@shware/workflow 3.0.0 → 3.2.0

package/dist/aws/instances.cjs

@@ -15,16 +15,16 @@ function isRunInput(event) {
 	return candidate.type === "$workflow.run" && candidate.requestContext === void 0 && typeof candidate.instanceId === "string" && typeof candidate.enteredAtMs === "number" && typeof candidate.params === "object" && candidate.params !== null;
 }
 const utf8 = new TextEncoder();
-const NAME = /^[a-zA-Z0-9_-]{1,64}$/;
 /**
-* The durable execution name for an instance: the instance id itself when it fits, otherwise a
-* prefix of it with a fingerprint of the whole — stable, so every retry of the start reuses it.
+* The durable execution name for one start of an instance: the instance id, cut to fit, with a
+* fingerprint of the whole id (so a cut never makes two instances collide) and the attempt's
+* token. Every retry of that start reuses the recorded name; a new attempt gets a new token.
 */
-function executionName(instanceId) {
-	if (NAME.test(instanceId)) return instanceId;
+function executionName(instanceId, attempt) {
 	const safe = instanceId.replace(/[^a-zA-Z0-9_-]/g, "-");
-	const fingerprint = `${require_engine_bucket.murmur3(utf8.encode(instanceId)).toString(36)}${require_engine_bucket.murmur3(utf8.encode(instanceId), 2538058380).toString(36)}`;
-	return `${safe.slice(0, 63 - fingerprint.length)}-${fingerprint}`;
+	const token = attempt.replace(/[^a-zA-Z0-9]/g, "").slice(0, 8);
+	const suffix = `-${`${require_engine_bucket.murmur3(utf8.encode(instanceId)).toString(36)}${require_engine_bucket.murmur3(utf8.encode(instanceId), 2538058380).toString(36)}`}-${token}`;
+	return `${safe.slice(0, 64 - suffix.length)}${suffix}`;
 }
 const MINUTE = 6e4;
 var AwsInstances = class {
@@ -32,12 +32,19 @@ var AwsInstances = class {
 	now;
 	startRetryMs;
 	reconcileEveryMs;
+	stopDrainMs;
 	constructor(options) {
 		this.options = options;
 		this.now = options.now ?? Date.now;
 		this.startRetryMs = options.startRetryMs ?? 720 * MINUTE;
 		this.reconcileEveryMs = options.reconcileEveryMs ?? 15 * MINUTE;
+		this.stopDrainMs = options.stopDrainMs ?? 15 * MINUTE;
 	}
+	/**
+	* A start, planned for one entry attempt. Its name is new every time: a failed entry reclaimed
+	* under the same instance id (an event replayed with its ts) must start a new execution — the
+	* old name would return the closed one. Retries of this attempt reuse the recorded name.
+	*/
 	async plan(options) {
 		const input = {
 			type: RUN_EVENT_TYPE,
@@ -46,8 +53,8 @@ var AwsInstances = class {
 			enteredAtMs: this.now()
 		};
 		return {
-			name: executionName(options.id),
-			target: await this.options.target(options.params.contentHash),
+			name: executionName(options.id, crypto.randomUUID().slice(0, 8)),
+			target: await this.options.target(options.params.contentHash, options.version),
 			input: JSON.stringify(input)
 		};
 	}
@@ -113,6 +120,10 @@ var AwsInstances = class {
 	vanished(record) {
 		return this.now() - record.createdAt > this.startRetryMs;
 	}
+	/** Stopped so recently that an invocation running at the time may still be acting. */
+	draining(record) {
+		return record.stoppedAt !== void 0 && this.now() - record.stoppedAt < this.stopDrainMs;
+	}
 	async reconcile(record, now) {
 		const arn = await this.arnOf(record);
 		const state = arn === void 0 ? void 0 : await this.options.lambda.executionState(arn);
@@ -146,16 +157,25 @@ var AwsInstances = class {
 			},
 			terminate: async () => {
 				const record = await current();
+				if (record.stoppedAt !== void 0) {
+					if (this.draining(record)) throw new Error(`${id} was stopped; its running invocation may still be finishing`);
+					return;
+				}
 				if (record.submittedAt === void 0 && record.unresolvedAt === void 0) await executions.markUnresolved(id, this.now());
 				const arn = await this.arnOf(record);
 				if (arn === void 0) {
 					if (this.vanished(record)) return;
 					throw new Error(`cannot stop ${id} yet: its execution is not visible`);
 				}
+				const state = await lambda.executionState(arn);
+				if (state === "succeeded" || state === "failed" || state === "timed_out") return;
 				if (!await lambda.stopExecution(arn)) throw new Error(`stopping ${id} failed`);
+				await executions.markStopped(id, this.now());
+				throw new Error(`${id} is stopped; its running invocation may still be finishing`);
 			},
 			status: async () => {
 				const record = await current();
+				if (this.draining(record)) return { status: "running" };
 				const arn = await this.arnOf(record);
 				if (arn === void 0) return { status: this.vanished(record) ? "terminated" : "running" };
 				const state = await lambda.executionState(arn);

package/dist/aws/instances.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"instances.cjs","names":["murmur3","InstanceNotFoundError"],"sources":["../../src/aws/instances.ts"],"sourcesContent":["import {\n  InstanceNotFoundError,\n  type JourneyParams,\n  type WorkflowBindingLike,\n  type WorkflowInstanceLike,\n} from '../cloudflare/bindings';\nimport { murmur3 } from '../engine/bucket';\nimport type {\n  ExecutionRecord,\n  ExecutionRegistry,\n  ExecutionStart,\n  JourneyStore,\n} from '../store/index';\nimport type { LambdaApi } from './lambda-api';\n\n/**\n * The router's instance port over Lambda durable executions: an instance is one execution of\n * this same function, started by an asynchronous self-invoke under a stable execution name;\n * a wake completes the callback its current wait parks on; stopping stops the execution.\n */\n\n/** The top-level shape of an internal run: what the self-invoke sends, never an HTTP body. */\nexport const RUN_EVENT_TYPE = '$workflow.run';\n\nexport interface RunInput {\n  type: typeof RUN_EVENT_TYPE;\n  instanceId: string;\n  params: JourneyParams;\n  /** When the instance was created (as Cloudflare's event timestamp): its entry anchor, fixed with the start. */\n  enteredAtMs: number;\n}\n\nexport function isRunInput(event: unknown): event is RunInput {\n  if (typeof event !== 'object' || event === null) return false;\n  const candidate = event as {\n    type?: unknown;\n    instanceId?: unknown;\n    enteredAtMs?: unknown;\n    params?: unknown;\n    requestContext?: unknown;\n  };\n  return (\n    candidate.type === RUN_EVENT_TYPE &&\n    candidate.requestContext === undefined &&\n    typeof candidate.instanceId === 'string' &&\n    typeof candidate.enteredAtMs === 'number' &&\n    typeof candidate.params === 'object' &&\n    candidate.params !== null\n  );\n}\n\nconst utf8 = new TextEncoder();\nconst NAME = /^[a-zA-Z0-9_-]{1,64}$/;\n\n/**\n * The durable execution name for an instance: the instance id itself when it fits, otherwise a\n * prefix of it with a fingerprint of the whole — stable, so every retry of the start reuses it.\n */\nexport function executionName(instanceId: string): string {\n  if (NAME.test(instanceId)) return instanceId;\n  const safe = instanceId.replace(/[^a-zA-Z0-9_-]/g, '-');\n  const fingerprint = `${murmur3(utf8.encode(instanceId)).toString(36)}${murmur3(utf8.encode(instanceId), 0x9747b28c).toString(36)}`;\n  return `${safe.slice(0, 63 - fingerprint.length)}-${fingerprint}`;\n}\n\nexport interface AwsInstancesOptions {\n  store: JourneyStore;\n  executions: ExecutionRegistry;\n  lambda: LambdaApi;\n  /** The qualified function ARN an execution pinned to `contentHash` must run on. */\n  target(contentHash: string): Promise<string>;\n  /**\n   * How long an unconfirmed start keeps being retried. It must stay shorter than the durable\n   * execution retention: past that the platform forgets the name, and a retry would start a\n   * second execution. Twelve hours by default.\n   */\n  startRetryMs?: number;\n  /** How stale a running instance's last check must be before maintenance looks again. */\n  reconcileEveryMs?: number;\n  now?: () => number;\n}\n\nconst MINUTE = 60_000;\n\nexport class AwsInstances implements WorkflowBindingLike {\n  private readonly now: () => number;\n  private readonly startRetryMs: number;\n  private readonly reconcileEveryMs: number;\n\n  constructor(private readonly options: AwsInstancesOptions) {\n    this.now = options.now ?? Date.now;\n    this.startRetryMs = options.startRetryMs ?? 12 * 60 * MINUTE;\n    this.reconcileEveryMs = options.reconcileEveryMs ?? 15 * MINUTE;\n  }\n\n  async plan(options: { id: string; params: JourneyParams; ts: number }): Promise<ExecutionStart> {\n    const input: RunInput = {\n      type: RUN_EVENT_TYPE,\n      instanceId: options.id,\n      params: options.params,\n      // The moment the instance is created, like Cloudflare's: an event's own ts may be long past\n      enteredAtMs: this.now(),\n    };\n    return {\n      name: executionName(options.id),\n      target: await this.options.target(options.params.contentHash),\n      input: JSON.stringify(input),\n    };\n  }\n\n  async create(options: { id: string; params: unknown }): Promise<WorkflowInstanceLike> {\n    const record = await this.options.executions.get(options.id);\n    if (record === undefined) {\n      throw new Error(`no start is recorded for ${options.id}: the entry must be planned first`);\n    }\n    await this.submit(record);\n    return this.instance(options.id);\n  }\n\n  async get(id: string): Promise<WorkflowInstanceLike> {\n    // A read of the registry alone: a Lambda failure must never read as \"no such instance\"\n    if ((await this.options.executions.get(id)) === undefined) {\n      throw new InstanceNotFoundError(id);\n    }\n    return this.instance(id);\n  }\n\n  async resume(entry: { workflow: string; userId: string }): Promise<void> {\n    for (const record of await this.options.executions.pendingStarts({ ...entry, limit: 1 })) {\n      if (!(await this.giveUpIfStale(record))) await this.submit(record);\n    }\n  }\n\n  async maintain(): Promise<void> {\n    const now = this.now();\n    const failures: unknown[] = [];\n    // Starts whose submit never confirmed: retried with the recorded name and payload\n    for (const record of await this.options.executions.pendingStarts({\n      createdBefore: now - MINUTE,\n      limit: 25,\n    })) {\n      try {\n        if (!(await this.giveUpIfStale(record))) await this.submit(record);\n      } catch (error) {\n        failures.push(error);\n      }\n    }\n    // Executions the platform ended without the run finalizing (a timeout, a stop, a crash)\n    for (const record of await this.options.executions.toReconcile(\n      25,\n      now - this.reconcileEveryMs\n    )) {\n      try {\n        await this.reconcile(record, now);\n      } catch (error) {\n        failures.push(error);\n      }\n    }\n    if (failures.length > 0) throw failures[0];\n  }\n\n  private async submit(record: ExecutionRecord): Promise<void> {\n    const { arn } = await this.options.lambda.startExecution({\n      target: record.target,\n      name: record.name,\n      payload: record.input,\n    });\n    await this.options.executions.markSubmitted(record.instanceId, arn, this.now());\n  }\n\n  /** Past the retry budget a start is unresolved for good: no retry could tell a duplicate apart. */\n  private async giveUpIfStale(record: ExecutionRecord): Promise<boolean> {\n    if (this.now() - record.createdAt <= this.startRetryMs) return false;\n    await this.options.executions.markUnresolved(record.instanceId, this.now());\n    console.error(\n      `[workflow] the start of ${record.instanceId} (${record.name}) was never confirmed: left unresolved`\n    );\n    return true;\n  }\n\n  private async arnOf(record: ExecutionRecord): Promise<string | undefined> {\n    if (record.arn !== undefined) return record.arn;\n    const arn = await this.options.lambda.findExecution(record.target, record.name);\n    if (arn !== undefined) await this.options.executions.setArn(record.instanceId, arn);\n    return arn;\n  }\n\n  /**\n   * Past the start retry budget, an execution still nowhere to be seen never started: any queued\n   * invoke has expired by then. Before that, not finding it says nothing.\n   */\n  private vanished(record: ExecutionRecord): boolean {\n    return this.now() - record.createdAt > this.startRetryMs;\n  }\n\n  private async reconcile(record: ExecutionRecord, now: number): Promise<void> {\n    const arn = await this.arnOf(record);\n    const state = arn === undefined ? undefined : await this.options.lambda.executionState(arn);\n    // Only a state that will never run another step — or one missing for good — ends the entry;\n    // a run still queued, or not visible yet, is left alone\n    const ended =\n      state === 'failed' ||\n      state === 'stopped' ||\n      state === 'timed_out' ||\n      (state === undefined && this.vanished(record));\n    if (ended) {\n      // Ended without its finalize step: the ledger must not show it running forever\n      const { store } = this.options;\n      await store.setEntryStatus(record.instanceId, 'failed');\n      await store.reporting?.instanceFinished({\n        workflow: record.workflow,\n        instanceId: record.instanceId,\n        userId: record.userId,\n        status: 'failed',\n        at: now,\n      });\n      console.warn(\n        `[workflow] ${record.instanceId} ended on the platform (${state ?? 'unknown'}) without finishing: recorded as failed`\n      );\n    }\n    await this.options.executions.markChecked(record.instanceId, now);\n  }\n\n  private instance(id: string): WorkflowInstanceLike {\n    const { executions, lambda } = this.options;\n    const current = async () => {\n      const record = await executions.get(id);\n      if (record === undefined) throw new InstanceNotFoundError(id);\n      return record;\n    };\n    return {\n      id,\n      sendEvent: async (event) => {\n        // The wait parked now, read at the moment of the wake: a newer wait's callback replaces\n        // an older one, and a wake for none (the instance is between waits) is nothing to do —\n        // its next wait re-reads the facts before parking\n        const { callbackId } = await current();\n        if (callbackId === undefined) return;\n        await lambda.completeCallback(callbackId, JSON.stringify(event.payload ?? {}));\n      },\n      terminate: async () => {\n        const record = await current();\n        if (record.submittedAt === undefined && record.unresolvedAt === undefined) {\n          // No retry may start it after this\n          await executions.markUnresolved(id, this.now());\n        }\n        const arn = await this.arnOf(record);\n        if (arn === undefined) {\n          // Not visible yet is not stopped: the erasure stays pending, and the sweep retries\n          if (this.vanished(record)) return;\n          throw new Error(`cannot stop ${id} yet: its execution is not visible`);\n        }\n        if (!(await lambda.stopExecution(arn))) throw new Error(`stopping ${id} failed`);\n      },\n      status: async () => {\n        const record = await current();\n        const arn = await this.arnOf(record);\n        // Not visible yet may still run: only one missing past the budget is gone\n        if (arn === undefined) return { status: this.vanished(record) ? 'terminated' : 'running' };\n        const state = await lambda.executionState(arn);\n        // In the router's vocabulary (Cloudflare's): what will never run another step\n        if (state === 'succeeded') return { status: 'complete' };\n        if (state === 'failed') return { status: 'errored' };\n        if (state === 'running') return { status: 'running' };\n        return { status: 'terminated' };\n      },\n    };\n  }\n}\n"],"mappings":";;;;;;;;;;AAsBA,MAAa,iBAAiB;AAU9B,SAAgB,WAAW,OAAmC;CAC5D,IAAI,OAAO,UAAU,YAAY,UAAU,MAAM,OAAO;CACxD,MAAM,YAAY;CAOlB,OACE,UAAU,SAAA,mBACV,UAAU,mBAAmB,KAAA,KAC7B,OAAO,UAAU,eAAe,YAChC,OAAO,UAAU,gBAAgB,YACjC,OAAO,UAAU,WAAW,YAC5B,UAAU,WAAW;AAEzB;AAEA,MAAM,OAAO,IAAI,YAAY;AAC7B,MAAM,OAAO;;;;;AAMb,SAAgB,cAAc,YAA4B;CACxD,IAAI,KAAK,KAAK,UAAU,GAAG,OAAO;CAClC,MAAM,OAAO,WAAW,QAAQ,mBAAmB,GAAG;CACtD,MAAM,cAAc,GAAGA,sBAAAA,QAAQ,KAAK,OAAO,UAAU,CAAC,CAAC,CAAC,SAAS,EAAE,IAAIA,sBAAAA,QAAQ,KAAK,OAAO,UAAU,GAAG,UAAU,CAAC,CAAC,SAAS,EAAE;CAC/H,OAAO,GAAG,KAAK,MAAM,GAAG,KAAK,YAAY,MAAM,EAAE,GAAG;AACtD;AAmBA,MAAM,SAAS;AAEf,IAAa,eAAb,MAAyD;CAK1B;CAJ7B;CACA;CACA;CAEA,YAAY,SAA+C;EAA9B,KAAA,UAAA;EAC3B,KAAK,MAAM,QAAQ,OAAO,KAAK;EAC/B,KAAK,eAAe,QAAQ,gBAAgB,MAAU;EACtD,KAAK,mBAAmB,QAAQ,oBAAoB,KAAK;CAC3D;CAEA,MAAM,KAAK,SAAqF;EAC9F,MAAM,QAAkB;GACtB,MAAM;GACN,YAAY,QAAQ;GACpB,QAAQ,QAAQ;GAEhB,aAAa,KAAK,IAAI;EACxB;EACA,OAAO;GACL,MAAM,cAAc,QAAQ,EAAE;GAC9B,QAAQ,MAAM,KAAK,QAAQ,OAAO,QAAQ,OAAO,WAAW;GAC5D,OAAO,KAAK,UAAU,KAAK;EAC7B;CACF;CAEA,MAAM,OAAO,SAAyE;EACpF,MAAM,SAAS,MAAM,KAAK,QAAQ,WAAW,IAAI,QAAQ,EAAE;EAC3D,IAAI,WAAW,KAAA,GACb,MAAM,IAAI,MAAM,4BAA4B,QAAQ,GAAG,kCAAkC;EAE3F,MAAM,KAAK,OAAO,MAAM;EACxB,OAAO,KAAK,SAAS,QAAQ,EAAE;CACjC;CAEA,MAAM,IAAI,IAA2C;EAEnD,IAAK,MAAM,KAAK,QAAQ,WAAW,IAAI,EAAE,MAAO,KAAA,GAC9C,MAAM,IAAIC,4BAAAA,sBAAsB,EAAE;EAEpC,OAAO,KAAK,SAAS,EAAE;CACzB;CAEA,MAAM,OAAO,OAA4D;EACvE,KAAK,MAAM,UAAU,MAAM,KAAK,QAAQ,WAAW,cAAc;GAAE,GAAG;GAAO,OAAO;EAAE,CAAC,GACrF,IAAI,CAAE,MAAM,KAAK,cAAc,MAAM,GAAI,MAAM,KAAK,OAAO,MAAM;CAErE;CAEA,MAAM,WAA0B;EAC9B,MAAM,MAAM,KAAK,IAAI;EACrB,MAAM,WAAsB,CAAC;EAE7B,KAAK,MAAM,UAAU,MAAM,KAAK,QAAQ,WAAW,cAAc;GAC/D,eAAe,MAAM;GACrB,OAAO;EACT,CAAC,GACC,IAAI;GACF,IAAI,CAAE,MAAM,KAAK,cAAc,MAAM,GAAI,MAAM,KAAK,OAAO,MAAM;EACnE,SAAS,OAAO;GACd,SAAS,KAAK,KAAK;EACrB;EAGF,KAAK,MAAM,UAAU,MAAM,KAAK,QAAQ,WAAW,YACjD,IACA,MAAM,KAAK,gBACb,GACE,IAAI;GACF,MAAM,KAAK,UAAU,QAAQ,GAAG;EAClC,SAAS,OAAO;GACd,SAAS,KAAK,KAAK;EACrB;EAEF,IAAI,SAAS,SAAS,GAAG,MAAM,SAAS;CAC1C;CAEA,MAAc,OAAO,QAAwC;EAC3D,MAAM,EAAE,QAAQ,MAAM,KAAK,QAAQ,OAAO,eAAe;GACvD,QAAQ,OAAO;GACf,MAAM,OAAO;GACb,SAAS,OAAO;EAClB,CAAC;EACD,MAAM,KAAK,QAAQ,WAAW,cAAc,OAAO,YAAY,KAAK,KAAK,IAAI,CAAC;CAChF;;CAGA,MAAc,cAAc,QAA2C;EACrE,IAAI,KAAK,IAAI,IAAI,OAAO,aAAa,KAAK,cAAc,OAAO;EAC/D,MAAM,KAAK,QAAQ,WAAW,eAAe,OAAO,YAAY,KAAK,IAAI,CAAC;EAC1E,QAAQ,MACN,2BAA2B,OAAO,WAAW,IAAI,OAAO,KAAK,uCAC/D;EACA,OAAO;CACT;CAEA,MAAc,MAAM,QAAsD;EACxE,IAAI,OAAO,QAAQ,KAAA,GAAW,OAAO,OAAO;EAC5C,MAAM,MAAM,MAAM,KAAK,QAAQ,OAAO,cAAc,OAAO,QAAQ,OAAO,IAAI;EAC9E,IAAI,QAAQ,KAAA,GAAW,MAAM,KAAK,QAAQ,WAAW,OAAO,OAAO,YAAY,GAAG;EAClF,OAAO;CACT;;;;;CAMA,SAAiB,QAAkC;EACjD,OAAO,KAAK,IAAI,IAAI,OAAO,YAAY,KAAK;CAC9C;CAEA,MAAc,UAAU,QAAyB,KAA4B;EAC3E,MAAM,MAAM,MAAM,KAAK,MAAM,MAAM;EACnC,MAAM,QAAQ,QAAQ,KAAA,IAAY,KAAA,IAAY,MAAM,KAAK,QAAQ,OAAO,eAAe,GAAG;EAQ1F,IAJE,UAAU,YACV,UAAU,aACV,UAAU,eACT,UAAU,KAAA,KAAa,KAAK,SAAS,MAAM,GACnC;GAET,MAAM,EAAE,UAAU,KAAK;GACvB,MAAM,MAAM,eAAe,OAAO,YAAY,QAAQ;GACtD,MAAM,MAAM,WAAW,iBAAiB;IACtC,UAAU,OAAO;IACjB,YAAY,OAAO;IACnB,QAAQ,OAAO;IACf,QAAQ;IACR,IAAI;GACN,CAAC;GACD,QAAQ,KACN,cAAc,OAAO,WAAW,0BAA0B,SAAS,UAAU,wCAC/E;EACF;EACA,MAAM,KAAK,QAAQ,WAAW,YAAY,OAAO,YAAY,GAAG;CAClE;CAEA,SAAiB,IAAkC;EACjD,MAAM,EAAE,YAAY,WAAW,KAAK;EACpC,MAAM,UAAU,YAAY;GAC1B,MAAM,SAAS,MAAM,WAAW,IAAI,EAAE;GACtC,IAAI,WAAW,KAAA,GAAW,MAAM,IAAIA,4BAAAA,sBAAsB,EAAE;GAC5D,OAAO;EACT;EACA,OAAO;GACL;GACA,WAAW,OAAO,UAAU;IAI1B,MAAM,EAAE,eAAe,MAAM,QAAQ;IACrC,IAAI,eAAe,KAAA,GAAW;IAC9B,MAAM,OAAO,iBAAiB,YAAY,KAAK,UAAU,MAAM,WAAW,CAAC,CAAC,CAAC;GAC/E;GACA,WAAW,YAAY;IACrB,MAAM,SAAS,MAAM,QAAQ;IAC7B,IAAI,OAAO,gBAAgB,KAAA,KAAa,OAAO,iBAAiB,KAAA,GAE9D,MAAM,WAAW,eAAe,IAAI,KAAK,IAAI,CAAC;IAEhD,MAAM,MAAM,MAAM,KAAK,MAAM,MAAM;IACnC,IAAI,QAAQ,KAAA,GAAW;KAErB,IAAI,KAAK,SAAS,MAAM,GAAG;KAC3B,MAAM,IAAI,MAAM,eAAe,GAAG,mCAAmC;IACvE;IACA,IAAI,CAAE,MAAM,OAAO,cAAc,GAAG,GAAI,MAAM,IAAI,MAAM,YAAY,GAAG,QAAQ;GACjF;GACA,QAAQ,YAAY;IAClB,MAAM,SAAS,MAAM,QAAQ;IAC7B,MAAM,MAAM,MAAM,KAAK,MAAM,MAAM;IAEnC,IAAI,QAAQ,KAAA,GAAW,OAAO,EAAE,QAAQ,KAAK,SAAS,MAAM,IAAI,eAAe,UAAU;IACzF,MAAM,QAAQ,MAAM,OAAO,eAAe,GAAG;IAE7C,IAAI,UAAU,aAAa,OAAO,EAAE,QAAQ,WAAW;IACvD,IAAI,UAAU,UAAU,OAAO,EAAE,QAAQ,UAAU;IACnD,IAAI,UAAU,WAAW,OAAO,EAAE,QAAQ,UAAU;IACpD,OAAO,EAAE,QAAQ,aAAa;GAChC;EACF;CACF;AACF"}
+{"version":3,"file":"instances.cjs","names":["murmur3","InstanceNotFoundError"],"sources":["../../src/aws/instances.ts"],"sourcesContent":["import {\n  InstanceNotFoundError,\n  type JourneyParams,\n  type WorkflowBindingLike,\n  type WorkflowInstanceLike,\n} from '../cloudflare/bindings';\nimport { murmur3 } from '../engine/bucket';\nimport type {\n  ExecutionRecord,\n  ExecutionRegistry,\n  ExecutionStart,\n  JourneyStore,\n} from '../store/index';\nimport type { LambdaApi } from './lambda-api';\n\n/**\n * The router's instance port over Lambda durable executions: an instance is one execution of\n * this same function, started by an asynchronous self-invoke under a stable execution name;\n * a wake completes the callback its current wait parks on; stopping stops the execution.\n */\n\n/** The top-level shape of an internal run: what the self-invoke sends, never an HTTP body. */\nexport const RUN_EVENT_TYPE = '$workflow.run';\n\nexport interface RunInput {\n  type: typeof RUN_EVENT_TYPE;\n  instanceId: string;\n  params: JourneyParams;\n  /** When the instance was created (as Cloudflare's event timestamp): its entry anchor, fixed with the start. */\n  enteredAtMs: number;\n}\n\nexport function isRunInput(event: unknown): event is RunInput {\n  if (typeof event !== 'object' || event === null) return false;\n  const candidate = event as {\n    type?: unknown;\n    instanceId?: unknown;\n    enteredAtMs?: unknown;\n    params?: unknown;\n    requestContext?: unknown;\n  };\n  return (\n    candidate.type === RUN_EVENT_TYPE &&\n    candidate.requestContext === undefined &&\n    typeof candidate.instanceId === 'string' &&\n    typeof candidate.enteredAtMs === 'number' &&\n    typeof candidate.params === 'object' &&\n    candidate.params !== null\n  );\n}\n\nconst utf8 = new TextEncoder();\n\n/**\n * The durable execution name for one start of an instance: the instance id, cut to fit, with a\n * fingerprint of the whole id (so a cut never makes two instances collide) and the attempt's\n * token. Every retry of that start reuses the recorded name; a new attempt gets a new token.\n */\nexport function executionName(instanceId: string, attempt: string): string {\n  const safe = instanceId.replace(/[^a-zA-Z0-9_-]/g, '-');\n  const token = attempt.replace(/[^a-zA-Z0-9]/g, '').slice(0, 8);\n  const fingerprint = `${murmur3(utf8.encode(instanceId)).toString(36)}${murmur3(utf8.encode(instanceId), 0x9747b28c).toString(36)}`;\n  const suffix = `-${fingerprint}-${token}`;\n  return `${safe.slice(0, 64 - suffix.length)}${suffix}`;\n}\n\nexport interface AwsInstancesOptions {\n  store: JourneyStore;\n  executions: ExecutionRegistry;\n  lambda: LambdaApi;\n  /**\n   * The qualified function ARN an execution pinned to `contentHash` must run on; `version` is\n   * the code version whose routes named it.\n   */\n  target(contentHash: string, version?: string): Promise<string>;\n  /**\n   * How long an unconfirmed start keeps being retried. It must stay shorter than the durable\n   * execution retention: past that the platform forgets the name, and a retry would start a\n   * second execution. Twelve hours by default.\n   */\n  startRetryMs?: number;\n  /** How stale a running instance's last check must be before maintenance looks again. */\n  reconcileEveryMs?: number;\n  /**\n   * How long after a stop an invocation already running may still act: Lambda cannot interrupt\n   * one, and it runs on to its next checkpoint. An erasure waits this long before it erases.\n   * The function's timeout is enough; 15 minutes (Lambda's maximum) by default.\n   */\n  stopDrainMs?: number;\n  now?: () => number;\n}\n\nconst MINUTE = 60_000;\n\nexport class AwsInstances implements WorkflowBindingLike {\n  private readonly now: () => number;\n  private readonly startRetryMs: number;\n  private readonly reconcileEveryMs: number;\n  private readonly stopDrainMs: number;\n\n  constructor(private readonly options: AwsInstancesOptions) {\n    this.now = options.now ?? Date.now;\n    this.startRetryMs = options.startRetryMs ?? 12 * 60 * MINUTE;\n    this.reconcileEveryMs = options.reconcileEveryMs ?? 15 * MINUTE;\n    this.stopDrainMs = options.stopDrainMs ?? 15 * MINUTE;\n  }\n\n  /**\n   * A start, planned for one entry attempt. Its name is new every time: a failed entry reclaimed\n   * under the same instance id (an event replayed with its ts) must start a new execution — the\n   * old name would return the closed one. Retries of this attempt reuse the recorded name.\n   */\n  async plan(options: {\n    id: string;\n    params: JourneyParams;\n    ts: number;\n    version?: string | undefined;\n  }): Promise<ExecutionStart> {\n    const input: RunInput = {\n      type: RUN_EVENT_TYPE,\n      instanceId: options.id,\n      params: options.params,\n      // The moment the instance is created, like Cloudflare's: an event's own ts may be long past\n      enteredAtMs: this.now(),\n    };\n    return {\n      name: executionName(options.id, crypto.randomUUID().slice(0, 8)),\n      target: await this.options.target(options.params.contentHash, options.version),\n      input: JSON.stringify(input),\n    };\n  }\n\n  async create(options: { id: string; params: unknown }): Promise<WorkflowInstanceLike> {\n    const record = await this.options.executions.get(options.id);\n    if (record === undefined) {\n      throw new Error(`no start is recorded for ${options.id}: the entry must be planned first`);\n    }\n    await this.submit(record);\n    return this.instance(options.id);\n  }\n\n  async get(id: string): Promise<WorkflowInstanceLike> {\n    // A read of the registry alone: a Lambda failure must never read as \"no such instance\"\n    if ((await this.options.executions.get(id)) === undefined) {\n      throw new InstanceNotFoundError(id);\n    }\n    return this.instance(id);\n  }\n\n  async resume(entry: { workflow: string; userId: string }): Promise<void> {\n    for (const record of await this.options.executions.pendingStarts({ ...entry, limit: 1 })) {\n      if (!(await this.giveUpIfStale(record))) await this.submit(record);\n    }\n  }\n\n  async maintain(): Promise<void> {\n    const now = this.now();\n    const failures: unknown[] = [];\n    // Starts whose submit never confirmed: retried with the recorded name and payload\n    for (const record of await this.options.executions.pendingStarts({\n      createdBefore: now - MINUTE,\n      limit: 25,\n    })) {\n      try {\n        if (!(await this.giveUpIfStale(record))) await this.submit(record);\n      } catch (error) {\n        failures.push(error);\n      }\n    }\n    // Executions the platform ended without the run finalizing (a timeout, a stop, a crash)\n    for (const record of await this.options.executions.toReconcile(\n      25,\n      now - this.reconcileEveryMs\n    )) {\n      try {\n        await this.reconcile(record, now);\n      } catch (error) {\n        failures.push(error);\n      }\n    }\n    if (failures.length > 0) throw failures[0];\n  }\n\n  private async submit(record: ExecutionRecord): Promise<void> {\n    const { arn } = await this.options.lambda.startExecution({\n      target: record.target,\n      name: record.name,\n      payload: record.input,\n    });\n    await this.options.executions.markSubmitted(record.instanceId, arn, this.now());\n  }\n\n  /** Past the retry budget a start is unresolved for good: no retry could tell a duplicate apart. */\n  private async giveUpIfStale(record: ExecutionRecord): Promise<boolean> {\n    if (this.now() - record.createdAt <= this.startRetryMs) return false;\n    await this.options.executions.markUnresolved(record.instanceId, this.now());\n    console.error(\n      `[workflow] the start of ${record.instanceId} (${record.name}) was never confirmed: left unresolved`\n    );\n    return true;\n  }\n\n  private async arnOf(record: ExecutionRecord): Promise<string | undefined> {\n    if (record.arn !== undefined) return record.arn;\n    const arn = await this.options.lambda.findExecution(record.target, record.name);\n    if (arn !== undefined) await this.options.executions.setArn(record.instanceId, arn);\n    return arn;\n  }\n\n  /**\n   * Past the start retry budget, an execution still nowhere to be seen never started: any queued\n   * invoke has expired by then. Before that, not finding it says nothing.\n   */\n  private vanished(record: ExecutionRecord): boolean {\n    return this.now() - record.createdAt > this.startRetryMs;\n  }\n\n  /** Stopped so recently that an invocation running at the time may still be acting. */\n  private draining(record: ExecutionRecord): boolean {\n    return record.stoppedAt !== undefined && this.now() - record.stoppedAt < this.stopDrainMs;\n  }\n\n  private async reconcile(record: ExecutionRecord, now: number): Promise<void> {\n    const arn = await this.arnOf(record);\n    const state = arn === undefined ? undefined : await this.options.lambda.executionState(arn);\n    // Only a state that will never run another step — or one missing for good — ends the entry;\n    // a run still queued, or not visible yet, is left alone\n    const ended =\n      state === 'failed' ||\n      state === 'stopped' ||\n      state === 'timed_out' ||\n      (state === undefined && this.vanished(record));\n    if (ended) {\n      // Ended without its finalize step: the ledger must not show it running forever\n      const { store } = this.options;\n      await store.setEntryStatus(record.instanceId, 'failed');\n      await store.reporting?.instanceFinished({\n        workflow: record.workflow,\n        instanceId: record.instanceId,\n        userId: record.userId,\n        status: 'failed',\n        at: now,\n      });\n      console.warn(\n        `[workflow] ${record.instanceId} ended on the platform (${state ?? 'unknown'}) without finishing: recorded as failed`\n      );\n    }\n    await this.options.executions.markChecked(record.instanceId, now);\n  }\n\n  private instance(id: string): WorkflowInstanceLike {\n    const { executions, lambda } = this.options;\n    const current = async () => {\n      const record = await executions.get(id);\n      if (record === undefined) throw new InstanceNotFoundError(id);\n      return record;\n    };\n    return {\n      id,\n      sendEvent: async (event) => {\n        // The wait parked now, read at the moment of the wake: a newer wait's callback replaces\n        // an older one, and a wake for none (the instance is between waits) is nothing to do —\n        // its next wait re-reads the facts before parking\n        const { callbackId } = await current();\n        if (callbackId === undefined) return;\n        await lambda.completeCallback(callbackId, JSON.stringify(event.payload ?? {}));\n      },\n      terminate: async () => {\n        const record = await current();\n        // Stopped before: done once an invocation that was running then has had time to end\n        if (record.stoppedAt !== undefined) {\n          if (this.draining(record)) {\n            throw new Error(`${id} was stopped; its running invocation may still be finishing`);\n          }\n          return;\n        }\n        if (record.submittedAt === undefined && record.unresolvedAt === undefined) {\n          // No retry may start it after this\n          await executions.markUnresolved(id, this.now());\n        }\n        const arn = await this.arnOf(record);\n        if (arn === undefined) {\n          // Not visible yet is not stopped: the erasure stays pending, and the sweep retries\n          if (this.vanished(record)) return;\n          throw new Error(`cannot stop ${id} yet: its execution is not visible`);\n        }\n        // One that finished on its own has no invocation left to drain\n        const state = await lambda.executionState(arn);\n        if (state === 'succeeded' || state === 'failed' || state === 'timed_out') return;\n        if (!(await lambda.stopExecution(arn))) throw new Error(`stopping ${id} failed`);\n        // A stop does not interrupt an invocation already running: it goes on to its next\n        // checkpoint, side effects included. The erasure waits (see stopDrainMs)\n        await executions.markStopped(id, this.now());\n        throw new Error(`${id} is stopped; its running invocation may still be finishing`);\n      },\n      status: async () => {\n        const record = await current();\n        if (this.draining(record)) return { status: 'running' };\n        const arn = await this.arnOf(record);\n        // Not visible yet may still run: only one missing past the budget is gone\n        if (arn === undefined) return { status: this.vanished(record) ? 'terminated' : 'running' };\n        const state = await lambda.executionState(arn);\n        // In the router's vocabulary (Cloudflare's): what will never run another step\n        if (state === 'succeeded') return { status: 'complete' };\n        if (state === 'failed') return { status: 'errored' };\n        if (state === 'running') return { status: 'running' };\n        return { status: 'terminated' };\n      },\n    };\n  }\n}\n"],"mappings":";;;;;;;;;;AAsBA,MAAa,iBAAiB;AAU9B,SAAgB,WAAW,OAAmC;CAC5D,IAAI,OAAO,UAAU,YAAY,UAAU,MAAM,OAAO;CACxD,MAAM,YAAY;CAOlB,OACE,UAAU,SAAA,mBACV,UAAU,mBAAmB,KAAA,KAC7B,OAAO,UAAU,eAAe,YAChC,OAAO,UAAU,gBAAgB,YACjC,OAAO,UAAU,WAAW,YAC5B,UAAU,WAAW;AAEzB;AAEA,MAAM,OAAO,IAAI,YAAY;;;;;;AAO7B,SAAgB,cAAc,YAAoB,SAAyB;CACzE,MAAM,OAAO,WAAW,QAAQ,mBAAmB,GAAG;CACtD,MAAM,QAAQ,QAAQ,QAAQ,iBAAiB,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC;CAE7D,MAAM,SAAS,IAAI,GADIA,sBAAAA,QAAQ,KAAK,OAAO,UAAU,CAAC,CAAC,CAAC,SAAS,EAAE,IAAIA,sBAAAA,QAAQ,KAAK,OAAO,UAAU,GAAG,UAAU,CAAC,CAAC,SAAS,EAAE,IAChG,GAAG;CAClC,OAAO,GAAG,KAAK,MAAM,GAAG,KAAK,OAAO,MAAM,IAAI;AAChD;AA4BA,MAAM,SAAS;AAEf,IAAa,eAAb,MAAyD;CAM1B;CAL7B;CACA;CACA;CACA;CAEA,YAAY,SAA+C;EAA9B,KAAA,UAAA;EAC3B,KAAK,MAAM,QAAQ,OAAO,KAAK;EAC/B,KAAK,eAAe,QAAQ,gBAAgB,MAAU;EACtD,KAAK,mBAAmB,QAAQ,oBAAoB,KAAK;EACzD,KAAK,cAAc,QAAQ,eAAe,KAAK;CACjD;;;;;;CAOA,MAAM,KAAK,SAKiB;EAC1B,MAAM,QAAkB;GACtB,MAAM;GACN,YAAY,QAAQ;GACpB,QAAQ,QAAQ;GAEhB,aAAa,KAAK,IAAI;EACxB;EACA,OAAO;GACL,MAAM,cAAc,QAAQ,IAAI,OAAO,WAAW,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;GAC/D,QAAQ,MAAM,KAAK,QAAQ,OAAO,QAAQ,OAAO,aAAa,QAAQ,OAAO;GAC7E,OAAO,KAAK,UAAU,KAAK;EAC7B;CACF;CAEA,MAAM,OAAO,SAAyE;EACpF,MAAM,SAAS,MAAM,KAAK,QAAQ,WAAW,IAAI,QAAQ,EAAE;EAC3D,IAAI,WAAW,KAAA,GACb,MAAM,IAAI,MAAM,4BAA4B,QAAQ,GAAG,kCAAkC;EAE3F,MAAM,KAAK,OAAO,MAAM;EACxB,OAAO,KAAK,SAAS,QAAQ,EAAE;CACjC;CAEA,MAAM,IAAI,IAA2C;EAEnD,IAAK,MAAM,KAAK,QAAQ,WAAW,IAAI,EAAE,MAAO,KAAA,GAC9C,MAAM,IAAIC,4BAAAA,sBAAsB,EAAE;EAEpC,OAAO,KAAK,SAAS,EAAE;CACzB;CAEA,MAAM,OAAO,OAA4D;EACvE,KAAK,MAAM,UAAU,MAAM,KAAK,QAAQ,WAAW,cAAc;GAAE,GAAG;GAAO,OAAO;EAAE,CAAC,GACrF,IAAI,CAAE,MAAM,KAAK,cAAc,MAAM,GAAI,MAAM,KAAK,OAAO,MAAM;CAErE;CAEA,MAAM,WAA0B;EAC9B,MAAM,MAAM,KAAK,IAAI;EACrB,MAAM,WAAsB,CAAC;EAE7B,KAAK,MAAM,UAAU,MAAM,KAAK,QAAQ,WAAW,cAAc;GAC/D,eAAe,MAAM;GACrB,OAAO;EACT,CAAC,GACC,IAAI;GACF,IAAI,CAAE,MAAM,KAAK,cAAc,MAAM,GAAI,MAAM,KAAK,OAAO,MAAM;EACnE,SAAS,OAAO;GACd,SAAS,KAAK,KAAK;EACrB;EAGF,KAAK,MAAM,UAAU,MAAM,KAAK,QAAQ,WAAW,YACjD,IACA,MAAM,KAAK,gBACb,GACE,IAAI;GACF,MAAM,KAAK,UAAU,QAAQ,GAAG;EAClC,SAAS,OAAO;GACd,SAAS,KAAK,KAAK;EACrB;EAEF,IAAI,SAAS,SAAS,GAAG,MAAM,SAAS;CAC1C;CAEA,MAAc,OAAO,QAAwC;EAC3D,MAAM,EAAE,QAAQ,MAAM,KAAK,QAAQ,OAAO,eAAe;GACvD,QAAQ,OAAO;GACf,MAAM,OAAO;GACb,SAAS,OAAO;EAClB,CAAC;EACD,MAAM,KAAK,QAAQ,WAAW,cAAc,OAAO,YAAY,KAAK,KAAK,IAAI,CAAC;CAChF;;CAGA,MAAc,cAAc,QAA2C;EACrE,IAAI,KAAK,IAAI,IAAI,OAAO,aAAa,KAAK,cAAc,OAAO;EAC/D,MAAM,KAAK,QAAQ,WAAW,eAAe,OAAO,YAAY,KAAK,IAAI,CAAC;EAC1E,QAAQ,MACN,2BAA2B,OAAO,WAAW,IAAI,OAAO,KAAK,uCAC/D;EACA,OAAO;CACT;CAEA,MAAc,MAAM,QAAsD;EACxE,IAAI,OAAO,QAAQ,KAAA,GAAW,OAAO,OAAO;EAC5C,MAAM,MAAM,MAAM,KAAK,QAAQ,OAAO,cAAc,OAAO,QAAQ,OAAO,IAAI;EAC9E,IAAI,QAAQ,KAAA,GAAW,MAAM,KAAK,QAAQ,WAAW,OAAO,OAAO,YAAY,GAAG;EAClF,OAAO;CACT;;;;;CAMA,SAAiB,QAAkC;EACjD,OAAO,KAAK,IAAI,IAAI,OAAO,YAAY,KAAK;CAC9C;;CAGA,SAAiB,QAAkC;EACjD,OAAO,OAAO,cAAc,KAAA,KAAa,KAAK,IAAI,IAAI,OAAO,YAAY,KAAK;CAChF;CAEA,MAAc,UAAU,QAAyB,KAA4B;EAC3E,MAAM,MAAM,MAAM,KAAK,MAAM,MAAM;EACnC,MAAM,QAAQ,QAAQ,KAAA,IAAY,KAAA,IAAY,MAAM,KAAK,QAAQ,OAAO,eAAe,GAAG;EAQ1F,IAJE,UAAU,YACV,UAAU,aACV,UAAU,eACT,UAAU,KAAA,KAAa,KAAK,SAAS,MAAM,GACnC;GAET,MAAM,EAAE,UAAU,KAAK;GACvB,MAAM,MAAM,eAAe,OAAO,YAAY,QAAQ;GACtD,MAAM,MAAM,WAAW,iBAAiB;IACtC,UAAU,OAAO;IACjB,YAAY,OAAO;IACnB,QAAQ,OAAO;IACf,QAAQ;IACR,IAAI;GACN,CAAC;GACD,QAAQ,KACN,cAAc,OAAO,WAAW,0BAA0B,SAAS,UAAU,wCAC/E;EACF;EACA,MAAM,KAAK,QAAQ,WAAW,YAAY,OAAO,YAAY,GAAG;CAClE;CAEA,SAAiB,IAAkC;EACjD,MAAM,EAAE,YAAY,WAAW,KAAK;EACpC,MAAM,UAAU,YAAY;GAC1B,MAAM,SAAS,MAAM,WAAW,IAAI,EAAE;GACtC,IAAI,WAAW,KAAA,GAAW,MAAM,IAAIA,4BAAAA,sBAAsB,EAAE;GAC5D,OAAO;EACT;EACA,OAAO;GACL;GACA,WAAW,OAAO,UAAU;IAI1B,MAAM,EAAE,eAAe,MAAM,QAAQ;IACrC,IAAI,eAAe,KAAA,GAAW;IAC9B,MAAM,OAAO,iBAAiB,YAAY,KAAK,UAAU,MAAM,WAAW,CAAC,CAAC,CAAC;GAC/E;GACA,WAAW,YAAY;IACrB,MAAM,SAAS,MAAM,QAAQ;IAE7B,IAAI,OAAO,cAAc,KAAA,GAAW;KAClC,IAAI,KAAK,SAAS,MAAM,GACtB,MAAM,IAAI,MAAM,GAAG,GAAG,4DAA4D;KAEpF;IACF;IACA,IAAI,OAAO,gBAAgB,KAAA,KAAa,OAAO,iBAAiB,KAAA,GAE9D,MAAM,WAAW,eAAe,IAAI,KAAK,IAAI,CAAC;IAEhD,MAAM,MAAM,MAAM,KAAK,MAAM,MAAM;IACnC,IAAI,QAAQ,KAAA,GAAW;KAErB,IAAI,KAAK,SAAS,MAAM,GAAG;KAC3B,MAAM,IAAI,MAAM,eAAe,GAAG,mCAAmC;IACvE;IAEA,MAAM,QAAQ,MAAM,OAAO,eAAe,GAAG;IAC7C,IAAI,UAAU,eAAe,UAAU,YAAY,UAAU,aAAa;IAC1E,IAAI,CAAE,MAAM,OAAO,cAAc,GAAG,GAAI,MAAM,IAAI,MAAM,YAAY,GAAG,QAAQ;IAG/E,MAAM,WAAW,YAAY,IAAI,KAAK,IAAI,CAAC;IAC3C,MAAM,IAAI,MAAM,GAAG,GAAG,2DAA2D;GACnF;GACA,QAAQ,YAAY;IAClB,MAAM,SAAS,MAAM,QAAQ;IAC7B,IAAI,KAAK,SAAS,MAAM,GAAG,OAAO,EAAE,QAAQ,UAAU;IACtD,MAAM,MAAM,MAAM,KAAK,MAAM,MAAM;IAEnC,IAAI,QAAQ,KAAA,GAAW,OAAO,EAAE,QAAQ,KAAK,SAAS,MAAM,IAAI,eAAe,UAAU;IACzF,MAAM,QAAQ,MAAM,OAAO,eAAe,GAAG;IAE7C,IAAI,UAAU,aAAa,OAAO,EAAE,QAAQ,WAAW;IACvD,IAAI,UAAU,UAAU,OAAO,EAAE,QAAQ,UAAU;IACnD,IAAI,UAAU,WAAW,OAAO,EAAE,QAAQ,UAAU;IACpD,OAAO,EAAE,QAAQ,aAAa;GAChC;EACF;CACF;AACF"}

package/dist/aws/instances.d.cts

@@ -18,16 +18,20 @@ export interface RunInput {
 }
 export declare function isRunInput(event: unknown): event is RunInput;
 /**
- * The durable execution name for an instance: the instance id itself when it fits, otherwise a
- * prefix of it with a fingerprint of the whole — stable, so every retry of the start reuses it.
+ * The durable execution name for one start of an instance: the instance id, cut to fit, with a
+ * fingerprint of the whole id (so a cut never makes two instances collide) and the attempt's
+ * token. Every retry of that start reuses the recorded name; a new attempt gets a new token.
  */
-export declare function executionName(instanceId: string): string;
+export declare function executionName(instanceId: string, attempt: string): string;
 export interface AwsInstancesOptions {
   store: JourneyStore;
   executions: ExecutionRegistry;
   lambda: LambdaApi;
-  /** The qualified function ARN an execution pinned to `contentHash` must run on. */
-  target(contentHash: string): Promise<string>;
+  /**
+   * The qualified function ARN an execution pinned to `contentHash` must run on; `version` is
+   * the code version whose routes named it.
+   */
+  target(contentHash: string, version?: string): Promise<string>;
   /**
    * How long an unconfirmed start keeps being retried. It must stay shorter than the durable
    * execution retention: past that the platform forgets the name, and a retry would start a
@@ -36,6 +40,12 @@ export interface AwsInstancesOptions {
   startRetryMs?: number;
   /** How stale a running instance's last check must be before maintenance looks again. */
   reconcileEveryMs?: number;
+  /**
+   * How long after a stop an invocation already running may still act: Lambda cannot interrupt
+   * one, and it runs on to its next checkpoint. An erasure waits this long before it erases.
+   * The function's timeout is enough; 15 minutes (Lambda's maximum) by default.
+   */
+  stopDrainMs?: number;
   now?: () => number;
 }
 export declare class AwsInstances implements WorkflowBindingLike {
@@ -43,11 +53,18 @@ export declare class AwsInstances implements WorkflowBindingLike {
   private readonly now;
   private readonly startRetryMs;
   private readonly reconcileEveryMs;
+  private readonly stopDrainMs;
   constructor(options: AwsInstancesOptions);
+  /**
+   * A start, planned for one entry attempt. Its name is new every time: a failed entry reclaimed
+   * under the same instance id (an event replayed with its ts) must start a new execution — the
+   * old name would return the closed one. Retries of this attempt reuse the recorded name.
+   */
   plan(options: {
     id: string;
     params: JourneyParams;
     ts: number;
+    version?: string | undefined;
   }): Promise<ExecutionStart>;
   create(options: {
     id: string;
@@ -68,6 +85,8 @@ export declare class AwsInstances implements WorkflowBindingLike {
    * invoke has expired by then. Before that, not finding it says nothing.
    */
   private vanished;
+  /** Stopped so recently that an invocation running at the time may still be acting. */
+  private draining;
   private reconcile;
   private instance;
 }

package/dist/aws/instances.d.cts.map

@@ -1 +1 @@
-{"version":3,"file":"instances.d.cts","names":[],"sources":["../../src/aws/instances.ts"],"mappings":";;;;;;;;;;qBAsBa;iBAEI;EACf,aAAa;EACb;EACA,QAAQ;;EAER;;wBAGc,WAAW,iBAAiB,SAAS;;;;;wBA0BrC,cAAc;iBAOb;EACf,OAAO;EACP,YAAY;EACZ,QAAQ;;EAER,OAAO,sBAAsB;;;;;;EAM7B;;EAEA;EACA;;qBAKW,wBAAwB;mBAKN;mBAJZ;mBACA;mBACA;EAEjB,YAA6B,SAAS;EAMhC,KAAK;IAAW;IAAY,QAAQ;IAAe;MAAe,QAAQ;EAe1E,OAAO;IAAW;IAAY;MAAoB,QAAQ;EAS1D,IAAI,aAAa,QAAQ;EAQzB,OAAO;IAAS;IAAkB;MAAmB;EAMrD,YAAY;UA4BJ;;UAUA;UASA;;;;;UAWN;UAIM;UA4BN"}
+{"version":3,"file":"instances.d.cts","names":[],"sources":["../../src/aws/instances.ts"],"mappings":";;;;;;;;;;qBAsBa;iBAEI;EACf,aAAa;EACb;EACA,QAAQ;;EAER;;wBAGc,WAAW,iBAAiB,SAAS;;;;;;wBA0BrC,cAAc,oBAAoB;iBAQjC;EACf,OAAO;EACP,YAAY;EACZ,QAAQ;;;;;EAKR,OAAO,qBAAqB,mBAAmB;;;;;;EAM/C;;EAEA;;;;;;EAMA;EACA;;qBAKW,wBAAwB;mBAMN;mBALZ;mBACA;mBACA;mBACA;EAEjB,YAA6B,SAAS;;;;;;EAYhC,KAAK;IACT;IACA,QAAQ;IACR;IACA;MACE,QAAQ;EAeN,OAAO;IAAW;IAAY;MAAoB,QAAQ;EAS1D,IAAI,aAAa,QAAQ;EAQzB,OAAO;IAAS;IAAkB;MAAmB;EAMrD,YAAY;UA4BJ;;UAUA;UASA;;;;;UAWN;;UAKA;UAIM;UA4BN"}

package/dist/aws/instances.d.mts

@@ -18,16 +18,20 @@ export interface RunInput {
 }
 export declare function isRunInput(event: unknown): event is RunInput;
 /**
- * The durable execution name for an instance: the instance id itself when it fits, otherwise a
- * prefix of it with a fingerprint of the whole — stable, so every retry of the start reuses it.
+ * The durable execution name for one start of an instance: the instance id, cut to fit, with a
+ * fingerprint of the whole id (so a cut never makes two instances collide) and the attempt's
+ * token. Every retry of that start reuses the recorded name; a new attempt gets a new token.
  */
-export declare function executionName(instanceId: string): string;
+export declare function executionName(instanceId: string, attempt: string): string;
 export interface AwsInstancesOptions {
   store: JourneyStore;
   executions: ExecutionRegistry;
   lambda: LambdaApi;
-  /** The qualified function ARN an execution pinned to `contentHash` must run on. */
-  target(contentHash: string): Promise<string>;
+  /**
+   * The qualified function ARN an execution pinned to `contentHash` must run on; `version` is
+   * the code version whose routes named it.
+   */
+  target(contentHash: string, version?: string): Promise<string>;
   /**
    * How long an unconfirmed start keeps being retried. It must stay shorter than the durable
    * execution retention: past that the platform forgets the name, and a retry would start a
@@ -36,6 +40,12 @@ export interface AwsInstancesOptions {
   startRetryMs?: number;
   /** How stale a running instance's last check must be before maintenance looks again. */
   reconcileEveryMs?: number;
+  /**
+   * How long after a stop an invocation already running may still act: Lambda cannot interrupt
+   * one, and it runs on to its next checkpoint. An erasure waits this long before it erases.
+   * The function's timeout is enough; 15 minutes (Lambda's maximum) by default.
+   */
+  stopDrainMs?: number;
   now?: () => number;
 }
 export declare class AwsInstances implements WorkflowBindingLike {
@@ -43,11 +53,18 @@ export declare class AwsInstances implements WorkflowBindingLike {
   private readonly now;
   private readonly startRetryMs;
   private readonly reconcileEveryMs;
+  private readonly stopDrainMs;
   constructor(options: AwsInstancesOptions);
+  /**
+   * A start, planned for one entry attempt. Its name is new every time: a failed entry reclaimed
+   * under the same instance id (an event replayed with its ts) must start a new execution — the
+   * old name would return the closed one. Retries of this attempt reuse the recorded name.
+   */
   plan(options: {
     id: string;
     params: JourneyParams;
     ts: number;
+    version?: string | undefined;
   }): Promise<ExecutionStart>;
   create(options: {
     id: string;
@@ -68,6 +85,8 @@ export declare class AwsInstances implements WorkflowBindingLike {
    * invoke has expired by then. Before that, not finding it says nothing.
    */
   private vanished;
+  /** Stopped so recently that an invocation running at the time may still be acting. */
+  private draining;
   private reconcile;
   private instance;
 }

package/dist/aws/instances.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"instances.d.mts","names":[],"sources":["../../src/aws/instances.ts"],"mappings":";;;;;;;;;;qBAsBa;iBAEI;EACf,aAAa;EACb;EACA,QAAQ;;EAER;;wBAGc,WAAW,iBAAiB,SAAS;;;;;wBA0BrC,cAAc;iBAOb;EACf,OAAO;EACP,YAAY;EACZ,QAAQ;;EAER,OAAO,sBAAsB;;;;;;EAM7B;;EAEA;EACA;;qBAKW,wBAAwB;mBAKN;mBAJZ;mBACA;mBACA;EAEjB,YAA6B,SAAS;EAMhC,KAAK;IAAW;IAAY,QAAQ;IAAe;MAAe,QAAQ;EAe1E,OAAO;IAAW;IAAY;MAAoB,QAAQ;EAS1D,IAAI,aAAa,QAAQ;EAQzB,OAAO;IAAS;IAAkB;MAAmB;EAMrD,YAAY;UA4BJ;;UAUA;UASA;;;;;UAWN;UAIM;UA4BN"}
+{"version":3,"file":"instances.d.mts","names":[],"sources":["../../src/aws/instances.ts"],"mappings":";;;;;;;;;;qBAsBa;iBAEI;EACf,aAAa;EACb;EACA,QAAQ;;EAER;;wBAGc,WAAW,iBAAiB,SAAS;;;;;;wBA0BrC,cAAc,oBAAoB;iBAQjC;EACf,OAAO;EACP,YAAY;EACZ,QAAQ;;;;;EAKR,OAAO,qBAAqB,mBAAmB;;;;;;EAM/C;;EAEA;;;;;;EAMA;EACA;;qBAKW,wBAAwB;mBAMN;mBALZ;mBACA;mBACA;mBACA;EAEjB,YAA6B,SAAS;;;;;;EAYhC,KAAK;IACT;IACA,QAAQ;IACR;IACA;MACE,QAAQ;EAeN,OAAO;IAAW;IAAY;MAAoB,QAAQ;EAS1D,IAAI,aAAa,QAAQ;EAQzB,OAAO;IAAS;IAAkB;MAAmB;EAMrD,YAAY;UA4BJ;;UAUA;UASA;;;;;UAWN;;UAKA;UAIM;UA4BN"}

package/dist/aws/instances.mjs

@@ -14,16 +14,16 @@ function isRunInput(event) {
 	return candidate.type === "$workflow.run" && candidate.requestContext === void 0 && typeof candidate.instanceId === "string" && typeof candidate.enteredAtMs === "number" && typeof candidate.params === "object" && candidate.params !== null;
 }
 const utf8 = new TextEncoder();
-const NAME = /^[a-zA-Z0-9_-]{1,64}$/;
 /**
-* The durable execution name for an instance: the instance id itself when it fits, otherwise a
-* prefix of it with a fingerprint of the whole — stable, so every retry of the start reuses it.
+* The durable execution name for one start of an instance: the instance id, cut to fit, with a
+* fingerprint of the whole id (so a cut never makes two instances collide) and the attempt's
+* token. Every retry of that start reuses the recorded name; a new attempt gets a new token.
 */
-function executionName(instanceId) {
-	if (NAME.test(instanceId)) return instanceId;
+function executionName(instanceId, attempt) {
 	const safe = instanceId.replace(/[^a-zA-Z0-9_-]/g, "-");
-	const fingerprint = `${murmur3(utf8.encode(instanceId)).toString(36)}${murmur3(utf8.encode(instanceId), 2538058380).toString(36)}`;
-	return `${safe.slice(0, 63 - fingerprint.length)}-${fingerprint}`;
+	const token = attempt.replace(/[^a-zA-Z0-9]/g, "").slice(0, 8);
+	const suffix = `-${`${murmur3(utf8.encode(instanceId)).toString(36)}${murmur3(utf8.encode(instanceId), 2538058380).toString(36)}`}-${token}`;
+	return `${safe.slice(0, 64 - suffix.length)}${suffix}`;
 }
 const MINUTE = 6e4;
 var AwsInstances = class {
@@ -31,12 +31,19 @@ var AwsInstances = class {
 	now;
 	startRetryMs;
 	reconcileEveryMs;
+	stopDrainMs;
 	constructor(options) {
 		this.options = options;
 		this.now = options.now ?? Date.now;
 		this.startRetryMs = options.startRetryMs ?? 720 * MINUTE;
 		this.reconcileEveryMs = options.reconcileEveryMs ?? 15 * MINUTE;
+		this.stopDrainMs = options.stopDrainMs ?? 15 * MINUTE;
 	}
+	/**
+	* A start, planned for one entry attempt. Its name is new every time: a failed entry reclaimed
+	* under the same instance id (an event replayed with its ts) must start a new execution — the
+	* old name would return the closed one. Retries of this attempt reuse the recorded name.
+	*/
 	async plan(options) {
 		const input = {
 			type: RUN_EVENT_TYPE,
@@ -45,8 +52,8 @@ var AwsInstances = class {
 			enteredAtMs: this.now()
 		};
 		return {
-			name: executionName(options.id),
-			target: await this.options.target(options.params.contentHash),
+			name: executionName(options.id, crypto.randomUUID().slice(0, 8)),
+			target: await this.options.target(options.params.contentHash, options.version),
 			input: JSON.stringify(input)
 		};
 	}
@@ -112,6 +119,10 @@ var AwsInstances = class {
 	vanished(record) {
 		return this.now() - record.createdAt > this.startRetryMs;
 	}
+	/** Stopped so recently that an invocation running at the time may still be acting. */
+	draining(record) {
+		return record.stoppedAt !== void 0 && this.now() - record.stoppedAt < this.stopDrainMs;
+	}
 	async reconcile(record, now) {
 		const arn = await this.arnOf(record);
 		const state = arn === void 0 ? void 0 : await this.options.lambda.executionState(arn);
@@ -145,16 +156,25 @@ var AwsInstances = class {
 			},
 			terminate: async () => {
 				const record = await current();
+				if (record.stoppedAt !== void 0) {
+					if (this.draining(record)) throw new Error(`${id} was stopped; its running invocation may still be finishing`);
+					return;
+				}
 				if (record.submittedAt === void 0 && record.unresolvedAt === void 0) await executions.markUnresolved(id, this.now());
 				const arn = await this.arnOf(record);
 				if (arn === void 0) {
 					if (this.vanished(record)) return;
 					throw new Error(`cannot stop ${id} yet: its execution is not visible`);
 				}
+				const state = await lambda.executionState(arn);
+				if (state === "succeeded" || state === "failed" || state === "timed_out") return;
 				if (!await lambda.stopExecution(arn)) throw new Error(`stopping ${id} failed`);
+				await executions.markStopped(id, this.now());
+				throw new Error(`${id} is stopped; its running invocation may still be finishing`);
 			},
 			status: async () => {
 				const record = await current();
+				if (this.draining(record)) return { status: "running" };
 				const arn = await this.arnOf(record);
 				if (arn === void 0) return { status: this.vanished(record) ? "terminated" : "running" };
 				const state = await lambda.executionState(arn);

package/dist/aws/instances.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"instances.mjs","names":[],"sources":["../../src/aws/instances.ts"],"sourcesContent":["import {\n  InstanceNotFoundError,\n  type JourneyParams,\n  type WorkflowBindingLike,\n  type WorkflowInstanceLike,\n} from '../cloudflare/bindings';\nimport { murmur3 } from '../engine/bucket';\nimport type {\n  ExecutionRecord,\n  ExecutionRegistry,\n  ExecutionStart,\n  JourneyStore,\n} from '../store/index';\nimport type { LambdaApi } from './lambda-api';\n\n/**\n * The router's instance port over Lambda durable executions: an instance is one execution of\n * this same function, started by an asynchronous self-invoke under a stable execution name;\n * a wake completes the callback its current wait parks on; stopping stops the execution.\n */\n\n/** The top-level shape of an internal run: what the self-invoke sends, never an HTTP body. */\nexport const RUN_EVENT_TYPE = '$workflow.run';\n\nexport interface RunInput {\n  type: typeof RUN_EVENT_TYPE;\n  instanceId: string;\n  params: JourneyParams;\n  /** When the instance was created (as Cloudflare's event timestamp): its entry anchor, fixed with the start. */\n  enteredAtMs: number;\n}\n\nexport function isRunInput(event: unknown): event is RunInput {\n  if (typeof event !== 'object' || event === null) return false;\n  const candidate = event as {\n    type?: unknown;\n    instanceId?: unknown;\n    enteredAtMs?: unknown;\n    params?: unknown;\n    requestContext?: unknown;\n  };\n  return (\n    candidate.type === RUN_EVENT_TYPE &&\n    candidate.requestContext === undefined &&\n    typeof candidate.instanceId === 'string' &&\n    typeof candidate.enteredAtMs === 'number' &&\n    typeof candidate.params === 'object' &&\n    candidate.params !== null\n  );\n}\n\nconst utf8 = new TextEncoder();\nconst NAME = /^[a-zA-Z0-9_-]{1,64}$/;\n\n/**\n * The durable execution name for an instance: the instance id itself when it fits, otherwise a\n * prefix of it with a fingerprint of the whole — stable, so every retry of the start reuses it.\n */\nexport function executionName(instanceId: string): string {\n  if (NAME.test(instanceId)) return instanceId;\n  const safe = instanceId.replace(/[^a-zA-Z0-9_-]/g, '-');\n  const fingerprint = `${murmur3(utf8.encode(instanceId)).toString(36)}${murmur3(utf8.encode(instanceId), 0x9747b28c).toString(36)}`;\n  return `${safe.slice(0, 63 - fingerprint.length)}-${fingerprint}`;\n}\n\nexport interface AwsInstancesOptions {\n  store: JourneyStore;\n  executions: ExecutionRegistry;\n  lambda: LambdaApi;\n  /** The qualified function ARN an execution pinned to `contentHash` must run on. */\n  target(contentHash: string): Promise<string>;\n  /**\n   * How long an unconfirmed start keeps being retried. It must stay shorter than the durable\n   * execution retention: past that the platform forgets the name, and a retry would start a\n   * second execution. Twelve hours by default.\n   */\n  startRetryMs?: number;\n  /** How stale a running instance's last check must be before maintenance looks again. */\n  reconcileEveryMs?: number;\n  now?: () => number;\n}\n\nconst MINUTE = 60_000;\n\nexport class AwsInstances implements WorkflowBindingLike {\n  private readonly now: () => number;\n  private readonly startRetryMs: number;\n  private readonly reconcileEveryMs: number;\n\n  constructor(private readonly options: AwsInstancesOptions) {\n    this.now = options.now ?? Date.now;\n    this.startRetryMs = options.startRetryMs ?? 12 * 60 * MINUTE;\n    this.reconcileEveryMs = options.reconcileEveryMs ?? 15 * MINUTE;\n  }\n\n  async plan(options: { id: string; params: JourneyParams; ts: number }): Promise<ExecutionStart> {\n    const input: RunInput = {\n      type: RUN_EVENT_TYPE,\n      instanceId: options.id,\n      params: options.params,\n      // The moment the instance is created, like Cloudflare's: an event's own ts may be long past\n      enteredAtMs: this.now(),\n    };\n    return {\n      name: executionName(options.id),\n      target: await this.options.target(options.params.contentHash),\n      input: JSON.stringify(input),\n    };\n  }\n\n  async create(options: { id: string; params: unknown }): Promise<WorkflowInstanceLike> {\n    const record = await this.options.executions.get(options.id);\n    if (record === undefined) {\n      throw new Error(`no start is recorded for ${options.id}: the entry must be planned first`);\n    }\n    await this.submit(record);\n    return this.instance(options.id);\n  }\n\n  async get(id: string): Promise<WorkflowInstanceLike> {\n    // A read of the registry alone: a Lambda failure must never read as \"no such instance\"\n    if ((await this.options.executions.get(id)) === undefined) {\n      throw new InstanceNotFoundError(id);\n    }\n    return this.instance(id);\n  }\n\n  async resume(entry: { workflow: string; userId: string }): Promise<void> {\n    for (const record of await this.options.executions.pendingStarts({ ...entry, limit: 1 })) {\n      if (!(await this.giveUpIfStale(record))) await this.submit(record);\n    }\n  }\n\n  async maintain(): Promise<void> {\n    const now = this.now();\n    const failures: unknown[] = [];\n    // Starts whose submit never confirmed: retried with the recorded name and payload\n    for (const record of await this.options.executions.pendingStarts({\n      createdBefore: now - MINUTE,\n      limit: 25,\n    })) {\n      try {\n        if (!(await this.giveUpIfStale(record))) await this.submit(record);\n      } catch (error) {\n        failures.push(error);\n      }\n    }\n    // Executions the platform ended without the run finalizing (a timeout, a stop, a crash)\n    for (const record of await this.options.executions.toReconcile(\n      25,\n      now - this.reconcileEveryMs\n    )) {\n      try {\n        await this.reconcile(record, now);\n      } catch (error) {\n        failures.push(error);\n      }\n    }\n    if (failures.length > 0) throw failures[0];\n  }\n\n  private async submit(record: ExecutionRecord): Promise<void> {\n    const { arn } = await this.options.lambda.startExecution({\n      target: record.target,\n      name: record.name,\n      payload: record.input,\n    });\n    await this.options.executions.markSubmitted(record.instanceId, arn, this.now());\n  }\n\n  /** Past the retry budget a start is unresolved for good: no retry could tell a duplicate apart. */\n  private async giveUpIfStale(record: ExecutionRecord): Promise<boolean> {\n    if (this.now() - record.createdAt <= this.startRetryMs) return false;\n    await this.options.executions.markUnresolved(record.instanceId, this.now());\n    console.error(\n      `[workflow] the start of ${record.instanceId} (${record.name}) was never confirmed: left unresolved`\n    );\n    return true;\n  }\n\n  private async arnOf(record: ExecutionRecord): Promise<string | undefined> {\n    if (record.arn !== undefined) return record.arn;\n    const arn = await this.options.lambda.findExecution(record.target, record.name);\n    if (arn !== undefined) await this.options.executions.setArn(record.instanceId, arn);\n    return arn;\n  }\n\n  /**\n   * Past the start retry budget, an execution still nowhere to be seen never started: any queued\n   * invoke has expired by then. Before that, not finding it says nothing.\n   */\n  private vanished(record: ExecutionRecord): boolean {\n    return this.now() - record.createdAt > this.startRetryMs;\n  }\n\n  private async reconcile(record: ExecutionRecord, now: number): Promise<void> {\n    const arn = await this.arnOf(record);\n    const state = arn === undefined ? undefined : await this.options.lambda.executionState(arn);\n    // Only a state that will never run another step — or one missing for good — ends the entry;\n    // a run still queued, or not visible yet, is left alone\n    const ended =\n      state === 'failed' ||\n      state === 'stopped' ||\n      state === 'timed_out' ||\n      (state === undefined && this.vanished(record));\n    if (ended) {\n      // Ended without its finalize step: the ledger must not show it running forever\n      const { store } = this.options;\n      await store.setEntryStatus(record.instanceId, 'failed');\n      await store.reporting?.instanceFinished({\n        workflow: record.workflow,\n        instanceId: record.instanceId,\n        userId: record.userId,\n        status: 'failed',\n        at: now,\n      });\n      console.warn(\n        `[workflow] ${record.instanceId} ended on the platform (${state ?? 'unknown'}) without finishing: recorded as failed`\n      );\n    }\n    await this.options.executions.markChecked(record.instanceId, now);\n  }\n\n  private instance(id: string): WorkflowInstanceLike {\n    const { executions, lambda } = this.options;\n    const current = async () => {\n      const record = await executions.get(id);\n      if (record === undefined) throw new InstanceNotFoundError(id);\n      return record;\n    };\n    return {\n      id,\n      sendEvent: async (event) => {\n        // The wait parked now, read at the moment of the wake: a newer wait's callback replaces\n        // an older one, and a wake for none (the instance is between waits) is nothing to do —\n        // its next wait re-reads the facts before parking\n        const { callbackId } = await current();\n        if (callbackId === undefined) return;\n        await lambda.completeCallback(callbackId, JSON.stringify(event.payload ?? {}));\n      },\n      terminate: async () => {\n        const record = await current();\n        if (record.submittedAt === undefined && record.unresolvedAt === undefined) {\n          // No retry may start it after this\n          await executions.markUnresolved(id, this.now());\n        }\n        const arn = await this.arnOf(record);\n        if (arn === undefined) {\n          // Not visible yet is not stopped: the erasure stays pending, and the sweep retries\n          if (this.vanished(record)) return;\n          throw new Error(`cannot stop ${id} yet: its execution is not visible`);\n        }\n        if (!(await lambda.stopExecution(arn))) throw new Error(`stopping ${id} failed`);\n      },\n      status: async () => {\n        const record = await current();\n        const arn = await this.arnOf(record);\n        // Not visible yet may still run: only one missing past the budget is gone\n        if (arn === undefined) return { status: this.vanished(record) ? 'terminated' : 'running' };\n        const state = await lambda.executionState(arn);\n        // In the router's vocabulary (Cloudflare's): what will never run another step\n        if (state === 'succeeded') return { status: 'complete' };\n        if (state === 'failed') return { status: 'errored' };\n        if (state === 'running') return { status: 'running' };\n        return { status: 'terminated' };\n      },\n    };\n  }\n}\n"],"mappings":";;;;;;;;;AAsBA,MAAa,iBAAiB;AAU9B,SAAgB,WAAW,OAAmC;CAC5D,IAAI,OAAO,UAAU,YAAY,UAAU,MAAM,OAAO;CACxD,MAAM,YAAY;CAOlB,OACE,UAAU,SAAA,mBACV,UAAU,mBAAmB,KAAA,KAC7B,OAAO,UAAU,eAAe,YAChC,OAAO,UAAU,gBAAgB,YACjC,OAAO,UAAU,WAAW,YAC5B,UAAU,WAAW;AAEzB;AAEA,MAAM,OAAO,IAAI,YAAY;AAC7B,MAAM,OAAO;;;;;AAMb,SAAgB,cAAc,YAA4B;CACxD,IAAI,KAAK,KAAK,UAAU,GAAG,OAAO;CAClC,MAAM,OAAO,WAAW,QAAQ,mBAAmB,GAAG;CACtD,MAAM,cAAc,GAAG,QAAQ,KAAK,OAAO,UAAU,CAAC,CAAC,CAAC,SAAS,EAAE,IAAI,QAAQ,KAAK,OAAO,UAAU,GAAG,UAAU,CAAC,CAAC,SAAS,EAAE;CAC/H,OAAO,GAAG,KAAK,MAAM,GAAG,KAAK,YAAY,MAAM,EAAE,GAAG;AACtD;AAmBA,MAAM,SAAS;AAEf,IAAa,eAAb,MAAyD;CAK1B;CAJ7B;CACA;CACA;CAEA,YAAY,SAA+C;EAA9B,KAAA,UAAA;EAC3B,KAAK,MAAM,QAAQ,OAAO,KAAK;EAC/B,KAAK,eAAe,QAAQ,gBAAgB,MAAU;EACtD,KAAK,mBAAmB,QAAQ,oBAAoB,KAAK;CAC3D;CAEA,MAAM,KAAK,SAAqF;EAC9F,MAAM,QAAkB;GACtB,MAAM;GACN,YAAY,QAAQ;GACpB,QAAQ,QAAQ;GAEhB,aAAa,KAAK,IAAI;EACxB;EACA,OAAO;GACL,MAAM,cAAc,QAAQ,EAAE;GAC9B,QAAQ,MAAM,KAAK,QAAQ,OAAO,QAAQ,OAAO,WAAW;GAC5D,OAAO,KAAK,UAAU,KAAK;EAC7B;CACF;CAEA,MAAM,OAAO,SAAyE;EACpF,MAAM,SAAS,MAAM,KAAK,QAAQ,WAAW,IAAI,QAAQ,EAAE;EAC3D,IAAI,WAAW,KAAA,GACb,MAAM,IAAI,MAAM,4BAA4B,QAAQ,GAAG,kCAAkC;EAE3F,MAAM,KAAK,OAAO,MAAM;EACxB,OAAO,KAAK,SAAS,QAAQ,EAAE;CACjC;CAEA,MAAM,IAAI,IAA2C;EAEnD,IAAK,MAAM,KAAK,QAAQ,WAAW,IAAI,EAAE,MAAO,KAAA,GAC9C,MAAM,IAAI,sBAAsB,EAAE;EAEpC,OAAO,KAAK,SAAS,EAAE;CACzB;CAEA,MAAM,OAAO,OAA4D;EACvE,KAAK,MAAM,UAAU,MAAM,KAAK,QAAQ,WAAW,cAAc;GAAE,GAAG;GAAO,OAAO;EAAE,CAAC,GACrF,IAAI,CAAE,MAAM,KAAK,cAAc,MAAM,GAAI,MAAM,KAAK,OAAO,MAAM;CAErE;CAEA,MAAM,WAA0B;EAC9B,MAAM,MAAM,KAAK,IAAI;EACrB,MAAM,WAAsB,CAAC;EAE7B,KAAK,MAAM,UAAU,MAAM,KAAK,QAAQ,WAAW,cAAc;GAC/D,eAAe,MAAM;GACrB,OAAO;EACT,CAAC,GACC,IAAI;GACF,IAAI,CAAE,MAAM,KAAK,cAAc,MAAM,GAAI,MAAM,KAAK,OAAO,MAAM;EACnE,SAAS,OAAO;GACd,SAAS,KAAK,KAAK;EACrB;EAGF,KAAK,MAAM,UAAU,MAAM,KAAK,QAAQ,WAAW,YACjD,IACA,MAAM,KAAK,gBACb,GACE,IAAI;GACF,MAAM,KAAK,UAAU,QAAQ,GAAG;EAClC,SAAS,OAAO;GACd,SAAS,KAAK,KAAK;EACrB;EAEF,IAAI,SAAS,SAAS,GAAG,MAAM,SAAS;CAC1C;CAEA,MAAc,OAAO,QAAwC;EAC3D,MAAM,EAAE,QAAQ,MAAM,KAAK,QAAQ,OAAO,eAAe;GACvD,QAAQ,OAAO;GACf,MAAM,OAAO;GACb,SAAS,OAAO;EAClB,CAAC;EACD,MAAM,KAAK,QAAQ,WAAW,cAAc,OAAO,YAAY,KAAK,KAAK,IAAI,CAAC;CAChF;;CAGA,MAAc,cAAc,QAA2C;EACrE,IAAI,KAAK,IAAI,IAAI,OAAO,aAAa,KAAK,cAAc,OAAO;EAC/D,MAAM,KAAK,QAAQ,WAAW,eAAe,OAAO,YAAY,KAAK,IAAI,CAAC;EAC1E,QAAQ,MACN,2BAA2B,OAAO,WAAW,IAAI,OAAO,KAAK,uCAC/D;EACA,OAAO;CACT;CAEA,MAAc,MAAM,QAAsD;EACxE,IAAI,OAAO,QAAQ,KAAA,GAAW,OAAO,OAAO;EAC5C,MAAM,MAAM,MAAM,KAAK,QAAQ,OAAO,cAAc,OAAO,QAAQ,OAAO,IAAI;EAC9E,IAAI,QAAQ,KAAA,GAAW,MAAM,KAAK,QAAQ,WAAW,OAAO,OAAO,YAAY,GAAG;EAClF,OAAO;CACT;;;;;CAMA,SAAiB,QAAkC;EACjD,OAAO,KAAK,IAAI,IAAI,OAAO,YAAY,KAAK;CAC9C;CAEA,MAAc,UAAU,QAAyB,KAA4B;EAC3E,MAAM,MAAM,MAAM,KAAK,MAAM,MAAM;EACnC,MAAM,QAAQ,QAAQ,KAAA,IAAY,KAAA,IAAY,MAAM,KAAK,QAAQ,OAAO,eAAe,GAAG;EAQ1F,IAJE,UAAU,YACV,UAAU,aACV,UAAU,eACT,UAAU,KAAA,KAAa,KAAK,SAAS,MAAM,GACnC;GAET,MAAM,EAAE,UAAU,KAAK;GACvB,MAAM,MAAM,eAAe,OAAO,YAAY,QAAQ;GACtD,MAAM,MAAM,WAAW,iBAAiB;IACtC,UAAU,OAAO;IACjB,YAAY,OAAO;IACnB,QAAQ,OAAO;IACf,QAAQ;IACR,IAAI;GACN,CAAC;GACD,QAAQ,KACN,cAAc,OAAO,WAAW,0BAA0B,SAAS,UAAU,wCAC/E;EACF;EACA,MAAM,KAAK,QAAQ,WAAW,YAAY,OAAO,YAAY,GAAG;CAClE;CAEA,SAAiB,IAAkC;EACjD,MAAM,EAAE,YAAY,WAAW,KAAK;EACpC,MAAM,UAAU,YAAY;GAC1B,MAAM,SAAS,MAAM,WAAW,IAAI,EAAE;GACtC,IAAI,WAAW,KAAA,GAAW,MAAM,IAAI,sBAAsB,EAAE;GAC5D,OAAO;EACT;EACA,OAAO;GACL;GACA,WAAW,OAAO,UAAU;IAI1B,MAAM,EAAE,eAAe,MAAM,QAAQ;IACrC,IAAI,eAAe,KAAA,GAAW;IAC9B,MAAM,OAAO,iBAAiB,YAAY,KAAK,UAAU,MAAM,WAAW,CAAC,CAAC,CAAC;GAC/E;GACA,WAAW,YAAY;IACrB,MAAM,SAAS,MAAM,QAAQ;IAC7B,IAAI,OAAO,gBAAgB,KAAA,KAAa,OAAO,iBAAiB,KAAA,GAE9D,MAAM,WAAW,eAAe,IAAI,KAAK,IAAI,CAAC;IAEhD,MAAM,MAAM,MAAM,KAAK,MAAM,MAAM;IACnC,IAAI,QAAQ,KAAA,GAAW;KAErB,IAAI,KAAK,SAAS,MAAM,GAAG;KAC3B,MAAM,IAAI,MAAM,eAAe,GAAG,mCAAmC;IACvE;IACA,IAAI,CAAE,MAAM,OAAO,cAAc,GAAG,GAAI,MAAM,IAAI,MAAM,YAAY,GAAG,QAAQ;GACjF;GACA,QAAQ,YAAY;IAClB,MAAM,SAAS,MAAM,QAAQ;IAC7B,MAAM,MAAM,MAAM,KAAK,MAAM,MAAM;IAEnC,IAAI,QAAQ,KAAA,GAAW,OAAO,EAAE,QAAQ,KAAK,SAAS,MAAM,IAAI,eAAe,UAAU;IACzF,MAAM,QAAQ,MAAM,OAAO,eAAe,GAAG;IAE7C,IAAI,UAAU,aAAa,OAAO,EAAE,QAAQ,WAAW;IACvD,IAAI,UAAU,UAAU,OAAO,EAAE,QAAQ,UAAU;IACnD,IAAI,UAAU,WAAW,OAAO,EAAE,QAAQ,UAAU;IACpD,OAAO,EAAE,QAAQ,aAAa;GAChC;EACF;CACF;AACF"}
+{"version":3,"file":"instances.mjs","names":[],"sources":["../../src/aws/instances.ts"],"sourcesContent":["import {\n  InstanceNotFoundError,\n  type JourneyParams,\n  type WorkflowBindingLike,\n  type WorkflowInstanceLike,\n} from '../cloudflare/bindings';\nimport { murmur3 } from '../engine/bucket';\nimport type {\n  ExecutionRecord,\n  ExecutionRegistry,\n  ExecutionStart,\n  JourneyStore,\n} from '../store/index';\nimport type { LambdaApi } from './lambda-api';\n\n/**\n * The router's instance port over Lambda durable executions: an instance is one execution of\n * this same function, started by an asynchronous self-invoke under a stable execution name;\n * a wake completes the callback its current wait parks on; stopping stops the execution.\n */\n\n/** The top-level shape of an internal run: what the self-invoke sends, never an HTTP body. */\nexport const RUN_EVENT_TYPE = '$workflow.run';\n\nexport interface RunInput {\n  type: typeof RUN_EVENT_TYPE;\n  instanceId: string;\n  params: JourneyParams;\n  /** When the instance was created (as Cloudflare's event timestamp): its entry anchor, fixed with the start. */\n  enteredAtMs: number;\n}\n\nexport function isRunInput(event: unknown): event is RunInput {\n  if (typeof event !== 'object' || event === null) return false;\n  const candidate = event as {\n    type?: unknown;\n    instanceId?: unknown;\n    enteredAtMs?: unknown;\n    params?: unknown;\n    requestContext?: unknown;\n  };\n  return (\n    candidate.type === RUN_EVENT_TYPE &&\n    candidate.requestContext === undefined &&\n    typeof candidate.instanceId === 'string' &&\n    typeof candidate.enteredAtMs === 'number' &&\n    typeof candidate.params === 'object' &&\n    candidate.params !== null\n  );\n}\n\nconst utf8 = new TextEncoder();\n\n/**\n * The durable execution name for one start of an instance: the instance id, cut to fit, with a\n * fingerprint of the whole id (so a cut never makes two instances collide) and the attempt's\n * token. Every retry of that start reuses the recorded name; a new attempt gets a new token.\n */\nexport function executionName(instanceId: string, attempt: string): string {\n  const safe = instanceId.replace(/[^a-zA-Z0-9_-]/g, '-');\n  const token = attempt.replace(/[^a-zA-Z0-9]/g, '').slice(0, 8);\n  const fingerprint = `${murmur3(utf8.encode(instanceId)).toString(36)}${murmur3(utf8.encode(instanceId), 0x9747b28c).toString(36)}`;\n  const suffix = `-${fingerprint}-${token}`;\n  return `${safe.slice(0, 64 - suffix.length)}${suffix}`;\n}\n\nexport interface AwsInstancesOptions {\n  store: JourneyStore;\n  executions: ExecutionRegistry;\n  lambda: LambdaApi;\n  /**\n   * The qualified function ARN an execution pinned to `contentHash` must run on; `version` is\n   * the code version whose routes named it.\n   */\n  target(contentHash: string, version?: string): Promise<string>;\n  /**\n   * How long an unconfirmed start keeps being retried. It must stay shorter than the durable\n   * execution retention: past that the platform forgets the name, and a retry would start a\n   * second execution. Twelve hours by default.\n   */\n  startRetryMs?: number;\n  /** How stale a running instance's last check must be before maintenance looks again. */\n  reconcileEveryMs?: number;\n  /**\n   * How long after a stop an invocation already running may still act: Lambda cannot interrupt\n   * one, and it runs on to its next checkpoint. An erasure waits this long before it erases.\n   * The function's timeout is enough; 15 minutes (Lambda's maximum) by default.\n   */\n  stopDrainMs?: number;\n  now?: () => number;\n}\n\nconst MINUTE = 60_000;\n\nexport class AwsInstances implements WorkflowBindingLike {\n  private readonly now: () => number;\n  private readonly startRetryMs: number;\n  private readonly reconcileEveryMs: number;\n  private readonly stopDrainMs: number;\n\n  constructor(private readonly options: AwsInstancesOptions) {\n    this.now = options.now ?? Date.now;\n    this.startRetryMs = options.startRetryMs ?? 12 * 60 * MINUTE;\n    this.reconcileEveryMs = options.reconcileEveryMs ?? 15 * MINUTE;\n    this.stopDrainMs = options.stopDrainMs ?? 15 * MINUTE;\n  }\n\n  /**\n   * A start, planned for one entry attempt. Its name is new every time: a failed entry reclaimed\n   * under the same instance id (an event replayed with its ts) must start a new execution — the\n   * old name would return the closed one. Retries of this attempt reuse the recorded name.\n   */\n  async plan(options: {\n    id: string;\n    params: JourneyParams;\n    ts: number;\n    version?: string | undefined;\n  }): Promise<ExecutionStart> {\n    const input: RunInput = {\n      type: RUN_EVENT_TYPE,\n      instanceId: options.id,\n      params: options.params,\n      // The moment the instance is created, like Cloudflare's: an event's own ts may be long past\n      enteredAtMs: this.now(),\n    };\n    return {\n      name: executionName(options.id, crypto.randomUUID().slice(0, 8)),\n      target: await this.options.target(options.params.contentHash, options.version),\n      input: JSON.stringify(input),\n    };\n  }\n\n  async create(options: { id: string; params: unknown }): Promise<WorkflowInstanceLike> {\n    const record = await this.options.executions.get(options.id);\n    if (record === undefined) {\n      throw new Error(`no start is recorded for ${options.id}: the entry must be planned first`);\n    }\n    await this.submit(record);\n    return this.instance(options.id);\n  }\n\n  async get(id: string): Promise<WorkflowInstanceLike> {\n    // A read of the registry alone: a Lambda failure must never read as \"no such instance\"\n    if ((await this.options.executions.get(id)) === undefined) {\n      throw new InstanceNotFoundError(id);\n    }\n    return this.instance(id);\n  }\n\n  async resume(entry: { workflow: string; userId: string }): Promise<void> {\n    for (const record of await this.options.executions.pendingStarts({ ...entry, limit: 1 })) {\n      if (!(await this.giveUpIfStale(record))) await this.submit(record);\n    }\n  }\n\n  async maintain(): Promise<void> {\n    const now = this.now();\n    const failures: unknown[] = [];\n    // Starts whose submit never confirmed: retried with the recorded name and payload\n    for (const record of await this.options.executions.pendingStarts({\n      createdBefore: now - MINUTE,\n      limit: 25,\n    })) {\n      try {\n        if (!(await this.giveUpIfStale(record))) await this.submit(record);\n      } catch (error) {\n        failures.push(error);\n      }\n    }\n    // Executions the platform ended without the run finalizing (a timeout, a stop, a crash)\n    for (const record of await this.options.executions.toReconcile(\n      25,\n      now - this.reconcileEveryMs\n    )) {\n      try {\n        await this.reconcile(record, now);\n      } catch (error) {\n        failures.push(error);\n      }\n    }\n    if (failures.length > 0) throw failures[0];\n  }\n\n  private async submit(record: ExecutionRecord): Promise<void> {\n    const { arn } = await this.options.lambda.startExecution({\n      target: record.target,\n      name: record.name,\n      payload: record.input,\n    });\n    await this.options.executions.markSubmitted(record.instanceId, arn, this.now());\n  }\n\n  /** Past the retry budget a start is unresolved for good: no retry could tell a duplicate apart. */\n  private async giveUpIfStale(record: ExecutionRecord): Promise<boolean> {\n    if (this.now() - record.createdAt <= this.startRetryMs) return false;\n    await this.options.executions.markUnresolved(record.instanceId, this.now());\n    console.error(\n      `[workflow] the start of ${record.instanceId} (${record.name}) was never confirmed: left unresolved`\n    );\n    return true;\n  }\n\n  private async arnOf(record: ExecutionRecord): Promise<string | undefined> {\n    if (record.arn !== undefined) return record.arn;\n    const arn = await this.options.lambda.findExecution(record.target, record.name);\n    if (arn !== undefined) await this.options.executions.setArn(record.instanceId, arn);\n    return arn;\n  }\n\n  /**\n   * Past the start retry budget, an execution still nowhere to be seen never started: any queued\n   * invoke has expired by then. Before that, not finding it says nothing.\n   */\n  private vanished(record: ExecutionRecord): boolean {\n    return this.now() - record.createdAt > this.startRetryMs;\n  }\n\n  /** Stopped so recently that an invocation running at the time may still be acting. */\n  private draining(record: ExecutionRecord): boolean {\n    return record.stoppedAt !== undefined && this.now() - record.stoppedAt < this.stopDrainMs;\n  }\n\n  private async reconcile(record: ExecutionRecord, now: number): Promise<void> {\n    const arn = await this.arnOf(record);\n    const state = arn === undefined ? undefined : await this.options.lambda.executionState(arn);\n    // Only a state that will never run another step — or one missing for good — ends the entry;\n    // a run still queued, or not visible yet, is left alone\n    const ended =\n      state === 'failed' ||\n      state === 'stopped' ||\n      state === 'timed_out' ||\n      (state === undefined && this.vanished(record));\n    if (ended) {\n      // Ended without its finalize step: the ledger must not show it running forever\n      const { store } = this.options;\n      await store.setEntryStatus(record.instanceId, 'failed');\n      await store.reporting?.instanceFinished({\n        workflow: record.workflow,\n        instanceId: record.instanceId,\n        userId: record.userId,\n        status: 'failed',\n        at: now,\n      });\n      console.warn(\n        `[workflow] ${record.instanceId} ended on the platform (${state ?? 'unknown'}) without finishing: recorded as failed`\n      );\n    }\n    await this.options.executions.markChecked(record.instanceId, now);\n  }\n\n  private instance(id: string): WorkflowInstanceLike {\n    const { executions, lambda } = this.options;\n    const current = async () => {\n      const record = await executions.get(id);\n      if (record === undefined) throw new InstanceNotFoundError(id);\n      return record;\n    };\n    return {\n      id,\n      sendEvent: async (event) => {\n        // The wait parked now, read at the moment of the wake: a newer wait's callback replaces\n        // an older one, and a wake for none (the instance is between waits) is nothing to do —\n        // its next wait re-reads the facts before parking\n        const { callbackId } = await current();\n        if (callbackId === undefined) return;\n        await lambda.completeCallback(callbackId, JSON.stringify(event.payload ?? {}));\n      },\n      terminate: async () => {\n        const record = await current();\n        // Stopped before: done once an invocation that was running then has had time to end\n        if (record.stoppedAt !== undefined) {\n          if (this.draining(record)) {\n            throw new Error(`${id} was stopped; its running invocation may still be finishing`);\n          }\n          return;\n        }\n        if (record.submittedAt === undefined && record.unresolvedAt === undefined) {\n          // No retry may start it after this\n          await executions.markUnresolved(id, this.now());\n        }\n        const arn = await this.arnOf(record);\n        if (arn === undefined) {\n          // Not visible yet is not stopped: the erasure stays pending, and the sweep retries\n          if (this.vanished(record)) return;\n          throw new Error(`cannot stop ${id} yet: its execution is not visible`);\n        }\n        // One that finished on its own has no invocation left to drain\n        const state = await lambda.executionState(arn);\n        if (state === 'succeeded' || state === 'failed' || state === 'timed_out') return;\n        if (!(await lambda.stopExecution(arn))) throw new Error(`stopping ${id} failed`);\n        // A stop does not interrupt an invocation already running: it goes on to its next\n        // checkpoint, side effects included. The erasure waits (see stopDrainMs)\n        await executions.markStopped(id, this.now());\n        throw new Error(`${id} is stopped; its running invocation may still be finishing`);\n      },\n      status: async () => {\n        const record = await current();\n        if (this.draining(record)) return { status: 'running' };\n        const arn = await this.arnOf(record);\n        // Not visible yet may still run: only one missing past the budget is gone\n        if (arn === undefined) return { status: this.vanished(record) ? 'terminated' : 'running' };\n        const state = await lambda.executionState(arn);\n        // In the router's vocabulary (Cloudflare's): what will never run another step\n        if (state === 'succeeded') return { status: 'complete' };\n        if (state === 'failed') return { status: 'errored' };\n        if (state === 'running') return { status: 'running' };\n        return { status: 'terminated' };\n      },\n    };\n  }\n}\n"],"mappings":";;;;;;;;;AAsBA,MAAa,iBAAiB;AAU9B,SAAgB,WAAW,OAAmC;CAC5D,IAAI,OAAO,UAAU,YAAY,UAAU,MAAM,OAAO;CACxD,MAAM,YAAY;CAOlB,OACE,UAAU,SAAA,mBACV,UAAU,mBAAmB,KAAA,KAC7B,OAAO,UAAU,eAAe,YAChC,OAAO,UAAU,gBAAgB,YACjC,OAAO,UAAU,WAAW,YAC5B,UAAU,WAAW;AAEzB;AAEA,MAAM,OAAO,IAAI,YAAY;;;;;;AAO7B,SAAgB,cAAc,YAAoB,SAAyB;CACzE,MAAM,OAAO,WAAW,QAAQ,mBAAmB,GAAG;CACtD,MAAM,QAAQ,QAAQ,QAAQ,iBAAiB,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC;CAE7D,MAAM,SAAS,IAAI,GADI,QAAQ,KAAK,OAAO,UAAU,CAAC,CAAC,CAAC,SAAS,EAAE,IAAI,QAAQ,KAAK,OAAO,UAAU,GAAG,UAAU,CAAC,CAAC,SAAS,EAAE,IAChG,GAAG;CAClC,OAAO,GAAG,KAAK,MAAM,GAAG,KAAK,OAAO,MAAM,IAAI;AAChD;AA4BA,MAAM,SAAS;AAEf,IAAa,eAAb,MAAyD;CAM1B;CAL7B;CACA;CACA;CACA;CAEA,YAAY,SAA+C;EAA9B,KAAA,UAAA;EAC3B,KAAK,MAAM,QAAQ,OAAO,KAAK;EAC/B,KAAK,eAAe,QAAQ,gBAAgB,MAAU;EACtD,KAAK,mBAAmB,QAAQ,oBAAoB,KAAK;EACzD,KAAK,cAAc,QAAQ,eAAe,KAAK;CACjD;;;;;;CAOA,MAAM,KAAK,SAKiB;EAC1B,MAAM,QAAkB;GACtB,MAAM;GACN,YAAY,QAAQ;GACpB,QAAQ,QAAQ;GAEhB,aAAa,KAAK,IAAI;EACxB;EACA,OAAO;GACL,MAAM,cAAc,QAAQ,IAAI,OAAO,WAAW,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;GAC/D,QAAQ,MAAM,KAAK,QAAQ,OAAO,QAAQ,OAAO,aAAa,QAAQ,OAAO;GAC7E,OAAO,KAAK,UAAU,KAAK;EAC7B;CACF;CAEA,MAAM,OAAO,SAAyE;EACpF,MAAM,SAAS,MAAM,KAAK,QAAQ,WAAW,IAAI,QAAQ,EAAE;EAC3D,IAAI,WAAW,KAAA,GACb,MAAM,IAAI,MAAM,4BAA4B,QAAQ,GAAG,kCAAkC;EAE3F,MAAM,KAAK,OAAO,MAAM;EACxB,OAAO,KAAK,SAAS,QAAQ,EAAE;CACjC;CAEA,MAAM,IAAI,IAA2C;EAEnD,IAAK,MAAM,KAAK,QAAQ,WAAW,IAAI,EAAE,MAAO,KAAA,GAC9C,MAAM,IAAI,sBAAsB,EAAE;EAEpC,OAAO,KAAK,SAAS,EAAE;CACzB;CAEA,MAAM,OAAO,OAA4D;EACvE,KAAK,MAAM,UAAU,MAAM,KAAK,QAAQ,WAAW,cAAc;GAAE,GAAG;GAAO,OAAO;EAAE,CAAC,GACrF,IAAI,CAAE,MAAM,KAAK,cAAc,MAAM,GAAI,MAAM,KAAK,OAAO,MAAM;CAErE;CAEA,MAAM,WAA0B;EAC9B,MAAM,MAAM,KAAK,IAAI;EACrB,MAAM,WAAsB,CAAC;EAE7B,KAAK,MAAM,UAAU,MAAM,KAAK,QAAQ,WAAW,cAAc;GAC/D,eAAe,MAAM;GACrB,OAAO;EACT,CAAC,GACC,IAAI;GACF,IAAI,CAAE,MAAM,KAAK,cAAc,MAAM,GAAI,MAAM,KAAK,OAAO,MAAM;EACnE,SAAS,OAAO;GACd,SAAS,KAAK,KAAK;EACrB;EAGF,KAAK,MAAM,UAAU,MAAM,KAAK,QAAQ,WAAW,YACjD,IACA,MAAM,KAAK,gBACb,GACE,IAAI;GACF,MAAM,KAAK,UAAU,QAAQ,GAAG;EAClC,SAAS,OAAO;GACd,SAAS,KAAK,KAAK;EACrB;EAEF,IAAI,SAAS,SAAS,GAAG,MAAM,SAAS;CAC1C;CAEA,MAAc,OAAO,QAAwC;EAC3D,MAAM,EAAE,QAAQ,MAAM,KAAK,QAAQ,OAAO,eAAe;GACvD,QAAQ,OAAO;GACf,MAAM,OAAO;GACb,SAAS,OAAO;EAClB,CAAC;EACD,MAAM,KAAK,QAAQ,WAAW,cAAc,OAAO,YAAY,KAAK,KAAK,IAAI,CAAC;CAChF;;CAGA,MAAc,cAAc,QAA2C;EACrE,IAAI,KAAK,IAAI,IAAI,OAAO,aAAa,KAAK,cAAc,OAAO;EAC/D,MAAM,KAAK,QAAQ,WAAW,eAAe,OAAO,YAAY,KAAK,IAAI,CAAC;EAC1E,QAAQ,MACN,2BAA2B,OAAO,WAAW,IAAI,OAAO,KAAK,uCAC/D;EACA,OAAO;CACT;CAEA,MAAc,MAAM,QAAsD;EACxE,IAAI,OAAO,QAAQ,KAAA,GAAW,OAAO,OAAO;EAC5C,MAAM,MAAM,MAAM,KAAK,QAAQ,OAAO,cAAc,OAAO,QAAQ,OAAO,IAAI;EAC9E,IAAI,QAAQ,KAAA,GAAW,MAAM,KAAK,QAAQ,WAAW,OAAO,OAAO,YAAY,GAAG;EAClF,OAAO;CACT;;;;;CAMA,SAAiB,QAAkC;EACjD,OAAO,KAAK,IAAI,IAAI,OAAO,YAAY,KAAK;CAC9C;;CAGA,SAAiB,QAAkC;EACjD,OAAO,OAAO,cAAc,KAAA,KAAa,KAAK,IAAI,IAAI,OAAO,YAAY,KAAK;CAChF;CAEA,MAAc,UAAU,QAAyB,KAA4B;EAC3E,MAAM,MAAM,MAAM,KAAK,MAAM,MAAM;EACnC,MAAM,QAAQ,QAAQ,KAAA,IAAY,KAAA,IAAY,MAAM,KAAK,QAAQ,OAAO,eAAe,GAAG;EAQ1F,IAJE,UAAU,YACV,UAAU,aACV,UAAU,eACT,UAAU,KAAA,KAAa,KAAK,SAAS,MAAM,GACnC;GAET,MAAM,EAAE,UAAU,KAAK;GACvB,MAAM,MAAM,eAAe,OAAO,YAAY,QAAQ;GACtD,MAAM,MAAM,WAAW,iBAAiB;IACtC,UAAU,OAAO;IACjB,YAAY,OAAO;IACnB,QAAQ,OAAO;IACf,QAAQ;IACR,IAAI;GACN,CAAC;GACD,QAAQ,KACN,cAAc,OAAO,WAAW,0BAA0B,SAAS,UAAU,wCAC/E;EACF;EACA,MAAM,KAAK,QAAQ,WAAW,YAAY,OAAO,YAAY,GAAG;CAClE;CAEA,SAAiB,IAAkC;EACjD,MAAM,EAAE,YAAY,WAAW,KAAK;EACpC,MAAM,UAAU,YAAY;GAC1B,MAAM,SAAS,MAAM,WAAW,IAAI,EAAE;GACtC,IAAI,WAAW,KAAA,GAAW,MAAM,IAAI,sBAAsB,EAAE;GAC5D,OAAO;EACT;EACA,OAAO;GACL;GACA,WAAW,OAAO,UAAU;IAI1B,MAAM,EAAE,eAAe,MAAM,QAAQ;IACrC,IAAI,eAAe,KAAA,GAAW;IAC9B,MAAM,OAAO,iBAAiB,YAAY,KAAK,UAAU,MAAM,WAAW,CAAC,CAAC,CAAC;GAC/E;GACA,WAAW,YAAY;IACrB,MAAM,SAAS,MAAM,QAAQ;IAE7B,IAAI,OAAO,cAAc,KAAA,GAAW;KAClC,IAAI,KAAK,SAAS,MAAM,GACtB,MAAM,IAAI,MAAM,GAAG,GAAG,4DAA4D;KAEpF;IACF;IACA,IAAI,OAAO,gBAAgB,KAAA,KAAa,OAAO,iBAAiB,KAAA,GAE9D,MAAM,WAAW,eAAe,IAAI,KAAK,IAAI,CAAC;IAEhD,MAAM,MAAM,MAAM,KAAK,MAAM,MAAM;IACnC,IAAI,QAAQ,KAAA,GAAW;KAErB,IAAI,KAAK,SAAS,MAAM,GAAG;KAC3B,MAAM,IAAI,MAAM,eAAe,GAAG,mCAAmC;IACvE;IAEA,MAAM,QAAQ,MAAM,OAAO,eAAe,GAAG;IAC7C,IAAI,UAAU,eAAe,UAAU,YAAY,UAAU,aAAa;IAC1E,IAAI,CAAE,MAAM,OAAO,cAAc,GAAG,GAAI,MAAM,IAAI,MAAM,YAAY,GAAG,QAAQ;IAG/E,MAAM,WAAW,YAAY,IAAI,KAAK,IAAI,CAAC;IAC3C,MAAM,IAAI,MAAM,GAAG,GAAG,2DAA2D;GACnF;GACA,QAAQ,YAAY;IAClB,MAAM,SAAS,MAAM,QAAQ;IAC7B,IAAI,KAAK,SAAS,MAAM,GAAG,OAAO,EAAE,QAAQ,UAAU;IACtD,MAAM,MAAM,MAAM,KAAK,MAAM,MAAM;IAEnC,IAAI,QAAQ,KAAA,GAAW,OAAO,EAAE,QAAQ,KAAK,SAAS,MAAM,IAAI,eAAe,UAAU;IACzF,MAAM,QAAQ,MAAM,OAAO,eAAe,GAAG;IAE7C,IAAI,UAAU,aAAa,OAAO,EAAE,QAAQ,WAAW;IACvD,IAAI,UAAU,UAAU,OAAO,EAAE,QAAQ,UAAU;IACnD,IAAI,UAAU,WAAW,OAAO,EAAE,QAAQ,UAAU;IACpD,OAAO,EAAE,QAAQ,aAAa;GAChC;EACF;CACF;AACF"}

package/dist/cloudflare/bindings.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"bindings.cjs","names":[],"sources":["../../src/cloudflare/bindings.ts"],"sourcesContent":["import type { EmailAddress } from '../email';\nimport type { ExecutionStart } from '../store/index';\n\n/**\n * A minimal structural interface over the Cloudflare bindings.\n *\n * @cloudflare/workers-types is deliberately not used: the global types it\n * injects clash with the DOM lib this package's react side needs. A structural\n * subset plus the ambient cloudflare:workers declaration is enough to compile,\n * and the real bindings satisfy it structurally at runtime.\n */\n\nexport interface KVNamespaceLike {\n  get(key: string): Promise<string | null>;\n  put(key: string, value: string): Promise<void>;\n}\n\n/** Structural subset of D1Result: `meta.changes` is how INSERT OR IGNORE reports whether it inserted. */\nexport interface D1RunResultLike {\n  meta?: { changes?: number };\n}\n\nexport interface D1PreparedStatementLike {\n  bind(...values: unknown[]): D1PreparedStatementLike;\n  first<T = Record<string, unknown>>(): Promise<T | null>;\n  all<T = Record<string, unknown>>(): Promise<{ results: T[] }>;\n  run(): Promise<D1RunResultLike>;\n}\n\nexport interface D1DatabaseLike {\n  prepare(sql: string): D1PreparedStatementLike;\n  /** Statements run in order inside one transaction (real D1 semantics) — deploy relies on the atomicity. */\n  batch(statements: D1PreparedStatementLike[]): Promise<unknown>;\n}\n\nexport interface WorkflowInstanceLike {\n  id: string;\n  sendEvent(event: { type: string; payload?: unknown }): Promise<void>;\n  /** Stop the instance for good (Cloudflare Workflows' `terminate`). */\n  terminate?(): Promise<void>;\n  /** Where it stands (`complete`, `errored`, `terminated`, `running`, …). */\n  status?(): Promise<{ status: string }>;\n}\n\n/**\n * How the router starts, wakes and stops instances: Cloudflare's workflow binding, or the AWS\n * adapter's equivalent over durable executions.\n */\nexport interface WorkflowBindingLike {\n  create(options: { id: string; params: unknown }): Promise<WorkflowInstanceLike>;\n  get(id: string): Promise<WorkflowInstanceLike>;\n  /**\n   * For a runtime whose start is a submit that can be lost in flight (AWS): the start to record\n   * with the entry, in one transaction. A failed `create` then keeps the entry — its recorded\n   * start is retried by the next ingest for the pair (`resume`) or by maintenance, never rolled\n   * back and re-entered as a second execution.\n   */\n  plan?(options: { id: string; params: JourneyParams; ts: number }): Promise<ExecutionStart>;\n  /** Retry the recorded, unconfirmed start of the (workflow, user) entry still running, if any. */\n  resume?(entry: { workflow: string; userId: string }): Promise<void>;\n  /**\n   * Maintenance the sweep runs first: old unconfirmed starts retried (or given up on), and\n   * executions the platform ended on its own (timeout, stop, crash) reconciled into the ledger.\n   */\n  maintain?(): Promise<void>;\n}\n\n/**\n * Cloudflare Email Service's send_email binding (structural subset).\n *\n * `idempotencyKey` is part of the call because the send happens inside a\n * `step.do`: a step body re-runs after its fn resolved but before the\n * checkpoint committed, so a binding that drops the key mails the user twice.\n * The binding is app-supplied glue (nothing here can de-duplicate — there is\n * no state between two runs of the same step), which is why the port makes the\n * key impossible to miss rather than merely available.\n */\nexport interface EmailBindingLike {\n  send(message: {\n    from: EmailAddress;\n    to: EmailAddress;\n    replyTo?: EmailAddress;\n    subject: string;\n    html: string;\n    /** `${instanceId}:${nodeId}`: stable across replays and retries — drop a send whose key was already delivered. */\n    idempotencyKey: string;\n  }): Promise<unknown>;\n}\n\n/** Every binding the journey engine needs (names match the wrangler config). */\nexport interface JourneyEnv {\n  /**\n   * BundleIR storage for the default D1 store (`wf:${contentHash}` → WorkflowIR JSON). Optional:\n   * a Worker on another JourneyStore (Postgres, say) does not declare it.\n   */\n  WORKFLOW_KV?: KVNamespaceLike;\n  /** Tables of the default D1 store (events / profiles / segments / triggers / entries / subscriptions). Optional, as above. */\n  DB?: D1DatabaseLike;\n  /** JourneyRunner's workflow binding (creating instances and waking them). */\n  JOURNEY: WorkflowBindingLike;\n  /** Optional message-delivery webhook (defaults to the console logging sender). */\n  MESSAGE_WEBHOOK_URL?: string;\n  /**\n   * Bearer token required on every mutating HTTP endpoint (`Authorization:\n   * Bearer <token>`). Unset = open — acceptable only for local dev; /deploy in\n   * particular rewrites the whole routing table, so production must set this.\n   */\n  API_TOKEN?: string;\n  /**\n   * This Worker's public origin. With a store that keeps reporting (Postgres), journey emails'\n   * links and open pixel point at its `/t/...` routes; without it emails go out untracked.\n   */\n  WORKFLOW_ORIGIN?: string;\n  /** Which `workflow.config.ts` entry applies (`development`, `production`, …); production when unset. */\n  ENVIRONMENT?: string;\n  /** Cloudflare Email Sending, when the config has `emails`. */\n  EMAIL?: EmailBindingLike;\n  /** The APNs auth key (`.p8`, base64) named by the config's `apns.keyId`. */\n  APNS_PRIVATE_KEY_BASE64?: string;\n  /** The Firebase service account (base64 JSON) the config's `fcm` sends with. */\n  GOOGLE_APPLICATION_CREDENTIALS_BASE64?: string;\n  /** The VAPID key pair web pushes are signed with (`generateVapidKeys`); the config's `webPush` turns the channel on. */\n  VAPID_PUBLIC_KEY?: string;\n  VAPID_PRIVATE_KEY?: string;\n  /**\n   * Cloudflare's version metadata binding (wrangler `\"version_metadata\": { \"binding\":\n   * \"CF_VERSION_METADATA\" }`). With it, and a store that records the live version (Postgres),\n   * journeyWorker makes the bundle compiled into each new version live by itself: `wrangler\n   * deploy` is the whole deploy.\n   */\n  CF_VERSION_METADATA?: { id: string; tag?: string; timestamp: string };\n  /** Development only: the HTTP/2 relay `wrangler dev` sends APNs requests through (see `@shware/workflow/apns-relay`). */\n  APNS_RELAY_ORIGIN?: string;\n}\n\n/** The runtime does not know the instance: the only failure that lets the router drop its wakes. */\nexport class InstanceNotFoundError extends Error {\n  override readonly name = 'InstanceNotFoundError';\n  constructor(readonly instanceId: string) {\n    super(`no such instance: ${instanceId}`);\n  }\n}\n\n/**\n * Does this lookup failure say the instance is gone, rather than that the lookup failed?\n * Cloudflare reports an unknown id as `instance.not_found`.\n */\nexport function isInstanceNotFound(error: unknown): boolean {\n  if (error instanceof InstanceNotFoundError) return true;\n  return /not[_ ]found|no such instance/i.test(String(error));\n}\n\n/** The event type the router uses to wake waiting instances (sendEvent's `type`). */\nexport const WAKE_EVENT_TYPE = 'wake';\n\n/** Journey instance parameters, passed by the ingest router when it creates one. */\nexport interface JourneyParams {\n  workflowId: string;\n  /** The IR version pinned at entry. */\n  contentHash: string;\n  userId: string;\n  trigger: { event: string; payload: Record<string, unknown> };\n  [key: string]: unknown;\n}\n\n/**\n * Slack on the deadline when deciding whether a thrown wait was a timeout: the\n * platform may surface the expiry a moment early, and a wait shorter than this\n * has no room to tell the two apart anyway.\n */\nexport const WAKE_TIMEOUT_TOLERANCE_MS = 5_000;\n\n/**\n * Did a wait that threw actually reach its deadline?\n *\n * CF signals a wait timeout by throwing, and so does every other failure in\n * there — a broken binding, an evicted instance, a malformed timeout. The\n * adapter used to read them all as timeouts, which made an infrastructure\n * fault indistinguishable from \"the user never did it\": the journey took its\n * onTimeout branch, early and silently. Only the clock can tell them apart.\n */\nexport function wakeExpired(startedAt: number, timeoutMs: number, now: number): boolean {\n  return now - startedAt >= Math.max(0, timeoutMs - WAKE_TIMEOUT_TOLERANCE_MS);\n}\n"],"mappings":";;;AAwIA,IAAa,wBAAb,cAA2C,MAAM;CAE1B;CADrB,OAAyB;CACzB,YAAY,YAA6B;EACvC,MAAM,qBAAqB,YAAY;EADpB,KAAA,aAAA;CAErB;AACF;;;;;AAMA,SAAgB,mBAAmB,OAAyB;CAC1D,IAAI,iBAAiB,uBAAuB,OAAO;CACnD,OAAO,iCAAiC,KAAK,OAAO,KAAK,CAAC;AAC5D;;AAGA,MAAa,kBAAkB;;;;;;AAiB/B,MAAa,4BAA4B;;;;;;;;;;AAWzC,SAAgB,YAAY,WAAmB,WAAmB,KAAsB;CACtF,OAAO,MAAM,aAAa,KAAK,IAAI,GAAG,YAAY,yBAAyB;AAC7E"}
+{"version":3,"file":"bindings.cjs","names":[],"sources":["../../src/cloudflare/bindings.ts"],"sourcesContent":["import type { EmailAddress } from '../email';\nimport type { ExecutionStart } from '../store/index';\n\n/**\n * A minimal structural interface over the Cloudflare bindings.\n *\n * @cloudflare/workers-types is deliberately not used: the global types it\n * injects clash with the DOM lib this package's react side needs. A structural\n * subset plus the ambient cloudflare:workers declaration is enough to compile,\n * and the real bindings satisfy it structurally at runtime.\n */\n\nexport interface KVNamespaceLike {\n  get(key: string): Promise<string | null>;\n  put(key: string, value: string): Promise<void>;\n}\n\n/** Structural subset of D1Result: `meta.changes` is how INSERT OR IGNORE reports whether it inserted. */\nexport interface D1RunResultLike {\n  meta?: { changes?: number };\n}\n\nexport interface D1PreparedStatementLike {\n  bind(...values: unknown[]): D1PreparedStatementLike;\n  first<T = Record<string, unknown>>(): Promise<T | null>;\n  all<T = Record<string, unknown>>(): Promise<{ results: T[] }>;\n  run(): Promise<D1RunResultLike>;\n}\n\nexport interface D1DatabaseLike {\n  prepare(sql: string): D1PreparedStatementLike;\n  /** Statements run in order inside one transaction (real D1 semantics) — deploy relies on the atomicity. */\n  batch(statements: D1PreparedStatementLike[]): Promise<unknown>;\n}\n\nexport interface WorkflowInstanceLike {\n  id: string;\n  sendEvent(event: { type: string; payload?: unknown }): Promise<void>;\n  /** Stop the instance for good (Cloudflare Workflows' `terminate`). */\n  terminate?(): Promise<void>;\n  /** Where it stands (`complete`, `errored`, `terminated`, `running`, …). */\n  status?(): Promise<{ status: string }>;\n}\n\n/**\n * How the router starts, wakes and stops instances: Cloudflare's workflow binding, or the AWS\n * adapter's equivalent over durable executions.\n */\nexport interface WorkflowBindingLike {\n  create(options: { id: string; params: unknown }): Promise<WorkflowInstanceLike>;\n  get(id: string): Promise<WorkflowInstanceLike>;\n  /**\n   * For a runtime whose start is a submit that can be lost in flight (AWS): the start to record\n   * with the entry, in one transaction. A failed `create` then keeps the entry — its recorded\n   * start is retried by the next ingest for the pair (`resume`) or by maintenance, never rolled\n   * back and re-entered as a second execution.\n   */\n  plan?(options: {\n    id: string;\n    params: JourneyParams;\n    ts: number;\n    /** The code version whose routes named `params.contentHash` (absent after a forced deploy). */\n    version?: string | undefined;\n  }): Promise<ExecutionStart>;\n  /** Retry the recorded, unconfirmed start of the (workflow, user) entry still running, if any. */\n  resume?(entry: { workflow: string; userId: string }): Promise<void>;\n  /**\n   * Maintenance the sweep runs first: old unconfirmed starts retried (or given up on), and\n   * executions the platform ended on its own (timeout, stop, crash) reconciled into the ledger.\n   */\n  maintain?(): Promise<void>;\n}\n\n/**\n * Cloudflare Email Service's send_email binding (structural subset).\n *\n * `idempotencyKey` is part of the call because the send happens inside a\n * `step.do`: a step body re-runs after its fn resolved but before the\n * checkpoint committed, so a binding that drops the key mails the user twice.\n * The binding is app-supplied glue (nothing here can de-duplicate — there is\n * no state between two runs of the same step), which is why the port makes the\n * key impossible to miss rather than merely available.\n */\nexport interface EmailBindingLike {\n  send(message: {\n    from: EmailAddress;\n    to: EmailAddress;\n    replyTo?: EmailAddress;\n    subject: string;\n    html: string;\n    /** `${instanceId}:${nodeId}`: stable across replays and retries — drop a send whose key was already delivered. */\n    idempotencyKey: string;\n  }): Promise<unknown>;\n}\n\n/** Every binding the journey engine needs (names match the wrangler config). */\nexport interface JourneyEnv {\n  /**\n   * BundleIR storage for the default D1 store (`wf:${contentHash}` → WorkflowIR JSON). Optional:\n   * a Worker on another JourneyStore (Postgres, say) does not declare it.\n   */\n  WORKFLOW_KV?: KVNamespaceLike;\n  /** Tables of the default D1 store (events / profiles / segments / triggers / entries / subscriptions). Optional, as above. */\n  DB?: D1DatabaseLike;\n  /** JourneyRunner's workflow binding (creating instances and waking them). */\n  JOURNEY: WorkflowBindingLike;\n  /** Optional message-delivery webhook (defaults to the console logging sender). */\n  MESSAGE_WEBHOOK_URL?: string;\n  /**\n   * Bearer token required on every mutating HTTP endpoint (`Authorization:\n   * Bearer <token>`). Unset = open — acceptable only for local dev; /deploy in\n   * particular rewrites the whole routing table, so production must set this.\n   */\n  API_TOKEN?: string;\n  /**\n   * This Worker's public origin. With a store that keeps reporting (Postgres), journey emails'\n   * links and open pixel point at its `/t/...` routes; without it emails go out untracked.\n   */\n  WORKFLOW_ORIGIN?: string;\n  /** Which `workflow.config.ts` entry applies (`development`, `production`, …); production when unset. */\n  ENVIRONMENT?: string;\n  /** Cloudflare Email Sending, when the config has `emails`. */\n  EMAIL?: EmailBindingLike;\n  /** The APNs auth key (`.p8`, base64) named by the config's `apns.keyId`. */\n  APNS_PRIVATE_KEY_BASE64?: string;\n  /** The Firebase service account (base64 JSON) the config's `fcm` sends with. */\n  GOOGLE_APPLICATION_CREDENTIALS_BASE64?: string;\n  /** The VAPID key pair web pushes are signed with (`generateVapidKeys`); the config's `webPush` turns the channel on. */\n  VAPID_PUBLIC_KEY?: string;\n  VAPID_PRIVATE_KEY?: string;\n  /**\n   * Cloudflare's version metadata binding (wrangler `\"version_metadata\": { \"binding\":\n   * \"CF_VERSION_METADATA\" }`). With it, and a store that records the live version (Postgres),\n   * journeyWorker makes the bundle compiled into each new version live by itself: `wrangler\n   * deploy` is the whole deploy.\n   */\n  CF_VERSION_METADATA?: { id: string; tag?: string; timestamp: string };\n  /** Development only: the HTTP/2 relay `wrangler dev` sends APNs requests through (see `@shware/workflow/apns-relay`). */\n  APNS_RELAY_ORIGIN?: string;\n}\n\n/** The runtime does not know the instance: the only failure that lets the router drop its wakes. */\nexport class InstanceNotFoundError extends Error {\n  override readonly name = 'InstanceNotFoundError';\n  constructor(readonly instanceId: string) {\n    super(`no such instance: ${instanceId}`);\n  }\n}\n\n/**\n * Does this lookup failure say the instance is gone, rather than that the lookup failed?\n * Cloudflare reports an unknown id as `instance.not_found`.\n */\nexport function isInstanceNotFound(error: unknown): boolean {\n  if (error instanceof InstanceNotFoundError) return true;\n  return /not[_ ]found|no such instance/i.test(String(error));\n}\n\n/** The event type the router uses to wake waiting instances (sendEvent's `type`). */\nexport const WAKE_EVENT_TYPE = 'wake';\n\n/** Journey instance parameters, passed by the ingest router when it creates one. */\nexport interface JourneyParams {\n  workflowId: string;\n  /** The IR version pinned at entry. */\n  contentHash: string;\n  userId: string;\n  trigger: { event: string; payload: Record<string, unknown> };\n  [key: string]: unknown;\n}\n\n/**\n * Slack on the deadline when deciding whether a thrown wait was a timeout: the\n * platform may surface the expiry a moment early, and a wait shorter than this\n * has no room to tell the two apart anyway.\n */\nexport const WAKE_TIMEOUT_TOLERANCE_MS = 5_000;\n\n/**\n * Did a wait that threw actually reach its deadline?\n *\n * CF signals a wait timeout by throwing, and so does every other failure in\n * there — a broken binding, an evicted instance, a malformed timeout. The\n * adapter used to read them all as timeouts, which made an infrastructure\n * fault indistinguishable from \"the user never did it\": the journey took its\n * onTimeout branch, early and silently. Only the clock can tell them apart.\n */\nexport function wakeExpired(startedAt: number, timeoutMs: number, now: number): boolean {\n  return now - startedAt >= Math.max(0, timeoutMs - WAKE_TIMEOUT_TOLERANCE_MS);\n}\n"],"mappings":";;;AA8IA,IAAa,wBAAb,cAA2C,MAAM;CAE1B;CADrB,OAAyB;CACzB,YAAY,YAA6B;EACvC,MAAM,qBAAqB,YAAY;EADpB,KAAA,aAAA;CAErB;AACF;;;;;AAMA,SAAgB,mBAAmB,OAAyB;CAC1D,IAAI,iBAAiB,uBAAuB,OAAO;CACnD,OAAO,iCAAiC,KAAK,OAAO,KAAK,CAAC;AAC5D;;AAGA,MAAa,kBAAkB;;;;;;AAiB/B,MAAa,4BAA4B;;;;;;;;;;AAWzC,SAAgB,YAAY,WAAmB,WAAmB,KAAsB;CACtF,OAAO,MAAM,aAAa,KAAK,IAAI,GAAG,YAAY,yBAAyB;AAC7E"}

package/dist/cloudflare/bindings.d.cts

@@ -65,6 +65,8 @@ export interface WorkflowBindingLike {
     id: string;
     params: JourneyParams;
     ts: number;
+    /** The code version whose routes named `params.contentHash` (absent after a forced deploy). */
+    version?: string | undefined;
   }): Promise<ExecutionStart>;
   /** Retry the recorded, unconfirmed start of the (workflow, user) entry still running, if any. */
   resume?(entry: {

package/dist/cloudflare/bindings.d.cts.map

@@ -1 +1 @@
-{"version":3,"file":"bindings.d.cts","names":[],"sources":["../../src/cloudflare/bindings.ts"],"mappings":";;;;;;;;;;;iBAYiB;EACf,IAAI,cAAc;EAClB,IAAI,aAAa,gBAAgB;;;iBAIlB;EACf;IAAS;;;iBAGM;EACf,QAAQ,oBAAoB;EAC5B,MAAM,IAAI,4BAA4B,QAAQ;EAC9C,IAAI,IAAI,4BAA4B;IAAU,SAAS;;EACvD,OAAO,QAAQ;;iBAGA;EACf,QAAQ,cAAc;;EAEtB,MAAM,YAAY,4BAA4B;;iBAG/B;EACf;EACA,UAAU;IAAS;IAAc;MAAsB;;EAEvD,cAAc;;EAEd,WAAW;IAAU;;;;;;;iBAON;EACf,OAAO;IAAW;IAAY;MAAoB,QAAQ;EAC1D,IAAI,aAAa,QAAQ;;;;;;;EAOzB,MAAM;IAAW;IAAY,QAAQ;IAAe;MAAe,QAAQ;;EAE3E,QAAQ;IAAS;IAAkB;MAAmB;;;;;EAKtD,aAAa;;;;;;;;;;;;iBAaE;EACf,KAAK;IACH,MAAM;IACN,IAAI;IACJ,UAAU;IACV;IACA;;IAEA;MACE;;;iBAIW;;;;;EAKf,cAAc;;EAEd,KAAK;;EAEL,SAAS;;EAET;;;;;;EAMA;;;;;EAKA;;EAEA;;EAEA,QAAQ;;EAER;;EAEA;;EAEA;EACA;;;;;;;EAOA;IAAwB;IAAY;IAAc;;;EAElD;;;qBAIW,8BAA8B;WAEpB;WADH;EAClB,YAAqB;;;;;;wBASP,mBAAmB;;qBAMtB;;iBAGI;EACf;;EAEA;EACA;EACA;IAAW;IAAe,SAAS;;GAClC;;;;;;;qBAQU;;;;;;;;;;wBAWG,YAAY,mBAAmB,mBAAmB"}
+{"version":3,"file":"bindings.d.cts","names":[],"sources":["../../src/cloudflare/bindings.ts"],"mappings":";;;;;;;;;;;iBAYiB;EACf,IAAI,cAAc;EAClB,IAAI,aAAa,gBAAgB;;;iBAIlB;EACf;IAAS;;;iBAGM;EACf,QAAQ,oBAAoB;EAC5B,MAAM,IAAI,4BAA4B,QAAQ;EAC9C,IAAI,IAAI,4BAA4B;IAAU,SAAS;;EACvD,OAAO,QAAQ;;iBAGA;EACf,QAAQ,cAAc;;EAEtB,MAAM,YAAY,4BAA4B;;iBAG/B;EACf;EACA,UAAU;IAAS;IAAc;MAAsB;;EAEvD,cAAc;;EAEd,WAAW;IAAU;;;;;;;iBAON;EACf,OAAO;IAAW;IAAY;MAAoB,QAAQ;EAC1D,IAAI,aAAa,QAAQ;;;;;;;EAOzB,MAAM;IACJ;IACA,QAAQ;IACR;;IAEA;MACE,QAAQ;;EAEZ,QAAQ;IAAS;IAAkB;MAAmB;;;;;EAKtD,aAAa;;;;;;;;;;;;iBAaE;EACf,KAAK;IACH,MAAM;IACN,IAAI;IACJ,UAAU;IACV;IACA;;IAEA;MACE;;;iBAIW;;;;;EAKf,cAAc;;EAEd,KAAK;;EAEL,SAAS;;EAET;;;;;;EAMA;;;;;EAKA;;EAEA;;EAEA,QAAQ;;EAER;;EAEA;;EAEA;EACA;;;;;;;EAOA;IAAwB;IAAY;IAAc;;;EAElD;;;qBAIW,8BAA8B;WAEpB;WADH;EAClB,YAAqB;;;;;;wBASP,mBAAmB;;qBAMtB;;iBAGI;EACf;;EAEA;EACA;EACA;IAAW;IAAe,SAAS;;GAClC;;;;;;;qBAQU;;;;;;;;;;wBAWG,YAAY,mBAAmB,mBAAmB"}

package/dist/cloudflare/bindings.d.mts

@@ -65,6 +65,8 @@ export interface WorkflowBindingLike {
     id: string;
     params: JourneyParams;
     ts: number;
+    /** The code version whose routes named `params.contentHash` (absent after a forced deploy). */
+    version?: string | undefined;
   }): Promise<ExecutionStart>;
   /** Retry the recorded, unconfirmed start of the (workflow, user) entry still running, if any. */
   resume?(entry: {

package/dist/cloudflare/bindings.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"bindings.d.mts","names":[],"sources":["../../src/cloudflare/bindings.ts"],"mappings":";;;;;;;;;;;iBAYiB;EACf,IAAI,cAAc;EAClB,IAAI,aAAa,gBAAgB;;;iBAIlB;EACf;IAAS;;;iBAGM;EACf,QAAQ,oBAAoB;EAC5B,MAAM,IAAI,4BAA4B,QAAQ;EAC9C,IAAI,IAAI,4BAA4B;IAAU,SAAS;;EACvD,OAAO,QAAQ;;iBAGA;EACf,QAAQ,cAAc;;EAEtB,MAAM,YAAY,4BAA4B;;iBAG/B;EACf;EACA,UAAU;IAAS;IAAc;MAAsB;;EAEvD,cAAc;;EAEd,WAAW;IAAU;;;;;;;iBAON;EACf,OAAO;IAAW;IAAY;MAAoB,QAAQ;EAC1D,IAAI,aAAa,QAAQ;;;;;;;EAOzB,MAAM;IAAW;IAAY,QAAQ;IAAe;MAAe,QAAQ;;EAE3E,QAAQ;IAAS;IAAkB;MAAmB;;;;;EAKtD,aAAa;;;;;;;;;;;;iBAaE;EACf,KAAK;IACH,MAAM;IACN,IAAI;IACJ,UAAU;IACV;IACA;;IAEA;MACE;;;iBAIW;;;;;EAKf,cAAc;;EAEd,KAAK;;EAEL,SAAS;;EAET;;;;;;EAMA;;;;;EAKA;;EAEA;;EAEA,QAAQ;;EAER;;EAEA;;EAEA;EACA;;;;;;;EAOA;IAAwB;IAAY;IAAc;;;EAElD;;;qBAIW,8BAA8B;WAEpB;WADH;EAClB,YAAqB;;;;;;wBASP,mBAAmB;;qBAMtB;;iBAGI;EACf;;EAEA;EACA;EACA;IAAW;IAAe,SAAS;;GAClC;;;;;;;qBAQU;;;;;;;;;;wBAWG,YAAY,mBAAmB,mBAAmB"}
+{"version":3,"file":"bindings.d.mts","names":[],"sources":["../../src/cloudflare/bindings.ts"],"mappings":";;;;;;;;;;;iBAYiB;EACf,IAAI,cAAc;EAClB,IAAI,aAAa,gBAAgB;;;iBAIlB;EACf;IAAS;;;iBAGM;EACf,QAAQ,oBAAoB;EAC5B,MAAM,IAAI,4BAA4B,QAAQ;EAC9C,IAAI,IAAI,4BAA4B;IAAU,SAAS;;EACvD,OAAO,QAAQ;;iBAGA;EACf,QAAQ,cAAc;;EAEtB,MAAM,YAAY,4BAA4B;;iBAG/B;EACf;EACA,UAAU;IAAS;IAAc;MAAsB;;EAEvD,cAAc;;EAEd,WAAW;IAAU;;;;;;;iBAON;EACf,OAAO;IAAW;IAAY;MAAoB,QAAQ;EAC1D,IAAI,aAAa,QAAQ;;;;;;;EAOzB,MAAM;IACJ;IACA,QAAQ;IACR;;IAEA;MACE,QAAQ;;EAEZ,QAAQ;IAAS;IAAkB;MAAmB;;;;;EAKtD,aAAa;;;;;;;;;;;;iBAaE;EACf,KAAK;IACH,MAAM;IACN,IAAI;IACJ,UAAU;IACV;IACA;;IAEA;MACE;;;iBAIW;;;;;EAKf,cAAc;;EAEd,KAAK;;EAEL,SAAS;;EAET;;;;;;EAMA;;;;;EAKA;;EAEA;;EAEA,QAAQ;;EAER;;EAEA;;EAEA;EACA;;;;;;;EAOA;IAAwB;IAAY;IAAc;;;EAElD;;;qBAIW,8BAA8B;WAEpB;WADH;EAClB,YAAqB;;;;;;wBASP,mBAAmB;;qBAMtB;;iBAGI;EACf;;EAEA;EACA;EACA;IAAW;IAAe,SAAS;;GAClC;;;;;;;qBAQU;;;;;;;;;;wBAWG,YAAY,mBAAmB,mBAAmB"}