@shware/workflow 3.0.0 → 3.1.0

package/README.md

@@ -791,12 +791,21 @@ no HTTP body can pass for the others:
 A start is recorded with its entry in one transaction (the `execution` table),
 so a lost `Invoke` response is retried with the same name and payload and never
 re-entered as a second execution. Retries stop after 12 hours (`startRetryMs`,
-keep it under the execution retention) and the start is left unresolved.
+keep it under the execution retention) and the start is left unresolved. A
+failed entry that is entered again gets a new execution, never the closed one.
+
+Erasing a user (`POST /users/forget`) stops their executions, then waits
+`stopDrainMs` (15 minutes by default; at least the function's timeout) before
+erasing: a stop does not interrupt an invocation already running, which goes on
+to its next checkpoint. Until then the erasure answers `erased: false` and the
+sweep finishes it.
 
 Deploy one artifact per version: publish a numbered version and point the
 `live` alias, which the Function URL is bound to, at it. Each version carries its
-compiled bundle and makes it live by itself, only over an older one; executions
-stay on the version that started them. `POST /deploy` of an arbitrary bundle is
+compiled bundle and makes it live by itself, only over an older one. Each route
+records the version that applied it, and an instance it starts runs on that
+version, so its IR and its code always match, even while an older version is
+still serving; executions stay on the version that started them. `POST /deploy` of an arbitrary bundle is
 refused.
 
 ```yaml
@@ -807,6 +816,7 @@ Workflow:
     Handler: aws.handler
     Timeout: 60
     AutoPublishAlias: live
+    # ExecutionTimeout: the longest journey (waits, delays and the goal window), up to 366 days
     DurableConfig: { ExecutionTimeout: 2592000, RetentionPeriodInDays: 30 }
     FunctionUrlConfig: { AuthType: NONE, InvokeMode: BUFFERED }
 ```

package/dist/aws/index.cjs

@@ -39,7 +39,7 @@ const json = (body, status = 200) => new Response(JSON.stringify(body), {
 	headers: { "content-type": "application/json" }
 });
 function journeyLambda(options) {
-	const { env: baseEnv, lambda: lambdaOption, startRetryMs, ...hostOptions } = options;
+	const { env: baseEnv, lambda: lambdaOption, startRetryMs, stopDrainMs, ...hostOptions } = options;
 	const host = require_host_journey_host.createJourneyHost({
 		...hostOptions,
 		store: (env, database) => options.store(env, database)
@@ -67,18 +67,18 @@ function journeyLambda(options) {
 		const executions = store.executions;
 		if (executions === void 0) throw new Error("journeyLambda needs a store with an execution registry (PostgresJourneyStore)");
 		const functionArn = unqualified(context.lambdaContext.invokedFunctionArn);
-		const target = async (contentHash) => {
+		const target = async (contentHash, version) => {
+			if (version !== void 0 && /^\d+$/.test(version)) return `${functionArn}:${version}`;
 			if (ownHashes.has(contentHash)) return `${functionArn}:${ownVersion()}`;
-			const live = await store.liveBundleVersion?.();
-			if (live !== void 0 && /^\d+$/.test(live.id)) return `${functionArn}:${live.id}`;
-			throw new Error(`no published version carries workflow IR ${contentHash}`);
+			throw new Error(`no published version is known to carry workflow IR ${contentHash}`);
 		};
 		const instances = new require_aws_instances.AwsInstances({
 			store,
 			executions,
 			lambda,
 			target,
-			...startRetryMs === void 0 ? {} : { startRetryMs }
+			...startRetryMs === void 0 ? {} : { startRetryMs },
+			...stopDrainMs === void 0 ? {} : { stopDrainMs }
 		});
 		return {
 			store,

package/dist/aws/index.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"index.cjs","names":["createJourneyHost","http2Fetch","sdkLambdaApi","AsyncLocalStorage","AwsInstances","executeJourney","AwsEngineStep","toRequest","fromResponse","sweepSegments","withDurableExecution","isFunctionUrlEvent","isRunInput"],"sources":["../../src/aws/index.ts"],"sourcesContent":["import { AsyncLocalStorage } from 'node:async_hooks';\nimport {\n  type DurableContext,\n  type DurableExecutionInvocationInput,\n  type DurableExecutionInvocationOutput,\n  withDurableExecution,\n} from '@aws/durable-execution-sdk-js';\nimport type { JourneyEnv } from '../cloudflare/bindings';\nimport type { JourneyOutcome } from '../engine/ports';\nimport { executeJourney } from '../host/execute';\nimport { type JourneyHostOptions, createJourneyHost } from '../host/journey-host';\nimport { type SweepResult, sweepSegments } from '../host/router';\nimport { http2Fetch } from '../http2-client';\nimport type { BundleVersion, ExecutionRegistry, JourneyStore, StoreLease } from '../store/index';\nimport { AwsEngineStep } from './engine-step';\nimport {\n  type FunctionUrlEvent,\n  type FunctionUrlResult,\n  fromResponse,\n  isFunctionUrlEvent,\n  toRequest,\n} from './function-url';\nimport { AwsInstances, type RunInput, isRunInput } from './instances';\nimport { type LambdaApi, sdkLambdaApi } from './lambda-api';\n\n/**\n * `@shware/workflow/aws` — the journey host as one Lambda durable function behind a Function\n * URL, on Postgres.\n *\n * The one handler tells three inputs apart by the event's top-level shape: a Function URL\n * request (the HTTP API — ingest, identify, devices, tracking, bundle, preview), an internal run\n * (one journey instance: one durable execution, started by an asynchronous invoke of this\n * function's own numbered version), and a scheduled maintenance tick. An HTTP body can never\n * pass for the other two: the Function URL always wraps it.\n *\n *   const journeys = journeyLambda({\n *     config,\n *     env,                                        // parsed from process.env (zod)\n *     store: (env, database) => postgresJsStore(env.DATABASE_URL, database),\n *     email: (env) => sesEmailTransport({ region: env.AWS_REGION }),\n *   });\n *   export const handler = journeys.handler;\n */\n\n/** The scheduled tick (EventBridge Scheduler's payload): the segment sweep and maintenance. */\nexport const SWEEP_EVENT_TYPE = '$workflow.sweep';\n\n/** What journeyLambda reads from its env: `JourneyEnv` without the binding it supplies itself. */\nexport type JourneyLambdaEnv = Omit<JourneyEnv, 'JOURNEY' | 'DB' | 'WORKFLOW_KV' | 'EMAIL'>;\n\nexport interface JourneyLambdaOptions<Env extends JourneyLambdaEnv> extends Omit<\n  JourneyHostOptions<Env & JourneyEnv>,\n  'env' | 'store'\n> {\n  /** The validated environment (parsed from `process.env` with zod by the app). */\n  env: Env;\n  /** The Postgres store: AWS needs its execution registry (`postgresJsStore`). */\n  store: (env: Env, database: { schema: string }) => JourneyStore | StoreLease;\n  /** The Lambda control plane; `@aws-sdk/client-lambda` with the execution role by default. */\n  lambda?: LambdaApi;\n  /** How long an unconfirmed start is retried (default 12 hours; keep it under the retention). */\n  startRetryMs?: number;\n}\n\n/**\n * The Lambda invocation context, as far as the handler's signature needs it — declared here so\n * the package's types do not depend on `@types/aws-lambda`. Lambda passes the full object.\n */\nexport interface LambdaContext {\n  functionName: string;\n  functionVersion: string;\n  invokedFunctionArn: string;\n  awsRequestId: string;\n  getRemainingTimeInMillis(): number;\n}\n\nexport interface JourneyLambda {\n  /** Export as the function's handler. */\n  handler: (\n    event: DurableExecutionInvocationInput,\n    context: LambdaContext\n  ) => Promise<DurableExecutionInvocationOutput>;\n}\n\ninterface Invocation {\n  lease?: Required<StoreLease>;\n}\n\n/** This function's ARN without its qualifier, from the ARN it was invoked under. */\nfunction unqualified(invokedFunctionArn: string): string {\n  return invokedFunctionArn.split(':').slice(0, 7).join(':');\n}\n\nconst json = (body: unknown, status = 200) =>\n  new Response(JSON.stringify(body), { status, headers: { 'content-type': 'application/json' } });\n\nexport function journeyLambda<Env extends JourneyLambdaEnv>(\n  options: JourneyLambdaOptions<Env>\n): JourneyLambda {\n  type HostEnv = Env & JourneyEnv;\n  const { env: baseEnv, lambda: lambdaOption, startRetryMs, ...hostOptions } = options;\n  const host = createJourneyHost<HostEnv>(\n    { ...hostOptions, store: (env, database) => options.store(env, database) },\n    // Node 24's fetch cannot reach APNs (HTTP/2 only): see http2-client.ts for when this can go\n    { apnsFetch: http2Fetch() }\n  );\n  const lambda = lambdaOption ?? sdkLambdaApi();\n  const ownHashes = new Set(host.bundle().workflows.map((workflow) => workflow.contentHash));\n  const scope = new AsyncLocalStorage<Invocation>();\n\n  /** The version this code was published as: `$LATEST` while developing. */\n  const ownVersion = () => process.env.AWS_LAMBDA_FUNCTION_VERSION ?? '$LATEST';\n  /** Numbered versions are ordered: the bundle compiled into a later one goes live by itself. */\n  const bundleVersion = (): BundleVersion | undefined => {\n    const version = ownVersion();\n    return /^\\d+$/.test(version) ? { id: version, createdAt: Number(version) } : undefined;\n  };\n\n  /** The store and the env (with the instance port) of this invocation, opened on first use. */\n  const open = (\n    context: DurableContext\n  ): { store: JourneyStore; env: HostEnv; executions: ExecutionRegistry } => {\n    const invocation = scope.getStore();\n    if (invocation === undefined) throw new Error('journeyLambda: outside an invocation');\n    const placeholder = { ...baseEnv } as unknown as HostEnv;\n    invocation.lease ??= host.lease(placeholder);\n    const { store } = invocation.lease;\n    const executions = store.executions;\n    if (executions === undefined) {\n      throw new Error(\n        'journeyLambda needs a store with an execution registry (PostgresJourneyStore)'\n      );\n    }\n    const functionArn = unqualified(context.lambdaContext.invokedFunctionArn);\n    const target = async (contentHash: string): Promise<string> => {\n      // An execution runs the code its IR was compiled with: this version's own workflows here,\n      // anything else on the version whose bundle put it in the routes\n      if (ownHashes.has(contentHash)) return `${functionArn}:${ownVersion()}`;\n      const live = await store.liveBundleVersion?.();\n      if (live !== undefined && /^\\d+$/.test(live.id)) return `${functionArn}:${live.id}`;\n      throw new Error(`no published version carries workflow IR ${contentHash}`);\n    };\n    const instances = new AwsInstances({\n      store,\n      executions,\n      lambda,\n      target,\n      ...(startRetryMs === undefined ? {} : { startRetryMs }),\n    });\n    return { store, env: { ...baseEnv, JOURNEY: instances }, executions };\n  };\n\n  const run = async (input: RunInput, context: DurableContext): Promise<JourneyOutcome> => {\n    const { store, env, executions } = open(context);\n    const { instanceId, params } = input;\n    // Running is the proof the start got through, whatever became of the invoke's response\n    await context.step('$workflow:started', async () => {\n      await executions.markSubmitted(\n        instanceId,\n        context.executionContext.durableExecutionArn,\n        Date.now()\n      );\n    });\n    return executeJourney(\n      {\n        instanceId,\n        params,\n        enteredAtMs: input.enteredAtMs,\n        step: new AwsEngineStep(context, store, executions, lambda, params.userId, instanceId),\n      },\n      host.runParts(env, store, params)\n    );\n  };\n\n  const http = (event: FunctionUrlEvent, context: DurableContext): Promise<FunctionUrlResult> => {\n    const serve = async (): Promise<FunctionUrlResult> => {\n      const method = event.requestContext.http.method;\n      try {\n        const { store, env } = open(context);\n        const request = toRequest(event);\n        // Only the bundle compiled into a version may route: one is never swapped in by hand\n        if (new URL(request.url).pathname === '/deploy') {\n          return await fromResponse(\n            json(\n              {\n                error:\n                  'deploy by publishing a version (POST /bundle/deploy applies its own bundle)',\n              },\n              409\n            ),\n            method\n          );\n        }\n        await host.applyOwnBundle(env, bundleVersion());\n        return await fromResponse(await host.handle(request, env, store), method);\n      } catch (error) {\n        console.error('[workflow] request failed', error);\n        return fromResponse(json({ error: 'internal error' }, 500), method);\n      }\n    };\n    // A read (the bundle, a preview, a tracked link or pixel) answers straight from the handler:\n    // its body can be large, and a step would checkpoint all of it. A write runs in one step,\n    // never retried — the caller is waiting, and retries the request itself\n    const method = event.requestContext.http.method.toUpperCase();\n    if (method === 'GET' || method === 'HEAD') return serve();\n    return context.step('http', serve, { retryStrategy: () => ({ shouldRetry: false }) });\n  };\n\n  const sweep = (context: DurableContext): Promise<SweepResult> =>\n    context.step(\n      'sweep',\n      async () => {\n        const { store, env } = open(context);\n        await host.applyOwnBundle(env, bundleVersion());\n        return sweepSegments(env, store);\n      },\n      { retryStrategy: () => ({ shouldRetry: false }) }\n    );\n\n  const durable = withDurableExecution(async (input: unknown, context: DurableContext) => {\n    if (isFunctionUrlEvent(input)) return http(input, context);\n    if (isRunInput(input)) return run(input, context);\n    if (\n      typeof input === 'object' &&\n      input !== null &&\n      (input as { type?: unknown }).type === SWEEP_EVENT_TYPE\n    ) {\n      return sweep(context);\n    }\n    throw new Error('journeyLambda: unrecognized event (not a Function URL request, run or sweep)');\n  });\n\n  const handler = async (\n    event: DurableExecutionInvocationInput,\n    context: LambdaContext\n  ): Promise<DurableExecutionInvocationOutput> => {\n    const invocation: Invocation = {};\n    try {\n      // The durable wrapper reads the whole context Lambda passed, not just the fields above\n      return await scope.run(invocation, () =>\n        durable(event, context as Parameters<typeof durable>[1])\n      );\n    } finally {\n      // Outside the durable wrapper: a suspended run returns PENDING without unwinding the\n      // handler, so a `finally` in there would never release the connection\n      await invocation.lease?.close().catch((error: unknown) => {\n        console.error('[workflow] closing the store failed', error);\n      });\n    }\n  };\n\n  return { handler };\n}\n\nexport { AwsEngineStep, stepRetry } from './engine-step';\nexport { AwsInstances, RUN_EVENT_TYPE, executionName, isRunInput } from './instances';\nexport type { AwsInstancesOptions, RunInput } from './instances';\nexport { sdkLambdaApi } from './lambda-api';\nexport type { ExecutionState, LambdaApi } from './lambda-api';\nexport { fromResponse, isFunctionUrlEvent, toRequest } from './function-url';\nexport type { FunctionUrlEvent, FunctionUrlResult } from './function-url';\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA6CA,MAAa,mBAAmB;;AA4ChC,SAAS,YAAY,oBAAoC;CACvD,OAAO,mBAAmB,MAAM,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,KAAK,GAAG;AAC3D;AAEA,MAAM,QAAQ,MAAe,SAAS,QACpC,IAAI,SAAS,KAAK,UAAU,IAAI,GAAG;CAAE;CAAQ,SAAS,EAAE,gBAAgB,mBAAmB;AAAE,CAAC;AAEhG,SAAgB,cACd,SACe;CAEf,MAAM,EAAE,KAAK,SAAS,QAAQ,cAAc,cAAc,GAAG,gBAAgB;CAC7E,MAAM,OAAOA,0BAAAA,kBACX;EAAE,GAAG;EAAa,QAAQ,KAAK,aAAa,QAAQ,MAAM,KAAK,QAAQ;CAAE,GAEzE,EAAE,WAAWC,qBAAAA,WAAW,EAAE,CAC5B;CACA,MAAM,SAAS,gBAAgBC,uBAAAA,aAAa;CAC5C,MAAM,YAAY,IAAI,IAAI,KAAK,OAAO,CAAC,CAAC,UAAU,KAAK,aAAa,SAAS,WAAW,CAAC;CACzF,MAAM,QAAQ,IAAIC,iBAAAA,kBAA8B;;CAGhD,MAAM,mBAAmB,QAAQ,IAAI,+BAA+B;;CAEpE,MAAM,sBAAiD;EACrD,MAAM,UAAU,WAAW;EAC3B,OAAO,QAAQ,KAAK,OAAO,IAAI;GAAE,IAAI;GAAS,WAAW,OAAO,OAAO;EAAE,IAAI,KAAA;CAC/E;;CAGA,MAAM,QACJ,YACyE;EACzE,MAAM,aAAa,MAAM,SAAS;EAClC,IAAI,eAAe,KAAA,GAAW,MAAM,IAAI,MAAM,sCAAsC;EACpF,MAAM,cAAc,EAAE,GAAG,QAAQ;EACjC,WAAW,UAAU,KAAK,MAAM,WAAW;EAC3C,MAAM,EAAE,UAAU,WAAW;EAC7B,MAAM,aAAa,MAAM;EACzB,IAAI,eAAe,KAAA,GACjB,MAAM,IAAI,MACR,+EACF;EAEF,MAAM,cAAc,YAAY,QAAQ,cAAc,kBAAkB;EACxE,MAAM,SAAS,OAAO,gBAAyC;GAG7D,IAAI,UAAU,IAAI,WAAW,GAAG,OAAO,GAAG,YAAY,GAAG,WAAW;GACpE,MAAM,OAAO,MAAM,MAAM,oBAAoB;GAC7C,IAAI,SAAS,KAAA,KAAa,QAAQ,KAAK,KAAK,EAAE,GAAG,OAAO,GAAG,YAAY,GAAG,KAAK;GAC/E,MAAM,IAAI,MAAM,4CAA4C,aAAa;EAC3E;EACA,MAAM,YAAY,IAAIC,sBAAAA,aAAa;GACjC;GACA;GACA;GACA;GACA,GAAI,iBAAiB,KAAA,IAAY,CAAC,IAAI,EAAE,aAAa;EACvD,CAAC;EACD,OAAO;GAAE;GAAO,KAAK;IAAE,GAAG;IAAS,SAAS;GAAU;GAAG;EAAW;CACtE;CAEA,MAAM,MAAM,OAAO,OAAiB,YAAqD;EACvF,MAAM,EAAE,OAAO,KAAK,eAAe,KAAK,OAAO;EAC/C,MAAM,EAAE,YAAY,WAAW;EAE/B,MAAM,QAAQ,KAAK,qBAAqB,YAAY;GAClD,MAAM,WAAW,cACf,YACA,QAAQ,iBAAiB,qBACzB,KAAK,IAAI,CACX;EACF,CAAC;EACD,OAAOC,qBAAAA,eACL;GACE;GACA;GACA,aAAa,MAAM;GACnB,MAAM,IAAIC,wBAAAA,cAAc,SAAS,OAAO,YAAY,QAAQ,OAAO,QAAQ,UAAU;EACvF,GACA,KAAK,SAAS,KAAK,OAAO,MAAM,CAClC;CACF;CAEA,MAAM,QAAQ,OAAyB,YAAwD;EAC7F,MAAM,QAAQ,YAAwC;GACpD,MAAM,SAAS,MAAM,eAAe,KAAK;GACzC,IAAI;IACF,MAAM,EAAE,OAAO,QAAQ,KAAK,OAAO;IACnC,MAAM,UAAUC,yBAAAA,UAAU,KAAK;IAE/B,IAAI,IAAI,IAAI,QAAQ,GAAG,CAAC,CAAC,aAAa,WACpC,OAAO,MAAMC,yBAAAA,aACX,KACE,EACE,OACE,8EACJ,GACA,GACF,GACA,MACF;IAEF,MAAM,KAAK,eAAe,KAAK,cAAc,CAAC;IAC9C,OAAO,MAAMA,yBAAAA,aAAa,MAAM,KAAK,OAAO,SAAS,KAAK,KAAK,GAAG,MAAM;GAC1E,SAAS,OAAO;IACd,QAAQ,MAAM,6BAA6B,KAAK;IAChD,OAAOA,yBAAAA,aAAa,KAAK,EAAE,OAAO,iBAAiB,GAAG,GAAG,GAAG,MAAM;GACpE;EACF;EAIA,MAAM,SAAS,MAAM,eAAe,KAAK,OAAO,YAAY;EAC5D,IAAI,WAAW,SAAS,WAAW,QAAQ,OAAO,MAAM;EACxD,OAAO,QAAQ,KAAK,QAAQ,OAAO,EAAE,sBAAsB,EAAE,aAAa,MAAM,GAAG,CAAC;CACtF;CAEA,MAAM,SAAS,YACb,QAAQ,KACN,SACA,YAAY;EACV,MAAM,EAAE,OAAO,QAAQ,KAAK,OAAO;EACnC,MAAM,KAAK,eAAe,KAAK,cAAc,CAAC;EAC9C,OAAOC,oBAAAA,cAAc,KAAK,KAAK;CACjC,GACA,EAAE,sBAAsB,EAAE,aAAa,MAAM,GAAG,CAClD;CAEF,MAAM,WAAA,GAAUC,8BAAAA,qBAAAA,CAAqB,OAAO,OAAgB,YAA4B;EACtF,IAAIC,yBAAAA,mBAAmB,KAAK,GAAG,OAAO,KAAK,OAAO,OAAO;EACzD,IAAIC,sBAAAA,WAAW,KAAK,GAAG,OAAO,IAAI,OAAO,OAAO;EAChD,IACE,OAAO,UAAU,YACjB,UAAU,QACT,MAA6B,SAAA,mBAE9B,OAAO,MAAM,OAAO;EAEtB,MAAM,IAAI,MAAM,8EAA8E;CAChG,CAAC;CAED,MAAM,UAAU,OACd,OACA,YAC8C;EAC9C,MAAM,aAAyB,CAAC;EAChC,IAAI;GAEF,OAAO,MAAM,MAAM,IAAI,kBACrB,QAAQ,OAAO,OAAwC,CACzD;EACF,UAAU;GAGR,MAAM,WAAW,OAAO,MAAM,CAAC,CAAC,OAAO,UAAmB;IACxD,QAAQ,MAAM,uCAAuC,KAAK;GAC5D,CAAC;EACH;CACF;CAEA,OAAO,EAAE,QAAQ;AACnB"}
+{"version":3,"file":"index.cjs","names":["createJourneyHost","http2Fetch","sdkLambdaApi","AsyncLocalStorage","AwsInstances","executeJourney","AwsEngineStep","toRequest","fromResponse","sweepSegments","withDurableExecution","isFunctionUrlEvent","isRunInput"],"sources":["../../src/aws/index.ts"],"sourcesContent":["import { AsyncLocalStorage } from 'node:async_hooks';\nimport {\n  type DurableContext,\n  type DurableExecutionInvocationInput,\n  type DurableExecutionInvocationOutput,\n  withDurableExecution,\n} from '@aws/durable-execution-sdk-js';\nimport type { JourneyEnv } from '../cloudflare/bindings';\nimport type { JourneyOutcome } from '../engine/ports';\nimport { executeJourney } from '../host/execute';\nimport { type JourneyHostOptions, createJourneyHost } from '../host/journey-host';\nimport { type SweepResult, sweepSegments } from '../host/router';\nimport { http2Fetch } from '../http2-client';\nimport type { BundleVersion, ExecutionRegistry, JourneyStore, StoreLease } from '../store/index';\nimport { AwsEngineStep } from './engine-step';\nimport {\n  type FunctionUrlEvent,\n  type FunctionUrlResult,\n  fromResponse,\n  isFunctionUrlEvent,\n  toRequest,\n} from './function-url';\nimport { AwsInstances, type RunInput, isRunInput } from './instances';\nimport { type LambdaApi, sdkLambdaApi } from './lambda-api';\n\n/**\n * `@shware/workflow/aws` — the journey host as one Lambda durable function behind a Function\n * URL, on Postgres.\n *\n * The one handler tells three inputs apart by the event's top-level shape: a Function URL\n * request (the HTTP API — ingest, identify, devices, tracking, bundle, preview), an internal run\n * (one journey instance: one durable execution, started by an asynchronous invoke of this\n * function's own numbered version), and a scheduled maintenance tick. An HTTP body can never\n * pass for the other two: the Function URL always wraps it.\n *\n *   const journeys = journeyLambda({\n *     config,\n *     env,                                        // parsed from process.env (zod)\n *     store: (env, database) => postgresJsStore(env.DATABASE_URL, database),\n *     email: (env) => sesEmailTransport({ region: env.AWS_REGION }),\n *   });\n *   export const handler = journeys.handler;\n */\n\n/** The scheduled tick (EventBridge Scheduler's payload): the segment sweep and maintenance. */\nexport const SWEEP_EVENT_TYPE = '$workflow.sweep';\n\n/** What journeyLambda reads from its env: `JourneyEnv` without the binding it supplies itself. */\nexport type JourneyLambdaEnv = Omit<JourneyEnv, 'JOURNEY' | 'DB' | 'WORKFLOW_KV' | 'EMAIL'>;\n\nexport interface JourneyLambdaOptions<Env extends JourneyLambdaEnv> extends Omit<\n  JourneyHostOptions<Env & JourneyEnv>,\n  'env' | 'store'\n> {\n  /** The validated environment (parsed from `process.env` with zod by the app). */\n  env: Env;\n  /** The Postgres store: AWS needs its execution registry (`postgresJsStore`). */\n  store: (env: Env, database: { schema: string }) => JourneyStore | StoreLease;\n  /** The Lambda control plane; `@aws-sdk/client-lambda` with the execution role by default. */\n  lambda?: LambdaApi;\n  /** How long an unconfirmed start is retried (default 12 hours; keep it under the retention). */\n  startRetryMs?: number;\n  /**\n   * How long an erasure waits after stopping an execution before it erases: an invocation\n   * running at the stop goes on to its next checkpoint. Set it to at least the function's\n   * timeout; 15 minutes (Lambda's maximum) by default.\n   */\n  stopDrainMs?: number;\n}\n\n/**\n * The Lambda invocation context, as far as the handler's signature needs it — declared here so\n * the package's types do not depend on `@types/aws-lambda`. Lambda passes the full object.\n */\nexport interface LambdaContext {\n  functionName: string;\n  functionVersion: string;\n  invokedFunctionArn: string;\n  awsRequestId: string;\n  getRemainingTimeInMillis(): number;\n}\n\nexport interface JourneyLambda {\n  /** Export as the function's handler. */\n  handler: (\n    event: DurableExecutionInvocationInput,\n    context: LambdaContext\n  ) => Promise<DurableExecutionInvocationOutput>;\n}\n\ninterface Invocation {\n  lease?: Required<StoreLease>;\n}\n\n/** This function's ARN without its qualifier, from the ARN it was invoked under. */\nfunction unqualified(invokedFunctionArn: string): string {\n  return invokedFunctionArn.split(':').slice(0, 7).join(':');\n}\n\nconst json = (body: unknown, status = 200) =>\n  new Response(JSON.stringify(body), { status, headers: { 'content-type': 'application/json' } });\n\nexport function journeyLambda<Env extends JourneyLambdaEnv>(\n  options: JourneyLambdaOptions<Env>\n): JourneyLambda {\n  type HostEnv = Env & JourneyEnv;\n  const { env: baseEnv, lambda: lambdaOption, startRetryMs, stopDrainMs, ...hostOptions } = options;\n  const host = createJourneyHost<HostEnv>(\n    { ...hostOptions, store: (env, database) => options.store(env, database) },\n    // Node 24's fetch cannot reach APNs (HTTP/2 only): see http2-client.ts for when this can go\n    { apnsFetch: http2Fetch() }\n  );\n  const lambda = lambdaOption ?? sdkLambdaApi();\n  const ownHashes = new Set(host.bundle().workflows.map((workflow) => workflow.contentHash));\n  const scope = new AsyncLocalStorage<Invocation>();\n\n  /** The version this code was published as: `$LATEST` while developing. */\n  const ownVersion = () => process.env.AWS_LAMBDA_FUNCTION_VERSION ?? '$LATEST';\n  /** Numbered versions are ordered: the bundle compiled into a later one goes live by itself. */\n  const bundleVersion = (): BundleVersion | undefined => {\n    const version = ownVersion();\n    return /^\\d+$/.test(version) ? { id: version, createdAt: Number(version) } : undefined;\n  };\n\n  /** The store and the env (with the instance port) of this invocation, opened on first use. */\n  const open = (\n    context: DurableContext\n  ): { store: JourneyStore; env: HostEnv; executions: ExecutionRegistry } => {\n    const invocation = scope.getStore();\n    if (invocation === undefined) throw new Error('journeyLambda: outside an invocation');\n    const placeholder = { ...baseEnv } as unknown as HostEnv;\n    invocation.lease ??= host.lease(placeholder);\n    const { store } = invocation.lease;\n    const executions = store.executions;\n    if (executions === undefined) {\n      throw new Error(\n        'journeyLambda needs a store with an execution registry (PostgresJourneyStore)'\n      );\n    }\n    const functionArn = unqualified(context.lambdaContext.invokedFunctionArn);\n    const target = async (contentHash: string, version?: string): Promise<string> => {\n      // An execution runs the code its IR was compiled with: the version whose bundle put the\n      // route there, read in the same row as the hash — never a separately read \"live\" version,\n      // which a release between the two reads would make another bundle's\n      if (version !== undefined && /^\\d+$/.test(version)) return `${functionArn}:${version}`;\n      // A forced deploy records no version: only this code's own workflows can run here\n      if (ownHashes.has(contentHash)) return `${functionArn}:${ownVersion()}`;\n      throw new Error(`no published version is known to carry workflow IR ${contentHash}`);\n    };\n    const instances = new AwsInstances({\n      store,\n      executions,\n      lambda,\n      target,\n      ...(startRetryMs === undefined ? {} : { startRetryMs }),\n      ...(stopDrainMs === undefined ? {} : { stopDrainMs }),\n    });\n    return { store, env: { ...baseEnv, JOURNEY: instances }, executions };\n  };\n\n  const run = async (input: RunInput, context: DurableContext): Promise<JourneyOutcome> => {\n    const { store, env, executions } = open(context);\n    const { instanceId, params } = input;\n    // Running is the proof the start got through, whatever became of the invoke's response\n    await context.step('$workflow:started', async () => {\n      await executions.markSubmitted(\n        instanceId,\n        context.executionContext.durableExecutionArn,\n        Date.now()\n      );\n    });\n    return executeJourney(\n      {\n        instanceId,\n        params,\n        enteredAtMs: input.enteredAtMs,\n        step: new AwsEngineStep(context, store, executions, lambda, params.userId, instanceId),\n      },\n      host.runParts(env, store, params)\n    );\n  };\n\n  const http = (event: FunctionUrlEvent, context: DurableContext): Promise<FunctionUrlResult> => {\n    const serve = async (): Promise<FunctionUrlResult> => {\n      const method = event.requestContext.http.method;\n      try {\n        const { store, env } = open(context);\n        const request = toRequest(event);\n        // Only the bundle compiled into a version may route: one is never swapped in by hand\n        if (new URL(request.url).pathname === '/deploy') {\n          return await fromResponse(\n            json(\n              {\n                error:\n                  'deploy by publishing a version (POST /bundle/deploy applies its own bundle)',\n              },\n              409\n            ),\n            method\n          );\n        }\n        await host.applyOwnBundle(env, bundleVersion());\n        return await fromResponse(await host.handle(request, env, store), method);\n      } catch (error) {\n        console.error('[workflow] request failed', error);\n        return fromResponse(json({ error: 'internal error' }, 500), method);\n      }\n    };\n    // A read (the bundle, a preview, a tracked link or pixel) answers straight from the handler:\n    // its body can be large, and a step would checkpoint all of it. A write runs in one step,\n    // never retried — the caller is waiting, and retries the request itself\n    const method = event.requestContext.http.method.toUpperCase();\n    if (method === 'GET' || method === 'HEAD') return serve();\n    return context.step('http', serve, { retryStrategy: () => ({ shouldRetry: false }) });\n  };\n\n  const sweep = (context: DurableContext): Promise<SweepResult> =>\n    context.step(\n      'sweep',\n      async () => {\n        const { store, env } = open(context);\n        await host.applyOwnBundle(env, bundleVersion());\n        return sweepSegments(env, store);\n      },\n      { retryStrategy: () => ({ shouldRetry: false }) }\n    );\n\n  const durable = withDurableExecution(async (input: unknown, context: DurableContext) => {\n    if (isFunctionUrlEvent(input)) return http(input, context);\n    if (isRunInput(input)) return run(input, context);\n    if (\n      typeof input === 'object' &&\n      input !== null &&\n      (input as { type?: unknown }).type === SWEEP_EVENT_TYPE\n    ) {\n      return sweep(context);\n    }\n    throw new Error('journeyLambda: unrecognized event (not a Function URL request, run or sweep)');\n  });\n\n  const handler = async (\n    event: DurableExecutionInvocationInput,\n    context: LambdaContext\n  ): Promise<DurableExecutionInvocationOutput> => {\n    const invocation: Invocation = {};\n    try {\n      // The durable wrapper reads the whole context Lambda passed, not just the fields above\n      return await scope.run(invocation, () =>\n        durable(event, context as Parameters<typeof durable>[1])\n      );\n    } finally {\n      // Outside the durable wrapper: a suspended run returns PENDING without unwinding the\n      // handler, so a `finally` in there would never release the connection\n      await invocation.lease?.close().catch((error: unknown) => {\n        console.error('[workflow] closing the store failed', error);\n      });\n    }\n  };\n\n  return { handler };\n}\n\nexport { AwsEngineStep, stepRetry } from './engine-step';\nexport { AwsInstances, RUN_EVENT_TYPE, executionName, isRunInput } from './instances';\nexport type { AwsInstancesOptions, RunInput } from './instances';\nexport { sdkLambdaApi } from './lambda-api';\nexport type { ExecutionState, LambdaApi } from './lambda-api';\nexport { fromResponse, isFunctionUrlEvent, toRequest } from './function-url';\nexport type { FunctionUrlEvent, FunctionUrlResult } from './function-url';\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA6CA,MAAa,mBAAmB;;AAkDhC,SAAS,YAAY,oBAAoC;CACvD,OAAO,mBAAmB,MAAM,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,KAAK,GAAG;AAC3D;AAEA,MAAM,QAAQ,MAAe,SAAS,QACpC,IAAI,SAAS,KAAK,UAAU,IAAI,GAAG;CAAE;CAAQ,SAAS,EAAE,gBAAgB,mBAAmB;AAAE,CAAC;AAEhG,SAAgB,cACd,SACe;CAEf,MAAM,EAAE,KAAK,SAAS,QAAQ,cAAc,cAAc,aAAa,GAAG,gBAAgB;CAC1F,MAAM,OAAOA,0BAAAA,kBACX;EAAE,GAAG;EAAa,QAAQ,KAAK,aAAa,QAAQ,MAAM,KAAK,QAAQ;CAAE,GAEzE,EAAE,WAAWC,qBAAAA,WAAW,EAAE,CAC5B;CACA,MAAM,SAAS,gBAAgBC,uBAAAA,aAAa;CAC5C,MAAM,YAAY,IAAI,IAAI,KAAK,OAAO,CAAC,CAAC,UAAU,KAAK,aAAa,SAAS,WAAW,CAAC;CACzF,MAAM,QAAQ,IAAIC,iBAAAA,kBAA8B;;CAGhD,MAAM,mBAAmB,QAAQ,IAAI,+BAA+B;;CAEpE,MAAM,sBAAiD;EACrD,MAAM,UAAU,WAAW;EAC3B,OAAO,QAAQ,KAAK,OAAO,IAAI;GAAE,IAAI;GAAS,WAAW,OAAO,OAAO;EAAE,IAAI,KAAA;CAC/E;;CAGA,MAAM,QACJ,YACyE;EACzE,MAAM,aAAa,MAAM,SAAS;EAClC,IAAI,eAAe,KAAA,GAAW,MAAM,IAAI,MAAM,sCAAsC;EACpF,MAAM,cAAc,EAAE,GAAG,QAAQ;EACjC,WAAW,UAAU,KAAK,MAAM,WAAW;EAC3C,MAAM,EAAE,UAAU,WAAW;EAC7B,MAAM,aAAa,MAAM;EACzB,IAAI,eAAe,KAAA,GACjB,MAAM,IAAI,MACR,+EACF;EAEF,MAAM,cAAc,YAAY,QAAQ,cAAc,kBAAkB;EACxE,MAAM,SAAS,OAAO,aAAqB,YAAsC;GAI/E,IAAI,YAAY,KAAA,KAAa,QAAQ,KAAK,OAAO,GAAG,OAAO,GAAG,YAAY,GAAG;GAE7E,IAAI,UAAU,IAAI,WAAW,GAAG,OAAO,GAAG,YAAY,GAAG,WAAW;GACpE,MAAM,IAAI,MAAM,sDAAsD,aAAa;EACrF;EACA,MAAM,YAAY,IAAIC,sBAAAA,aAAa;GACjC;GACA;GACA;GACA;GACA,GAAI,iBAAiB,KAAA,IAAY,CAAC,IAAI,EAAE,aAAa;GACrD,GAAI,gBAAgB,KAAA,IAAY,CAAC,IAAI,EAAE,YAAY;EACrD,CAAC;EACD,OAAO;GAAE;GAAO,KAAK;IAAE,GAAG;IAAS,SAAS;GAAU;GAAG;EAAW;CACtE;CAEA,MAAM,MAAM,OAAO,OAAiB,YAAqD;EACvF,MAAM,EAAE,OAAO,KAAK,eAAe,KAAK,OAAO;EAC/C,MAAM,EAAE,YAAY,WAAW;EAE/B,MAAM,QAAQ,KAAK,qBAAqB,YAAY;GAClD,MAAM,WAAW,cACf,YACA,QAAQ,iBAAiB,qBACzB,KAAK,IAAI,CACX;EACF,CAAC;EACD,OAAOC,qBAAAA,eACL;GACE;GACA;GACA,aAAa,MAAM;GACnB,MAAM,IAAIC,wBAAAA,cAAc,SAAS,OAAO,YAAY,QAAQ,OAAO,QAAQ,UAAU;EACvF,GACA,KAAK,SAAS,KAAK,OAAO,MAAM,CAClC;CACF;CAEA,MAAM,QAAQ,OAAyB,YAAwD;EAC7F,MAAM,QAAQ,YAAwC;GACpD,MAAM,SAAS,MAAM,eAAe,KAAK;GACzC,IAAI;IACF,MAAM,EAAE,OAAO,QAAQ,KAAK,OAAO;IACnC,MAAM,UAAUC,yBAAAA,UAAU,KAAK;IAE/B,IAAI,IAAI,IAAI,QAAQ,GAAG,CAAC,CAAC,aAAa,WACpC,OAAO,MAAMC,yBAAAA,aACX,KACE,EACE,OACE,8EACJ,GACA,GACF,GACA,MACF;IAEF,MAAM,KAAK,eAAe,KAAK,cAAc,CAAC;IAC9C,OAAO,MAAMA,yBAAAA,aAAa,MAAM,KAAK,OAAO,SAAS,KAAK,KAAK,GAAG,MAAM;GAC1E,SAAS,OAAO;IACd,QAAQ,MAAM,6BAA6B,KAAK;IAChD,OAAOA,yBAAAA,aAAa,KAAK,EAAE,OAAO,iBAAiB,GAAG,GAAG,GAAG,MAAM;GACpE;EACF;EAIA,MAAM,SAAS,MAAM,eAAe,KAAK,OAAO,YAAY;EAC5D,IAAI,WAAW,SAAS,WAAW,QAAQ,OAAO,MAAM;EACxD,OAAO,QAAQ,KAAK,QAAQ,OAAO,EAAE,sBAAsB,EAAE,aAAa,MAAM,GAAG,CAAC;CACtF;CAEA,MAAM,SAAS,YACb,QAAQ,KACN,SACA,YAAY;EACV,MAAM,EAAE,OAAO,QAAQ,KAAK,OAAO;EACnC,MAAM,KAAK,eAAe,KAAK,cAAc,CAAC;EAC9C,OAAOC,oBAAAA,cAAc,KAAK,KAAK;CACjC,GACA,EAAE,sBAAsB,EAAE,aAAa,MAAM,GAAG,CAClD;CAEF,MAAM,WAAA,GAAUC,8BAAAA,qBAAAA,CAAqB,OAAO,OAAgB,YAA4B;EACtF,IAAIC,yBAAAA,mBAAmB,KAAK,GAAG,OAAO,KAAK,OAAO,OAAO;EACzD,IAAIC,sBAAAA,WAAW,KAAK,GAAG,OAAO,IAAI,OAAO,OAAO;EAChD,IACE,OAAO,UAAU,YACjB,UAAU,QACT,MAA6B,SAAA,mBAE9B,OAAO,MAAM,OAAO;EAEtB,MAAM,IAAI,MAAM,8EAA8E;CAChG,CAAC;CAED,MAAM,UAAU,OACd,OACA,YAC8C;EAC9C,MAAM,aAAyB,CAAC;EAChC,IAAI;GAEF,OAAO,MAAM,MAAM,IAAI,kBACrB,QAAQ,OAAO,OAAwC,CACzD;EACF,UAAU;GAGR,MAAM,WAAW,OAAO,MAAM,CAAC,CAAC,OAAO,UAAmB;IACxD,QAAQ,MAAM,uCAAuC,KAAK;GAC5D,CAAC;EACH;CACF;CAEA,OAAO,EAAE,QAAQ;AACnB"}

package/dist/aws/index.d.cts

@@ -40,6 +40,12 @@ export interface JourneyLambdaOptions<Env extends JourneyLambdaEnv> extends Omit
   lambda?: LambdaApi;
   /** How long an unconfirmed start is retried (default 12 hours; keep it under the retention). */
   startRetryMs?: number;
+  /**
+   * How long an erasure waits after stopping an execution before it erases: an invocation
+   * running at the stop goes on to its next checkpoint. Set it to at least the function's
+   * timeout; 15 minutes (Lambda's maximum) by default.
+   */
+  stopDrainMs?: number;
 }
 /**
  * The Lambda invocation context, as far as the handler's signature needs it — declared here so

package/dist/aws/index.d.cts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.cts","names":[],"sources":["../../src/aws/index.ts"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;qBA6Ca;;YAGD,mBAAmB,KAAK;iBAEnB,qBAAqB,YAAY,0BAA0B,KAC1E,mBAAmB,MAAM;;EAIzB,KAAK;;EAEL,QAAQ,KAAK,KAAK;IAAY;QAAqB,eAAe;;EAElE,SAAS;;EAET;;;;;;iBAOe;EACf;EACA;EACA;EACA;EACA;;iBAGe;;EAEf,UACE,OAAO,iCACP,SAAS,kBACN,QAAQ;;wBAeC,cAAc,YAAY,kBACxC,SAAS,qBAAqB,OAC7B"}
+{"version":3,"file":"index.d.cts","names":[],"sources":["../../src/aws/index.ts"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;qBA6Ca;;YAGD,mBAAmB,KAAK;iBAEnB,qBAAqB,YAAY,0BAA0B,KAC1E,mBAAmB,MAAM;;EAIzB,KAAK;;EAEL,QAAQ,KAAK,KAAK;IAAY;QAAqB,eAAe;;EAElE,SAAS;;EAET;;;;;;EAMA;;;;;;iBAOe;EACf;EACA;EACA;EACA;EACA;;iBAGe;;EAEf,UACE,OAAO,iCACP,SAAS,kBACN,QAAQ;;wBAeC,cAAc,YAAY,kBACxC,SAAS,qBAAqB,OAC7B"}

package/dist/aws/index.d.mts

@@ -40,6 +40,12 @@ export interface JourneyLambdaOptions<Env extends JourneyLambdaEnv> extends Omit
   lambda?: LambdaApi;
   /** How long an unconfirmed start is retried (default 12 hours; keep it under the retention). */
   startRetryMs?: number;
+  /**
+   * How long an erasure waits after stopping an execution before it erases: an invocation
+   * running at the stop goes on to its next checkpoint. Set it to at least the function's
+   * timeout; 15 minutes (Lambda's maximum) by default.
+   */
+  stopDrainMs?: number;
 }
 /**
  * The Lambda invocation context, as far as the handler's signature needs it — declared here so

package/dist/aws/index.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.mts","names":[],"sources":["../../src/aws/index.ts"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;qBA6Ca;;YAGD,mBAAmB,KAAK;iBAEnB,qBAAqB,YAAY,0BAA0B,KAC1E,mBAAmB,MAAM;;EAIzB,KAAK;;EAEL,QAAQ,KAAK,KAAK;IAAY;QAAqB,eAAe;;EAElE,SAAS;;EAET;;;;;;iBAOe;EACf;EACA;EACA;EACA;EACA;;iBAGe;;EAEf,UACE,OAAO,iCACP,SAAS,kBACN,QAAQ;;wBAeC,cAAc,YAAY,kBACxC,SAAS,qBAAqB,OAC7B"}
+{"version":3,"file":"index.d.mts","names":[],"sources":["../../src/aws/index.ts"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;qBA6Ca;;YAGD,mBAAmB,KAAK;iBAEnB,qBAAqB,YAAY,0BAA0B,KAC1E,mBAAmB,MAAM;;EAIzB,KAAK;;EAEL,QAAQ,KAAK,KAAK;IAAY;QAAqB,eAAe;;EAElE,SAAS;;EAET;;;;;;EAMA;;;;;;iBAOe;EACf;EACA;EACA;EACA;EACA;;iBAGe;;EAEf,UACE,OAAO,iCACP,SAAS,kBACN,QAAQ;;wBAeC,cAAc,YAAY,kBACxC,SAAS,qBAAqB,OAC7B"}

package/dist/aws/index.mjs

@@ -38,7 +38,7 @@ const json = (body, status = 200) => new Response(JSON.stringify(body), {
 	headers: { "content-type": "application/json" }
 });
 function journeyLambda(options) {
-	const { env: baseEnv, lambda: lambdaOption, startRetryMs, ...hostOptions } = options;
+	const { env: baseEnv, lambda: lambdaOption, startRetryMs, stopDrainMs, ...hostOptions } = options;
 	const host = createJourneyHost({
 		...hostOptions,
 		store: (env, database) => options.store(env, database)
@@ -66,18 +66,18 @@ function journeyLambda(options) {
 		const executions = store.executions;
 		if (executions === void 0) throw new Error("journeyLambda needs a store with an execution registry (PostgresJourneyStore)");
 		const functionArn = unqualified(context.lambdaContext.invokedFunctionArn);
-		const target = async (contentHash) => {
+		const target = async (contentHash, version) => {
+			if (version !== void 0 && /^\d+$/.test(version)) return `${functionArn}:${version}`;
 			if (ownHashes.has(contentHash)) return `${functionArn}:${ownVersion()}`;
-			const live = await store.liveBundleVersion?.();
-			if (live !== void 0 && /^\d+$/.test(live.id)) return `${functionArn}:${live.id}`;
-			throw new Error(`no published version carries workflow IR ${contentHash}`);
+			throw new Error(`no published version is known to carry workflow IR ${contentHash}`);
 		};
 		const instances = new AwsInstances({
 			store,
 			executions,
 			lambda,
 			target,
-			...startRetryMs === void 0 ? {} : { startRetryMs }
+			...startRetryMs === void 0 ? {} : { startRetryMs },
+			...stopDrainMs === void 0 ? {} : { stopDrainMs }
 		});
 		return {
 			store,

package/dist/aws/index.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"index.mjs","names":[],"sources":["../../src/aws/index.ts"],"sourcesContent":["import { AsyncLocalStorage } from 'node:async_hooks';\nimport {\n  type DurableContext,\n  type DurableExecutionInvocationInput,\n  type DurableExecutionInvocationOutput,\n  withDurableExecution,\n} from '@aws/durable-execution-sdk-js';\nimport type { JourneyEnv } from '../cloudflare/bindings';\nimport type { JourneyOutcome } from '../engine/ports';\nimport { executeJourney } from '../host/execute';\nimport { type JourneyHostOptions, createJourneyHost } from '../host/journey-host';\nimport { type SweepResult, sweepSegments } from '../host/router';\nimport { http2Fetch } from '../http2-client';\nimport type { BundleVersion, ExecutionRegistry, JourneyStore, StoreLease } from '../store/index';\nimport { AwsEngineStep } from './engine-step';\nimport {\n  type FunctionUrlEvent,\n  type FunctionUrlResult,\n  fromResponse,\n  isFunctionUrlEvent,\n  toRequest,\n} from './function-url';\nimport { AwsInstances, type RunInput, isRunInput } from './instances';\nimport { type LambdaApi, sdkLambdaApi } from './lambda-api';\n\n/**\n * `@shware/workflow/aws` — the journey host as one Lambda durable function behind a Function\n * URL, on Postgres.\n *\n * The one handler tells three inputs apart by the event's top-level shape: a Function URL\n * request (the HTTP API — ingest, identify, devices, tracking, bundle, preview), an internal run\n * (one journey instance: one durable execution, started by an asynchronous invoke of this\n * function's own numbered version), and a scheduled maintenance tick. An HTTP body can never\n * pass for the other two: the Function URL always wraps it.\n *\n *   const journeys = journeyLambda({\n *     config,\n *     env,                                        // parsed from process.env (zod)\n *     store: (env, database) => postgresJsStore(env.DATABASE_URL, database),\n *     email: (env) => sesEmailTransport({ region: env.AWS_REGION }),\n *   });\n *   export const handler = journeys.handler;\n */\n\n/** The scheduled tick (EventBridge Scheduler's payload): the segment sweep and maintenance. */\nexport const SWEEP_EVENT_TYPE = '$workflow.sweep';\n\n/** What journeyLambda reads from its env: `JourneyEnv` without the binding it supplies itself. */\nexport type JourneyLambdaEnv = Omit<JourneyEnv, 'JOURNEY' | 'DB' | 'WORKFLOW_KV' | 'EMAIL'>;\n\nexport interface JourneyLambdaOptions<Env extends JourneyLambdaEnv> extends Omit<\n  JourneyHostOptions<Env & JourneyEnv>,\n  'env' | 'store'\n> {\n  /** The validated environment (parsed from `process.env` with zod by the app). */\n  env: Env;\n  /** The Postgres store: AWS needs its execution registry (`postgresJsStore`). */\n  store: (env: Env, database: { schema: string }) => JourneyStore | StoreLease;\n  /** The Lambda control plane; `@aws-sdk/client-lambda` with the execution role by default. */\n  lambda?: LambdaApi;\n  /** How long an unconfirmed start is retried (default 12 hours; keep it under the retention). */\n  startRetryMs?: number;\n}\n\n/**\n * The Lambda invocation context, as far as the handler's signature needs it — declared here so\n * the package's types do not depend on `@types/aws-lambda`. Lambda passes the full object.\n */\nexport interface LambdaContext {\n  functionName: string;\n  functionVersion: string;\n  invokedFunctionArn: string;\n  awsRequestId: string;\n  getRemainingTimeInMillis(): number;\n}\n\nexport interface JourneyLambda {\n  /** Export as the function's handler. */\n  handler: (\n    event: DurableExecutionInvocationInput,\n    context: LambdaContext\n  ) => Promise<DurableExecutionInvocationOutput>;\n}\n\ninterface Invocation {\n  lease?: Required<StoreLease>;\n}\n\n/** This function's ARN without its qualifier, from the ARN it was invoked under. */\nfunction unqualified(invokedFunctionArn: string): string {\n  return invokedFunctionArn.split(':').slice(0, 7).join(':');\n}\n\nconst json = (body: unknown, status = 200) =>\n  new Response(JSON.stringify(body), { status, headers: { 'content-type': 'application/json' } });\n\nexport function journeyLambda<Env extends JourneyLambdaEnv>(\n  options: JourneyLambdaOptions<Env>\n): JourneyLambda {\n  type HostEnv = Env & JourneyEnv;\n  const { env: baseEnv, lambda: lambdaOption, startRetryMs, ...hostOptions } = options;\n  const host = createJourneyHost<HostEnv>(\n    { ...hostOptions, store: (env, database) => options.store(env, database) },\n    // Node 24's fetch cannot reach APNs (HTTP/2 only): see http2-client.ts for when this can go\n    { apnsFetch: http2Fetch() }\n  );\n  const lambda = lambdaOption ?? sdkLambdaApi();\n  const ownHashes = new Set(host.bundle().workflows.map((workflow) => workflow.contentHash));\n  const scope = new AsyncLocalStorage<Invocation>();\n\n  /** The version this code was published as: `$LATEST` while developing. */\n  const ownVersion = () => process.env.AWS_LAMBDA_FUNCTION_VERSION ?? '$LATEST';\n  /** Numbered versions are ordered: the bundle compiled into a later one goes live by itself. */\n  const bundleVersion = (): BundleVersion | undefined => {\n    const version = ownVersion();\n    return /^\\d+$/.test(version) ? { id: version, createdAt: Number(version) } : undefined;\n  };\n\n  /** The store and the env (with the instance port) of this invocation, opened on first use. */\n  const open = (\n    context: DurableContext\n  ): { store: JourneyStore; env: HostEnv; executions: ExecutionRegistry } => {\n    const invocation = scope.getStore();\n    if (invocation === undefined) throw new Error('journeyLambda: outside an invocation');\n    const placeholder = { ...baseEnv } as unknown as HostEnv;\n    invocation.lease ??= host.lease(placeholder);\n    const { store } = invocation.lease;\n    const executions = store.executions;\n    if (executions === undefined) {\n      throw new Error(\n        'journeyLambda needs a store with an execution registry (PostgresJourneyStore)'\n      );\n    }\n    const functionArn = unqualified(context.lambdaContext.invokedFunctionArn);\n    const target = async (contentHash: string): Promise<string> => {\n      // An execution runs the code its IR was compiled with: this version's own workflows here,\n      // anything else on the version whose bundle put it in the routes\n      if (ownHashes.has(contentHash)) return `${functionArn}:${ownVersion()}`;\n      const live = await store.liveBundleVersion?.();\n      if (live !== undefined && /^\\d+$/.test(live.id)) return `${functionArn}:${live.id}`;\n      throw new Error(`no published version carries workflow IR ${contentHash}`);\n    };\n    const instances = new AwsInstances({\n      store,\n      executions,\n      lambda,\n      target,\n      ...(startRetryMs === undefined ? {} : { startRetryMs }),\n    });\n    return { store, env: { ...baseEnv, JOURNEY: instances }, executions };\n  };\n\n  const run = async (input: RunInput, context: DurableContext): Promise<JourneyOutcome> => {\n    const { store, env, executions } = open(context);\n    const { instanceId, params } = input;\n    // Running is the proof the start got through, whatever became of the invoke's response\n    await context.step('$workflow:started', async () => {\n      await executions.markSubmitted(\n        instanceId,\n        context.executionContext.durableExecutionArn,\n        Date.now()\n      );\n    });\n    return executeJourney(\n      {\n        instanceId,\n        params,\n        enteredAtMs: input.enteredAtMs,\n        step: new AwsEngineStep(context, store, executions, lambda, params.userId, instanceId),\n      },\n      host.runParts(env, store, params)\n    );\n  };\n\n  const http = (event: FunctionUrlEvent, context: DurableContext): Promise<FunctionUrlResult> => {\n    const serve = async (): Promise<FunctionUrlResult> => {\n      const method = event.requestContext.http.method;\n      try {\n        const { store, env } = open(context);\n        const request = toRequest(event);\n        // Only the bundle compiled into a version may route: one is never swapped in by hand\n        if (new URL(request.url).pathname === '/deploy') {\n          return await fromResponse(\n            json(\n              {\n                error:\n                  'deploy by publishing a version (POST /bundle/deploy applies its own bundle)',\n              },\n              409\n            ),\n            method\n          );\n        }\n        await host.applyOwnBundle(env, bundleVersion());\n        return await fromResponse(await host.handle(request, env, store), method);\n      } catch (error) {\n        console.error('[workflow] request failed', error);\n        return fromResponse(json({ error: 'internal error' }, 500), method);\n      }\n    };\n    // A read (the bundle, a preview, a tracked link or pixel) answers straight from the handler:\n    // its body can be large, and a step would checkpoint all of it. A write runs in one step,\n    // never retried — the caller is waiting, and retries the request itself\n    const method = event.requestContext.http.method.toUpperCase();\n    if (method === 'GET' || method === 'HEAD') return serve();\n    return context.step('http', serve, { retryStrategy: () => ({ shouldRetry: false }) });\n  };\n\n  const sweep = (context: DurableContext): Promise<SweepResult> =>\n    context.step(\n      'sweep',\n      async () => {\n        const { store, env } = open(context);\n        await host.applyOwnBundle(env, bundleVersion());\n        return sweepSegments(env, store);\n      },\n      { retryStrategy: () => ({ shouldRetry: false }) }\n    );\n\n  const durable = withDurableExecution(async (input: unknown, context: DurableContext) => {\n    if (isFunctionUrlEvent(input)) return http(input, context);\n    if (isRunInput(input)) return run(input, context);\n    if (\n      typeof input === 'object' &&\n      input !== null &&\n      (input as { type?: unknown }).type === SWEEP_EVENT_TYPE\n    ) {\n      return sweep(context);\n    }\n    throw new Error('journeyLambda: unrecognized event (not a Function URL request, run or sweep)');\n  });\n\n  const handler = async (\n    event: DurableExecutionInvocationInput,\n    context: LambdaContext\n  ): Promise<DurableExecutionInvocationOutput> => {\n    const invocation: Invocation = {};\n    try {\n      // The durable wrapper reads the whole context Lambda passed, not just the fields above\n      return await scope.run(invocation, () =>\n        durable(event, context as Parameters<typeof durable>[1])\n      );\n    } finally {\n      // Outside the durable wrapper: a suspended run returns PENDING without unwinding the\n      // handler, so a `finally` in there would never release the connection\n      await invocation.lease?.close().catch((error: unknown) => {\n        console.error('[workflow] closing the store failed', error);\n      });\n    }\n  };\n\n  return { handler };\n}\n\nexport { AwsEngineStep, stepRetry } from './engine-step';\nexport { AwsInstances, RUN_EVENT_TYPE, executionName, isRunInput } from './instances';\nexport type { AwsInstancesOptions, RunInput } from './instances';\nexport { sdkLambdaApi } from './lambda-api';\nexport type { ExecutionState, LambdaApi } from './lambda-api';\nexport { fromResponse, isFunctionUrlEvent, toRequest } from './function-url';\nexport type { FunctionUrlEvent, FunctionUrlResult } from './function-url';\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA6CA,MAAa,mBAAmB;;AA4ChC,SAAS,YAAY,oBAAoC;CACvD,OAAO,mBAAmB,MAAM,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,KAAK,GAAG;AAC3D;AAEA,MAAM,QAAQ,MAAe,SAAS,QACpC,IAAI,SAAS,KAAK,UAAU,IAAI,GAAG;CAAE;CAAQ,SAAS,EAAE,gBAAgB,mBAAmB;AAAE,CAAC;AAEhG,SAAgB,cACd,SACe;CAEf,MAAM,EAAE,KAAK,SAAS,QAAQ,cAAc,cAAc,GAAG,gBAAgB;CAC7E,MAAM,OAAO,kBACX;EAAE,GAAG;EAAa,QAAQ,KAAK,aAAa,QAAQ,MAAM,KAAK,QAAQ;CAAE,GAEzE,EAAE,WAAW,WAAW,EAAE,CAC5B;CACA,MAAM,SAAS,gBAAgB,aAAa;CAC5C,MAAM,YAAY,IAAI,IAAI,KAAK,OAAO,CAAC,CAAC,UAAU,KAAK,aAAa,SAAS,WAAW,CAAC;CACzF,MAAM,QAAQ,IAAI,kBAA8B;;CAGhD,MAAM,mBAAmB,QAAQ,IAAI,+BAA+B;;CAEpE,MAAM,sBAAiD;EACrD,MAAM,UAAU,WAAW;EAC3B,OAAO,QAAQ,KAAK,OAAO,IAAI;GAAE,IAAI;GAAS,WAAW,OAAO,OAAO;EAAE,IAAI,KAAA;CAC/E;;CAGA,MAAM,QACJ,YACyE;EACzE,MAAM,aAAa,MAAM,SAAS;EAClC,IAAI,eAAe,KAAA,GAAW,MAAM,IAAI,MAAM,sCAAsC;EACpF,MAAM,cAAc,EAAE,GAAG,QAAQ;EACjC,WAAW,UAAU,KAAK,MAAM,WAAW;EAC3C,MAAM,EAAE,UAAU,WAAW;EAC7B,MAAM,aAAa,MAAM;EACzB,IAAI,eAAe,KAAA,GACjB,MAAM,IAAI,MACR,+EACF;EAEF,MAAM,cAAc,YAAY,QAAQ,cAAc,kBAAkB;EACxE,MAAM,SAAS,OAAO,gBAAyC;GAG7D,IAAI,UAAU,IAAI,WAAW,GAAG,OAAO,GAAG,YAAY,GAAG,WAAW;GACpE,MAAM,OAAO,MAAM,MAAM,oBAAoB;GAC7C,IAAI,SAAS,KAAA,KAAa,QAAQ,KAAK,KAAK,EAAE,GAAG,OAAO,GAAG,YAAY,GAAG,KAAK;GAC/E,MAAM,IAAI,MAAM,4CAA4C,aAAa;EAC3E;EACA,MAAM,YAAY,IAAI,aAAa;GACjC;GACA;GACA;GACA;GACA,GAAI,iBAAiB,KAAA,IAAY,CAAC,IAAI,EAAE,aAAa;EACvD,CAAC;EACD,OAAO;GAAE;GAAO,KAAK;IAAE,GAAG;IAAS,SAAS;GAAU;GAAG;EAAW;CACtE;CAEA,MAAM,MAAM,OAAO,OAAiB,YAAqD;EACvF,MAAM,EAAE,OAAO,KAAK,eAAe,KAAK,OAAO;EAC/C,MAAM,EAAE,YAAY,WAAW;EAE/B,MAAM,QAAQ,KAAK,qBAAqB,YAAY;GAClD,MAAM,WAAW,cACf,YACA,QAAQ,iBAAiB,qBACzB,KAAK,IAAI,CACX;EACF,CAAC;EACD,OAAO,eACL;GACE;GACA;GACA,aAAa,MAAM;GACnB,MAAM,IAAI,cAAc,SAAS,OAAO,YAAY,QAAQ,OAAO,QAAQ,UAAU;EACvF,GACA,KAAK,SAAS,KAAK,OAAO,MAAM,CAClC;CACF;CAEA,MAAM,QAAQ,OAAyB,YAAwD;EAC7F,MAAM,QAAQ,YAAwC;GACpD,MAAM,SAAS,MAAM,eAAe,KAAK;GACzC,IAAI;IACF,MAAM,EAAE,OAAO,QAAQ,KAAK,OAAO;IACnC,MAAM,UAAU,UAAU,KAAK;IAE/B,IAAI,IAAI,IAAI,QAAQ,GAAG,CAAC,CAAC,aAAa,WACpC,OAAO,MAAM,aACX,KACE,EACE,OACE,8EACJ,GACA,GACF,GACA,MACF;IAEF,MAAM,KAAK,eAAe,KAAK,cAAc,CAAC;IAC9C,OAAO,MAAM,aAAa,MAAM,KAAK,OAAO,SAAS,KAAK,KAAK,GAAG,MAAM;GAC1E,SAAS,OAAO;IACd,QAAQ,MAAM,6BAA6B,KAAK;IAChD,OAAO,aAAa,KAAK,EAAE,OAAO,iBAAiB,GAAG,GAAG,GAAG,MAAM;GACpE;EACF;EAIA,MAAM,SAAS,MAAM,eAAe,KAAK,OAAO,YAAY;EAC5D,IAAI,WAAW,SAAS,WAAW,QAAQ,OAAO,MAAM;EACxD,OAAO,QAAQ,KAAK,QAAQ,OAAO,EAAE,sBAAsB,EAAE,aAAa,MAAM,GAAG,CAAC;CACtF;CAEA,MAAM,SAAS,YACb,QAAQ,KACN,SACA,YAAY;EACV,MAAM,EAAE,OAAO,QAAQ,KAAK,OAAO;EACnC,MAAM,KAAK,eAAe,KAAK,cAAc,CAAC;EAC9C,OAAO,cAAc,KAAK,KAAK;CACjC,GACA,EAAE,sBAAsB,EAAE,aAAa,MAAM,GAAG,CAClD;CAEF,MAAM,UAAU,qBAAqB,OAAO,OAAgB,YAA4B;EACtF,IAAI,mBAAmB,KAAK,GAAG,OAAO,KAAK,OAAO,OAAO;EACzD,IAAI,WAAW,KAAK,GAAG,OAAO,IAAI,OAAO,OAAO;EAChD,IACE,OAAO,UAAU,YACjB,UAAU,QACT,MAA6B,SAAA,mBAE9B,OAAO,MAAM,OAAO;EAEtB,MAAM,IAAI,MAAM,8EAA8E;CAChG,CAAC;CAED,MAAM,UAAU,OACd,OACA,YAC8C;EAC9C,MAAM,aAAyB,CAAC;EAChC,IAAI;GAEF,OAAO,MAAM,MAAM,IAAI,kBACrB,QAAQ,OAAO,OAAwC,CACzD;EACF,UAAU;GAGR,MAAM,WAAW,OAAO,MAAM,CAAC,CAAC,OAAO,UAAmB;IACxD,QAAQ,MAAM,uCAAuC,KAAK;GAC5D,CAAC;EACH;CACF;CAEA,OAAO,EAAE,QAAQ;AACnB"}
+{"version":3,"file":"index.mjs","names":[],"sources":["../../src/aws/index.ts"],"sourcesContent":["import { AsyncLocalStorage } from 'node:async_hooks';\nimport {\n  type DurableContext,\n  type DurableExecutionInvocationInput,\n  type DurableExecutionInvocationOutput,\n  withDurableExecution,\n} from '@aws/durable-execution-sdk-js';\nimport type { JourneyEnv } from '../cloudflare/bindings';\nimport type { JourneyOutcome } from '../engine/ports';\nimport { executeJourney } from '../host/execute';\nimport { type JourneyHostOptions, createJourneyHost } from '../host/journey-host';\nimport { type SweepResult, sweepSegments } from '../host/router';\nimport { http2Fetch } from '../http2-client';\nimport type { BundleVersion, ExecutionRegistry, JourneyStore, StoreLease } from '../store/index';\nimport { AwsEngineStep } from './engine-step';\nimport {\n  type FunctionUrlEvent,\n  type FunctionUrlResult,\n  fromResponse,\n  isFunctionUrlEvent,\n  toRequest,\n} from './function-url';\nimport { AwsInstances, type RunInput, isRunInput } from './instances';\nimport { type LambdaApi, sdkLambdaApi } from './lambda-api';\n\n/**\n * `@shware/workflow/aws` — the journey host as one Lambda durable function behind a Function\n * URL, on Postgres.\n *\n * The one handler tells three inputs apart by the event's top-level shape: a Function URL\n * request (the HTTP API — ingest, identify, devices, tracking, bundle, preview), an internal run\n * (one journey instance: one durable execution, started by an asynchronous invoke of this\n * function's own numbered version), and a scheduled maintenance tick. An HTTP body can never\n * pass for the other two: the Function URL always wraps it.\n *\n *   const journeys = journeyLambda({\n *     config,\n *     env,                                        // parsed from process.env (zod)\n *     store: (env, database) => postgresJsStore(env.DATABASE_URL, database),\n *     email: (env) => sesEmailTransport({ region: env.AWS_REGION }),\n *   });\n *   export const handler = journeys.handler;\n */\n\n/** The scheduled tick (EventBridge Scheduler's payload): the segment sweep and maintenance. */\nexport const SWEEP_EVENT_TYPE = '$workflow.sweep';\n\n/** What journeyLambda reads from its env: `JourneyEnv` without the binding it supplies itself. */\nexport type JourneyLambdaEnv = Omit<JourneyEnv, 'JOURNEY' | 'DB' | 'WORKFLOW_KV' | 'EMAIL'>;\n\nexport interface JourneyLambdaOptions<Env extends JourneyLambdaEnv> extends Omit<\n  JourneyHostOptions<Env & JourneyEnv>,\n  'env' | 'store'\n> {\n  /** The validated environment (parsed from `process.env` with zod by the app). */\n  env: Env;\n  /** The Postgres store: AWS needs its execution registry (`postgresJsStore`). */\n  store: (env: Env, database: { schema: string }) => JourneyStore | StoreLease;\n  /** The Lambda control plane; `@aws-sdk/client-lambda` with the execution role by default. */\n  lambda?: LambdaApi;\n  /** How long an unconfirmed start is retried (default 12 hours; keep it under the retention). */\n  startRetryMs?: number;\n  /**\n   * How long an erasure waits after stopping an execution before it erases: an invocation\n   * running at the stop goes on to its next checkpoint. Set it to at least the function's\n   * timeout; 15 minutes (Lambda's maximum) by default.\n   */\n  stopDrainMs?: number;\n}\n\n/**\n * The Lambda invocation context, as far as the handler's signature needs it — declared here so\n * the package's types do not depend on `@types/aws-lambda`. Lambda passes the full object.\n */\nexport interface LambdaContext {\n  functionName: string;\n  functionVersion: string;\n  invokedFunctionArn: string;\n  awsRequestId: string;\n  getRemainingTimeInMillis(): number;\n}\n\nexport interface JourneyLambda {\n  /** Export as the function's handler. */\n  handler: (\n    event: DurableExecutionInvocationInput,\n    context: LambdaContext\n  ) => Promise<DurableExecutionInvocationOutput>;\n}\n\ninterface Invocation {\n  lease?: Required<StoreLease>;\n}\n\n/** This function's ARN without its qualifier, from the ARN it was invoked under. */\nfunction unqualified(invokedFunctionArn: string): string {\n  return invokedFunctionArn.split(':').slice(0, 7).join(':');\n}\n\nconst json = (body: unknown, status = 200) =>\n  new Response(JSON.stringify(body), { status, headers: { 'content-type': 'application/json' } });\n\nexport function journeyLambda<Env extends JourneyLambdaEnv>(\n  options: JourneyLambdaOptions<Env>\n): JourneyLambda {\n  type HostEnv = Env & JourneyEnv;\n  const { env: baseEnv, lambda: lambdaOption, startRetryMs, stopDrainMs, ...hostOptions } = options;\n  const host = createJourneyHost<HostEnv>(\n    { ...hostOptions, store: (env, database) => options.store(env, database) },\n    // Node 24's fetch cannot reach APNs (HTTP/2 only): see http2-client.ts for when this can go\n    { apnsFetch: http2Fetch() }\n  );\n  const lambda = lambdaOption ?? sdkLambdaApi();\n  const ownHashes = new Set(host.bundle().workflows.map((workflow) => workflow.contentHash));\n  const scope = new AsyncLocalStorage<Invocation>();\n\n  /** The version this code was published as: `$LATEST` while developing. */\n  const ownVersion = () => process.env.AWS_LAMBDA_FUNCTION_VERSION ?? '$LATEST';\n  /** Numbered versions are ordered: the bundle compiled into a later one goes live by itself. */\n  const bundleVersion = (): BundleVersion | undefined => {\n    const version = ownVersion();\n    return /^\\d+$/.test(version) ? { id: version, createdAt: Number(version) } : undefined;\n  };\n\n  /** The store and the env (with the instance port) of this invocation, opened on first use. */\n  const open = (\n    context: DurableContext\n  ): { store: JourneyStore; env: HostEnv; executions: ExecutionRegistry } => {\n    const invocation = scope.getStore();\n    if (invocation === undefined) throw new Error('journeyLambda: outside an invocation');\n    const placeholder = { ...baseEnv } as unknown as HostEnv;\n    invocation.lease ??= host.lease(placeholder);\n    const { store } = invocation.lease;\n    const executions = store.executions;\n    if (executions === undefined) {\n      throw new Error(\n        'journeyLambda needs a store with an execution registry (PostgresJourneyStore)'\n      );\n    }\n    const functionArn = unqualified(context.lambdaContext.invokedFunctionArn);\n    const target = async (contentHash: string, version?: string): Promise<string> => {\n      // An execution runs the code its IR was compiled with: the version whose bundle put the\n      // route there, read in the same row as the hash — never a separately read \"live\" version,\n      // which a release between the two reads would make another bundle's\n      if (version !== undefined && /^\\d+$/.test(version)) return `${functionArn}:${version}`;\n      // A forced deploy records no version: only this code's own workflows can run here\n      if (ownHashes.has(contentHash)) return `${functionArn}:${ownVersion()}`;\n      throw new Error(`no published version is known to carry workflow IR ${contentHash}`);\n    };\n    const instances = new AwsInstances({\n      store,\n      executions,\n      lambda,\n      target,\n      ...(startRetryMs === undefined ? {} : { startRetryMs }),\n      ...(stopDrainMs === undefined ? {} : { stopDrainMs }),\n    });\n    return { store, env: { ...baseEnv, JOURNEY: instances }, executions };\n  };\n\n  const run = async (input: RunInput, context: DurableContext): Promise<JourneyOutcome> => {\n    const { store, env, executions } = open(context);\n    const { instanceId, params } = input;\n    // Running is the proof the start got through, whatever became of the invoke's response\n    await context.step('$workflow:started', async () => {\n      await executions.markSubmitted(\n        instanceId,\n        context.executionContext.durableExecutionArn,\n        Date.now()\n      );\n    });\n    return executeJourney(\n      {\n        instanceId,\n        params,\n        enteredAtMs: input.enteredAtMs,\n        step: new AwsEngineStep(context, store, executions, lambda, params.userId, instanceId),\n      },\n      host.runParts(env, store, params)\n    );\n  };\n\n  const http = (event: FunctionUrlEvent, context: DurableContext): Promise<FunctionUrlResult> => {\n    const serve = async (): Promise<FunctionUrlResult> => {\n      const method = event.requestContext.http.method;\n      try {\n        const { store, env } = open(context);\n        const request = toRequest(event);\n        // Only the bundle compiled into a version may route: one is never swapped in by hand\n        if (new URL(request.url).pathname === '/deploy') {\n          return await fromResponse(\n            json(\n              {\n                error:\n                  'deploy by publishing a version (POST /bundle/deploy applies its own bundle)',\n              },\n              409\n            ),\n            method\n          );\n        }\n        await host.applyOwnBundle(env, bundleVersion());\n        return await fromResponse(await host.handle(request, env, store), method);\n      } catch (error) {\n        console.error('[workflow] request failed', error);\n        return fromResponse(json({ error: 'internal error' }, 500), method);\n      }\n    };\n    // A read (the bundle, a preview, a tracked link or pixel) answers straight from the handler:\n    // its body can be large, and a step would checkpoint all of it. A write runs in one step,\n    // never retried — the caller is waiting, and retries the request itself\n    const method = event.requestContext.http.method.toUpperCase();\n    if (method === 'GET' || method === 'HEAD') return serve();\n    return context.step('http', serve, { retryStrategy: () => ({ shouldRetry: false }) });\n  };\n\n  const sweep = (context: DurableContext): Promise<SweepResult> =>\n    context.step(\n      'sweep',\n      async () => {\n        const { store, env } = open(context);\n        await host.applyOwnBundle(env, bundleVersion());\n        return sweepSegments(env, store);\n      },\n      { retryStrategy: () => ({ shouldRetry: false }) }\n    );\n\n  const durable = withDurableExecution(async (input: unknown, context: DurableContext) => {\n    if (isFunctionUrlEvent(input)) return http(input, context);\n    if (isRunInput(input)) return run(input, context);\n    if (\n      typeof input === 'object' &&\n      input !== null &&\n      (input as { type?: unknown }).type === SWEEP_EVENT_TYPE\n    ) {\n      return sweep(context);\n    }\n    throw new Error('journeyLambda: unrecognized event (not a Function URL request, run or sweep)');\n  });\n\n  const handler = async (\n    event: DurableExecutionInvocationInput,\n    context: LambdaContext\n  ): Promise<DurableExecutionInvocationOutput> => {\n    const invocation: Invocation = {};\n    try {\n      // The durable wrapper reads the whole context Lambda passed, not just the fields above\n      return await scope.run(invocation, () =>\n        durable(event, context as Parameters<typeof durable>[1])\n      );\n    } finally {\n      // Outside the durable wrapper: a suspended run returns PENDING without unwinding the\n      // handler, so a `finally` in there would never release the connection\n      await invocation.lease?.close().catch((error: unknown) => {\n        console.error('[workflow] closing the store failed', error);\n      });\n    }\n  };\n\n  return { handler };\n}\n\nexport { AwsEngineStep, stepRetry } from './engine-step';\nexport { AwsInstances, RUN_EVENT_TYPE, executionName, isRunInput } from './instances';\nexport type { AwsInstancesOptions, RunInput } from './instances';\nexport { sdkLambdaApi } from './lambda-api';\nexport type { ExecutionState, LambdaApi } from './lambda-api';\nexport { fromResponse, isFunctionUrlEvent, toRequest } from './function-url';\nexport type { FunctionUrlEvent, FunctionUrlResult } from './function-url';\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA6CA,MAAa,mBAAmB;;AAkDhC,SAAS,YAAY,oBAAoC;CACvD,OAAO,mBAAmB,MAAM,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,KAAK,GAAG;AAC3D;AAEA,MAAM,QAAQ,MAAe,SAAS,QACpC,IAAI,SAAS,KAAK,UAAU,IAAI,GAAG;CAAE;CAAQ,SAAS,EAAE,gBAAgB,mBAAmB;AAAE,CAAC;AAEhG,SAAgB,cACd,SACe;CAEf,MAAM,EAAE,KAAK,SAAS,QAAQ,cAAc,cAAc,aAAa,GAAG,gBAAgB;CAC1F,MAAM,OAAO,kBACX;EAAE,GAAG;EAAa,QAAQ,KAAK,aAAa,QAAQ,MAAM,KAAK,QAAQ;CAAE,GAEzE,EAAE,WAAW,WAAW,EAAE,CAC5B;CACA,MAAM,SAAS,gBAAgB,aAAa;CAC5C,MAAM,YAAY,IAAI,IAAI,KAAK,OAAO,CAAC,CAAC,UAAU,KAAK,aAAa,SAAS,WAAW,CAAC;CACzF,MAAM,QAAQ,IAAI,kBAA8B;;CAGhD,MAAM,mBAAmB,QAAQ,IAAI,+BAA+B;;CAEpE,MAAM,sBAAiD;EACrD,MAAM,UAAU,WAAW;EAC3B,OAAO,QAAQ,KAAK,OAAO,IAAI;GAAE,IAAI;GAAS,WAAW,OAAO,OAAO;EAAE,IAAI,KAAA;CAC/E;;CAGA,MAAM,QACJ,YACyE;EACzE,MAAM,aAAa,MAAM,SAAS;EAClC,IAAI,eAAe,KAAA,GAAW,MAAM,IAAI,MAAM,sCAAsC;EACpF,MAAM,cAAc,EAAE,GAAG,QAAQ;EACjC,WAAW,UAAU,KAAK,MAAM,WAAW;EAC3C,MAAM,EAAE,UAAU,WAAW;EAC7B,MAAM,aAAa,MAAM;EACzB,IAAI,eAAe,KAAA,GACjB,MAAM,IAAI,MACR,+EACF;EAEF,MAAM,cAAc,YAAY,QAAQ,cAAc,kBAAkB;EACxE,MAAM,SAAS,OAAO,aAAqB,YAAsC;GAI/E,IAAI,YAAY,KAAA,KAAa,QAAQ,KAAK,OAAO,GAAG,OAAO,GAAG,YAAY,GAAG;GAE7E,IAAI,UAAU,IAAI,WAAW,GAAG,OAAO,GAAG,YAAY,GAAG,WAAW;GACpE,MAAM,IAAI,MAAM,sDAAsD,aAAa;EACrF;EACA,MAAM,YAAY,IAAI,aAAa;GACjC;GACA;GACA;GACA;GACA,GAAI,iBAAiB,KAAA,IAAY,CAAC,IAAI,EAAE,aAAa;GACrD,GAAI,gBAAgB,KAAA,IAAY,CAAC,IAAI,EAAE,YAAY;EACrD,CAAC;EACD,OAAO;GAAE;GAAO,KAAK;IAAE,GAAG;IAAS,SAAS;GAAU;GAAG;EAAW;CACtE;CAEA,MAAM,MAAM,OAAO,OAAiB,YAAqD;EACvF,MAAM,EAAE,OAAO,KAAK,eAAe,KAAK,OAAO;EAC/C,MAAM,EAAE,YAAY,WAAW;EAE/B,MAAM,QAAQ,KAAK,qBAAqB,YAAY;GAClD,MAAM,WAAW,cACf,YACA,QAAQ,iBAAiB,qBACzB,KAAK,IAAI,CACX;EACF,CAAC;EACD,OAAO,eACL;GACE;GACA;GACA,aAAa,MAAM;GACnB,MAAM,IAAI,cAAc,SAAS,OAAO,YAAY,QAAQ,OAAO,QAAQ,UAAU;EACvF,GACA,KAAK,SAAS,KAAK,OAAO,MAAM,CAClC;CACF;CAEA,MAAM,QAAQ,OAAyB,YAAwD;EAC7F,MAAM,QAAQ,YAAwC;GACpD,MAAM,SAAS,MAAM,eAAe,KAAK;GACzC,IAAI;IACF,MAAM,EAAE,OAAO,QAAQ,KAAK,OAAO;IACnC,MAAM,UAAU,UAAU,KAAK;IAE/B,IAAI,IAAI,IAAI,QAAQ,GAAG,CAAC,CAAC,aAAa,WACpC,OAAO,MAAM,aACX,KACE,EACE,OACE,8EACJ,GACA,GACF,GACA,MACF;IAEF,MAAM,KAAK,eAAe,KAAK,cAAc,CAAC;IAC9C,OAAO,MAAM,aAAa,MAAM,KAAK,OAAO,SAAS,KAAK,KAAK,GAAG,MAAM;GAC1E,SAAS,OAAO;IACd,QAAQ,MAAM,6BAA6B,KAAK;IAChD,OAAO,aAAa,KAAK,EAAE,OAAO,iBAAiB,GAAG,GAAG,GAAG,MAAM;GACpE;EACF;EAIA,MAAM,SAAS,MAAM,eAAe,KAAK,OAAO,YAAY;EAC5D,IAAI,WAAW,SAAS,WAAW,QAAQ,OAAO,MAAM;EACxD,OAAO,QAAQ,KAAK,QAAQ,OAAO,EAAE,sBAAsB,EAAE,aAAa,MAAM,GAAG,CAAC;CACtF;CAEA,MAAM,SAAS,YACb,QAAQ,KACN,SACA,YAAY;EACV,MAAM,EAAE,OAAO,QAAQ,KAAK,OAAO;EACnC,MAAM,KAAK,eAAe,KAAK,cAAc,CAAC;EAC9C,OAAO,cAAc,KAAK,KAAK;CACjC,GACA,EAAE,sBAAsB,EAAE,aAAa,MAAM,GAAG,CAClD;CAEF,MAAM,UAAU,qBAAqB,OAAO,OAAgB,YAA4B;EACtF,IAAI,mBAAmB,KAAK,GAAG,OAAO,KAAK,OAAO,OAAO;EACzD,IAAI,WAAW,KAAK,GAAG,OAAO,IAAI,OAAO,OAAO;EAChD,IACE,OAAO,UAAU,YACjB,UAAU,QACT,MAA6B,SAAA,mBAE9B,OAAO,MAAM,OAAO;EAEtB,MAAM,IAAI,MAAM,8EAA8E;CAChG,CAAC;CAED,MAAM,UAAU,OACd,OACA,YAC8C;EAC9C,MAAM,aAAyB,CAAC;EAChC,IAAI;GAEF,OAAO,MAAM,MAAM,IAAI,kBACrB,QAAQ,OAAO,OAAwC,CACzD;EACF,UAAU;GAGR,MAAM,WAAW,OAAO,MAAM,CAAC,CAAC,OAAO,UAAmB;IACxD,QAAQ,MAAM,uCAAuC,KAAK;GAC5D,CAAC;EACH;CACF;CAEA,OAAO,EAAE,QAAQ;AACnB"}

package/dist/aws/instances.cjs

@@ -15,16 +15,16 @@ function isRunInput(event) {
 	return candidate.type === "$workflow.run" && candidate.requestContext === void 0 && typeof candidate.instanceId === "string" && typeof candidate.enteredAtMs === "number" && typeof candidate.params === "object" && candidate.params !== null;
 }
 const utf8 = new TextEncoder();
-const NAME = /^[a-zA-Z0-9_-]{1,64}$/;
 /**
-* The durable execution name for an instance: the instance id itself when it fits, otherwise a
-* prefix of it with a fingerprint of the whole — stable, so every retry of the start reuses it.
+* The durable execution name for one start of an instance: the instance id, cut to fit, with a
+* fingerprint of the whole id (so a cut never makes two instances collide) and the attempt's
+* token. Every retry of that start reuses the recorded name; a new attempt gets a new token.
 */
-function executionName(instanceId) {
-	if (NAME.test(instanceId)) return instanceId;
+function executionName(instanceId, attempt) {
 	const safe = instanceId.replace(/[^a-zA-Z0-9_-]/g, "-");
-	const fingerprint = `${require_engine_bucket.murmur3(utf8.encode(instanceId)).toString(36)}${require_engine_bucket.murmur3(utf8.encode(instanceId), 2538058380).toString(36)}`;
-	return `${safe.slice(0, 63 - fingerprint.length)}-${fingerprint}`;
+	const token = attempt.replace(/[^a-zA-Z0-9]/g, "").slice(0, 8);
+	const suffix = `-${`${require_engine_bucket.murmur3(utf8.encode(instanceId)).toString(36)}${require_engine_bucket.murmur3(utf8.encode(instanceId), 2538058380).toString(36)}`}-${token}`;
+	return `${safe.slice(0, 64 - suffix.length)}${suffix}`;
 }
 const MINUTE = 6e4;
 var AwsInstances = class {
@@ -32,12 +32,19 @@ var AwsInstances = class {
 	now;
 	startRetryMs;
 	reconcileEveryMs;
+	stopDrainMs;
 	constructor(options) {
 		this.options = options;
 		this.now = options.now ?? Date.now;
 		this.startRetryMs = options.startRetryMs ?? 720 * MINUTE;
 		this.reconcileEveryMs = options.reconcileEveryMs ?? 15 * MINUTE;
+		this.stopDrainMs = options.stopDrainMs ?? 15 * MINUTE;
 	}
+	/**
+	* A start, planned for one entry attempt. Its name is new every time: a failed entry reclaimed
+	* under the same instance id (an event replayed with its ts) must start a new execution — the
+	* old name would return the closed one. Retries of this attempt reuse the recorded name.
+	*/
 	async plan(options) {
 		const input = {
 			type: RUN_EVENT_TYPE,
@@ -46,8 +53,8 @@ var AwsInstances = class {
 			enteredAtMs: this.now()
 		};
 		return {
-			name: executionName(options.id),
-			target: await this.options.target(options.params.contentHash),
+			name: executionName(options.id, crypto.randomUUID().slice(0, 8)),
+			target: await this.options.target(options.params.contentHash, options.version),
 			input: JSON.stringify(input)
 		};
 	}
@@ -113,6 +120,10 @@ var AwsInstances = class {
 	vanished(record) {
 		return this.now() - record.createdAt > this.startRetryMs;
 	}
+	/** Stopped so recently that an invocation running at the time may still be acting. */
+	draining(record) {
+		return record.stoppedAt !== void 0 && this.now() - record.stoppedAt < this.stopDrainMs;
+	}
 	async reconcile(record, now) {
 		const arn = await this.arnOf(record);
 		const state = arn === void 0 ? void 0 : await this.options.lambda.executionState(arn);
@@ -146,16 +157,25 @@ var AwsInstances = class {
 			},
 			terminate: async () => {
 				const record = await current();
+				if (record.stoppedAt !== void 0) {
+					if (this.draining(record)) throw new Error(`${id} was stopped; its running invocation may still be finishing`);
+					return;
+				}
 				if (record.submittedAt === void 0 && record.unresolvedAt === void 0) await executions.markUnresolved(id, this.now());
 				const arn = await this.arnOf(record);
 				if (arn === void 0) {
 					if (this.vanished(record)) return;
 					throw new Error(`cannot stop ${id} yet: its execution is not visible`);
 				}
+				const state = await lambda.executionState(arn);
+				if (state === "succeeded" || state === "failed" || state === "timed_out") return;
 				if (!await lambda.stopExecution(arn)) throw new Error(`stopping ${id} failed`);
+				await executions.markStopped(id, this.now());
+				throw new Error(`${id} is stopped; its running invocation may still be finishing`);
 			},
 			status: async () => {
 				const record = await current();
+				if (this.draining(record)) return { status: "running" };
 				const arn = await this.arnOf(record);
 				if (arn === void 0) return { status: this.vanished(record) ? "terminated" : "running" };
 				const state = await lambda.executionState(arn);

package/dist/aws/instances.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"instances.cjs","names":["murmur3","InstanceNotFoundError"],"sources":["../../src/aws/instances.ts"],"sourcesContent":["import {\n  InstanceNotFoundError,\n  type JourneyParams,\n  type WorkflowBindingLike,\n  type WorkflowInstanceLike,\n} from '../cloudflare/bindings';\nimport { murmur3 } from '../engine/bucket';\nimport type {\n  ExecutionRecord,\n  ExecutionRegistry,\n  ExecutionStart,\n  JourneyStore,\n} from '../store/index';\nimport type { LambdaApi } from './lambda-api';\n\n/**\n * The router's instance port over Lambda durable executions: an instance is one execution of\n * this same function, started by an asynchronous self-invoke under a stable execution name;\n * a wake completes the callback its current wait parks on; stopping stops the execution.\n */\n\n/** The top-level shape of an internal run: what the self-invoke sends, never an HTTP body. */\nexport const RUN_EVENT_TYPE = '$workflow.run';\n\nexport interface RunInput {\n  type: typeof RUN_EVENT_TYPE;\n  instanceId: string;\n  params: JourneyParams;\n  /** When the instance was created (as Cloudflare's event timestamp): its entry anchor, fixed with the start. */\n  enteredAtMs: number;\n}\n\nexport function isRunInput(event: unknown): event is RunInput {\n  if (typeof event !== 'object' || event === null) return false;\n  const candidate = event as {\n    type?: unknown;\n    instanceId?: unknown;\n    enteredAtMs?: unknown;\n    params?: unknown;\n    requestContext?: unknown;\n  };\n  return (\n    candidate.type === RUN_EVENT_TYPE &&\n    candidate.requestContext === undefined &&\n    typeof candidate.instanceId === 'string' &&\n    typeof candidate.enteredAtMs === 'number' &&\n    typeof candidate.params === 'object' &&\n    candidate.params !== null\n  );\n}\n\nconst utf8 = new TextEncoder();\nconst NAME = /^[a-zA-Z0-9_-]{1,64}$/;\n\n/**\n * The durable execution name for an instance: the instance id itself when it fits, otherwise a\n * prefix of it with a fingerprint of the whole — stable, so every retry of the start reuses it.\n */\nexport function executionName(instanceId: string): string {\n  if (NAME.test(instanceId)) return instanceId;\n  const safe = instanceId.replace(/[^a-zA-Z0-9_-]/g, '-');\n  const fingerprint = `${murmur3(utf8.encode(instanceId)).toString(36)}${murmur3(utf8.encode(instanceId), 0x9747b28c).toString(36)}`;\n  return `${safe.slice(0, 63 - fingerprint.length)}-${fingerprint}`;\n}\n\nexport interface AwsInstancesOptions {\n  store: JourneyStore;\n  executions: ExecutionRegistry;\n  lambda: LambdaApi;\n  /** The qualified function ARN an execution pinned to `contentHash` must run on. */\n  target(contentHash: string): Promise<string>;\n  /**\n   * How long an unconfirmed start keeps being retried. It must stay shorter than the durable\n   * execution retention: past that the platform forgets the name, and a retry would start a\n   * second execution. Twelve hours by default.\n   */\n  startRetryMs?: number;\n  /** How stale a running instance's last check must be before maintenance looks again. */\n  reconcileEveryMs?: number;\n  now?: () => number;\n}\n\nconst MINUTE = 60_000;\n\nexport class AwsInstances implements WorkflowBindingLike {\n  private readonly now: () => number;\n  private readonly startRetryMs: number;\n  private readonly reconcileEveryMs: number;\n\n  constructor(private readonly options: AwsInstancesOptions) {\n    this.now = options.now ?? Date.now;\n    this.startRetryMs = options.startRetryMs ?? 12 * 60 * MINUTE;\n    this.reconcileEveryMs = options.reconcileEveryMs ?? 15 * MINUTE;\n  }\n\n  async plan(options: { id: string; params: JourneyParams; ts: number }): Promise<ExecutionStart> {\n    const input: RunInput = {\n      type: RUN_EVENT_TYPE,\n      instanceId: options.id,\n      params: options.params,\n      // The moment the instance is created, like Cloudflare's: an event's own ts may be long past\n      enteredAtMs: this.now(),\n    };\n    return {\n      name: executionName(options.id),\n      target: await this.options.target(options.params.contentHash),\n      input: JSON.stringify(input),\n    };\n  }\n\n  async create(options: { id: string; params: unknown }): Promise<WorkflowInstanceLike> {\n    const record = await this.options.executions.get(options.id);\n    if (record === undefined) {\n      throw new Error(`no start is recorded for ${options.id}: the entry must be planned first`);\n    }\n    await this.submit(record);\n    return this.instance(options.id);\n  }\n\n  async get(id: string): Promise<WorkflowInstanceLike> {\n    // A read of the registry alone: a Lambda failure must never read as \"no such instance\"\n    if ((await this.options.executions.get(id)) === undefined) {\n      throw new InstanceNotFoundError(id);\n    }\n    return this.instance(id);\n  }\n\n  async resume(entry: { workflow: string; userId: string }): Promise<void> {\n    for (const record of await this.options.executions.pendingStarts({ ...entry, limit: 1 })) {\n      if (!(await this.giveUpIfStale(record))) await this.submit(record);\n    }\n  }\n\n  async maintain(): Promise<void> {\n    const now = this.now();\n    const failures: unknown[] = [];\n    // Starts whose submit never confirmed: retried with the recorded name and payload\n    for (const record of await this.options.executions.pendingStarts({\n      createdBefore: now - MINUTE,\n      limit: 25,\n    })) {\n      try {\n        if (!(await this.giveUpIfStale(record))) await this.submit(record);\n      } catch (error) {\n        failures.push(error);\n      }\n    }\n    // Executions the platform ended without the run finalizing (a timeout, a stop, a crash)\n    for (const record of await this.options.executions.toReconcile(\n      25,\n      now - this.reconcileEveryMs\n    )) {\n      try {\n        await this.reconcile(record, now);\n      } catch (error) {\n        failures.push(error);\n      }\n    }\n    if (failures.length > 0) throw failures[0];\n  }\n\n  private async submit(record: ExecutionRecord): Promise<void> {\n    const { arn } = await this.options.lambda.startExecution({\n      target: record.target,\n      name: record.name,\n      payload: record.input,\n    });\n    await this.options.executions.markSubmitted(record.instanceId, arn, this.now());\n  }\n\n  /** Past the retry budget a start is unresolved for good: no retry could tell a duplicate apart. */\n  private async giveUpIfStale(record: ExecutionRecord): Promise<boolean> {\n    if (this.now() - record.createdAt <= this.startRetryMs) return false;\n    await this.options.executions.markUnresolved(record.instanceId, this.now());\n    console.error(\n      `[workflow] the start of ${record.instanceId} (${record.name}) was never confirmed: left unresolved`\n    );\n    return true;\n  }\n\n  private async arnOf(record: ExecutionRecord): Promise<string | undefined> {\n    if (record.arn !== undefined) return record.arn;\n    const arn = await this.options.lambda.findExecution(record.target, record.name);\n    if (arn !== undefined) await this.options.executions.setArn(record.instanceId, arn);\n    return arn;\n  }\n\n  /**\n   * Past the start retry budget, an execution still nowhere to be seen never started: any queued\n   * invoke has expired by then. Before that, not finding it says nothing.\n   */\n  private vanished(record: ExecutionRecord): boolean {\n    return this.now() - record.createdAt > this.startRetryMs;\n  }\n\n  private async reconcile(record: ExecutionRecord, now: number): Promise<void> {\n    const arn = await this.arnOf(record);\n    const state = arn === undefined ? undefined : await this.options.lambda.executionState(arn);\n    // Only a state that will never run another step — or one missing for good — ends the entry;\n    // a run still queued, or not visible yet, is left alone\n    const ended =\n      state === 'failed' ||\n      state === 'stopped' ||\n      state === 'timed_out' ||\n      (state === undefined && this.vanished(record));\n    if (ended) {\n      // Ended without its finalize step: the ledger must not show it running forever\n      const { store } = this.options;\n      await store.setEntryStatus(record.instanceId, 'failed');\n      await store.reporting?.instanceFinished({\n        workflow: record.workflow,\n        instanceId: record.instanceId,\n        userId: record.userId,\n        status: 'failed',\n        at: now,\n      });\n      console.warn(\n        `[workflow] ${record.instanceId} ended on the platform (${state ?? 'unknown'}) without finishing: recorded as failed`\n      );\n    }\n    await this.options.executions.markChecked(record.instanceId, now);\n  }\n\n  private instance(id: string): WorkflowInstanceLike {\n    const { executions, lambda } = this.options;\n    const current = async () => {\n      const record = await executions.get(id);\n      if (record === undefined) throw new InstanceNotFoundError(id);\n      return record;\n    };\n    return {\n      id,\n      sendEvent: async (event) => {\n        // The wait parked now, read at the moment of the wake: a newer wait's callback replaces\n        // an older one, and a wake for none (the instance is between waits) is nothing to do —\n        // its next wait re-reads the facts before parking\n        const { callbackId } = await current();\n        if (callbackId === undefined) return;\n        await lambda.completeCallback(callbackId, JSON.stringify(event.payload ?? {}));\n      },\n      terminate: async () => {\n        const record = await current();\n        if (record.submittedAt === undefined && record.unresolvedAt === undefined) {\n          // No retry may start it after this\n          await executions.markUnresolved(id, this.now());\n        }\n        const arn = await this.arnOf(record);\n        if (arn === undefined) {\n          // Not visible yet is not stopped: the erasure stays pending, and the sweep retries\n          if (this.vanished(record)) return;\n          throw new Error(`cannot stop ${id} yet: its execution is not visible`);\n        }\n        if (!(await lambda.stopExecution(arn))) throw new Error(`stopping ${id} failed`);\n      },\n      status: async () => {\n        const record = await current();\n        const arn = await this.arnOf(record);\n        // Not visible yet may still run: only one missing past the budget is gone\n        if (arn === undefined) return { status: this.vanished(record) ? 'terminated' : 'running' };\n        const state = await lambda.executionState(arn);\n        // In the router's vocabulary (Cloudflare's): what will never run another step\n        if (state === 'succeeded') return { status: 'complete' };\n        if (state === 'failed') return { status: 'errored' };\n        if (state === 'running') return { status: 'running' };\n        return { status: 'terminated' };\n      },\n    };\n  }\n}\n"],"mappings":";;;;;;;;;;AAsBA,MAAa,iBAAiB;AAU9B,SAAgB,WAAW,OAAmC;CAC5D,IAAI,OAAO,UAAU,YAAY,UAAU,MAAM,OAAO;CACxD,MAAM,YAAY;CAOlB,OACE,UAAU,SAAA,mBACV,UAAU,mBAAmB,KAAA,KAC7B,OAAO,UAAU,eAAe,YAChC,OAAO,UAAU,gBAAgB,YACjC,OAAO,UAAU,WAAW,YAC5B,UAAU,WAAW;AAEzB;AAEA,MAAM,OAAO,IAAI,YAAY;AAC7B,MAAM,OAAO;;;;;AAMb,SAAgB,cAAc,YAA4B;CACxD,IAAI,KAAK,KAAK,UAAU,GAAG,OAAO;CAClC,MAAM,OAAO,WAAW,QAAQ,mBAAmB,GAAG;CACtD,MAAM,cAAc,GAAGA,sBAAAA,QAAQ,KAAK,OAAO,UAAU,CAAC,CAAC,CAAC,SAAS,EAAE,IAAIA,sBAAAA,QAAQ,KAAK,OAAO,UAAU,GAAG,UAAU,CAAC,CAAC,SAAS,EAAE;CAC/H,OAAO,GAAG,KAAK,MAAM,GAAG,KAAK,YAAY,MAAM,EAAE,GAAG;AACtD;AAmBA,MAAM,SAAS;AAEf,IAAa,eAAb,MAAyD;CAK1B;CAJ7B;CACA;CACA;CAEA,YAAY,SAA+C;EAA9B,KAAA,UAAA;EAC3B,KAAK,MAAM,QAAQ,OAAO,KAAK;EAC/B,KAAK,eAAe,QAAQ,gBAAgB,MAAU;EACtD,KAAK,mBAAmB,QAAQ,oBAAoB,KAAK;CAC3D;CAEA,MAAM,KAAK,SAAqF;EAC9F,MAAM,QAAkB;GACtB,MAAM;GACN,YAAY,QAAQ;GACpB,QAAQ,QAAQ;GAEhB,aAAa,KAAK,IAAI;EACxB;EACA,OAAO;GACL,MAAM,cAAc,QAAQ,EAAE;GAC9B,QAAQ,MAAM,KAAK,QAAQ,OAAO,QAAQ,OAAO,WAAW;GAC5D,OAAO,KAAK,UAAU,KAAK;EAC7B;CACF;CAEA,MAAM,OAAO,SAAyE;EACpF,MAAM,SAAS,MAAM,KAAK,QAAQ,WAAW,IAAI,QAAQ,EAAE;EAC3D,IAAI,WAAW,KAAA,GACb,MAAM,IAAI,MAAM,4BAA4B,QAAQ,GAAG,kCAAkC;EAE3F,MAAM,KAAK,OAAO,MAAM;EACxB,OAAO,KAAK,SAAS,QAAQ,EAAE;CACjC;CAEA,MAAM,IAAI,IAA2C;EAEnD,IAAK,MAAM,KAAK,QAAQ,WAAW,IAAI,EAAE,MAAO,KAAA,GAC9C,MAAM,IAAIC,4BAAAA,sBAAsB,EAAE;EAEpC,OAAO,KAAK,SAAS,EAAE;CACzB;CAEA,MAAM,OAAO,OAA4D;EACvE,KAAK,MAAM,UAAU,MAAM,KAAK,QAAQ,WAAW,cAAc;GAAE,GAAG;GAAO,OAAO;EAAE,CAAC,GACrF,IAAI,CAAE,MAAM,KAAK,cAAc,MAAM,GAAI,MAAM,KAAK,OAAO,MAAM;CAErE;CAEA,MAAM,WAA0B;EAC9B,MAAM,MAAM,KAAK,IAAI;EACrB,MAAM,WAAsB,CAAC;EAE7B,KAAK,MAAM,UAAU,MAAM,KAAK,QAAQ,WAAW,cAAc;GAC/D,eAAe,MAAM;GACrB,OAAO;EACT,CAAC,GACC,IAAI;GACF,IAAI,CAAE,MAAM,KAAK,cAAc,MAAM,GAAI,MAAM,KAAK,OAAO,MAAM;EACnE,SAAS,OAAO;GACd,SAAS,KAAK,KAAK;EACrB;EAGF,KAAK,MAAM,UAAU,MAAM,KAAK,QAAQ,WAAW,YACjD,IACA,MAAM,KAAK,gBACb,GACE,IAAI;GACF,MAAM,KAAK,UAAU,QAAQ,GAAG;EAClC,SAAS,OAAO;GACd,SAAS,KAAK,KAAK;EACrB;EAEF,IAAI,SAAS,SAAS,GAAG,MAAM,SAAS;CAC1C;CAEA,MAAc,OAAO,QAAwC;EAC3D,MAAM,EAAE,QAAQ,MAAM,KAAK,QAAQ,OAAO,eAAe;GACvD,QAAQ,OAAO;GACf,MAAM,OAAO;GACb,SAAS,OAAO;EAClB,CAAC;EACD,MAAM,KAAK,QAAQ,WAAW,cAAc,OAAO,YAAY,KAAK,KAAK,IAAI,CAAC;CAChF;;CAGA,MAAc,cAAc,QAA2C;EACrE,IAAI,KAAK,IAAI,IAAI,OAAO,aAAa,KAAK,cAAc,OAAO;EAC/D,MAAM,KAAK,QAAQ,WAAW,eAAe,OAAO,YAAY,KAAK,IAAI,CAAC;EAC1E,QAAQ,MACN,2BAA2B,OAAO,WAAW,IAAI,OAAO,KAAK,uCAC/D;EACA,OAAO;CACT;CAEA,MAAc,MAAM,QAAsD;EACxE,IAAI,OAAO,QAAQ,KAAA,GAAW,OAAO,OAAO;EAC5C,MAAM,MAAM,MAAM,KAAK,QAAQ,OAAO,cAAc,OAAO,QAAQ,OAAO,IAAI;EAC9E,IAAI,QAAQ,KAAA,GAAW,MAAM,KAAK,QAAQ,WAAW,OAAO,OAAO,YAAY,GAAG;EAClF,OAAO;CACT;;;;;CAMA,SAAiB,QAAkC;EACjD,OAAO,KAAK,IAAI,IAAI,OAAO,YAAY,KAAK;CAC9C;CAEA,MAAc,UAAU,QAAyB,KAA4B;EAC3E,MAAM,MAAM,MAAM,KAAK,MAAM,MAAM;EACnC,MAAM,QAAQ,QAAQ,KAAA,IAAY,KAAA,IAAY,MAAM,KAAK,QAAQ,OAAO,eAAe,GAAG;EAQ1F,IAJE,UAAU,YACV,UAAU,aACV,UAAU,eACT,UAAU,KAAA,KAAa,KAAK,SAAS,MAAM,GACnC;GAET,MAAM,EAAE,UAAU,KAAK;GACvB,MAAM,MAAM,eAAe,OAAO,YAAY,QAAQ;GACtD,MAAM,MAAM,WAAW,iBAAiB;IACtC,UAAU,OAAO;IACjB,YAAY,OAAO;IACnB,QAAQ,OAAO;IACf,QAAQ;IACR,IAAI;GACN,CAAC;GACD,QAAQ,KACN,cAAc,OAAO,WAAW,0BAA0B,SAAS,UAAU,wCAC/E;EACF;EACA,MAAM,KAAK,QAAQ,WAAW,YAAY,OAAO,YAAY,GAAG;CAClE;CAEA,SAAiB,IAAkC;EACjD,MAAM,EAAE,YAAY,WAAW,KAAK;EACpC,MAAM,UAAU,YAAY;GAC1B,MAAM,SAAS,MAAM,WAAW,IAAI,EAAE;GACtC,IAAI,WAAW,KAAA,GAAW,MAAM,IAAIA,4BAAAA,sBAAsB,EAAE;GAC5D,OAAO;EACT;EACA,OAAO;GACL;GACA,WAAW,OAAO,UAAU;IAI1B,MAAM,EAAE,eAAe,MAAM,QAAQ;IACrC,IAAI,eAAe,KAAA,GAAW;IAC9B,MAAM,OAAO,iBAAiB,YAAY,KAAK,UAAU,MAAM,WAAW,CAAC,CAAC,CAAC;GAC/E;GACA,WAAW,YAAY;IACrB,MAAM,SAAS,MAAM,QAAQ;IAC7B,IAAI,OAAO,gBAAgB,KAAA,KAAa,OAAO,iBAAiB,KAAA,GAE9D,MAAM,WAAW,eAAe,IAAI,KAAK,IAAI,CAAC;IAEhD,MAAM,MAAM,MAAM,KAAK,MAAM,MAAM;IACnC,IAAI,QAAQ,KAAA,GAAW;KAErB,IAAI,KAAK,SAAS,MAAM,GAAG;KAC3B,MAAM,IAAI,MAAM,eAAe,GAAG,mCAAmC;IACvE;IACA,IAAI,CAAE,MAAM,OAAO,cAAc,GAAG,GAAI,MAAM,IAAI,MAAM,YAAY,GAAG,QAAQ;GACjF;GACA,QAAQ,YAAY;IAClB,MAAM,SAAS,MAAM,QAAQ;IAC7B,MAAM,MAAM,MAAM,KAAK,MAAM,MAAM;IAEnC,IAAI,QAAQ,KAAA,GAAW,OAAO,EAAE,QAAQ,KAAK,SAAS,MAAM,IAAI,eAAe,UAAU;IACzF,MAAM,QAAQ,MAAM,OAAO,eAAe,GAAG;IAE7C,IAAI,UAAU,aAAa,OAAO,EAAE,QAAQ,WAAW;IACvD,IAAI,UAAU,UAAU,OAAO,EAAE,QAAQ,UAAU;IACnD,IAAI,UAAU,WAAW,OAAO,EAAE,QAAQ,UAAU;IACpD,OAAO,EAAE,QAAQ,aAAa;GAChC;EACF;CACF;AACF"}
+{"version":3,"file":"instances.cjs","names":["murmur3","InstanceNotFoundError"],"sources":["../../src/aws/instances.ts"],"sourcesContent":["import {\n  InstanceNotFoundError,\n  type JourneyParams,\n  type WorkflowBindingLike,\n  type WorkflowInstanceLike,\n} from '../cloudflare/bindings';\nimport { murmur3 } from '../engine/bucket';\nimport type {\n  ExecutionRecord,\n  ExecutionRegistry,\n  ExecutionStart,\n  JourneyStore,\n} from '../store/index';\nimport type { LambdaApi } from './lambda-api';\n\n/**\n * The router's instance port over Lambda durable executions: an instance is one execution of\n * this same function, started by an asynchronous self-invoke under a stable execution name;\n * a wake completes the callback its current wait parks on; stopping stops the execution.\n */\n\n/** The top-level shape of an internal run: what the self-invoke sends, never an HTTP body. */\nexport const RUN_EVENT_TYPE = '$workflow.run';\n\nexport interface RunInput {\n  type: typeof RUN_EVENT_TYPE;\n  instanceId: string;\n  params: JourneyParams;\n  /** When the instance was created (as Cloudflare's event timestamp): its entry anchor, fixed with the start. */\n  enteredAtMs: number;\n}\n\nexport function isRunInput(event: unknown): event is RunInput {\n  if (typeof event !== 'object' || event === null) return false;\n  const candidate = event as {\n    type?: unknown;\n    instanceId?: unknown;\n    enteredAtMs?: unknown;\n    params?: unknown;\n    requestContext?: unknown;\n  };\n  return (\n    candidate.type === RUN_EVENT_TYPE &&\n    candidate.requestContext === undefined &&\n    typeof candidate.instanceId === 'string' &&\n    typeof candidate.enteredAtMs === 'number' &&\n    typeof candidate.params === 'object' &&\n    candidate.params !== null\n  );\n}\n\nconst utf8 = new TextEncoder();\n\n/**\n * The durable execution name for one start of an instance: the instance id, cut to fit, with a\n * fingerprint of the whole id (so a cut never makes two instances collide) and the attempt's\n * token. Every retry of that start reuses the recorded name; a new attempt gets a new token.\n */\nexport function executionName(instanceId: string, attempt: string): string {\n  const safe = instanceId.replace(/[^a-zA-Z0-9_-]/g, '-');\n  const token = attempt.replace(/[^a-zA-Z0-9]/g, '').slice(0, 8);\n  const fingerprint = `${murmur3(utf8.encode(instanceId)).toString(36)}${murmur3(utf8.encode(instanceId), 0x9747b28c).toString(36)}`;\n  const suffix = `-${fingerprint}-${token}`;\n  return `${safe.slice(0, 64 - suffix.length)}${suffix}`;\n}\n\nexport interface AwsInstancesOptions {\n  store: JourneyStore;\n  executions: ExecutionRegistry;\n  lambda: LambdaApi;\n  /**\n   * The qualified function ARN an execution pinned to `contentHash` must run on; `version` is\n   * the code version whose routes named it.\n   */\n  target(contentHash: string, version?: string): Promise<string>;\n  /**\n   * How long an unconfirmed start keeps being retried. It must stay shorter than the durable\n   * execution retention: past that the platform forgets the name, and a retry would start a\n   * second execution. Twelve hours by default.\n   */\n  startRetryMs?: number;\n  /** How stale a running instance's last check must be before maintenance looks again. */\n  reconcileEveryMs?: number;\n  /**\n   * How long after a stop an invocation already running may still act: Lambda cannot interrupt\n   * one, and it runs on to its next checkpoint. An erasure waits this long before it erases.\n   * The function's timeout is enough; 15 minutes (Lambda's maximum) by default.\n   */\n  stopDrainMs?: number;\n  now?: () => number;\n}\n\nconst MINUTE = 60_000;\n\nexport class AwsInstances implements WorkflowBindingLike {\n  private readonly now: () => number;\n  private readonly startRetryMs: number;\n  private readonly reconcileEveryMs: number;\n  private readonly stopDrainMs: number;\n\n  constructor(private readonly options: AwsInstancesOptions) {\n    this.now = options.now ?? Date.now;\n    this.startRetryMs = options.startRetryMs ?? 12 * 60 * MINUTE;\n    this.reconcileEveryMs = options.reconcileEveryMs ?? 15 * MINUTE;\n    this.stopDrainMs = options.stopDrainMs ?? 15 * MINUTE;\n  }\n\n  /**\n   * A start, planned for one entry attempt. Its name is new every time: a failed entry reclaimed\n   * under the same instance id (an event replayed with its ts) must start a new execution — the\n   * old name would return the closed one. Retries of this attempt reuse the recorded name.\n   */\n  async plan(options: {\n    id: string;\n    params: JourneyParams;\n    ts: number;\n    version?: string | undefined;\n  }): Promise<ExecutionStart> {\n    const input: RunInput = {\n      type: RUN_EVENT_TYPE,\n      instanceId: options.id,\n      params: options.params,\n      // The moment the instance is created, like Cloudflare's: an event's own ts may be long past\n      enteredAtMs: this.now(),\n    };\n    return {\n      name: executionName(options.id, crypto.randomUUID().slice(0, 8)),\n      target: await this.options.target(options.params.contentHash, options.version),\n      input: JSON.stringify(input),\n    };\n  }\n\n  async create(options: { id: string; params: unknown }): Promise<WorkflowInstanceLike> {\n    const record = await this.options.executions.get(options.id);\n    if (record === undefined) {\n      throw new Error(`no start is recorded for ${options.id}: the entry must be planned first`);\n    }\n    await this.submit(record);\n    return this.instance(options.id);\n  }\n\n  async get(id: string): Promise<WorkflowInstanceLike> {\n    // A read of the registry alone: a Lambda failure must never read as \"no such instance\"\n    if ((await this.options.executions.get(id)) === undefined) {\n      throw new InstanceNotFoundError(id);\n    }\n    return this.instance(id);\n  }\n\n  async resume(entry: { workflow: string; userId: string }): Promise<void> {\n    for (const record of await this.options.executions.pendingStarts({ ...entry, limit: 1 })) {\n      if (!(await this.giveUpIfStale(record))) await this.submit(record);\n    }\n  }\n\n  async maintain(): Promise<void> {\n    const now = this.now();\n    const failures: unknown[] = [];\n    // Starts whose submit never confirmed: retried with the recorded name and payload\n    for (const record of await this.options.executions.pendingStarts({\n      createdBefore: now - MINUTE,\n      limit: 25,\n    })) {\n      try {\n        if (!(await this.giveUpIfStale(record))) await this.submit(record);\n      } catch (error) {\n        failures.push(error);\n      }\n    }\n    // Executions the platform ended without the run finalizing (a timeout, a stop, a crash)\n    for (const record of await this.options.executions.toReconcile(\n      25,\n      now - this.reconcileEveryMs\n    )) {\n      try {\n        await this.reconcile(record, now);\n      } catch (error) {\n        failures.push(error);\n      }\n    }\n    if (failures.length > 0) throw failures[0];\n  }\n\n  private async submit(record: ExecutionRecord): Promise<void> {\n    const { arn } = await this.options.lambda.startExecution({\n      target: record.target,\n      name: record.name,\n      payload: record.input,\n    });\n    await this.options.executions.markSubmitted(record.instanceId, arn, this.now());\n  }\n\n  /** Past the retry budget a start is unresolved for good: no retry could tell a duplicate apart. */\n  private async giveUpIfStale(record: ExecutionRecord): Promise<boolean> {\n    if (this.now() - record.createdAt <= this.startRetryMs) return false;\n    await this.options.executions.markUnresolved(record.instanceId, this.now());\n    console.error(\n      `[workflow] the start of ${record.instanceId} (${record.name}) was never confirmed: left unresolved`\n    );\n    return true;\n  }\n\n  private async arnOf(record: ExecutionRecord): Promise<string | undefined> {\n    if (record.arn !== undefined) return record.arn;\n    const arn = await this.options.lambda.findExecution(record.target, record.name);\n    if (arn !== undefined) await this.options.executions.setArn(record.instanceId, arn);\n    return arn;\n  }\n\n  /**\n   * Past the start retry budget, an execution still nowhere to be seen never started: any queued\n   * invoke has expired by then. Before that, not finding it says nothing.\n   */\n  private vanished(record: ExecutionRecord): boolean {\n    return this.now() - record.createdAt > this.startRetryMs;\n  }\n\n  /** Stopped so recently that an invocation running at the time may still be acting. */\n  private draining(record: ExecutionRecord): boolean {\n    return record.stoppedAt !== undefined && this.now() - record.stoppedAt < this.stopDrainMs;\n  }\n\n  private async reconcile(record: ExecutionRecord, now: number): Promise<void> {\n    const arn = await this.arnOf(record);\n    const state = arn === undefined ? undefined : await this.options.lambda.executionState(arn);\n    // Only a state that will never run another step — or one missing for good — ends the entry;\n    // a run still queued, or not visible yet, is left alone\n    const ended =\n      state === 'failed' ||\n      state === 'stopped' ||\n      state === 'timed_out' ||\n      (state === undefined && this.vanished(record));\n    if (ended) {\n      // Ended without its finalize step: the ledger must not show it running forever\n      const { store } = this.options;\n      await store.setEntryStatus(record.instanceId, 'failed');\n      await store.reporting?.instanceFinished({\n        workflow: record.workflow,\n        instanceId: record.instanceId,\n        userId: record.userId,\n        status: 'failed',\n        at: now,\n      });\n      console.warn(\n        `[workflow] ${record.instanceId} ended on the platform (${state ?? 'unknown'}) without finishing: recorded as failed`\n      );\n    }\n    await this.options.executions.markChecked(record.instanceId, now);\n  }\n\n  private instance(id: string): WorkflowInstanceLike {\n    const { executions, lambda } = this.options;\n    const current = async () => {\n      const record = await executions.get(id);\n      if (record === undefined) throw new InstanceNotFoundError(id);\n      return record;\n    };\n    return {\n      id,\n      sendEvent: async (event) => {\n        // The wait parked now, read at the moment of the wake: a newer wait's callback replaces\n        // an older one, and a wake for none (the instance is between waits) is nothing to do —\n        // its next wait re-reads the facts before parking\n        const { callbackId } = await current();\n        if (callbackId === undefined) return;\n        await lambda.completeCallback(callbackId, JSON.stringify(event.payload ?? {}));\n      },\n      terminate: async () => {\n        const record = await current();\n        // Stopped before: done once an invocation that was running then has had time to end\n        if (record.stoppedAt !== undefined) {\n          if (this.draining(record)) {\n            throw new Error(`${id} was stopped; its running invocation may still be finishing`);\n          }\n          return;\n        }\n        if (record.submittedAt === undefined && record.unresolvedAt === undefined) {\n          // No retry may start it after this\n          await executions.markUnresolved(id, this.now());\n        }\n        const arn = await this.arnOf(record);\n        if (arn === undefined) {\n          // Not visible yet is not stopped: the erasure stays pending, and the sweep retries\n          if (this.vanished(record)) return;\n          throw new Error(`cannot stop ${id} yet: its execution is not visible`);\n        }\n        // One that finished on its own has no invocation left to drain\n        const state = await lambda.executionState(arn);\n        if (state === 'succeeded' || state === 'failed' || state === 'timed_out') return;\n        if (!(await lambda.stopExecution(arn))) throw new Error(`stopping ${id} failed`);\n        // A stop does not interrupt an invocation already running: it goes on to its next\n        // checkpoint, side effects included. The erasure waits (see stopDrainMs)\n        await executions.markStopped(id, this.now());\n        throw new Error(`${id} is stopped; its running invocation may still be finishing`);\n      },\n      status: async () => {\n        const record = await current();\n        if (this.draining(record)) return { status: 'running' };\n        const arn = await this.arnOf(record);\n        // Not visible yet may still run: only one missing past the budget is gone\n        if (arn === undefined) return { status: this.vanished(record) ? 'terminated' : 'running' };\n        const state = await lambda.executionState(arn);\n        // In the router's vocabulary (Cloudflare's): what will never run another step\n        if (state === 'succeeded') return { status: 'complete' };\n        if (state === 'failed') return { status: 'errored' };\n        if (state === 'running') return { status: 'running' };\n        return { status: 'terminated' };\n      },\n    };\n  }\n}\n"],"mappings":";;;;;;;;;;AAsBA,MAAa,iBAAiB;AAU9B,SAAgB,WAAW,OAAmC;CAC5D,IAAI,OAAO,UAAU,YAAY,UAAU,MAAM,OAAO;CACxD,MAAM,YAAY;CAOlB,OACE,UAAU,SAAA,mBACV,UAAU,mBAAmB,KAAA,KAC7B,OAAO,UAAU,eAAe,YAChC,OAAO,UAAU,gBAAgB,YACjC,OAAO,UAAU,WAAW,YAC5B,UAAU,WAAW;AAEzB;AAEA,MAAM,OAAO,IAAI,YAAY;;;;;;AAO7B,SAAgB,cAAc,YAAoB,SAAyB;CACzE,MAAM,OAAO,WAAW,QAAQ,mBAAmB,GAAG;CACtD,MAAM,QAAQ,QAAQ,QAAQ,iBAAiB,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC;CAE7D,MAAM,SAAS,IAAI,GADIA,sBAAAA,QAAQ,KAAK,OAAO,UAAU,CAAC,CAAC,CAAC,SAAS,EAAE,IAAIA,sBAAAA,QAAQ,KAAK,OAAO,UAAU,GAAG,UAAU,CAAC,CAAC,SAAS,EAAE,IAChG,GAAG;CAClC,OAAO,GAAG,KAAK,MAAM,GAAG,KAAK,OAAO,MAAM,IAAI;AAChD;AA4BA,MAAM,SAAS;AAEf,IAAa,eAAb,MAAyD;CAM1B;CAL7B;CACA;CACA;CACA;CAEA,YAAY,SAA+C;EAA9B,KAAA,UAAA;EAC3B,KAAK,MAAM,QAAQ,OAAO,KAAK;EAC/B,KAAK,eAAe,QAAQ,gBAAgB,MAAU;EACtD,KAAK,mBAAmB,QAAQ,oBAAoB,KAAK;EACzD,KAAK,cAAc,QAAQ,eAAe,KAAK;CACjD;;;;;;CAOA,MAAM,KAAK,SAKiB;EAC1B,MAAM,QAAkB;GACtB,MAAM;GACN,YAAY,QAAQ;GACpB,QAAQ,QAAQ;GAEhB,aAAa,KAAK,IAAI;EACxB;EACA,OAAO;GACL,MAAM,cAAc,QAAQ,IAAI,OAAO,WAAW,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;GAC/D,QAAQ,MAAM,KAAK,QAAQ,OAAO,QAAQ,OAAO,aAAa,QAAQ,OAAO;GAC7E,OAAO,KAAK,UAAU,KAAK;EAC7B;CACF;CAEA,MAAM,OAAO,SAAyE;EACpF,MAAM,SAAS,MAAM,KAAK,QAAQ,WAAW,IAAI,QAAQ,EAAE;EAC3D,IAAI,WAAW,KAAA,GACb,MAAM,IAAI,MAAM,4BAA4B,QAAQ,GAAG,kCAAkC;EAE3F,MAAM,KAAK,OAAO,MAAM;EACxB,OAAO,KAAK,SAAS,QAAQ,EAAE;CACjC;CAEA,MAAM,IAAI,IAA2C;EAEnD,IAAK,MAAM,KAAK,QAAQ,WAAW,IAAI,EAAE,MAAO,KAAA,GAC9C,MAAM,IAAIC,4BAAAA,sBAAsB,EAAE;EAEpC,OAAO,KAAK,SAAS,EAAE;CACzB;CAEA,MAAM,OAAO,OAA4D;EACvE,KAAK,MAAM,UAAU,MAAM,KAAK,QAAQ,WAAW,cAAc;GAAE,GAAG;GAAO,OAAO;EAAE,CAAC,GACrF,IAAI,CAAE,MAAM,KAAK,cAAc,MAAM,GAAI,MAAM,KAAK,OAAO,MAAM;CAErE;CAEA,MAAM,WAA0B;EAC9B,MAAM,MAAM,KAAK,IAAI;EACrB,MAAM,WAAsB,CAAC;EAE7B,KAAK,MAAM,UAAU,MAAM,KAAK,QAAQ,WAAW,cAAc;GAC/D,eAAe,MAAM;GACrB,OAAO;EACT,CAAC,GACC,IAAI;GACF,IAAI,CAAE,MAAM,KAAK,cAAc,MAAM,GAAI,MAAM,KAAK,OAAO,MAAM;EACnE,SAAS,OAAO;GACd,SAAS,KAAK,KAAK;EACrB;EAGF,KAAK,MAAM,UAAU,MAAM,KAAK,QAAQ,WAAW,YACjD,IACA,MAAM,KAAK,gBACb,GACE,IAAI;GACF,MAAM,KAAK,UAAU,QAAQ,GAAG;EAClC,SAAS,OAAO;GACd,SAAS,KAAK,KAAK;EACrB;EAEF,IAAI,SAAS,SAAS,GAAG,MAAM,SAAS;CAC1C;CAEA,MAAc,OAAO,QAAwC;EAC3D,MAAM,EAAE,QAAQ,MAAM,KAAK,QAAQ,OAAO,eAAe;GACvD,QAAQ,OAAO;GACf,MAAM,OAAO;GACb,SAAS,OAAO;EAClB,CAAC;EACD,MAAM,KAAK,QAAQ,WAAW,cAAc,OAAO,YAAY,KAAK,KAAK,IAAI,CAAC;CAChF;;CAGA,MAAc,cAAc,QAA2C;EACrE,IAAI,KAAK,IAAI,IAAI,OAAO,aAAa,KAAK,cAAc,OAAO;EAC/D,MAAM,KAAK,QAAQ,WAAW,eAAe,OAAO,YAAY,KAAK,IAAI,CAAC;EAC1E,QAAQ,MACN,2BAA2B,OAAO,WAAW,IAAI,OAAO,KAAK,uCAC/D;EACA,OAAO;CACT;CAEA,MAAc,MAAM,QAAsD;EACxE,IAAI,OAAO,QAAQ,KAAA,GAAW,OAAO,OAAO;EAC5C,MAAM,MAAM,MAAM,KAAK,QAAQ,OAAO,cAAc,OAAO,QAAQ,OAAO,IAAI;EAC9E,IAAI,QAAQ,KAAA,GAAW,MAAM,KAAK,QAAQ,WAAW,OAAO,OAAO,YAAY,GAAG;EAClF,OAAO;CACT;;;;;CAMA,SAAiB,QAAkC;EACjD,OAAO,KAAK,IAAI,IAAI,OAAO,YAAY,KAAK;CAC9C;;CAGA,SAAiB,QAAkC;EACjD,OAAO,OAAO,cAAc,KAAA,KAAa,KAAK,IAAI,IAAI,OAAO,YAAY,KAAK;CAChF;CAEA,MAAc,UAAU,QAAyB,KAA4B;EAC3E,MAAM,MAAM,MAAM,KAAK,MAAM,MAAM;EACnC,MAAM,QAAQ,QAAQ,KAAA,IAAY,KAAA,IAAY,MAAM,KAAK,QAAQ,OAAO,eAAe,GAAG;EAQ1F,IAJE,UAAU,YACV,UAAU,aACV,UAAU,eACT,UAAU,KAAA,KAAa,KAAK,SAAS,MAAM,GACnC;GAET,MAAM,EAAE,UAAU,KAAK;GACvB,MAAM,MAAM,eAAe,OAAO,YAAY,QAAQ;GACtD,MAAM,MAAM,WAAW,iBAAiB;IACtC,UAAU,OAAO;IACjB,YAAY,OAAO;IACnB,QAAQ,OAAO;IACf,QAAQ;IACR,IAAI;GACN,CAAC;GACD,QAAQ,KACN,cAAc,OAAO,WAAW,0BAA0B,SAAS,UAAU,wCAC/E;EACF;EACA,MAAM,KAAK,QAAQ,WAAW,YAAY,OAAO,YAAY,GAAG;CAClE;CAEA,SAAiB,IAAkC;EACjD,MAAM,EAAE,YAAY,WAAW,KAAK;EACpC,MAAM,UAAU,YAAY;GAC1B,MAAM,SAAS,MAAM,WAAW,IAAI,EAAE;GACtC,IAAI,WAAW,KAAA,GAAW,MAAM,IAAIA,4BAAAA,sBAAsB,EAAE;GAC5D,OAAO;EACT;EACA,OAAO;GACL;GACA,WAAW,OAAO,UAAU;IAI1B,MAAM,EAAE,eAAe,MAAM,QAAQ;IACrC,IAAI,eAAe,KAAA,GAAW;IAC9B,MAAM,OAAO,iBAAiB,YAAY,KAAK,UAAU,MAAM,WAAW,CAAC,CAAC,CAAC;GAC/E;GACA,WAAW,YAAY;IACrB,MAAM,SAAS,MAAM,QAAQ;IAE7B,IAAI,OAAO,cAAc,KAAA,GAAW;KAClC,IAAI,KAAK,SAAS,MAAM,GACtB,MAAM,IAAI,MAAM,GAAG,GAAG,4DAA4D;KAEpF;IACF;IACA,IAAI,OAAO,gBAAgB,KAAA,KAAa,OAAO,iBAAiB,KAAA,GAE9D,MAAM,WAAW,eAAe,IAAI,KAAK,IAAI,CAAC;IAEhD,MAAM,MAAM,MAAM,KAAK,MAAM,MAAM;IACnC,IAAI,QAAQ,KAAA,GAAW;KAErB,IAAI,KAAK,SAAS,MAAM,GAAG;KAC3B,MAAM,IAAI,MAAM,eAAe,GAAG,mCAAmC;IACvE;IAEA,MAAM,QAAQ,MAAM,OAAO,eAAe,GAAG;IAC7C,IAAI,UAAU,eAAe,UAAU,YAAY,UAAU,aAAa;IAC1E,IAAI,CAAE,MAAM,OAAO,cAAc,GAAG,GAAI,MAAM,IAAI,MAAM,YAAY,GAAG,QAAQ;IAG/E,MAAM,WAAW,YAAY,IAAI,KAAK,IAAI,CAAC;IAC3C,MAAM,IAAI,MAAM,GAAG,GAAG,2DAA2D;GACnF;GACA,QAAQ,YAAY;IAClB,MAAM,SAAS,MAAM,QAAQ;IAC7B,IAAI,KAAK,SAAS,MAAM,GAAG,OAAO,EAAE,QAAQ,UAAU;IACtD,MAAM,MAAM,MAAM,KAAK,MAAM,MAAM;IAEnC,IAAI,QAAQ,KAAA,GAAW,OAAO,EAAE,QAAQ,KAAK,SAAS,MAAM,IAAI,eAAe,UAAU;IACzF,MAAM,QAAQ,MAAM,OAAO,eAAe,GAAG;IAE7C,IAAI,UAAU,aAAa,OAAO,EAAE,QAAQ,WAAW;IACvD,IAAI,UAAU,UAAU,OAAO,EAAE,QAAQ,UAAU;IACnD,IAAI,UAAU,WAAW,OAAO,EAAE,QAAQ,UAAU;IACpD,OAAO,EAAE,QAAQ,aAAa;GAChC;EACF;CACF;AACF"}

package/dist/aws/instances.d.cts

@@ -18,16 +18,20 @@ export interface RunInput {
 }
 export declare function isRunInput(event: unknown): event is RunInput;
 /**
- * The durable execution name for an instance: the instance id itself when it fits, otherwise a
- * prefix of it with a fingerprint of the whole — stable, so every retry of the start reuses it.
+ * The durable execution name for one start of an instance: the instance id, cut to fit, with a
+ * fingerprint of the whole id (so a cut never makes two instances collide) and the attempt's
+ * token. Every retry of that start reuses the recorded name; a new attempt gets a new token.
  */
-export declare function executionName(instanceId: string): string;
+export declare function executionName(instanceId: string, attempt: string): string;
 export interface AwsInstancesOptions {
   store: JourneyStore;
   executions: ExecutionRegistry;
   lambda: LambdaApi;
-  /** The qualified function ARN an execution pinned to `contentHash` must run on. */
-  target(contentHash: string): Promise<string>;
+  /**
+   * The qualified function ARN an execution pinned to `contentHash` must run on; `version` is
+   * the code version whose routes named it.
+   */
+  target(contentHash: string, version?: string): Promise<string>;
   /**
    * How long an unconfirmed start keeps being retried. It must stay shorter than the durable
    * execution retention: past that the platform forgets the name, and a retry would start a
@@ -36,6 +40,12 @@ export interface AwsInstancesOptions {
   startRetryMs?: number;
   /** How stale a running instance's last check must be before maintenance looks again. */
   reconcileEveryMs?: number;
+  /**
+   * How long after a stop an invocation already running may still act: Lambda cannot interrupt
+   * one, and it runs on to its next checkpoint. An erasure waits this long before it erases.
+   * The function's timeout is enough; 15 minutes (Lambda's maximum) by default.
+   */
+  stopDrainMs?: number;
   now?: () => number;
 }
 export declare class AwsInstances implements WorkflowBindingLike {
@@ -43,11 +53,18 @@ export declare class AwsInstances implements WorkflowBindingLike {
   private readonly now;
   private readonly startRetryMs;
   private readonly reconcileEveryMs;
+  private readonly stopDrainMs;
   constructor(options: AwsInstancesOptions);
+  /**
+   * A start, planned for one entry attempt. Its name is new every time: a failed entry reclaimed
+   * under the same instance id (an event replayed with its ts) must start a new execution — the
+   * old name would return the closed one. Retries of this attempt reuse the recorded name.
+   */
   plan(options: {
     id: string;
     params: JourneyParams;
     ts: number;
+    version?: string | undefined;
   }): Promise<ExecutionStart>;
   create(options: {
     id: string;
@@ -68,6 +85,8 @@ export declare class AwsInstances implements WorkflowBindingLike {
    * invoke has expired by then. Before that, not finding it says nothing.
    */
   private vanished;
+  /** Stopped so recently that an invocation running at the time may still be acting. */
+  private draining;
   private reconcile;
   private instance;
 }

package/dist/aws/instances.d.cts.map

@@ -1 +1 @@
-{"version":3,"file":"instances.d.cts","names":[],"sources":["../../src/aws/instances.ts"],"mappings":";;;;;;;;;;qBAsBa;iBAEI;EACf,aAAa;EACb;EACA,QAAQ;;EAER;;wBAGc,WAAW,iBAAiB,SAAS;;;;;wBA0BrC,cAAc;iBAOb;EACf,OAAO;EACP,YAAY;EACZ,QAAQ;;EAER,OAAO,sBAAsB;;;;;;EAM7B;;EAEA;EACA;;qBAKW,wBAAwB;mBAKN;mBAJZ;mBACA;mBACA;EAEjB,YAA6B,SAAS;EAMhC,KAAK;IAAW;IAAY,QAAQ;IAAe;MAAe,QAAQ;EAe1E,OAAO;IAAW;IAAY;MAAoB,QAAQ;EAS1D,IAAI,aAAa,QAAQ;EAQzB,OAAO;IAAS;IAAkB;MAAmB;EAMrD,YAAY;UA4BJ;;UAUA;UASA;;;;;UAWN;UAIM;UA4BN"}
+{"version":3,"file":"instances.d.cts","names":[],"sources":["../../src/aws/instances.ts"],"mappings":";;;;;;;;;;qBAsBa;iBAEI;EACf,aAAa;EACb;EACA,QAAQ;;EAER;;wBAGc,WAAW,iBAAiB,SAAS;;;;;;wBA0BrC,cAAc,oBAAoB;iBAQjC;EACf,OAAO;EACP,YAAY;EACZ,QAAQ;;;;;EAKR,OAAO,qBAAqB,mBAAmB;;;;;;EAM/C;;EAEA;;;;;;EAMA;EACA;;qBAKW,wBAAwB;mBAMN;mBALZ;mBACA;mBACA;mBACA;EAEjB,YAA6B,SAAS;;;;;;EAYhC,KAAK;IACT;IACA,QAAQ;IACR;IACA;MACE,QAAQ;EAeN,OAAO;IAAW;IAAY;MAAoB,QAAQ;EAS1D,IAAI,aAAa,QAAQ;EAQzB,OAAO;IAAS;IAAkB;MAAmB;EAMrD,YAAY;UA4BJ;;UAUA;UASA;;;;;UAWN;;UAKA;UAIM;UA4BN"}

package/dist/aws/instances.d.mts

@@ -18,16 +18,20 @@ export interface RunInput {
 }
 export declare function isRunInput(event: unknown): event is RunInput;
 /**
- * The durable execution name for an instance: the instance id itself when it fits, otherwise a
- * prefix of it with a fingerprint of the whole — stable, so every retry of the start reuses it.
+ * The durable execution name for one start of an instance: the instance id, cut to fit, with a
+ * fingerprint of the whole id (so a cut never makes two instances collide) and the attempt's
+ * token. Every retry of that start reuses the recorded name; a new attempt gets a new token.
  */
-export declare function executionName(instanceId: string): string;
+export declare function executionName(instanceId: string, attempt: string): string;
 export interface AwsInstancesOptions {
   store: JourneyStore;
   executions: ExecutionRegistry;
   lambda: LambdaApi;
-  /** The qualified function ARN an execution pinned to `contentHash` must run on. */
-  target(contentHash: string): Promise<string>;
+  /**
+   * The qualified function ARN an execution pinned to `contentHash` must run on; `version` is
+   * the code version whose routes named it.
+   */
+  target(contentHash: string, version?: string): Promise<string>;
   /**
    * How long an unconfirmed start keeps being retried. It must stay shorter than the durable
    * execution retention: past that the platform forgets the name, and a retry would start a
@@ -36,6 +40,12 @@ export interface AwsInstancesOptions {
   startRetryMs?: number;
   /** How stale a running instance's last check must be before maintenance looks again. */
   reconcileEveryMs?: number;
+  /**
+   * How long after a stop an invocation already running may still act: Lambda cannot interrupt
+   * one, and it runs on to its next checkpoint. An erasure waits this long before it erases.
+   * The function's timeout is enough; 15 minutes (Lambda's maximum) by default.
+   */
+  stopDrainMs?: number;
   now?: () => number;
 }
 export declare class AwsInstances implements WorkflowBindingLike {
@@ -43,11 +53,18 @@ export declare class AwsInstances implements WorkflowBindingLike {
   private readonly now;
   private readonly startRetryMs;
   private readonly reconcileEveryMs;
+  private readonly stopDrainMs;
   constructor(options: AwsInstancesOptions);
+  /**
+   * A start, planned for one entry attempt. Its name is new every time: a failed entry reclaimed
+   * under the same instance id (an event replayed with its ts) must start a new execution — the
+   * old name would return the closed one. Retries of this attempt reuse the recorded name.
+   */
   plan(options: {
     id: string;
     params: JourneyParams;
     ts: number;
+    version?: string | undefined;
   }): Promise<ExecutionStart>;
   create(options: {
     id: string;
@@ -68,6 +85,8 @@ export declare class AwsInstances implements WorkflowBindingLike {
    * invoke has expired by then. Before that, not finding it says nothing.
    */
   private vanished;
+  /** Stopped so recently that an invocation running at the time may still be acting. */
+  private draining;
   private reconcile;
   private instance;
 }

package/dist/aws/instances.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"instances.d.mts","names":[],"sources":["../../src/aws/instances.ts"],"mappings":";;;;;;;;;;qBAsBa;iBAEI;EACf,aAAa;EACb;EACA,QAAQ;;EAER;;wBAGc,WAAW,iBAAiB,SAAS;;;;;wBA0BrC,cAAc;iBAOb;EACf,OAAO;EACP,YAAY;EACZ,QAAQ;;EAER,OAAO,sBAAsB;;;;;;EAM7B;;EAEA;EACA;;qBAKW,wBAAwB;mBAKN;mBAJZ;mBACA;mBACA;EAEjB,YAA6B,SAAS;EAMhC,KAAK;IAAW;IAAY,QAAQ;IAAe;MAAe,QAAQ;EAe1E,OAAO;IAAW;IAAY;MAAoB,QAAQ;EAS1D,IAAI,aAAa,QAAQ;EAQzB,OAAO;IAAS;IAAkB;MAAmB;EAMrD,YAAY;UA4BJ;;UAUA;UASA;;;;;UAWN;UAIM;UA4BN"}
+{"version":3,"file":"instances.d.mts","names":[],"sources":["../../src/aws/instances.ts"],"mappings":";;;;;;;;;;qBAsBa;iBAEI;EACf,aAAa;EACb;EACA,QAAQ;;EAER;;wBAGc,WAAW,iBAAiB,SAAS;;;;;;wBA0BrC,cAAc,oBAAoB;iBAQjC;EACf,OAAO;EACP,YAAY;EACZ,QAAQ;;;;;EAKR,OAAO,qBAAqB,mBAAmB;;;;;;EAM/C;;EAEA;;;;;;EAMA;EACA;;qBAKW,wBAAwB;mBAMN;mBALZ;mBACA;mBACA;mBACA;EAEjB,YAA6B,SAAS;;;;;;EAYhC,KAAK;IACT;IACA,QAAQ;IACR;IACA;MACE,QAAQ;EAeN,OAAO;IAAW;IAAY;MAAoB,QAAQ;EAS1D,IAAI,aAAa,QAAQ;EAQzB,OAAO;IAAS;IAAkB;MAAmB;EAMrD,YAAY;UA4BJ;;UAUA;UASA;;;;;UAWN;;UAKA;UAIM;UA4BN"}