,
+    any Contribution intentionally submitted for inclusion in the Work
+    by You to the Licensor shall be under the terms and conditions of
+    this License, without any additional terms or conditions.
+    Notwithstanding the above, nothing herein shall supersede or modify
+    the terms of any separate license agreement you may have executed
+    with Licensor regarding such Contributions.
+
+6.  Trademarks. This License does not grant permission to use the trade
+    names, trademarks, service marks, or product names of the Licensor,
+    except as required for reasonable and customary use in describing the
+    origin of the Work and reproducing the content of the NOTICE file.
+
+7.  Disclaimer of Warranty. Unless required by applicable law or
+    agreed to in writing, Licensor provides the Work (and each
+    Contributor provides its Contributions) on an "AS IS" BASIS,
+    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+    implied, including, without limitation, any warranties or conditions
+    of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+    PARTICULAR PURPOSE. You are solely responsible for determining the
+    appropriateness of using or redistributing the Work and assume any
+    risks associated with Your exercise of permissions under this License.
+
+8.  Limitation of Liability. In no event and under no legal theory,
+    whether in tort (including negligence), contract, or otherwise,
+    unless required by applicable law (such as deliberate and grossly
+    negligent acts) or agreed to in writing, shall any Contributor be
+    liable to You for damages, including any direct, indirect, special,
+    incidental, or consequential damages of any character arising as a
+    result of this License or out of the use or inability to use the
+    Work (including but not limited to damages for loss of goodwill,
+    work stoppage, computer failure or malfunction, or any and all
+    other commercial damages or losses), even if such Contributor
+    has been advised of the possibility of such damages.
+
+9.  Accepting Warranty or Additional Liability. While redistributing
+    the Work or Derivative Works thereof, You may choose to offer,
+    and charge a fee for, acceptance of support, warranty, indemnity,
+    or other liability obligations and/or rights consistent with this
+    License. However, in accepting such obligations, You may act only
+    on Your own behalf and on Your sole responsibility, not on behalf
+    of any other Contributor, and only if You agree to indemnify,
+    defend, and hold each Contributor harmless for any liability
+    incurred by, or claims asserted against, such Contributor by reason
+    of your accepting any such warranty or additional liability.
+
+END OF TERMS AND CONDITIONS
+
+APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+Copyright 2025 Vinnymac LLC.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.

package/NOTICE

@@ -0,0 +1,24 @@
+@ewhauser/world-celld
+Copyright 2026 ewhauser
+
+This product includes software developed as part of the "worlds" project
+(https://github.com/vinnymac/worlds), Copyright vinnymac and contributors,
+licensed under the Apache License, Version 2.0.
+
+The following files are vendored (verbatim or with modifications) from
+vinnymac/worlds:
+
+  From packages/world-cloudflare/src:
+    src/apply-event.ts
+    src/storage.ts
+    src/streamer.ts
+    src/queue.ts               (modified: Cloudflare Queues replaced by QueueDO)
+    src/test-mocks.ts          (modified)
+    src/util.ts
+    src/worker/durable-objects/WorkflowRunDO.ts
+    src/worker/durable-objects/StreamDO.ts
+
+  From packages/shared/src:
+    src/vendor/shared/*
+
+  Portions of test/ are derived from packages/world-cloudflare/test.

package/README.md

@@ -0,0 +1,292 @@
+# world-celld
+
+A [Workflow DevKit](https://useworkflow.dev) `World` backed by
+[celld](https://github.com/denoland/celld).
+
+`world-celld` stores workflow runs, hooks, and streams in celld cells. Scheduled
+work is delivered with durable cell alarms. This gives Node applications a
+self-hosted alternative to platform-specific Workflow backends.
+
+> [!WARNING]
+> `world-celld` is experimental and has not been proven in production. Its API
+> and storage layout may change before 1.0.
+
+## What it provides
+
+- Workflow run, step, event, and hook persistence
+- Durable streams
+- Delayed work, retries, deduplication, and dead-letter storage
+- An authenticated HTTP connection between a Node application and a celld fleet
+- An in-process fleet for local development and conformance testing
+
+## Try the example
+
+You need Node.js 22 or later and pnpm 11.
+
+```sh
+pnpm install
+pnpm build
+pnpm --dir examples/demo-app build
+pnpm --dir examples/demo-app demo
+```
+
+The example starts an in-memory fleet and runs an order workflow through steps,
+a sleep, an approval hook, and an output stream. It uses the same worker, cell
+classes, and HTTP protocol as a celld deployment; only persistence and cell
+routing are emulated.
+
+See [`examples/demo-app`](./examples/demo-app) for the application and workflow
+source.
+
+## Use it in an application
+
+Install the package from npm:
+
+```sh
+pnpm add @ewhauser/world-celld
+```
+
+Workflow DevKit can load the package from environment variables:
+
+```sh
+WORKFLOW_TARGET_WORLD=@ewhauser/world-celld
+CELLD_FLEET_URL=http://fleet.internal:8080
+CELLD_WORLD_SECRET=replace-with-a-secret
+WORKFLOW_BASE_URL=https://workflow.example.com
+```
+
+You can also construct the World directly:
+
+```ts
+import { createCelldWorld } from '@ewhauser/world-celld';
+
+const world = createCelldWorld({
+  fleetUrl: 'http://fleet.internal:8080',
+  secret: process.env.CELLD_WORLD_SECRET!,
+  baseUrl: 'https://workflow.example.com',
+});
+```
+
+`WORKFLOW_BASE_URL` (or `baseUrl`) is where queue cells deliver flow and step
+requests. It must be reachable from every celld node.
+
+## Deploy the worker
+
+Before deploying, you need a celld fleet, `esbuild` on `PATH`, and an object
+store that meets celld's conditional-write requirements. Refer to the
+[celld documentation](https://github.com/denoland/celld) for fleet and storage
+setup.
+
+From a source checkout:
+
+```sh
+celld deploy ./celld-worker --bucket s3://my-cells-bucket
+```
+
+From an installed package, first copy the deployable worker into your project:
+
+```sh
+cp -R node_modules/@ewhauser/world-celld/celld-worker ./workflow-world
+celld deploy ./workflow-world --bucket s3://my-cells-bucket
+```
+
+The worker rejects stateful requests unless `WORLD_SECRET` is configured. Pass
+the same secret to the fleet and the application:
+
+```sh
+CELLD_VAR_WORLD_SECRET="$CELLD_WORLD_SECRET" \
+celld --bucket s3://my-cells-bucket \
+  --listen 0.0.0.0:8080 \
+  --internal-listen 10.0.0.12:8081 \
+  --advertise 10.0.0.12:8081
+```
+
+Use a secret manager rather than putting the value in `wrangler.jsonc`. Keep
+celld's internal listener on a trusted network; the World bearer token protects
+the worker RPC routes, not celld's administrative endpoints.
+
+More deployment detail is in [`celld-worker/README.md`](./celld-worker/README.md).
+
+## How it works
+
+```text
+Workflow application
+  |
+  | authenticated HTTP RPC
+  v
+celld worker router
+  |-- WorkflowRunDO  one cell per workflow run
+  |-- StreamDO       stream chunks and run/stream indexes
+  |-- IndexDO        run and hook lookup indexes
+  `-- QueueDO        delayed delivery, retries, and dead letters
+          |
+          | HTTP callbacks
+          v
+Workflow application /.well-known/workflow/v1/{flow|step}
+```
+
+The application-side package implements the Workflow `World` interface and
+translates its storage, stream, and queue operations into RPC calls. The celld
+worker accepts only a fixed set of methods and routes each request to the named
+cell that owns the data.
+
+## Configuration
+
+Application options can be passed to `createCelldWorld()` unless an environment
+variable is shown below.
+
+| Option         | Environment variable  | Default                  |
+| -------------- | --------------------- | ------------------------ |
+| `fleetUrl`     | `CELLD_FLEET_URL`     | required                 |
+| `secret`       | `CELLD_WORLD_SECRET`  | required with `fleetUrl` |
+| `baseUrl`      | `WORKFLOW_BASE_URL`   | `http://localhost:$PORT` |
+| `deploymentId` | `CELLD_DEPLOYMENT_ID` | `celld-default`          |
+| `queueShards`  | —                     | `1`                      |
+| `readPollMs`   | —                     | `250`                    |
+| `rpcTimeoutMs` | —                     | `30000`                  |
+
+The deployed worker also accepts these celld variables:
+
+| Variable                    | Default  | Purpose                                              |
+| --------------------------- | -------- | ---------------------------------------------------- |
+| `WORLD_SECRET`              | none     | Required bearer secret for RPC routes                |
+| `WORKFLOW_CALLBACK_SECRET`  | none     | Sent with deliveries as `x-workflow-callback-secret` |
+| `QUEUE_MAX_ATTEMPTS`        | `5`      | Attempts before a message is dead-lettered           |
+| `QUEUE_MAX_INFLIGHT`        | `5`      | Concurrent deliveries per queue cell                 |
+| `QUEUE_DELIVERY_TIMEOUT_MS` | `300000` | Timeout for an application callback                  |
+
+`queueShards` is part of queue placement and is pinned when a queue cell is
+first used. Drain pending work before changing it.
+
+## Operational notes
+
+- Delivery is at least once. Workflow steps and other external side effects
+  must be idempotent.
+- Queue cells expose `stats`, `listDeadLetters`, `redriveDeadLetter`,
+  `purgeDeadLetters`, and `rearmAlarm` through the authenticated RPC endpoint.
+- A new application URL applies to newly enqueued messages. Existing messages
+  retain the callback URL with which they were created.
+- Fleet restarts can interrupt in-flight callbacks; expired claims are
+  delivered again.
+
+## Development
+
+```sh
+pnpm format
+pnpm check
+```
+
+`pnpm check` runs formatting, linting, type checking, tests, the build, and the
+worker and npm-package checks. The package check inspects the exact tarball and
+installs it in a clean temporary consumer with lifecycle scripts disabled.
+Oxlint runs its correctness, suspicious, and performance categories with
+type-aware checks and warnings denied. The default test suite includes the
+upstream `@workflow/world-testing` conformance suite and does not require celld.
+To run the live fleet tests:
+
+```sh
+CELLD_FLEET_URL=http://fleet.internal:8080 \
+CELLD_WORLD_SECRET=replace-with-a-secret \
+pnpm test:integration
+```
+
+### Local MinIO performance and loss test
+
+The opt-in performance harness starts a fresh MinIO bucket and a single celld
+node with Docker Compose, sends concurrent queue traffic, and verifies that
+every accepted message reaches a successful callback. A configurable portion
+of callbacks returns one `503` first, so the same run also exercises durable
+redelivery. The result includes enqueue and delivery throughput plus p50, p95,
+p99, and maximum latency for all deliveries, first-attempt successes, and
+retried messages. It is saved to `.perf-results/minio-latest.json`.
+
+> MinIO Community is **not a supported celld production store**. It does not
+> implement the conditional writes celld needs for ownership fencing. This
+> deliberately single-node harness disables celld's storage probe and tests
+> the queue's persistence, redelivery, and performance paths only; it does not
+> validate multi-node ownership or failover correctness.
+
+With Docker and the Compose plugin installed, run:
+
+```sh
+pnpm test:perf:minio
+```
+
+The defaults send 1,000 messages with concurrency 32 across two queue cells,
+and force every twentieth message through one `503` redelivery.
+
+#### Reference result
+
+The following directional baseline was recorded on August 15, 2026. MinIO and
+celld ran as native arm64 processes because Docker was unavailable on the test
+machine; container results will differ.
+
+| Environment | Value                                                                                                    |
+| ----------- | -------------------------------------------------------------------------------------------------------- |
+| Machine     | MacBook Pro (Mac15,8), Apple M3 Max, 16 cores (12 performance, 4 efficiency), 64 GB RAM                  |
+| OS          | macOS 26.5.2 (25F84), arm64                                                                              |
+| Services    | celld v0.2.1; MinIO RELEASE.2025-09-07T16-13-09Z                                                         |
+| Workload    | 1,000 messages; concurrency 32; 2 queue shards; 256-byte target payload; every 20th message retried once |
+
+| Metric                  |                                                                            Result |
+| ----------------------- | --------------------------------------------------------------------------------: |
+| Delivery integrity      | 1,000 accepted, 1,000 delivered, 0 missing, 0 duplicate successes, 0 dead letters |
+| Callback attempts       |                                           1,050, including 50 forced redeliveries |
+| Enqueue throughput      |                                                                 882.55 messages/s |
+| Delivery throughput     |                                                                 808.81 messages/s |
+| Enqueue latency         |                          p50 24.37 ms; p95 75.60 ms; p99 176.67 ms; max 200.36 ms |
+| All delivery latency    |                         p50 53.95 ms; p95 167.86 ms; p99 210.84 ms; max 312.03 ms |
+| First-attempt latency   |                         p50 52.55 ms; p95 166.35 ms; p99 209.80 ms; max 212.01 ms |
+| Retried-message latency |                         p50 82.52 ms; p95 262.63 ms; p99 312.03 ms; max 312.03 ms |
+| Final queue state       |                         0 pending, 0 in flight, 0 dead letters across both shards |
+
+Use these numbers as a smoke-test reference, not a portable performance
+guarantee. For regression tracking, compare repeated runs on the same machine
+and runtime configuration. Two shards gave the best latency balance for this
+workload; benchmark your own traffic before changing the shard count. A fleet
+pins its shard count on first use, so changing it requires draining the queues.
+
+Override the workload or set machine-specific regression budgets with
+environment variables:
+
+```sh
+PERF_MESSAGES=10000 \
+PERF_CONCURRENCY=64 \
+PERF_QUEUE_SHARDS=16 \
+PERF_MIN_DELIVERY_PER_SECOND=100 \
+PERF_MAX_DELIVERY_P99_MS=5000 \
+pnpm test:perf:minio
+```
+
+Useful controls are `PERF_PAYLOAD_BYTES`, `PERF_RETRY_EVERY`,
+`PERF_TIMEOUT_MS`, `PERF_QUEUE_MAX_INFLIGHT`,
+`PERF_MIN_ENQUEUE_PER_SECOND`, `PERF_MIN_DELIVERY_PER_SECOND`, and
+`PERF_MAX_DELIVERY_P99_MS`. Throughput and latency budgets default to disabled
+because local machines vary. Message-loss, dead-letter, message-ID, queue-drain,
+and duplicate-success checks are always enforced.
+
+Bug reports and focused pull requests are welcome. Please include a regression
+test for behavior changes and run the checks above before submitting a PR.
+
+## Supply-chain security
+
+CI and release workflows start with no permissions and grant only the access a
+job needs. Third-party actions are pinned to verified release commits. Release
+builds do not use caches, and the exact npm tarball is checksummed, clean-room
+installed, and verified again before publication.
+
+Releases publish from GitHub-hosted runners through npm trusted publishing
+(OIDC), without a long-lived npm token. npm records provenance for public
+releases. The Git tag and GitHub release are created only after npm accepts the
+matching tarball; published GitHub releases are immutable. Dependency updates
+use cooldowns, and pnpm permits lifecycle scripts only for an explicit
+allowlist.
+
+See [`SECURITY.md`](./SECURITY.md) to report a vulnerability and
+[`RELEASING.md`](./RELEASING.md) for the release procedure.
+
+## License
+
+Apache-2.0. Parts of the implementation are adapted from
+[`vinnymac/worlds`](https://github.com/vinnymac/worlds), also under Apache-2.0.
+See [`NOTICE`](./NOTICE) for details.

package/celld-worker/README.md

@@ -0,0 +1,34 @@
+# world-celld worker
+
+The celld-deployable half of `@ewhauser/world-celld`: four cell classes
+(WorkflowRunDO, StreamDO, IndexDO, QueueDO) behind an authenticated HTTP RPC
+router.
+
+## Deploy
+
+Copy this directory out of `node_modules` so `celld deploy` can bundle it
+(its `main` must live inside the project directory), then deploy against your
+fleet bucket:
+
+```sh
+cp -r node_modules/@ewhauser/world-celld/celld-worker ./workflow-world
+celld deploy ./workflow-world --bucket s3://my-cells-bucket
+```
+
+Requirements:
+
+- `esbuild` on PATH (celld shells out to it).
+- A bucket with conditional-write support (celld's fencing requirement).
+- `WORLD_SECRET` injected at the node level (`CELLD_VAR_WORLD_SECRET=...`) —
+  the router fails closed with 503 while it is empty.
+
+Point the app at any node's public listener:
+
+```ts
+import { createCelldWorld } from '@ewhauser/world-celld';
+
+const world = createCelldWorld({
+  fleetUrl: 'http://fleet.internal:8080',
+  secret: process.env.CELLD_WORLD_SECRET!,
+});
+```

package/celld-worker/worker.ts

@@ -0,0 +1,5 @@
+// Deployable celld entry. `celld deploy` requires `main` to live inside the
+// project directory; this one-liner resolves the real worker through the
+// application's node_modules so the deployed bundle stays in step with the
+// installed @ewhauser/world-celld version.
+export { IndexDO, QueueDO, StreamDO, WorkflowRunDO, default } from '@ewhauser/world-celld/worker';

package/celld-worker/wrangler.jsonc

@@ -0,0 +1,32 @@
+{
+  // world-celld worker: deployed to a celld fleet with `celld deploy`.
+  // celld accepts wrangler.jsonc (not .toml) and only these keys — anything
+  // else fails the deploy loudly.
+  "name": "workflow-world",
+  "main": "worker.ts",
+  "compatibility_date": "2026-01-01",
+  "durable_objects": {
+    "bindings": [
+      { "name": "WORKFLOW_DB", "class_name": "WorkflowRunDO" },
+      { "name": "WORKFLOW_STREAMS", "class_name": "StreamDO" },
+      { "name": "WORKFLOW_INDEX", "class_name": "IndexDO" },
+      { "name": "WORKFLOW_QUEUE", "class_name": "QueueDO" },
+    ],
+  },
+  "migrations": [
+    {
+      "tag": "v1",
+      "new_sqlite_classes": ["WorkflowRunDO", "StreamDO", "IndexDO", "QueueDO"],
+    },
+  ],
+  "vars": {
+    // REQUIRED: bearer secret for the world's RPC surface. All /v1/rpc
+    // routes fail closed with 503 while this is empty. Inject the real value
+    // at the node level with CELLD_VAR_WORLD_SECRET instead of committing it.
+    "WORLD_SECRET": "",
+    // Optional: forwarded as x-workflow-callback-secret on queue deliveries.
+    "WORKFLOW_CALLBACK_SECRET": "",
+    // Optional queue tuning (strings): QUEUE_MAX_ATTEMPTS, QUEUE_MAX_INFLIGHT,
+    // QUEUE_DELIVERY_TIMEOUT_MS.
+  },
+}