@mcp-b/do-runtime 0.2.2 → 0.3.0

package/dist/chunks/io-context-Ci3Rf6U5.js

@@ -0,0 +1,1459 @@
+//#region src/io/io-gate.ts
+/**
+* ← workerd `src/workerd/io/io-gate.{h,c++}`
+*
+* An I/O gate allows someone to "lock" a type of I/O so that other concurrent tasks trying to
+* perform that type of I/O are blocked until the lock is released.
+*
+* I/O gates are used in actors to implement consistency guarantees, allowing in-memory state and
+* storage to be synchronized.
+*
+* Each Actor has two main gates:
+* - Input gate: While locked, blocks all incoming I/O events of any type from being delivered to
+*   the actor, other than the specific event or events that hold the lock. This includes
+*   blocking responses to subrequests, timer events, input streams, etc. Used when storage
+*   operations are outstanding, so that awaiting a storage operation does not risk allowing
+*   concurrent events that render the state inconsistent.
+* - Output gate: While locked, blocks all outgoing messages from an actor that would allow the
+*   rest of the world to observe the actor's state. Held while writes that have been confirmed
+*   to the application are still being flushed to disk. If the flush fails, these messages will
+*   never be sent, so that the rest of the world cannot observe a prematurely-confirmed write.
+*
+* Three things kj gives for free and JS does not, resolved the same way at every site:
+*
+*  1. **Destructors.** `~Lock` releases and `~CriticalSection` diagnoses a dropped section as
+*     deadlock. Both become explicit: `Lock.release()` and `CriticalSection.drop()`. A `Lock`
+*     released twice throws rather than corrupting the refcount.
+*  2. **Cancel-by-drop.** Dropping a `kj::Promise` unwinds its waiter. Every such site takes an
+*     `AbortSignal`, the convention `Timer.afterDelay` already set in `io-context.ts`. Aborting a
+*     `wait()` rejects it with `CanceledError`; a never-settling promise would be an invisible
+*     hang, which is what this repo's fail-closed tenet exists to prevent.
+*  3. **`kj::ForkedPromise` holding an exception with no branches.** JS reports that as an
+*     unhandled rejection, so every promise this module stores keeps a no-op `catch` of its own
+*     and hands observers a separate view.
+*
+* Error strings are copied verbatim from upstream; users and upstream tests match on them.
+*
+* Not ported: `SpanParent`/`SpanBuilder` tracing, since there is no `trace.h` here and upstream's
+* own tests pass `nullptr` at every call site; and the `~InputGate` assertion that no locks
+* outlive the gate, which guards against dangling references GC makes impossible.
+*
+* Spec: §1.1, §1.2, §1.5, decisions 3, 5 and 13 in
+* docs/decisions.md.
+*/
+/**
+* Raised when a `wait()` is cancelled through its `AbortSignal`.
+*
+* kj has no equivalent, because a cancelled continuation simply never runs. It is deliberately
+* NOT a gate failure: a cancelled waiter leaves the gate exactly as it found it, so
+* `CriticalSection.wait()` rethrows this one without calling `setBroken()`.
+*/
+var CanceledError = class extends Error {
+	name = "CanceledError";
+};
+/** Mirrors `OutputGate::makeUnfulfilledException()`: one place that spells the exception. */
+function makeCanceledError() {
+	return new CanceledError("input gate wait was canceled");
+}
+/**
+* `addEventListener("abort", ...)` never fires for a signal that has already aborted, so a
+* pre-aborted signal would silently hold its lock forever. Every cancellation site goes through
+* here, and every one of them first rejects a pre-aborted wait before touching gate state, so
+* "cancelled" always means "left the gate exactly as it found it".
+*/
+function onAbort(signal, run) {
+	if (signal === void 0) return;
+	if (signal.aborted) {
+		run();
+		return;
+	}
+	signal.addEventListener("abort", run, { once: true });
+}
+/** ← `InputGate::Hooks::DEFAULT`. */
+var DEFAULT_INPUT_GATE_HOOKS = {
+	inputGateLocked() {},
+	inputGateReleased() {},
+	inputGateWaiterAdded() {},
+	inputGateWaiterRemoved() {}
+};
+/** ← `InputGate::Waiter`: a `kj::List` node plus the adapted promise's fulfiller. */
+var Waiter = class {
+	/** Rewritten by `CriticalSection.succeeded()` when a straggler is reparented. */
+	gate;
+	isChildWaiter;
+	/** ← `link.isLinked()`. */
+	linked = true;
+	#resolve;
+	#reject;
+	constructor(gate, isChildWaiter, resolve, reject) {
+		this.gate = gate;
+		this.isChildWaiter = isChildWaiter;
+		this.#resolve = resolve;
+		this.#reject = reject;
+		gate.hooks.inputGateWaiterAdded();
+		if (isChildWaiter) gate.waitingChildren.push(this);
+		else gate.waiters.push(this);
+	}
+	unlink() {
+		if (!this.linked) return;
+		this.linked = false;
+		const list = this.isChildWaiter ? this.gate.waitingChildren : this.gate.waiters;
+		const index = list.indexOf(this);
+		if (index < 0) throw new Error("InputGate::Waiter is linked but absent from its gate's list");
+		list.splice(index, 1);
+	}
+	fulfill(lock) {
+		this.unlink();
+		this.gate.hooks.inputGateWaiterRemoved();
+		this.#resolve(lock);
+	}
+	reject(exception) {
+		this.unlink();
+		this.gate.hooks.inputGateWaiterRemoved();
+		this.#reject(exception);
+	}
+};
+/**
+* An InputGate blocks incoming events from being delivered to an actor while the lock is held.
+*
+* Upstream marks the state below `private` and befriends `Lock` and `CriticalSection`.
+* TypeScript has no friendship, and `protected` would not let `CriticalSection` reach these
+* members on its *parent* gate, which `succeeded()` does. The boundary that actually holds is
+* the package facade in `src/index.ts`, which exports none of these types.
+*/
+var InputGate = class {
+	hooks;
+	/**
+	* How many instances of `Lock` currently exist? When this reaches zero, we'll release some
+	* waiters.
+	*
+	* Upstream also carries a `bool isCriticalSection`, because `CriticalSection` inherits
+	* `InputGate` privately and has to `static_cast` back. `instanceof` is the same test with no
+	* cast and no field that can disagree with the object it describes.
+	*/
+	lockCount = 0;
+	waiters = [];
+	/**
+	* Waiters representing CriticalSections that are ready to start. These take priority over other
+	* waiters.
+	*/
+	waitingChildren = [];
+	/** A fulfiller for onBroken(), or an exception if already broken. */
+	brokenState;
+	#brokenPromise;
+	constructor(hooks = DEFAULT_INPUT_GATE_HOOKS) {
+		this.hooks = hooks;
+		const { promise, reject } = Promise.withResolvers();
+		this.#brokenPromise = promise;
+		this.brokenState = {
+			kind: "fulfiller",
+			reject
+		};
+		promise.catch(() => {});
+	}
+	/** Wait until there are no `Lock`s, then create a new one and return it. */
+	wait(signal) {
+		if (signal?.aborted === true) return Promise.reject(makeCanceledError());
+		else if (this.brokenState.kind === "exception") return Promise.reject(this.brokenState.exception);
+		else if (this.lockCount === 0) return Promise.resolve(new Lock(this));
+		else return this.newWaiterPromise(false, signal);
+	}
+	/**
+	* Rejects if and when calls to `wait()` become broken due to a failed critical section. The
+	* actor should be shut down in this case. This promise never resolves, only rejects.
+	*/
+	onBroken() {
+		if (this.brokenState.kind === "exception") return Promise.reject(this.brokenState.exception);
+		else return this.#brokenPromise;
+	}
+	/** ← `kj::newAdaptedPromise<Lock, Waiter>(gate, isChildWaiter, span)`. */
+	newWaiterPromise(isChildWaiter, signal) {
+		const { promise, resolve, reject } = Promise.withResolvers();
+		const waiter = new Waiter(this, isChildWaiter, resolve, reject);
+		onAbort(signal, () => {
+			if (!waiter.linked) return;
+			waiter.reject(makeCanceledError());
+		});
+		return promise;
+	}
+	releaseLock() {
+		if (this instanceof CriticalSection && this.state === "REPARENTED") {
+			if (this.waitingChildren.length !== 0 || this.waiters.length !== 0 || this.lockCount !== 0) throw new Error("releasing a lock on a reparented CriticalSection that still holds state");
+			this.parentAsInputGate().releaseLock();
+			return;
+		}
+		if (this.lockCount === 0) throw new Error("InputGate::releaseLock() with no locks outstanding");
+		this.lockCount--;
+		if (this.lockCount === 0) {
+			this.hooks.inputGateReleased();
+			const child = this.waitingChildren[0];
+			if (child !== void 0) child.fulfill(new Lock(this));
+			else {
+				const waiter = this.waiters[0];
+				if (waiter !== void 0) waiter.fulfill(new Lock(this));
+			}
+		}
+	}
+	/** Called when a critical section fails. All future waiters will throw this exception. */
+	setBroken(exception) {
+		for (const waiter of [...this.waitingChildren]) waiter.reject(exception);
+		for (const waiter of [...this.waiters]) waiter.reject(exception);
+		if (this.brokenState.kind === "fulfiller") this.brokenState.reject(exception);
+		this.brokenState = {
+			kind: "exception",
+			exception
+		};
+	}
+};
+/** ← `InputGate::Lock`. A lock that blocks all new events from being delivered while it exists. */
+var Lock = class Lock {
+	/** ← "Becomes null on move." Here it becomes undefined on `release()`. */
+	#gate;
+	constructor(gate) {
+		this.#gate = gate;
+		let gateToLock = gate;
+		if (gate instanceof CriticalSection && gate.state === "REPARENTED") gateToLock = gate.parentAsInputGate();
+		if (++gateToLock.lockCount === 1) gateToLock.hooks.inputGateLocked();
+	}
+	/** ← `~Lock`. */
+	release() {
+		const gate = this.#gate;
+		if (gate === void 0) throw new Error("InputGate::Lock was released twice");
+		this.#gate = void 0;
+		gate.releaseLock();
+	}
+	/**
+	* Increments the lock's refcount, returning a duplicate `Lock`. All `Lock`s must be released
+	* before the gate is unlocked.
+	*/
+	addRef() {
+		return new Lock(this.#requireGate());
+	}
+	/**
+	* Start a new critical section from this lock. After `wait()` has been called on the returned
+	* critical section for the first time, no further Locks will be handed out by
+	* InputGate::wait() until the CriticalSection has been dropped.
+	*
+	* CriticalSections can be nested. If this Lock is itself part of a CriticalSection, the new
+	* CriticalSection will be nested within it and the outer CriticalSection's wait() won't
+	* produce a Lock again until the inner CriticalSection is dropped.
+	*/
+	startCriticalSection() {
+		return new CriticalSection(this.#requireGate());
+	}
+	/** If this lock was taken in a CriticalSection, return it. */
+	getCriticalSection() {
+		const gate = this.#requireGate();
+		return gate instanceof CriticalSection ? gate : void 0;
+	}
+	isFor(otherGate) {
+		if (otherGate instanceof CriticalSection) throw new Error("InputGate::Lock::isFor() takes the root gate, not a CriticalSection");
+		let ptr = this.#requireGate();
+		while (ptr instanceof CriticalSection) ptr = ptr.parentAsInputGate();
+		return ptr === otherGate;
+	}
+	/** ← `operator==`. */
+	equals(other) {
+		return this.#requireGate() === other.#requireGate();
+	}
+	#requireGate() {
+		const gate = this.#gate;
+		if (gate === void 0) throw new Error("InputGate::Lock was used after release");
+		return gate;
+	}
+};
+/**
+* A CriticalSection is a procedure that must not be interrupted by anything "external".
+* While a CriticalSection is running, all events that were not initiated by the
+* CriticalSection itself will be blocked from being delivered.
+*
+* The difference between a Lock and a CriticalSection is that a critical section may succeed
+* or fail. A failed critical section permanently breaks the input gate. Locks, on the other
+* hand, are simply released when dropped.
+*
+* A CriticalSection itself holds a Lock, which blocks the "parent scope" from continuing
+* execution until the critical section is done. Meanwhile, the code running inside the critical
+* section obtains nested Locks. These nested locks control concurrency of the operations
+* initiated within the critical section in the same way that input locks normally do at the
+* top-level scope. E.g., if a critical section initiates a storage read and a fetch() at the
+* same time, the fetch() is prevented from returning until after the storage read has returned.
+*/
+var CriticalSection = class CriticalSection extends InputGate {
+	state = "NOT_STARTED";
+	/**
+	* Points to the parent scope, which may be another CriticalSection in the case of nesting.
+	* ← `kj::OneOf<InputGate*, kj::Own<CriticalSection>>`; the two arms are one `instanceof` apart.
+	*/
+	#parent;
+	/**
+	* A lock in the parent scope. `parentLock` becomes non-null after the first lock is obtained,
+	* and becomes null again when succeeded() is called.
+	*/
+	#parentLock;
+	constructor(parent) {
+		super();
+		this.#parent = parent;
+	}
+	/**
+	* Wait for a nested lock in order to continue this CriticalSection.
+	*
+	* The first call to wait() begins the CriticalSection. After that wait completes, until the
+	* CriticalSection is done and dropped, no other locks will be allowed on this InputGate, except
+	* locks requested by calling wait() on this CriticalSection -- or one of its children.
+	*
+	* Everything before the first `await` runs in the caller's synchronous slice, which is what
+	* lets the NOT_STARTED path take its parent lock before any other event can queue behind it.
+	*/
+	async wait(signal) {
+		if (signal?.aborted === true) throw makeCanceledError();
+		for (;;) switch (this.state) {
+			case "NOT_STARTED": {
+				this.state = "INITIAL_WAIT";
+				const target = this.parentAsInputGate();
+				if (target.brokenState.kind === "exception") {
+					const exception = target.brokenState.exception;
+					this.setBroken(exception);
+					throw exception;
+				}
+				if (target.lockCount === 0) {
+					this.state = "RUNNING";
+					this.#parentLock = new Lock(target);
+					continue;
+				} else {
+					let lock;
+					try {
+						lock = await target.newWaiterPromise(true, signal);
+					} catch (exception) {
+						if (exception instanceof CanceledError) throw exception;
+						this.state = "RUNNING";
+						this.setBroken(exception);
+						throw exception;
+					}
+					this.state = "RUNNING";
+					this.#parentLock = lock;
+					continue;
+				}
+			}
+			case "INITIAL_WAIT": throw new Error("CriticalSection::wait() should be called once initially");
+			case "RUNNING": return await super.wait(signal);
+			case "REPARENTED": return await this.#parent.wait(signal);
+		}
+	}
+	/**
+	* Call when the critical section has completed successfully. If this is not called before the
+	* CriticalSection is dropped, then failed() is called implicitly.
+	*
+	* Returns the input lock that was held on the parent critical section. This can be used to
+	* continue execution in the parent before any other input arrives.
+	*/
+	succeeded() {
+		if (this.state !== "RUNNING") throw new Error("CriticalSection::succeeded() requires a running critical section");
+		const parentGate = this.parentAsInputGate();
+		for (const waiter of this.waitingChildren) waiter.gate = parentGate;
+		parentGate.waitingChildren.push(...this.waitingChildren);
+		this.waitingChildren.length = 0;
+		for (const waiter of this.waiters) waiter.gate = parentGate;
+		parentGate.waiters.push(...this.waiters);
+		this.waiters.length = 0;
+		parentGate.lockCount += this.lockCount;
+		this.lockCount = 0;
+		this.state = "REPARENTED";
+		const result = this.#parentLock;
+		if (result === void 0) throw new Error("CriticalSection::succeeded() with no parent lock");
+		this.#parentLock = void 0;
+		return result;
+	}
+	/**
+	* Call to indicate the CriticalSection has failed with the given exception. This immediately
+	* breaks the InputGate.
+	*/
+	failed(exception) {
+		if (this.brokenState.kind === "exception") return;
+		this.setBroken(exception);
+		if (this.#parent instanceof CriticalSection) this.#parent.failed(exception);
+		else this.#parent.setBroken(exception);
+	}
+	/** ← `~CriticalSection`. */
+	drop() {
+		switch (this.state) {
+			case "NOT_STARTED": break;
+			case "INITIAL_WAIT": break;
+			case "RUNNING": this.failed(/* @__PURE__ */ new Error("jsg.Error: A critical section within this Durable Object awaited a Promise that apparently will never complete. This could happen in particular if a critical section awaits a task that was initiated outside of the critical section. Since a critical section blocks all other tasks from completing, this leads to deadlock."));
+		}
+		const parentLock = this.#parentLock;
+		if (parentLock !== void 0) {
+			this.#parentLock = void 0;
+			parentLock.release();
+		}
+	}
+	/** Return a reference for the parent scope, skipping any reparented CriticalSections */
+	parentAsInputGate() {
+		let parent = this.#parent;
+		for (;;) {
+			if (!(parent instanceof CriticalSection)) return parent;
+			if (parent.state !== "REPARENTED") return parent;
+			parent = parent.#parent;
+		}
+	}
+};
+/** ← `OutputGate::Hooks::DEFAULT`. */
+var DEFAULT_OUTPUT_GATE_HOOKS = {
+	/** ← `kj::NEVER_DONE`. */
+	makeTimeoutPromise: () => new Promise(() => {}),
+	outputGateLocked() {},
+	outputGateReleased() {},
+	outputGateWaiterAdded() {},
+	outputGateWaiterRemoved() {}
+};
+/** ← `OutputGate::makeUnfulfilledException()`. */
+function makeUnfulfilledException() {
+	return /* @__PURE__ */ new Error("output lock was canceled before completion");
+}
+/**
+* An OutputGate blocks outgoing messages from an Actor until writes which they might depend on
+* are confirmed.
+*
+* A promise chain, not a counter (§1.1): each `lockWhile` joins a new link onto the chain and
+* re-forks it, so a `wait()` is bound to exactly the locks outstanding when it was taken and is
+* unaffected by any later `lockWhile`.
+*/
+var OutputGate = class {
+	#hooks;
+	#pastLocksPromise = Promise.resolve();
+	/** A fulfiller for onBroken(), or an exception if already broken. */
+	#brokenState = { kind: "none" };
+	constructor(hooks = DEFAULT_OUTPUT_GATE_HOOKS) {
+		this.#hooks = hooks;
+	}
+	/**
+	* Block all future `wait()` calls until `promise` completes. Returns a wrapper around
+	* `promise`. If `promise` rejects, the exception will propagate to all future `wait()`s. If the
+	* returned promise is canceled before completion, all future `wait()`s will also throw.
+	*/
+	lockWhile(promise, signal) {
+		const fulfiller = this.#lock();
+		const raced = Promise.race([promise, this.#hooks.makeTimeoutPromise()]);
+		this.#hooks.outputGateLocked();
+		return new Promise((resolve, reject) => {
+			onAbort(signal, () => {
+				if (!fulfiller.isWaiting()) return;
+				this.#hooks.outputGateReleased();
+				const exception = makeUnfulfilledException();
+				this.#setBroken(exception);
+				fulfiller.reject(exception);
+				reject(exception);
+			});
+			raced.then((value) => {
+				if (!fulfiller.isWaiting()) return;
+				fulfiller.fulfill();
+				this.#hooks.outputGateReleased();
+				resolve(value);
+			}, (exception) => {
+				if (!fulfiller.isWaiting()) return;
+				this.#setBroken(exception);
+				fulfiller.reject(exception);
+				this.#hooks.outputGateReleased();
+				reject(exception);
+			});
+		});
+	}
+	/**
+	* Wait until all preceding locks are released. The wait will not be affected by any future
+	* call to `lockWhile()`.
+	*/
+	wait() {
+		this.#hooks.outputGateWaiterAdded();
+		return this.#pastLocksPromise.then(() => {
+			this.#hooks.outputGateWaiterRemoved();
+		}, (exception) => {
+			this.#hooks.outputGateWaiterRemoved();
+			throw exception;
+		});
+	}
+	/**
+	* Rejects if and when calls to `wait()` become broken due to a failed lockWhile(). The actor
+	* should be shut down in this case. This promise never resolves, only rejects.
+	*
+	* This method can only be called once.
+	*/
+	onBroken() {
+		if (this.#brokenState.kind === "fulfiller") throw new Error("onBroken() can only be called once");
+		if (this.#brokenState.kind === "exception") return Promise.reject(this.#brokenState.exception);
+		else {
+			const { promise, reject } = Promise.withResolvers();
+			this.#brokenState = {
+				kind: "fulfiller",
+				reject
+			};
+			promise.catch(() => {});
+			return promise;
+		}
+	}
+	isBroken() {
+		return this.#brokenState.kind === "exception";
+	}
+	#lock() {
+		const { promise, resolve, reject } = Promise.withResolvers();
+		this.#setPastLocks(Promise.allSettled([this.#pastLocksPromise, promise]).then((results) => {
+			for (const result of results) if (result.status === "rejected") throw result.reason;
+		}));
+		let waiting = true;
+		return {
+			isWaiting: () => waiting,
+			fulfill: () => {
+				waiting = false;
+				resolve();
+			},
+			reject: (exception) => {
+				waiting = false;
+				reject(exception);
+			}
+		};
+	}
+	#setPastLocks(promise) {
+		this.#pastLocksPromise = promise;
+		promise.catch(() => {});
+	}
+	#setBroken(exception) {
+		if (this.#brokenState.kind === "fulfiller") this.#brokenState.reject(exception);
+		this.#brokenState = {
+			kind: "exception",
+			exception
+		};
+	}
+};
+//#endregion
+//#region src/io/io-context.ts
+/**
+* ← workerd `src/workerd/io/io-context.{h,c++}`
+*
+* IoContext: the one door, plus the two await forms.
+*
+* This is the file with no true upstream correspondence for its *enforcement*.
+* Workerd acquires the input gate at isolate entry, so acquisition is
+* structural. We have no isolate hook, so a lock is taken at our own dispatch
+* boundary instead. See "The enforcement point is the one thing we cannot port"
+* in the design record.
+*
+* What this file does, stated before anything about how it got here:
+*
+*  1. `#currentInputLocks` is a STACK of the locks held by the slices that are
+*     running. It is upstream's single `kj::Maybe<InputGate::Lock>
+*     currentInputLock` member (`io-context.h:993`) with the `Maybe` widened,
+*     and a "frame" is an entry in it. A frame carries nothing else: the only
+*     two things ever read from one are the lock (`getInputLock`) and the
+*     critical section that lock belongs to (`getCriticalSection`), and the
+*     lock answers both.
+*  2. A lock is released, and leaves the stack, at the END OF THE MICROTASK
+*     CHECKPOINT of the slice holding it — not when that slice's synchronous
+*     body returns. That is upstream's own boundary, not a relaxation of it:
+*     `runImpl`'s inner `KJ_DEFER` calls `js.runMicrotasks()`
+*     (`io-context.c++:1262`) and `runInContextScope`'s outer one then clears
+*     `currentInputLock` (`:1214`), inner scope first, so the whole checkpoint
+*     drains under the lock. `currentInputLock` holds the `Lock` by value, so
+*     clearing it is the release. `atCheckpointEnd` below is that point.
+*  3. NEITHER await form releases anything at the moment of the await.
+*     `awaitIo` reads `getCriticalSection()` and `awaitIoWithInputLock` takes
+*     an `addRef`; both then return a promise and let the slice end normally.
+*     So an invocation that calls `awaitIo` keeps the gate until its own
+*     checkpoint-end exit and the gate opens there — which is still before any
+*     real I/O can complete, so "a bare timer releases the input gate" holds.
+*     Upstream is the same: `getCriticalSection()` (`io-context.c++:362`) does
+*     not touch `currentInputLock`, and `:1214` is the only place that clears
+*     it. The difference between the two forms is entirely on the far side —
+*     `awaitIo` re-enters through `run(func, criticalSection)` and queues for a
+*     fresh lock, `awaitIoWithInputLock` re-enters holding the ref it took.
+*  4. Removal from the stack is by identity, not by popping, because entries do
+*     overlap — three deep in the unit tests. One invocation can have several
+*     held awaits outstanding (`Promise.all` over two storage reads), and a
+*     section's last body slice overlaps the slice that resolves it.
+*
+* Two mechanics were validated against real workerd before this scaffolding
+* landed, and both are easy to get wrong:
+*
+*  1. The ambient "which lock am I under" must be a STACK of invocation frames,
+*     not a single slot, so that `current` always names the running invocation.
+*     The prototype that found this stated it as "`awaitIo` splices its frame
+*     out and re-pushes the SAME frame on resume". That is not what happens
+*     here and the difference is worth knowing: nothing splices at the point of
+*     the await, because a lock already leaves the stack when its slice ends,
+*     which is the same event that releases it (`#exit` does both). A
+*     resumption then pushes a fresh lock. The prototype needed the splice
+*     because its door held one lock for a whole invocation; the identity that
+*     has to survive an await here is the critical section, and that is
+*     captured at the call rather than looked up later.
+*  2. That ambient is safe here for a reason that does NOT generalise to the
+*     §2.3 ambient-field hazard: the gate guarantees pushes and pops nest
+*     properly in time, because only one holder chain is inside at once.
+*     `_cf_currentSubAgentBridge` has no such guarantee, which is why it is a
+*     live bug and this is not.
+*
+* Consequence: no async context is required. Do not add a dependency on
+* decision 8 here without re-running the conformance gate suite first.
+*
+* The invariant a future simplifier has to re-check: a single slot would pass
+* every test in `io-context.test.ts`, and that was established by trying it,
+* not by argument. `current()` is only read from inside a slice, every slice
+* pushes its own lock last, and no second slice can begin while an earlier
+* frame is still waiting for its checkpoint-end exit — that frame is holding
+* the gate. So the top of a stack and the last write to a slot always agree.
+* The stack is still what is here, because a slot would be holding a stale
+* value at every one of the overlaps in (4), and that is unobservable for
+* exactly as long as the invariant holds. Tightening (2) back to the end of the
+* synchronous body breaks it immediately, which is the regime the mechanic was
+* found in.
+*
+* Spec: §1.2, §1.3, §1.5, §1.6, §1.7.1, §1.9, decisions 1, 2, 4 and 13 in
+* docs/decisions.md.
+*
+* `TimeoutManager` is the only part of this file a consumer's own code reaches
+* directly: every host-provided async primitive a
+* Durable Object can await has to route through here, or the continuation after
+* it resumes with an empty invocation stack. `TimeoutManager` below is the
+* timer half; `api/global-scope.ts` and `api/web-socket.ts` are the rest.
+*
+* Not ported, because the substrate has no equivalent to port onto: isolate and
+* async locks (`Worker::Lock`, `jsg::Lock`, `takeAsyncLock`) and everything
+* that exists to enter or leave an isolate — which is precisely the thing this
+* file substitutes for; the limit enforcer and `afterLimitTimeout` (the
+* deadline takes the `Timer` port instead); trace spans, already a recorded
+* divergence documented in §1.12; subrequest channels and HTTP, which are
+* `api/http.ts`'s gating over the substrate's own `fetch`;
+* `IoOwn`/`IoPtr`/`DeleteQueue`, which guard cross-context dereferences that GC
+* makes impossible; hang detection and `registerPendingEvent`, which need the
+* isolate's own idea of pending work; and the thread-local
+* `IoContext::current()` static, whose lock-resolving half the invocation stack
+* replaces — its *identity* half is `currentSlice` below, narrowed to the
+* synchronous slice, with one consumer and no resolver. `EventOutcome` and
+* `RequestObserver` are metrics types with no port, so `waitUntilStatus()`
+* returns the first exception instead.
+*/
+/** ← `static constexpr int64_t max = 3153600000000;  // Milliseconds in 100 years`. */
+var MAX_TIMEOUT_MS = 31536e8;
+/** ← `afterLimitTimeout(30 * kj::SECONDS)` in `IoContext::blockConcurrencyWhile`. */
+var BLOCK_CONCURRENCY_WHILE_TIMEOUT_MS = 3e4;
+/** Copied verbatim: users and upstream tests match on it. */
+var BLOCK_CONCURRENCY_WHILE_TIMEOUT_MESSAGE = "A call to blockConcurrencyWhile() in a Durable Object waited for too long. The call was canceled and the Durable Object was reset.";
+/** ← `jsg::annotateBroken(msg, "broken.inputGateBroken")`. */
+var INPUT_GATE_BROKEN_PREFIX = "broken.inputGateBroken; ";
+/**
+* THE check every storage entry point in `api/` makes before touching the
+* database, and the only place this package throws for a missing input lock.
+*
+* Upstream never faces the question. `IoContext::current()` is a thread-local
+* read with a `KJ_REQUIRE` behind it, and it cannot fail for a storage call
+* because isolate entry is the only way into an actor and it always took a
+* lock. We have no isolate hook (see this file's header), so a continuation
+* that resumed from a raw `setTimeout`, a raw `fetch`, or any other promise the
+* runtime does not own comes back with an empty invocation stack, and its next
+* storage call reaches `ActorSqlite` — which is synchronous, touches no gate,
+* and would happily serve it outside any transaction boundary.
+*
+* So this throws, matching the assert. It is deliberately ONE function called
+* from every entry point rather than a check written at each of them: the
+* policy is a design decision that belongs to the design record, and when it
+* changes it has to change in one place rather than across a surface the
+* vendored consumer reaches from hundreds of call sites. There is no lenient
+* mode, no flag, and no implicit acquire — a lost invocation is loud, and a
+* lost transaction boundary is not.
+*/
+function requireInputLock(ctx, op) {
+	if (ctx.hasCurrent()) return;
+	throw new Error(`${op}: no input lock available in this context${ctx.describeLostLock()}`);
+}
+/**
+* A stack for `noteGateUse`, captured where user frames are still on the stack.
+*
+* The invocation stack's own push and pop are scheduler moments — `#runImpl`
+* runs from a gate resumption and `#exit` from a `MessageChannel` callback — so
+* a trace taken there names only runtime internals. The moments that still see
+* the caller are the synchronous entries into the gate machinery: an `awaitIo`
+* call, an `entry` dispatch, a callback's registration. V8's zero-cost async
+* traces extend those with the awaiting chain, which is usually the frame the
+* reader actually wants.
+*
+* The first slice drops the `Error` header (absent on SpiderMonkey) and the two
+* runtime frames: this helper and the gate entry point that called it.
+*/
+function captureGateStack() {
+	const stack = (/* @__PURE__ */ new Error()).stack;
+	if (stack === void 0) return void 0;
+	const frames = stack.split("\n");
+	const trimmed = frames.slice(frames[0]?.startsWith("Error") ? 3 : 2).join("\n");
+	return trimmed === "" ? void 0 : trimmed;
+}
+/**
+* The end of the microtask checkpoint — the moment `runImpl`'s `KJ_DEFER` fires.
+*
+* Upstream drains the whole checkpoint INSIDE the isolate run: the defer calls
+* `js.runMicrotasks()` and only the outer defer in `runInContextScope` then
+* clears `currentInputLock`. So a continuation that awaits nothing but
+* already-resolved promises stays under the same lock, and a continuation that
+* waits on real I/O does not. In JS the only observable end of a microtask drain
+* is the next macrotask, so that is where a lock leaves the invocation stack.
+*
+* Measured, because the obvious alternatives are wrong in ways nothing catches:
+* releasing synchronously when the invoked function returns, or on the next
+* microtask, both hand the lock back BEFORE the code awaiting the I/O resumes as
+* soon as one promise sits between the two — one `async` wrapper, a `.then`, a
+* `Promise.all` — and `actor-state.ts` is exactly such a wrapper. The gate would
+* then open in the middle of a storage await with no test failing, which is the
+* silent loss of atomicity §1.7.1 names.
+*
+* `MessageChannel` and not `setTimeout`, decided by benchmark rather than by
+* argument, because the two are three orders of magnitude apart on the shapes
+* that wait for a release. A chain of these schedules each hand-off from inside
+* the previous one's callback, so a `setTimeout` chain's nesting level climbs
+* past five and stays there, where browsers clamp it to 4ms. Median per hand-off
+* over 50 chained hops:
+*
+*   |                        | setTimeout | MessageChannel |
+*   | node                   | 1.273 ms   | 0.018 ms       |
+*   | chromium page          | 4.96 ms    | 0.024 ms       |
+*   | chromium Worker        | 5.542 ms   | 0.022 ms       |
+*
+* Only two shapes pay it: an `awaitIo` chain, which has to re-acquire the lock
+* its slice gave up, and a queue of events waiting on the holder. A chain of
+* held storage awaits does not — the lock passes from `addRef` to `addRef` and
+* the release is off the critical path. So 50 sequential facet RPCs cost 277ms
+* of pure clamp in a Worker under `setTimeout` and 1.1ms under this.
+*
+* One channel per BATCH, and a batch is an explicit array: `atCheckpointEnd`
+* pushes onto `pendingCheckpointEnds` and only the push that finds it empty opens
+* a channel. Ordering then comes from the array, which the language guarantees,
+* rather than from delivery order across separate channels, which no
+* specification does. That mattered because the storage engine below depends on
+* a commit scheduled inside a slice running before the release scheduled at the
+* end of that slice; separate channels do deliver in post order in Node,
+* measured across 200 of them including one scheduled from inside another's
+* callback, but a browser that chose otherwise would open the gate onto a
+* transaction a previous event left open, and nothing would say so.
+*
+* A callback scheduled DURING a drain lands in the next batch, which is the
+* semantics to want: one hand-off is one checkpoint end, and a slice that begins
+* inside this drain gets its own. The drain runs every callback even if one
+* throws, and rethrows the first exception afterwards, because abandoning the
+* rest of a batch is how a gate wedges with nothing to see.
+*
+* A long-lived shared port was rejected for the reason it always is: it has to be
+* closed on abort and `unref`'d so it cannot hold a test runner's event loop
+* open, and an `unref`'d port can drop a release at exit — a wedged gate. A
+* channel that lives for exactly one message cannot. Batching gets most of what
+* a shared port was worth anyway: a slice that schedules a commit and a release
+* now allocates one channel where it used to allocate two.
+*
+* **Exported because `kj::evalLater()` is this same point.** `ActorSqlite` opens
+* its implicit transaction on the first write and commits it "on the next turn of
+* the event loop" (`actor-sqlite.c++:352-357`); upstream's next turn is after the
+* isolate run, which is after `js.runMicrotasks()`, which is after
+* `currentInputLock` is cleared. Upstream's two boundaries are one boundary, and
+* they stay one here only if the commit rides the same primitive as the release.
+* Two consequences the storage engine depends on, both properties of this
+* function rather than of `ActorSqlite`:
+*
+*  1. **Everything that holds the input lock across an await is a microtask
+*     chain.** `awaitIoWithInputLock` resumes through `#awaitIoImpl`'s `.then`
+*     into `run(func, lock)`, which never waits on the gate. So a whole run of
+*     held storage awaits finishes before the next hand-off and its writes are
+*     one transaction (§1.7.1 row 1).
+*  2. **Everything that releases it needs at least one hand-off.** `awaitIo`
+*     resumes through `gate.wait()`, which cannot resolve until `#exit` runs
+*     here. So a timer or outbound await puts the commit between the two writes
+*     (§1.7.1 row 2).
+*
+*/
+function atCheckpointEnd(run) {
+	pendingCheckpointEnds.push(run);
+	if (pendingCheckpointEnds.length > 1) return;
+	const channel = new MessageChannel();
+	channel.port1.onmessage = () => {
+		channel.port1.close();
+		channel.port2.close();
+		const batch = pendingCheckpointEnds.splice(0);
+		let failure;
+		for (const callback of batch) try {
+			callback();
+		} catch (exception) {
+			failure ??= { exception };
+		}
+		if (failure !== void 0) throw failure.exception;
+	};
+	channel.port2.postMessage(0);
+}
+/** The current batch. Its order is the hand-off order every consumer below relies on. */
+var pendingCheckpointEnds = [];
+/**
+* ← `static thread_local IoContext* threadLocalRequest` (`io-context.c++:25`).
+*
+* **This is NOT an async context and must not become one.** It is set on entry
+* to a slice's SYNCHRONOUS body and restored the instant that body returns —
+* which for an `async` function is its first `await`. It propagates through
+* exactly nothing. The package's "no async context is required" property
+* (README, Part 4 mechanic 1) is undisturbed: nothing resolves a lock through
+* this, and deleting it would change no gate behaviour.
+*
+* Upstream's scope is wider and cannot be matched. `runInContextScope` saves the
+* previous context, installs itself, and restores at the end of the isolate run
+* — which drains the whole microtask checkpoint synchronously, so upstream's
+* `current()` covers a slice's continuations too. JS cannot drain a checkpoint
+* synchronously, so covering continuations here would mean holding the value
+* until `atCheckpointEnd`, and by then a SECOND actor's body can have run and
+* left. That is not a hazard upstream has: two actors' slices genuinely overlap
+* in this window (§1.10 gives every facet its own gates, so nothing serialises
+* a parent against its child), and the value would be wrong with nothing to say
+* so.
+*
+* So the port keeps only the half that is exact, and the one consumer is a
+* tripwire that refuses on mismatch and stays quiet on `undefined` — never a
+* resolver. See `requireOwnSlice` in `api/global-scope.ts`.
+*/
+var currentSlice;
+/** ← `IoContext::tryCurrent()` (`io-context.c++:1416-1422`), over the narrowed scope above. */
+function tryCurrentSlice() {
+	return currentSlice;
+}
+/**
+* ← the `SuppressIoContextScope` constructor's `threadLocalRequest = this` half
+* (`io-context.c++:1208`), as a function rather than an assignment in `#runImpl`.
+*
+* A function because `currentSlice = this` reads to a linter as a `this` alias — the
+* ES5 `var self = this` habit — when it is the opposite: publishing the running
+* context to a module scope, which is exactly what the C++ does to a thread local.
+*/
+function enterSlice(context) {
+	currentSlice = context;
+}
+/** ← `promiseForExceptionOrT()`: merge the rejection into the value so it survives the hop. */
+function promiseForExceptionOrT(promise) {
+	return promise.then((value) => ({
+		ok: true,
+		value
+	}), (exception) => ({
+		ok: false,
+		exception
+	}));
+}
+/** ← `IdentityFunc<T>`. */
+function identity(value) {
+	return value;
+}
+/**
+* ← the `if (!msg.startsWith("broken."))` guard in `blockConcurrencyWhile`'s error
+* handler. Upstream rewrites the exception's description in place, so this does
+* too. `jsg`'s exception tunnelling — the `jsg.Error:` / `remote.` prefixes
+* `annotateBroken()` also produces — has no port here, so only the brokenness tag
+* it exists to carry survives.
+*/
+function annotateInputGateBroken(exception) {
+	if (!(exception instanceof Error)) return;
+	if (exception.message.startsWith("broken.") || exception.message.startsWith("remote.broken.")) return;
+	exception.message = INPUT_GATE_BROKEN_PREFIX + exception.message;
+}
+/**
+* ← `jsg::isExceptionFromInputGateBroken` (`jsg/exception.c++:168-172`):
+* "annotateBroken() produces 'broken.inputGateBroken; {message}', optionally
+* prefixed with 'remote.' when crossing RPC boundaries. Strip the remote prefix
+* first, then check the tag."
+*
+* Its writer is `annotateInputGateBroken` directly above, which is why the two
+* live together rather than the reader moving to its consumer: `jsg/` has no
+* module here, and a prefix known in two places is a prefix that drifts.
+*/
+function isExceptionFromInputGateBroken(exception) {
+	if (!(exception instanceof Error)) return false;
+	let description = exception.message;
+	while (description.startsWith(REMOTE_EXCEPTION_PREFIX)) description = description.slice(REMOTE_EXCEPTION_PREFIX.length);
+	return description.startsWith(INPUT_GATE_BROKEN_PREFIX);
+}
+/** ← `ERROR_REMOTE_PREFIX` (`jsg/exception.h`). */
+var REMOTE_EXCEPTION_PREFIX = "remote.";
+/**
+* ← `jsg::EXCEPTION_IS_USER_ERROR` (`jsg/exception.h:160`), a
+* `kj::Exception::DetailTypeId` attached to an arbitrary exception rather than a
+* type of exception.
+*
+* A symbol-keyed property is the closest JS has: it rides any thrown object,
+* survives a rethrow, and cannot collide with anything an application writes.
+* `Symbol.for` rather than `Symbol()` so the detail is still legible after the
+* exception crosses a realm — the mistake decision 18 records capnweb making.
+*/
+var EXCEPTION_IS_USER_ERROR = Symbol.for("workerd.exceptionIsUserError");
+/** ← `error.setDetail(jsg::EXCEPTION_IS_USER_ERROR, kj::heapArray<byte>(0))`. */
+function setUserErrorDetail(exception) {
+	if (typeof exception !== "object" || exception === null) return;
+	Object.defineProperty(exception, EXCEPTION_IS_USER_ERROR, {
+		value: true,
+		enumerable: false,
+		configurable: true
+	});
+}
+/** ← `e.getDetail(jsg::EXCEPTION_IS_USER_ERROR) != kj::none`. */
+function hasUserErrorDetail(exception) {
+	if (typeof exception !== "object" || exception === null) return false;
+	return exception[EXCEPTION_IS_USER_ERROR] === true;
+}
+/**
+* ← `IoContext::TimeoutManagerImpl` (`io-context.c++:40-140`, `:742-880`).
+*
+* **The one mechanic worth reading twice: a timer is NOT `awaitIo`.** Upstream
+* says why in a comment on the very line (`io-context.c++:756-758`): "the manual
+* use of run() here (including carrying over the critical section) is kind of
+* ugly, but using awaitIo() doesn't work here because we need the ability to
+* cancel the timer, so we don't want to addTask() it, which awaitIo() does
+* implicitly." So the shape is `cs = ctx.getCriticalSection()` captured at the
+* call, then `ctx.run(callback, cs)` when it fires. The captured section is what
+* makes a timer armed inside `blockConcurrencyWhile` run INSIDE that section
+* rather than queueing on the root gate behind it.
+*
+* **Substrate divergence: one `Timer.afterDelay` per timeout, where upstream
+* keeps a sorted `timeoutTimes` map and a single `timerTask` for the nearest.**
+* That structure exists because `kj::TimerChannel::atTime` supports one pending
+* wait, so upstream has to multiplex; `Timer.afterDelay` takes as many
+* concurrent waits as are asked for. The observable properties it produced —
+* timers fire in deadline order, ties broken by arming order — are the ones both
+* lane timers already have, since both are `setTimeout` underneath. Nothing else
+* in `resetTimerTask` is observable, so nothing else is ported.
+*
+* Not ported: `TimeoutId::Generator` and its cross-`ServiceWorkerGlobalScope`
+* assertion (`io-context.c++:52-60`), which exists to catch an IoContext being
+* current for a different V8 context — a confusion with no shape here, since a
+* timeout id is minted by the manager that owns it; `registerPendingEvent`,
+* which needs the isolate's own idea of pending work; and `getNextTimeout`,
+* whose only caller is the limit enforcer.
+*/
+var TimeoutManager = class {
+	#timer;
+	#timeouts = /* @__PURE__ */ new Map();
+	#nextId = 1;
+	constructor(timer) {
+		this.#timer = timer;
+	}
+	/** ← `TimeoutManagerImpl::setTimeout` (`io-context.c++:51-67`). */
+	setTimeout(ctx, params) {
+		const id = this.#nextId++;
+		const state = {
+			params,
+			isCanceled: false,
+			armed: void 0
+		};
+		this.#timeouts.set(id, state);
+		this.#arm(ctx, id, state);
+		return id;
+	}
+	/** ← `TimeoutManagerImpl::clearTimeout` (`io-context.c++:874-883`). */
+	clearTimeout(id) {
+		const state = this.#timeouts.get(id);
+		if (state === void 0) return;
+		this.#cancel(id, state);
+	}
+	/** ← `TimeoutManagerImpl::getTimeoutCount` (`io-context.c++:71-73`). */
+	getTimeoutCount() {
+		return this.#timeouts.size;
+	}
+	/** ← `TimeoutManagerImpl::cancelAll` (`io-context.c++:83-87`). */
+	cancelAll() {
+		for (const [id, state] of [...this.#timeouts]) this.#cancel(id, state);
+	}
+	/** ← `TimeoutState::cancel` — clear the flag, drop the callback reference, disarm. */
+	#cancel(id, state) {
+		state.isCanceled = true;
+		state.params.callback = void 0;
+		state.armed?.abort();
+		state.armed = void 0;
+		this.#timeouts.delete(id);
+	}
+	/** ← `TimeoutManagerImpl::setTimeoutImpl` (`io-context.c++:742-853`). */
+	#arm(ctx, id, state) {
+		const criticalSection = ctx.getCriticalSection();
+		const wake = new AbortController();
+		state.armed = wake;
+		const fired = this.#timer.afterDelay(state.params.msDelay, wake.signal).then(async () => {
+			if (state.isCanceled) return;
+			state.armed = void 0;
+			await this.#fire(ctx, id, state, criticalSection);
+		}, (exception) => {
+			if (!state.isCanceled) throw exception;
+		});
+		ctx.addWaitUntil(fired);
+	}
+	/** ← the body of the `.then` at `io-context.c++:759-816`, which is one `context.run`. */
+	async #fire(ctx, id, state, criticalSection) {
+		await ctx.run(() => {
+			if (state.isCanceled) return;
+			const callback = state.params.callback;
+			if (callback === void 0) return;
+			if (!state.params.repeat) {
+				state.params.callback = void 0;
+				this.#timeouts.delete(id);
+			}
+			try {
+				callback();
+			} finally {
+				if (state.params.repeat && !state.isCanceled) this.#arm(ctx, id, state);
+			}
+		}, criticalSection);
+	}
+};
+/**
+* A set of background promises, with the one behaviour `kj::TaskSet` adds over an
+* array: a failing task reports to `taskFailed` instead of becoming an unhandled
+* rejection, and the set can be waited on until empty.
+*/
+var TaskSet = class {
+	#tasks = /* @__PURE__ */ new Set();
+	#taskFailed;
+	constructor(taskFailed) {
+		this.#taskFailed = taskFailed;
+	}
+	add(promise) {
+		const task = promise.then(() => {
+			this.#tasks.delete(task);
+		}, (exception) => {
+			this.#tasks.delete(task);
+			this.#taskFailed(exception);
+		});
+		this.#tasks.add(task);
+	}
+	/** ← `kj::TaskSet::onEmpty()`. Re-checks, since a task can add another. */
+	async onEmpty() {
+		while (this.#tasks.size > 0) await Promise.all([...this.#tasks]);
+	}
+};
+var IoContext = class {
+	#actor;
+	#timer;
+	/**
+	* ← `kj::Maybe<InputGate::Lock> currentInputLock`, made a stack.
+	*
+	* The top entry is the lock of the slice that is running right now. Entries are
+	* removed by identity rather than popped, so `#exit` never depends on the order
+	* the overlapping slices happen to leave in.
+	*/
+	#currentInputLocks = [];
+	/**
+	* Where this context's gate was last deliberately engaged, for
+	* `describeLostLock`. One slot, overwritten on every engagement — the gate
+	* serialises slices, so the latest note is the best available ancestor of
+	* whatever continuation is running lockless now.
+	*/
+	#lastGateUse;
+	#transformGateUses = 0;
+	#transformGateStack;
+	#abortException;
+	#abortPromise;
+	#rejectAbort;
+	/**
+	* Two sets, as upstream: `abortWhen()` always uses `tasks` so that a monitor
+	* which never completes cannot hold up a drain, while `addTask()` in an actor
+	* is a waitUntil task.
+	*/
+	#tasks;
+	#waitUntilTasks;
+	#addTaskCounter = 0;
+	#waitUntilStatus;
+	/** ← `kj::Own<TimeoutManager> timeoutManager` (`io-context.h:1043`). */
+	#timeouts;
+	constructor(actor, timer) {
+		this.#actor = actor;
+		this.#timer = timer;
+		this.#timeouts = new TimeoutManager(timer);
+		const { promise, reject } = Promise.withResolvers();
+		this.#abortPromise = promise;
+		this.#rejectAbort = reject;
+		promise.catch(() => {});
+		this.#tasks = new TaskSet((exception) => this.#taskFailed(exception));
+		this.#waitUntilTasks = new TaskSet((exception) => this.#taskFailed(exception));
+		this.abortWhen(actor.getInputGate().onBroken());
+		this.abortWhen(actor.getOutputGate().onBroken());
+	}
+	/**
+	* Get the current input lock. Throws an exception if no input lock is held (e.g. because
+	* this is not an actor request).
+	*
+	* ← `KJ_ASSERT_NONNULL(currentInputLock, ...).addRef()`. The `addRef` IS the §1.2
+	* distinction: it is the only way to hold the gate past the end of this slice.
+	*/
+	getInputLock() {
+		return this.#requireCurrent().addRef();
+	}
+	/** Get the current CriticalSection, if there is one, or returns null if not. */
+	getCriticalSection() {
+		return this.#currentInputLocks.at(-1)?.getCriticalSection();
+	}
+	/** Is a gated slice running? The question `IoContext::hasCurrent()` answers upstream. */
+	hasCurrent() {
+		return this.#currentInputLocks.length > 0;
+	}
+	/**
+	* ← `IoContext::isCurrent()` (`io-context.c++:1428-1430`), over the narrowed
+	* scope `currentSlice` documents: true only while a synchronous body of THIS
+	* context is on the JS stack.
+	*
+	* Distinct from `hasCurrent()` above, which asks whether this context holds a
+	* lock at all — true throughout an outstanding held await, and true for a
+	* parent whose slice is awaiting a facet while the facet's body runs. This one
+	* is the question a shared global has to answer: is the code calling me this
+	* actor's?
+	*/
+	isCurrentSlice() {
+		return currentSlice === this;
+	}
+	/**
+	* Record that user code just engaged this context's gate — an `awaitIo`, an
+	* `entry` dispatch, a re-entry callback firing. No upstream analogue, because
+	* upstream cannot lose the lock; here a continuation that awaits a promise
+	* the runtime does not own comes back lockless, the throw lands at the next
+	* storage call three layers later, and the gap between "where the code last
+	* verifiably ran gated" and the throw site is exactly where the foreign await
+	* hides. This is that first coordinate. Always on: the capture rides calls
+	* that already allocate promise machinery, and a stack costs microseconds
+	* against the diagnosis it replaces.
+	*/
+	noteGateUse(what, stack) {
+		this.#lastGateUse = {
+			what,
+			stack,
+			at: this.now()
+		};
+	}
+	/**
+	* The suffix `requireInputLock` appends when the invocation stack is empty:
+	* where this context's gate was last engaged, and how long before the throw.
+	*
+	* "Last engaged" is the honest claim, not "this continuation's ancestor" —
+	* once the offending chain went lockless the gate reopened, so another slice
+	* may have run in between and be the note this reports. In practice the loss
+	* is discovered within the same event storm and the note is the parent; when
+	* it is not, an engagement of this actor moments earlier is still the right
+	* neighbourhood to search.
+	*/
+	describeLostLock() {
+		const use = this.#lastGateUse;
+		if (use === void 0) return " (this context has never held its gate: the call arrived from outside any actor invocation)";
+		const age = Math.round(this.now() - use.at);
+		const stackSuffix = use.stack === void 0 ? "" : `, at:\n${use.stack}`;
+		return ` (an await after the last gated point resumed from a promise the runtime does not own; the gate was last engaged by ${use.what} ${age}ms before this call${stackSuffix})`;
+	}
+	/**
+	* ← `IoContext::getActorOrThrow()`. Upstream's throws when the request is not
+	* an actor request; there is no such request here, so it is a plain accessor.
+	*/
+	getActorOrThrow() {
+		return this.#actor;
+	}
+	/** ← `IoContext::now()` (`io-context.h:703`), which reads the same timer. */
+	now() {
+		return this.#timer.now();
+	}
+	/**
+	* ← `IoContext::setTimeoutImpl` (`io-context.c++:885-899`), clamp included.
+	*
+	* The generator parameter is gone with `TimeoutId::Generator` — see
+	* `TimeoutManager`'s header — so the signature is upstream's minus that one
+	* argument.
+	*/
+	setTimeoutImpl(repeat, callback, msDelay) {
+		const delay = msDelay <= 0 || Number.isNaN(msDelay) ? 0 : msDelay >= MAX_TIMEOUT_MS ? MAX_TIMEOUT_MS : Math.trunc(msDelay);
+		return this.#timeouts.setTimeout(this, {
+			repeat,
+			msDelay: delay,
+			callback
+		});
+	}
+	/** ← `IoContext::clearTimeoutImpl` (`io-context.c++:901-903`). */
+	clearTimeoutImpl(id) {
+		this.#timeouts.clearTimeout(id);
+	}
+	/** ← `IoContext::getTimeoutCount` (`io-context.c++:905-907`). */
+	getTimeoutCount() {
+		return this.#timeouts.getTimeoutCount();
+	}
+	/**
+	* Wait until all outstanding output locks have been unlocked. Does not wait for future
+	* output locks, even if they are created before past locks are unlocked.
+	*/
+	waitForOutputLocks() {
+		return this.#actor.getOutputGate().wait();
+	}
+	/**
+	* Check if the output gate is currently broken. This indicates that there was a problem
+	* with committing storage writes.
+	*/
+	isOutputGateBroken() {
+		return this.#actor.getOutputGate().isBroken();
+	}
+	/** Lock output until the given promise completes. */
+	lockOutputWhile(promise, signal) {
+		return this.#actor.getOutputGate().lockWhile(promise, signal);
+	}
+	/**
+	* Rejects if and when the context should be aborted, e.g. because a gate broke. This
+	* promise never resolves, only rejects.
+	*/
+	onAbort() {
+		return this.#abortPromise;
+	}
+	/** Force context abort now. */
+	abort(exception) {
+		if (this.#abortException !== void 0) return;
+		this.#abortException = { exception };
+		this.#actor.shutdownActorCache(exception);
+		this.#timeouts.cancelAll();
+		this.#rejectAbort(exception);
+	}
+	/**
+	* Await the given promise and, if it throws, call `abort()` with the exception. The promise
+	* given here should just be a monitoring promise, it should not represent any sort of
+	* background work beyond monitoring.
+	*/
+	abortWhen(promise) {
+		if (this.#abortException === void 0) this.#tasks.add(promise.then(() => {}, (exception) => {
+			this.abort(exception);
+		}));
+	}
+	/**
+	* Arrange for the given promise to execute as part of this request.
+	*
+	* "In Actors, we treat all tasks as wait-until tasks, because it's perfectly legit to start
+	* a task under one request and then expect some other request to handle it later." Every
+	* context here is an actor context, so that branch is the only branch.
+	*/
+	addTask(promise) {
+		++this.#addTaskCounter;
+		this.addWaitUntil(promise);
+	}
+	/**
+	* Indicates that the script has requested that it stay active until the given promise
+	* resolves. `drainWaitUntil()` waits until all such promises have completed. Touches
+	* neither gate (§1.9).
+	*/
+	addWaitUntil(promise) {
+		this.#waitUntilTasks.add(promise);
+	}
+	/** Returns the number of times addTask() has been called (even if the tasks have completed). */
+	taskCount() {
+		return this.#addTaskCounter;
+	}
+	/**
+	* The first exception a background task failed with, if any.
+	*
+	* ← `waitUntilStatus()`, which returns an `EventOutcome` derived from the exception by
+	* `RequestObserver`. There is no observer here, so the exception itself is the status —
+	* and keeping it is what stops a failed background task from being swallowed, since
+	* upstream's other half of `taskFailed()` is a log this package has no port for.
+	*/
+	waitUntilStatus() {
+		return this.#waitUntilStatus?.exception;
+	}
+	/**
+	* ← `IncomingRequest::drain()`, actor branch. "For actors, all promises are canceled on
+	* actor shutdown, not on a fixed timeout, because work doesn't necessarily happen on a
+	* per-request basis in actors."
+	*/
+	async drainWaitUntil() {
+		await Promise.race([this.#waitUntilTasks.onEmpty(), this.#abortPromise.catch(() => {})]);
+	}
+	/**
+	* Run the given callback within this context, holding an input lock.
+	*
+	* ← the two `IoContext::run()` overloads: given a CriticalSection it waits on that, given
+	* an already-held Lock it runs under it, and given neither it takes a fresh lock from the
+	* gate. The third case is what a new external event does, and it is the reason inheritance
+	* cannot be read from gate state — see `makeReentryCallback`.
+	*/
+	async run(func, ilOrCs) {
+		const aborted = this.#abortException;
+		if (aborted !== void 0) throw aborted.exception;
+		let lock;
+		if (ilOrCs === void 0) lock = await this.#actor.getInputGate().wait();
+		else if (ilOrCs instanceof CriticalSection) lock = await ilOrCs.wait();
+		else lock = ilOrCs;
+		return await this.#runImpl(func, lock);
+	}
+	/**
+	* Make a function which, when called, re-enters this IoContext to run some code.
+	*
+	* Upstream, on why the critical section travels with the callback at all:
+	*
+	* > "What if the call was made within blockConcurrencyWhile()? The callback will be blocked
+	* > until the critical section ends, which could lead to deadlock if the critical section
+	* > code is waiting on it? ... The callback is allowed to run within the critical section
+	* > (blockConcurrencyWhile()) from which it was called."
+	*
+	* The section is read here, at the point of capture, and never on invocation: a new
+	* external event that inherited the running section would skip the queue and
+	* `blockConcurrencyWhile` would silently block nothing (Part 4, mechanic 2).
+	*
+	* The returned function can be called multiple times.
+	*
+	* It does not route through `io-gate.ts`'s `makeReentryCallback`, which is the same idea
+	* expressed at the gate. Upstream's `IoContext::makeReentryCallback` is literally
+	* `ctx.run(func, cs)`, and going through the gate helper instead would take a lock this
+	* file then has to make current a second time. The gate copy stays: it is the shape a
+	* consumer holding only a gate needs, and Section 1's tests cover it.
+	*/
+	makeReentryCallback(func) {
+		this.#requireCurrent();
+		const criticalSection = this.getCriticalSection();
+		const registrationStack = captureGateStack();
+		return async (...args) => {
+			this.noteGateUse("a re-entry callback registered at the site below", registrationStack);
+			const call = this.run((lock) => func(lock, ...args), criticalSection);
+			this.addTask(call.then(() => {}, () => {}));
+			return await call;
+		};
+	}
+	awaitIo(promise, func = identity) {
+		this.noteGateUse("awaitIo", captureGateStack());
+		return this.#awaitIoImpl(promise, this.getCriticalSection(), func);
+	}
+	/**
+	* The await transform's hot path. It preserves provenance without capturing
+	* an Error stack for every await: the first call and every 64th call refresh
+	* the sampled site, while intervening calls keep that stack and say so.
+	*/
+	awaitIoFromTransform(promise) {
+		const shouldSample = this.#transformGateUses++ % 64 === 0 || this.#transformGateStack === void 0;
+		if (shouldSample) this.#transformGateStack = captureGateStack();
+		this.#lastGateUse = {
+			what: shouldSample ? "a transformed await sampled at the site below" : "a transformed await (stack from the most recent sampled transformed await)",
+			stack: this.#transformGateStack,
+			at: this.now()
+		};
+		return this.#awaitIoImpl(promise, this.getCriticalSection(), identity);
+	}
+	awaitIoWithInputLock(promise, func = identity) {
+		let inputLock;
+		try {
+			inputLock = this.getInputLock();
+		} catch (exception) {
+			return Promise.reject(exception);
+		}
+		this.noteGateUse("awaitIoWithInputLock", captureGateStack());
+		return this.#awaitIoImpl(promise, inputLock, func);
+	}
+	/**
+	* Runs `callback` within its own critical section, returning its final result. If
+	* `callback` throws, the input lock will break, resetting the actor.
+	*
+	* Three behaviours live here rather than in `io-gate.ts`, which has no timer, and rather
+	* than in `api/actor-state.ts`, whose own `blockConcurrencyWhile` is a one-line forward:
+	* the 30-second deadline, the brokenness annotation, and the fact that on failure the
+	* returned promise is never settled at all.
+	*/
+	blockConcurrencyWhile(callback) {
+		const lock = this.getInputLock();
+		this.noteGateUse("blockConcurrencyWhile", captureGateStack());
+		const criticalSection = lock.startCriticalSection();
+		const { promise: result, resolve } = Promise.withResolvers();
+		this.addTask((async () => {
+			try {
+				const value = await this.#runCriticalSection(criticalSection, callback);
+				await this.#runImpl(() => {
+					resolve(value);
+				}, criticalSection.succeeded());
+			} catch (exception) {
+				annotateInputGateBroken(exception);
+				criticalSection.failed(exception);
+				throw exception;
+			} finally {
+				criticalSection.drop();
+			}
+		})());
+		lock.release();
+		return result;
+	}
+	/**
+	* ← `runImpl()` + `runInContextScope()`: check the lock belongs to this actor, make it the
+	* current one, run, and let `KJ_DEFER` clear it.
+	*
+	* The defer fires after the microtask checkpoint, not when `func` returns — see
+	* `atCheckpointEnd`. Everything else about the scope is isolate machinery with no port.
+	*/
+	async #runImpl(func, lock) {
+		if (!lock.isFor(this.#actor.getInputGate())) throw new Error("IoContext::runImpl() was given a lock belonging to another actor");
+		this.#currentInputLocks.push(lock);
+		let result;
+		const previousSlice = currentSlice;
+		enterSlice(this);
+		try {
+			result = func(lock);
+		} finally {
+			enterSlice(previousSlice);
+			atCheckpointEnd(() => {
+				this.#exit(lock);
+			});
+		}
+		return await result;
+	}
+	/**
+	* ← `requireCurrent()`. Upstream asks whether this IoContext is the thread's current one;
+	* with no thread-local there is only one question left, and it is the one every caller of
+	* `requireCurrent()` actually depends on: is a gated slice running?
+	*/
+	#requireCurrent() {
+		const lock = this.#currentInputLocks.at(-1);
+		if (lock === void 0) throw new Error(`no input lock available in this context${this.describeLostLock()}`);
+		return lock;
+	}
+	/** ← the far side of `runInContextScope`'s `KJ_DEFER`. */
+	#exit(lock) {
+		const at = this.#currentInputLocks.lastIndexOf(lock);
+		if (at < 0) throw new Error("IoContext invocation stack lost a lock it was holding");
+		this.#currentInputLocks.splice(at, 1);
+		lock.release();
+	}
+	/**
+	* ← `awaitIoImpl()`.
+	*
+	* The KJ-side rejection is merged into the value so a single continuation handles both, the
+	* continuation re-enters through `run(func, ilOrCs)`, and the whole thing rides `addTask()`.
+	* When `ilOrCs` is a Lock this is `awaitIoWithInputLock` and the gate never opened; when it
+	* is a CriticalSection or nothing this is `awaitIo` and the resumption queues for a fresh
+	* lock like any other event.
+	*/
+	#awaitIoImpl(promise, ilOrCs, func) {
+		const { promise: result, resolve, reject } = Promise.withResolvers();
+		this.addTask(promiseForExceptionOrT(promise).then(async (outcome) => {
+			try {
+				await this.run(() => {
+					if (outcome.ok) try {
+						resolve(func(outcome.value));
+					} catch (exception) {
+						reject(exception);
+					}
+					else reject(outcome.exception);
+				}, ilOrCs);
+			} catch (exception) {
+				if (ilOrCs instanceof Lock) ilOrCs.release();
+				throw exception;
+			}
+		}));
+		return result;
+	}
+	/**
+	* ← the first `.then()` of `blockConcurrencyWhile`: start the section, run the callback
+	* under its first nested lock, and race the deadline.
+	*/
+	async #runCriticalSection(criticalSection, callback) {
+		const inputLock = await criticalSection.wait();
+		return await this.#runImpl((lock) => {
+			const running = callback(lock);
+			const deadline = new AbortController();
+			const timeout = this.#timer.afterDelay(BLOCK_CONCURRENCY_WHILE_TIMEOUT_MS, deadline.signal).then(() => {
+				throw new Error(BLOCK_CONCURRENCY_WHILE_TIMEOUT_MESSAGE);
+			});
+			return Promise.race([Promise.resolve(running), timeout]).finally(() => {
+				deadline.abort();
+			});
+		}, inputLock);
+	}
+	/** ← `IoContext::taskFailed()`, minus the logging half, which has no port. */
+	#taskFailed(exception) {
+		if (this.#waitUntilStatus === void 0) this.#waitUntilStatus = { exception };
+	}
+};
+//#endregion
+export { isExceptionFromInputGateBroken as a, tryCurrentSlice as c, hasUserErrorDetail as i, InputGate as l, atCheckpointEnd as n, requireInputLock as o, captureGateStack as r, setUserErrorDetail as s, IoContext as t, OutputGate as u };
+
+//# sourceMappingURL=io-context-Ci3Rf6U5.js.map