@statewalker/cellb 0.0.0-stage → 0.1.1

package/vendor/celld/workflows.js

@@ -0,0 +1,1610 @@
+// GENERATED by scripts/vendor-celld.mjs from denoland/celld@8702f6d186c77698dbfb30cf29e3b1922a88f008 crates/celld/js/harness.js
+// (Apache-2.0): the Workflows section, unchanged, wrapped as workflowService(host). Do not edit.
+export function workflowService(host) {
+  const { __cell, __cf, __sc_encode, __als_get, __als_set, __alarm_set, __alarm_delete,
+    __registerWaitUntil, __ctxRun } = host;
+  const __isolate_condemn = host.condemn ?? (() => {});
+  const classes = {};
+  const __runtimeClass = (name, cls) => { classes[name] = cls; };
+  const __celld = {};
+// ---- Workflows ----------------------------------------------------------
+// A workflow instance is one cell of the runtime-supplied `__Workflow` class,
+// named `<workflow_name>/<instance_id>` through getByName, so it inherits
+// ownership, fencing, LTX replication and the output gate from the cell it
+// already is. Execution is replay: `run()` re-executes from the top on every
+// resume and only steps are memoized, in `ctx.storage` KV under `__wf.*`.
+// This half is the server; `__makeWorkflow` below is the client the binding
+// hands to a Worker. The public contract is in docs/cloudflare-compat.md.
+
+// Upstream's limit for a step return, an event payload, and the params. The
+// error is distinct and names the step, because "too large" and "the isolate
+// died" must not read the same (the D1 row-cap precedent).
+const __WF_VALUE_CAP = 1 << 20;
+// Workflow names, instance ids, and event types all share this charset.
+// `/` is outside it, which is what makes the `<name>/<id>` cell-name join
+// unambiguous.
+const __WF_NAME_RE = /^[a-zA-Z0-9_][a-zA-Z0-9-_]*$/;
+const __wfError = (message) => new Error("WORKFLOW_ERROR: " + message);
+// The suspension primitive: a blocked step returns a promise that never
+// settles in this invocation, so user code simply stops progressing. A
+// sentinel thrown through user code was rejected because `Promise.all` in
+// `run()` would observe it as a rejection and user try/catch would eat it.
+const __wfNever = new Promise(() => {});
+const __wfTerminal = (status) =>
+  status === "complete" || status === "errored" || status === "terminated";
+// Upstream's hard bounds: 10,000 retries per step, 365 days for any sleep or
+// event wait, one second under a waitForEvent timeout. Enforced loudly at the
+// call site -- a config outside them would otherwise misbehave only after
+// the instance is minutes or days into its run.
+const __WF_RETRY_LIMIT_CAP = 10000;
+const __WF_STEP_NAME_LIMIT = 256;
+const __WF_MAX_WAIT_MS = 365 * 86400000;
+const __WF_MIN_EVENT_TIMEOUT_MS = 1000;
+// celld has no account plans, so it exposes the larger published retention
+// ceiling as one stable application limit. Both an omitted policy and an
+// omitted member of a partial policy use this value.
+const __WF_RETENTION_MAX_MS = 30 * 86400000;
+const __WF_LOCATION_HINTS = new Set([
+  "wnam", "enam", "sam", "weur", "eeur", "apac", "apac-ne", "apac-se",
+  "oc", "afr", "me",
+]);
+// How long run() can stay pending on non-step work while no step runs and
+// none is blocked before the instance fails. Upstream permits un-stepped
+// awaits between steps (they are merely non-durable), so erroring at the
+// first quiescent macrotask would kill any run() whose external await
+// outlives one turn of the loop. Sixty seconds is long enough for any
+// sane un-stepped await and short enough that a truly never-settling
+// promise fails the instance instead of wedging the alarm handler.
+const __WF_STALL_GRACE_MS = 60000;
+const __WF_UNITS = {
+  second: 1000,
+  minute: 60000,
+  hour: 3600000,
+  day: 86400000,
+  week: 604800000,
+  // Upstream does not document its month/year arithmetic; fixed 30/365-day
+  // units are used so one expression cannot mean two durations depending on
+  // when it runs.
+  month: 30 * 86400000,
+  year: 365 * 86400000,
+};
+const __wfDuration = (value, what) => {
+  if (typeof value === "number" && Number.isFinite(value) && value >= 0) return value;
+  if (typeof value !== "string") {
+    throw __wfError(
+      `invalid duration for ${what}: ${JSON.stringify(value)}; use milliseconds ` +
+        'or "<n> <second|minute|hour|day|week|month|year>[s]"',
+    );
+  }
+  const match = /^\s*(\d+(?:\.\d+)?)\s+(second|minute|hour|day|week|month|year)s?\s*$/
+    .exec(value);
+  if (!match) {
+    throw __wfError(
+      `invalid duration for ${what}: ${JSON.stringify(value)}; use milliseconds ` +
+        'or "<n> <second|minute|hour|day|week|month|year>[s]"',
+    );
+  }
+  return Number(match[1]) * __WF_UNITS[match[2]];
+};
+const __wfRetentionDuration = (value, what) => {
+  const durationMs = __wfDuration(value, what);
+  if (durationMs > __WF_RETENTION_MAX_MS) {
+    throw __wfError(
+      `${what} is ${durationMs} ms, above celld's 30-day retention limit`,
+    );
+  }
+  return durationMs;
+};
+const __wfOwnObject = (value) =>
+  value !== null && typeof value === "object" && !Array.isArray(value);
+const __wfUnknownKey = (value, allowed) =>
+  Object.keys(value).find((key) => !allowed.includes(key));
+const __wfStepName = (name) => {
+  // The pinned workers-sdk validator has no minimum length. An empty name is
+  // therefore valid, although rejecting it looks safer at first glance. A
+  // non-empty check made celld reject Worker code that the upstream runtime
+  // accepts, so keep only the upstream length and control-character bounds.
+  if (
+    typeof name !== "string" || name.length > __WF_STEP_NAME_LIMIT ||
+    /[\x00-\x1f]/.test(name)
+  ) {
+    throw __wfError(
+      `invalid step name ${JSON.stringify(name)}: use at most ` +
+        `${__WF_STEP_NAME_LIMIT} characters and no control characters`,
+    );
+  }
+};
+const __wfEventType = (type) => {
+  if (typeof type !== "string" || type.length > 100 || !__WF_NAME_RE.test(type)) {
+    throw __wfError(
+      `invalid event type ${JSON.stringify(type)}: use at most 100 letters, ` +
+        "digits, hyphens, or underscores",
+    );
+  }
+};
+const __wfSleepDuration = (duration, name) => {
+  const durationMs = __wfDuration(
+    duration,
+    `the duration of sleep ${JSON.stringify(name)}`,
+  );
+  if (durationMs > __WF_MAX_WAIT_MS) {
+    throw __wfError(
+      `sleep ${JSON.stringify(name)} is ${durationMs} ms, above the upstream ` +
+        "limit of 365 days",
+    );
+  }
+  return durationMs;
+};
+const __wfSleepUntil = (timestamp, name) => {
+  const at = timestamp instanceof Date ? timestamp.getTime() : timestamp;
+  if (typeof at !== "number" || !Number.isFinite(at)) {
+    throw __wfError(
+      `invalid sleepUntil timestamp for ${JSON.stringify(name)}: use a Date ` +
+        "or a UNIX timestamp in milliseconds",
+    );
+  }
+  const delay = at - Date.now();
+  if (delay > __WF_MAX_WAIT_MS) {
+    throw __wfError(
+      `sleepUntil ${JSON.stringify(name)} is ${delay} ms away, above the ` +
+        "upstream limit of 365 days",
+    );
+  }
+  return at;
+};
+const __wfWaitOptions = (options, name) => {
+  if (!__wfOwnObject(options)) {
+    throw __wfError(`invalid waitForEvent options for ${JSON.stringify(name)}`);
+  }
+  __wfEventType(options.type);
+  const timeout = options.timeout ?? "24 hours";
+  const timeoutMs = __wfDuration(
+    timeout,
+    `the timeout of waitForEvent ${JSON.stringify(name)}`,
+  );
+  if (timeoutMs < __WF_MIN_EVENT_TIMEOUT_MS || timeoutMs > __WF_MAX_WAIT_MS) {
+    throw __wfError(
+      `the timeout of waitForEvent ${JSON.stringify(name)} is ${timeoutMs} ms; ` +
+        "upstream allows 1 second to 365 days",
+    );
+  }
+  return { type: options.type, timeout, timeoutMs };
+};
+const __wfEventOptions = (options) => {
+  if (!__wfOwnObject(options)) {
+    throw __wfError("sendEvent() needs an event object");
+  }
+  __wfEventType(options.type);
+  if (options.payload !== undefined) __wfCheckValue(options.payload, "the event payload");
+  return { type: options.type, payload: options.payload };
+};
+const __wfRetentionOptions = (retention, what) => {
+  if (retention === undefined) {
+    return {
+      successMs: __WF_RETENTION_MAX_MS,
+      errorMs: __WF_RETENTION_MAX_MS,
+    };
+  }
+  if (!__wfOwnObject(retention)) {
+    throw __wfError(`${what} option retention must be an object`);
+  }
+  const unknown = __wfUnknownKey(retention, ["successRetention", "errorRetention"]);
+  if (unknown !== undefined) {
+    throw __wfError(
+      `${what} option retention has an unknown field ${JSON.stringify(unknown)}`,
+    );
+  }
+  return {
+    successMs: retention.successRetention === undefined
+      ? __WF_RETENTION_MAX_MS
+      : __wfRetentionDuration(
+        retention.successRetention,
+        `${what} successRetention`,
+      ),
+    errorMs: retention.errorRetention === undefined
+      ? __WF_RETENTION_MAX_MS
+      : __wfRetentionDuration(retention.errorRetention, `${what} errorRetention`),
+  };
+};
+const __wfLocationHint = (hint, what) => {
+  if (hint !== undefined && !__WF_LOCATION_HINTS.has(hint)) {
+    throw __wfError(
+      `${what} has invalid locationHint ${JSON.stringify(hint)}`,
+    );
+  }
+  return hint;
+};
+const __wfRestartOptions = (options) => {
+  if (options === undefined) return {};
+  if (!__wfOwnObject(options)) {
+    throw __wfError("restart() options must be an object");
+  }
+  const unknown = __wfUnknownKey(options, ["from"]);
+  if (unknown !== undefined) {
+    throw __wfError(`restart() has an unknown option ${JSON.stringify(unknown)}`);
+  }
+  if (options.from === undefined) return {};
+  const from = options.from;
+  if (!__wfOwnObject(from)) {
+    throw __wfError("restart() option from must be an object");
+  }
+  const fromUnknown = __wfUnknownKey(from, ["name", "count", "type"]);
+  if (fromUnknown !== undefined) {
+    throw __wfError(
+      `restart() option from has an unknown field ${JSON.stringify(fromUnknown)}`,
+    );
+  }
+  __wfStepName(from.name);
+  const count = from.count ?? 1;
+  if (!Number.isInteger(count) || count < 1) {
+    throw __wfError("restart() option from.count must be a positive integer");
+  }
+  const type = from.type ?? "do";
+  if (!["do", "sleep", "waitForEvent"].includes(type)) {
+    throw __wfError(
+      'restart() option from.type must be "do", "sleep", or "waitForEvent"',
+    );
+  }
+  return { from: { name: from.name, count, type } };
+};
+const __wfStepConfig = (config, name) => {
+  if (!__wfOwnObject(config)) {
+    throw __wfError(`invalid config for step ${JSON.stringify(name)}: use an object`);
+  }
+  let unknown = __wfUnknownKey(config, ["retries", "timeout", "sensitive"]);
+  if (unknown !== undefined) {
+    throw __wfError(
+      `invalid config for step ${JSON.stringify(name)}: unknown option ` +
+        JSON.stringify(unknown),
+    );
+  }
+  const retries = config.retries;
+  if (retries !== undefined) {
+    if (!__wfOwnObject(retries)) {
+      throw __wfError(`invalid retries config for step ${JSON.stringify(name)}`);
+    }
+    unknown = __wfUnknownKey(retries, ["limit", "delay", "backoff"]);
+    if (unknown !== undefined) {
+      throw __wfError(
+        `invalid retries config for step ${JSON.stringify(name)}: unknown option ` +
+          JSON.stringify(unknown),
+      );
+    }
+    if (
+      typeof retries.limit !== "number" || !Number.isFinite(retries.limit) ||
+      retries.limit < 0
+    ) {
+      throw __wfError(
+        `invalid retries config for step ${JSON.stringify(name)}: ` +
+          "limit must be a non-negative number",
+      );
+    }
+    if (retries.limit > __WF_RETRY_LIMIT_CAP) {
+      throw __wfError(
+        `invalid retries config for step ${JSON.stringify(name)}: limit is above ` +
+          String(__WF_RETRY_LIMIT_CAP),
+      );
+    }
+    if (typeof retries.delay !== "function") {
+      __wfDuration(retries.delay, `the retries config delay of step ${JSON.stringify(name)}`);
+    }
+    if (
+      retries.backoff !== undefined &&
+      !["constant", "linear", "exponential"].includes(retries.backoff)
+    ) {
+      throw __wfError(
+        `invalid retries config for step ${JSON.stringify(name)}: ` +
+          "backoff must be constant, linear, or exponential",
+      );
+    }
+  }
+  if (config.timeout !== undefined) {
+    const timeout = __wfDuration(
+      config.timeout,
+      `the config timeout of step ${JSON.stringify(name)}`,
+    );
+    if (timeout === 0) {
+      throw __wfError(
+        `invalid config timeout for step ${JSON.stringify(name)}: use a value above zero`,
+      );
+    }
+  }
+  if (config.sensitive !== undefined && config.sensitive !== "output") {
+    throw __wfError(
+      `invalid config sensitive value for step ${JSON.stringify(name)}: use "output"`,
+    );
+  }
+  return {
+    ...config,
+    ...(retries === undefined ? {} : { retries: { ...retries } }),
+  };
+};
+// Serialization is checked with the same encoder storage and RPC use, so a
+// value that passes here cannot fail later at the isolate boundary. The
+// thrown errors are permanent: retrying cannot make a value cloneable or
+// shrink it.
+const __wfEncodeValue = (value, what) => {
+  try {
+    return __sc_encode(value);
+  } catch (error) {
+    const failure = __wfError(
+      `${what} is not serializable: ${String(error && error.message || error)}. ` +
+        "It must survive structured clone; a ReadableStream return is not implemented in celld.",
+    );
+    failure.__wfPermanent = true;
+    throw failure;
+  }
+};
+const __wfCheckEncodedValue = (bytes, what) => {
+  if (bytes.byteLength > __WF_VALUE_CAP) {
+    const failure = __wfError(
+      `${what} is ${bytes.byteLength} bytes, above the 1 MiB limit; ` +
+        "store large output externally and return a reference",
+    );
+    failure.__wfPermanent = true;
+    throw failure;
+  }
+};
+const __wfCheckValue = (value, what) =>
+  __wfCheckEncodedValue(__wfEncodeValue(value, what), what);
+const __wfErrorRecord = (error) => ({
+  name: String(error && error.name || "Error"),
+  message: String(error && error.message || error),
+});
+// A permanently failed step rejects on every replay, so user try/catch
+// around step.do keeps working after a resume, not only on the attempt that
+// failed live.
+const __wfReviveError = (record) => {
+  const error = new Error(record.message);
+  error.name = record.name;
+  return error;
+};
+const __wfLedgerPrefix = (generation) => `__wf.${generation}.`;
+const __wfEventPrefix = (generation) =>
+  __wfLedgerPrefix(generation) + "event.";
+const __wfEventKey = (generation, sequence) =>
+  __wfEventPrefix(generation) + String(sequence).padStart(9, "0");
+const __wfRetentionMs = (meta, status) =>
+  status === "complete"
+    ? (meta.retention?.successMs ?? __WF_RETENTION_MAX_MS)
+    : (meta.retention?.errorMs ?? __WF_RETENTION_MAX_MS);
+const __wfFinishRetention = (meta, transaction) => {
+  meta.endedMs = Date.now();
+  meta.expiresMs = meta.endedMs + __wfRetentionMs(meta, meta.status);
+  transaction.setAlarm(meta.expiresMs);
+};
+// A ledger record replays only through the kind of call that wrote it. A
+// `do` renamed into a `sleep`, or two calls reordered under one name, would
+// otherwise read fields the other kind never wrote and continue on
+// undefined -- a deadline of NaN, a value of nothing -- instead of failing.
+const __wfKindCheck = (record, kind, name) => {
+  if (record === undefined || record.kind === kind) return record;
+  const failure = __wfError(
+    `step ${JSON.stringify(name)} replays as ${kind} but its ledger record ` +
+      `was written by ${record.kind}; a step keeps one kind across replays`,
+  );
+  failure.__wfPermanent = true;
+  throw failure;
+};
+// Each step callback runs under an async-context frame naming its step (the
+// same CPED-backed frame __ctxRun uses, so it survives the callback's
+// awaits). A step started inside another step's callback would wedge
+// quiescence: the outer callback cannot settle while it awaits the blocked
+// inner step, so `running` never reaches zero and the instance can neither
+// suspend nor finish. The frame is what lets the inner call refuse loudly
+// at the nesting site instead.
+const __wfStepKey = Symbol("celld.wfStep");
+const __wfEnclosingStep = () => {
+  const frame = __als_get();
+  return frame === undefined ? undefined : frame.get(__wfStepKey);
+};
+const __wfEnterStep = (name, fn) => {
+  const prior = __als_get();
+  const frame = new Map(prior);
+  frame.set(__wfStepKey, name);
+  __als_set(frame);
+  try {
+    return fn();
+  } finally {
+    __als_set(prior);
+  }
+};
+
+// Race an attempt against its deadline. The abandoned callback keeps
+// running -- there is no cancellation to send it -- but its result is
+// discarded and the timeout counts as a failed attempt, as upstream.
+const __wfTimeout = (promise, ms, name, attempt) =>
+  new Promise((resolve, reject) => {
+    const timer = setTimeout(
+      () =>
+        reject(new Error(
+          `step ${JSON.stringify(name)} timed out after ${ms} ms (attempt ${attempt})`,
+        )),
+      ms,
+    );
+    promise.then(
+      (value) => { clearTimeout(timer); resolve(value); },
+      (error) => { clearTimeout(timer); reject(error); },
+    );
+  });
+
+// Storage failures belong to the engine even when workflow code catches the
+// rejected step promise. Record them outside the Error object, so user code
+// cannot suppress a retry or forge one by returning a marked exception.
+const __wfTrackStorageFailures = (storage, driver) => {
+  const tracked = Object.create(storage);
+  for (const name of ["get", "put", "transactionSync"]) {
+    Object.defineProperty(tracked, name, {
+      value(...args) {
+        try {
+          const result = storage[name](...args);
+          if (result !== null && typeof result === "object" &&
+            typeof result.then === "function") {
+            return result.catch((error) => {
+              driver.storageFailure ??= error;
+              throw error;
+            });
+          }
+          return result;
+        } catch (error) {
+          driver.storageFailure ??= error;
+          throw error;
+        }
+      },
+    });
+  }
+  return tracked;
+};
+
+// The WorkflowStep the driver hands to run(). Each method resolves its step
+// record by (name, occurrence count) -- the count is assigned synchronously
+// at call time, so `Promise.all` of two same-named steps gets deterministic
+// distinct keys in call order, and a repeated name in a loop cannot collide.
+const __wfMakeStep = (driver) => {
+  const storage = driver.storage;
+  // The shared step frame. `body` resolves to {value} or {block: at, kind};
+  // a blocked step leaves its promise unsettled forever in this invocation.
+  // The running counter covers the whole body, ledger reads included, so
+  // quiescence cannot fire between a step's read and its decision.
+  const frame = (name, body) => {
+    // A stale replay -- one whose invocation already suspended -- can wake
+    // later if user code raced a step against an un-stepped await. It goes
+    // quiet instead of executing an attempt beside the fresh replay.
+    if (driver.finished) return __wfNever;
+    const enclosing = __wfEnclosingStep();
+    if (enclosing !== undefined) {
+      const failure = __wfError(
+        `step ${JSON.stringify(name)} cannot start inside the callback of ` +
+          `step ${JSON.stringify(enclosing)}; a step callback must not use ` +
+          "the step API",
+      );
+      failure.__wfPermanent = true;
+      return Promise.reject(failure);
+    }
+    const count = (driver.counts.get(name) ?? 0) + 1;
+    driver.counts.set(name, count);
+    const ordinal = ++driver.ordinal;
+    const key = driver.ledgerPrefix + `step.${count}.${name}`;
+    // Step activity restarts the stall clock: a pending grace timer was
+    // armed against a run() that looked stuck, and this call is progress.
+    driver.clearStall();
+    driver.running += 1;
+    return new Promise((resolve, reject) => {
+      (async () => {
+        const meta = await storage.get("__wf.meta");
+        if (
+          meta === undefined || meta.generation !== driver.generation ||
+          __wfTerminal(meta.status) || meta.status === "paused" ||
+          meta.status === "waitingForPause"
+        ) {
+          return { pause: true };
+        }
+        return await body(key, count, ordinal);
+      })().then(
+        (result) => {
+          driver.running -= 1;
+          driver.clearStall();
+          if (result.pause === true) {
+            driver.pauseRequested = true;
+            driver.check();
+            return;
+          }
+          if (result.block !== undefined) {
+            if (!driver.finished) {
+              driver.blocked.push({ at: result.block, kind: result.kind });
+            }
+            driver.check();
+            return;
+          }
+          driver.check();
+          resolve(result.value);
+        },
+        (error) => {
+          driver.running -= 1;
+          driver.clearStall();
+          driver.check();
+          reject(error);
+        },
+      );
+    });
+  };
+  const doStep = (name, configOrCallback, callbackOrRollback, maybeRollback) => {
+    const hasConfig = typeof configOrCallback !== "function";
+    let config = hasConfig ? (configOrCallback ?? {}) : {};
+    const callback = hasConfig ? callbackOrRollback : configOrCallback;
+    const rollback = hasConfig ? maybeRollback : callbackOrRollback;
+    try {
+      __wfStepName(name);
+      config = __wfStepConfig(config, name);
+    } catch (error) {
+      return Promise.reject(error);
+    }
+    if (rollback !== undefined) {
+      return Promise.reject(__wfError(
+        "step rollbackOptions are not implemented in celld; remove the rollback handler",
+      ));
+    }
+    if (config.sensitive !== undefined) {
+      return Promise.reject(__wfError(
+        "sensitive step output is not implemented in celld; remove `sensitive`",
+      ));
+    }
+    if (typeof callback !== "function") {
+      return Promise.reject(__wfError("step.do needs a callback function"));
+    }
+    return frame(name, async (key, count, ordinal) => {
+      const record = __wfKindCheck(await storage.get(key), "do", name);
+      if (record !== undefined && record.status === "completed") {
+        return { value: record.value };
+      }
+      if (record !== undefined && record.status === "failed") {
+        throw __wfReviveError(record.error);
+      }
+      // A pending retry whose backoff has not elapsed blocks without
+      // executing; the deadline was persisted when the attempt failed, so a
+      // replay cannot reset the backoff.
+      if (record !== undefined && record.nextAt > Date.now()) {
+        return { block: record.nextAt, kind: "retry" };
+      }
+      const attempt = (record === undefined ? 0 : record.attempt) + 1;
+      const historyOrdinal = record?.ordinal ?? ordinal;
+      const retries = config.retries ??
+        { limit: 5, delay: 10000, backoff: "exponential" };
+      const timeout = config.timeout ?? "10 minutes";
+      const timeoutMs = __wfDuration(
+        timeout,
+        `the timeout of step ${JSON.stringify(name)}`,
+      );
+      // Upstream omits a dynamic delay from the step context. Copying the
+      // config verbatim would expose the callback to itself as retry policy,
+      // while callers expect only the serializable limit and backoff fields.
+      const contextRetries = typeof retries.delay === "function"
+        ? { limit: retries.limit, ...(retries.backoff === undefined
+          ? {}
+          : { backoff: retries.backoff }) }
+        : retries;
+      const context = {
+        step: { name, count },
+        attempt,
+        config: { retries: contextRetries, timeout },
+      };
+      try {
+        // Persist the history entry before the callback starts. A concurrent
+        // selected restart can therefore name an in-flight occurrence, and
+        // its new generation fences the callback's eventual old-ledger write.
+        await storage.put(key, {
+          kind: "do",
+          status: "running",
+          attempt: attempt - 1,
+          ordinal: historyOrdinal,
+        });
+        const value = await __wfTimeout(
+          __wfEnterStep(name, async () => callback(context)),
+          timeoutMs,
+          name,
+          attempt,
+        );
+        if (value !== undefined) {
+          __wfCheckValue(value, `the return value of step ${JSON.stringify(name)}`);
+        }
+        await storage.put(key, {
+          kind: "do",
+          status: "completed",
+          value,
+          ordinal: historyOrdinal,
+        });
+        return { value };
+      } catch (error) {
+        // NonRetryableError skips retries by contract; a value-cap or
+        // serialization failure is marked permanent above because another
+        // attempt returns the same value.
+        const permanent = error instanceof NonRetryableError ||
+          (error !== null && typeof error === "object" &&
+            (error.name === "NonRetryableError" || error.__wfPermanent === true)) ||
+          attempt > retries.limit;
+        if (permanent) {
+          await storage.put(key, {
+            kind: "do",
+            status: "failed",
+            error: __wfErrorRecord(error),
+            ordinal: historyOrdinal,
+          });
+          throw error;
+        }
+        // Upstream documents the backoff names, not the arithmetic; the
+        // simplest reading is used and recorded in the design page. When
+        // `retries` is given without `backoff`, celld uses constant -- the
+        // documented exponential default is the whole-config-omitted case.
+        const dynamic = typeof retries.delay === "function";
+        const delay = dynamic
+          ? await __wfEnterStep(name, () => retries.delay({ ctx: context, error }))
+          : retries.delay;
+        const base = __wfDuration(
+          delay,
+          `the retry delay of step ${JSON.stringify(name)}`,
+        );
+        // A delay callback replaces the fixed base duration, not the backoff
+        // policy. Skipping this factor makes a dynamic exponential or linear
+        // policy retry earlier than the same policy with a fixed base.
+        const factor = retries.backoff === "exponential"
+          ? 2 ** (attempt - 1)
+          : retries.backoff === "linear"
+          ? attempt
+          : 1;
+        const nextAt = Date.now() + base * factor;
+        await storage.put(key, {
+          kind: "do",
+          status: "retrying",
+          attempt,
+          nextAt,
+          ordinal: historyOrdinal,
+        });
+        return { block: nextAt, kind: "retry" };
+      }
+    });
+  };
+  const sleepUntilDeadline = (name, key, ordinal, deadline) => (async () => {
+    const record = __wfKindCheck(await storage.get(key), "sleep", name);
+    if (record !== undefined && record.status === "completed") {
+      return { value: undefined };
+    }
+    const historyOrdinal = record?.ordinal ?? ordinal;
+    let at = record === undefined ? undefined : record.deadline;
+    if (at === undefined) {
+      // The absolute deadline is computed once and persisted. Recomputing
+      // from "now" on replay would extend the sleep by however long the
+      // instance was down, so a crash could postpone a deadline forever.
+      at = deadline();
+      if (at - Date.now() > __WF_MAX_WAIT_MS) {
+        throw __wfError(
+          `sleep ${JSON.stringify(name)} ends ${at - Date.now()} ms from now, ` +
+            "above the upstream limit of 365 days",
+        );
+      }
+      await storage.put(key, {
+        kind: "sleep",
+        status: "sleeping",
+        deadline: at,
+        ordinal: historyOrdinal,
+      });
+    }
+    if (at <= Date.now()) {
+      await storage.put(key, {
+        kind: "sleep",
+        status: "completed",
+        ordinal: historyOrdinal,
+      });
+      return { value: undefined };
+    }
+    return { block: at, kind: "sleep" };
+  })();
+  return {
+    do: doStep,
+    sleep: (name, duration) => {
+      let durationMs;
+      try {
+        __wfStepName(name);
+        durationMs = __wfSleepDuration(duration, name);
+      } catch (error) {
+        return Promise.reject(error);
+      }
+      return frame(name, (key, _count, ordinal) =>
+        sleepUntilDeadline(
+          name,
+          key,
+          ordinal,
+          () => Date.now() + durationMs,
+        ));
+    },
+    sleepUntil: (name, timestamp) => {
+      let at;
+      try {
+        __wfStepName(name);
+        at = __wfSleepUntil(timestamp, name);
+      } catch (error) {
+        return Promise.reject(error);
+      }
+      return frame(name, (key, _count, ordinal) =>
+        sleepUntilDeadline(name, key, ordinal, () => {
+          // A replay uses the persisted deadline after it has passed. Check
+          // the moving future bound only while the deadline is first installed,
+          // or every successful sleep would fail on the resume that completes it.
+          if (at - Date.now() < 0) {
+            throw __wfError(
+              `sleepUntil ${JSON.stringify(name)} needs a future timestamp`,
+            );
+          }
+          return at;
+        }));
+    },
+    waitForEvent: (name, options) => {
+      let checked;
+      try {
+        __wfStepName(name);
+        checked = __wfWaitOptions(options, name);
+      } catch (error) {
+        return Promise.reject(error);
+      }
+      return frame(name, async (key, _count, ordinal) => {
+        let record = __wfKindCheck(await storage.get(key), "event", name);
+        if (record !== undefined && record.status === "completed") {
+          return { value: record.value };
+        }
+        if (record !== undefined && record.status === "failed") {
+          throw __wfReviveError(record.error);
+        }
+        if (record === undefined) {
+          record = {
+            kind: "event",
+            status: "waiting",
+            type: checked.type,
+            deadline: Date.now() + checked.timeoutMs,
+            ordinal,
+          };
+          await storage.put(key, record);
+        }
+        // The deadline is checked before the buffer: an event that arrived
+        // after the persisted deadline must time the step out, not succeed
+        // because the replay that noticed it ran late.
+        if (record.deadline <= Date.now()) {
+          const error = new Error(
+            `waitForEvent ${JSON.stringify(name)} timed out waiting for an event ` +
+              `of type ${JSON.stringify(record.type)}`,
+          );
+          await storage.put(key, {
+            kind: "event",
+            status: "failed",
+            error: __wfErrorRecord(error),
+            ordinal: record.ordinal,
+          });
+          throw error;
+        }
+        // Delivered events persist until a matching step consumes one, in
+        // arrival order -- the zero-padded sequence key makes list order
+        // arrival order -- so an event sent before the step is reached is
+        // buffered, not lost.
+        const consumed = storage.transactionSync(() => {
+          const current = __wfKindCheck(storage.kv.get(key), "event", name);
+          if (current !== undefined && current.status === "completed") {
+            return { value: current.value };
+          }
+          if (current !== undefined && current.status === "failed") {
+            throw __wfReviveError(current.error);
+          }
+          for (const [eventKey, event] of storage.kv.list({
+            prefix: __wfEventPrefix(driver.generation),
+          })) {
+            if (event.type !== current.type) continue;
+            const value = {
+              payload: event.payload,
+              timestamp: new Date(event.timestampMs),
+              type: event.type,
+            };
+            // The delete and completed ledger record are one SQLite commit.
+            // A crash can therefore expose both or neither, so an
+            // acknowledged event cannot disappear between them.
+            storage.kv.delete(eventKey);
+            /*__CELLD_TEST_WORKFLOW_EVENT_CONSUMED__*/
+            storage.kv.put(key, {
+              kind: "event",
+              status: "completed",
+              value,
+              ordinal: current.ordinal,
+            });
+            return { value };
+          }
+        });
+        if (consumed !== undefined) return consumed;
+        return { block: record.deadline, kind: "event" };
+      });
+    },
+  };
+};
+
+const __WorkflowCell = (() => {
+  class StorageTransaction {
+    constructor(storage) {
+      this.kv = storage.kv;
+      this._scope = storage._scope;
+    }
+    setAlarm(t) {
+      __alarm_set(this._scope, t instanceof Date ? t.getTime() : Number(t));
+    }
+    deleteAlarm() {
+      __alarm_delete(this._scope);
+    }
+  }
+  const transactionSync = (storage, callback) =>
+    storage.transactionSync(() => callback(new StorageTransaction(storage)));
+  const clearInstance = (transaction) => {
+    for (const [key] of transaction.kv.list({ prefix: "__wf." })) {
+      transaction.kv.delete(key);
+    }
+    transaction.deleteAlarm();
+  };
+  const expireTerminal = (transaction, meta, now) => {
+    if (!__wfTerminal(meta.status)) return false;
+    if (meta.expiresMs === undefined) {
+      meta.endedMs = now;
+      meta.expiresMs = now + __wfRetentionMs(meta, meta.status);
+      transaction.kv.put("__wf.meta", meta);
+    }
+    if (meta.expiresMs > now) return false;
+    clearInstance(transaction);
+    return true;
+  };
+
+  // The adapter stays in this closure because Workflow needs synchronous
+  // alarm writes inside transactionSync(). The public async alarm API runs
+  // after that commit, while a global helper would let application code
+  // split metadata from its wake or invoke the raw operation after commit.
+  return class __WorkflowCell {
+  constructor(state) {
+    this._state = state;
+  }
+  async __wfCreate({
+    workflowName,
+    instanceId,
+    params,
+    retention,
+    locationHint,
+    skipExisting = false,
+  }) {
+    const storage = this._state.storage;
+    if (params !== undefined) __wfCheckValue(params, "the workflow params");
+    const result = transactionSync(storage, (transaction) => {
+      let meta = transaction.kv.get("__wf.meta");
+      if (meta !== undefined && expireTerminal(transaction, meta, Date.now())) {
+        meta = undefined;
+      }
+      if (meta !== undefined && skipExisting) return { id: instanceId, created: false };
+      if (meta !== undefined) {
+        throw __wfError(
+          `instance ${JSON.stringify(instanceId)} already exists with status ` +
+            JSON.stringify(meta.status),
+        );
+      }
+      const generation = crypto.randomUUID();
+      transaction.kv.put("__wf.meta", {
+        workflowName,
+        instanceId,
+        params,
+        retention,
+        ...(locationHint === undefined ? {} : { locationHint }),
+        generation,
+        createdMs: Date.now(),
+        status: "queued",
+      });
+      // The metadata and alarm are one SQLite commit. A committed creation
+      // therefore always has the wake that can start or recover its drive.
+      transaction.setAlarm(Date.now());
+      /*__CELLD_TEST_WORKFLOW_META_CREATED__*/
+      return { id: instanceId, created: true };
+    });
+    return result;
+  }
+  async __wfStatus() {
+    const meta = transactionSync(this._state.storage, (transaction) => {
+      const current = transaction.kv.get("__wf.meta");
+      if (current === undefined) return undefined;
+      return expireTerminal(transaction, current, Date.now()) ? undefined : current;
+    });
+    // A cell exists on first address like any cell, so an absent ledger is
+    // the only honest "no such instance" signal. Inventing an instance here
+    // would turn every typo into an empty workflow.
+    if (meta === undefined) throw __wfError("instance does not exist");
+    const status = { status: meta.status, rollback: null };
+    if (meta.error !== undefined) status.error = meta.error;
+    if (meta.output !== undefined) status.output = meta.output;
+    return status;
+  }
+  async __wfDelete() {
+    const storage = this._state.storage;
+    const deleted = transactionSync(storage, (transaction) => {
+      const meta = transaction.kv.get("__wf.meta");
+      if (meta === undefined) return false;
+      if (expireTerminal(transaction, meta, Date.now())) return false;
+      clearInstance(transaction);
+      return true;
+    });
+    // Throw after the transaction commits. An expiry discovered here must
+    // keep its cleanup even though delete() reports that the instance is gone.
+    if (!deleted) throw __wfError("instance does not exist");
+    // A callback can still be awaiting application I/O when deletion lands.
+    // Reset the object after the deletion commit so that callback cannot
+    // recreate an old-generation ledger entry after delete() reports success.
+    this._state.abort(new Error("WORKFLOW_INSTANCE_DELETED"));
+  }
+  async __wfPause() {
+    const storage = this._state.storage;
+    transactionSync(storage, (transaction) => {
+      const meta = transaction.kv.get("__wf.meta");
+      if (meta === undefined) throw __wfError("instance does not exist");
+      if (__wfTerminal(meta.status) || meta.status === "paused" ||
+          meta.status === "waitingForPause") return;
+      if (meta.status === "running") {
+        meta.status = "waitingForPause";
+        // A drive lost after this commit must re-enter and finish the pause.
+        transaction.setAlarm(Date.now());
+      } else {
+        meta.status = "paused";
+        meta.pausedMs = Date.now();
+        transaction.deleteAlarm();
+      }
+      transaction.kv.put("__wf.meta", meta);
+    });
+  }
+  async __wfResume() {
+    const storage = this._state.storage;
+    transactionSync(storage, (transaction) => {
+      const meta = transaction.kv.get("__wf.meta");
+      if (meta === undefined) throw __wfError("instance does not exist");
+      if (meta.status === "waitingForPause") {
+        meta.status = "running";
+        transaction.kv.put("__wf.meta", meta);
+        transaction.setAlarm(Date.now());
+        return;
+      }
+      if (meta.status !== "paused") {
+        throw __wfError(
+          `cannot resume an instance with status ${JSON.stringify(meta.status)}`,
+        );
+      }
+      const offset = Math.max(0, Date.now() - (meta.pausedMs ?? Date.now()));
+      for (const [key, record] of transaction.kv.list({
+        prefix: __wfLedgerPrefix(meta.generation) + "step.",
+      })) {
+        if (record.status === "retrying") record.nextAt += offset;
+        if (record.status === "sleeping" || record.status === "waiting") {
+          record.deadline += offset;
+        }
+        transaction.kv.put(key, record);
+      }
+      delete meta.pausedMs;
+      meta.status = "queued";
+      transaction.kv.put("__wf.meta", meta);
+      transaction.setAlarm(Date.now());
+    });
+  }
+  async __wfRestart(options) {
+    const checked = __wfRestartOptions(options);
+    const storage = this._state.storage;
+    transactionSync(storage, (transaction) => {
+      const meta = transaction.kv.get("__wf.meta");
+      if (meta === undefined) throw __wfError("instance does not exist");
+      const oldPrefix = __wfLedgerPrefix(meta.generation);
+      let targetOrdinal;
+      if (checked.from !== undefined) {
+        const expectedKind = checked.from.type === "waitForEvent"
+          ? "event"
+          : checked.from.type;
+        let occurrence = 0;
+        const history = [...transaction.kv.list({ prefix: oldPrefix + "step." })]
+          .filter(([, record]) => Number.isInteger(record.ordinal))
+          .sort((left, right) => left[1].ordinal - right[1].ordinal);
+        // The ledger key is `<prefix>step.<per-name-count>.<name>`. Derive
+        // the name from it because a record stores replay state, not identity.
+        for (const [key, record] of history) {
+          const marker = oldPrefix + "step.";
+          const suffix = key.slice(marker.length);
+          const dot = suffix.indexOf(".");
+          const name = dot < 0 ? "" : suffix.slice(dot + 1);
+          if (record.kind !== expectedKind || name !== checked.from.name) continue;
+          occurrence += 1;
+          if (occurrence === checked.from.count) {
+            targetOrdinal = record.ordinal;
+            break;
+          }
+        }
+        if (targetOrdinal === undefined) {
+          throw __wfError(
+            `restart() could not find ${checked.from.type} step ` +
+              `${JSON.stringify(checked.from.name)} occurrence ${checked.from.count}`,
+          );
+        }
+      }
+      const generation = crypto.randomUUID();
+      const newPrefix = __wfLedgerPrefix(generation);
+      if (targetOrdinal !== undefined) {
+        for (const [key, record] of transaction.kv.list({ prefix: oldPrefix + "step." })) {
+          if (Number.isInteger(record.ordinal) && record.ordinal < targetOrdinal) {
+            transaction.kv.put(newPrefix + key.slice(oldPrefix.length), record);
+          }
+        }
+      }
+      for (const [key] of transaction.kv.list({ prefix: oldPrefix })) {
+        transaction.kv.delete(key);
+      }
+      meta.generation = generation;
+      meta.status = "queued";
+      delete meta.pausedMs;
+      delete meta.output;
+      delete meta.error;
+      transaction.kv.put("__wf.meta", meta);
+      transaction.setAlarm(Date.now());
+    });
+  }
+  async __wfTerminate() {
+    const storage = this._state.storage;
+    transactionSync(storage, (transaction) => {
+      const meta = transaction.kv.get("__wf.meta");
+      if (meta === undefined) throw __wfError("instance does not exist");
+      if (__wfTerminal(meta.status)) {
+        throw __wfError(
+          `cannot terminate an instance with status ${JSON.stringify(meta.status)}`,
+        );
+      }
+      meta.status = "terminated";
+      __wfFinishRetention(meta, transaction);
+      transaction.kv.put("__wf.meta", meta);
+      /*__CELLD_TEST_WORKFLOW_TERMINAL_ALARM_SET__*/
+    });
+  }
+  async __wfSendEvent(options) {
+    const storage = this._state.storage;
+    // The binding validates first to avoid an unnecessary cell call. Repeat
+    // the check here because this RPC owns the durable event invariant: no
+    // current or future internal caller can bypass validation before storage.
+    const { type, payload } = __wfEventOptions(options);
+    transactionSync(storage, (transaction) => {
+      const meta = transaction.kv.get("__wf.meta");
+      if (meta === undefined) throw __wfError("instance does not exist");
+      if (__wfTerminal(meta.status)) {
+        throw __wfError(
+          `cannot send an event to an instance with status ${JSON.stringify(meta.status)}`,
+        );
+      }
+      const sequenceKey = __wfLedgerPrefix(meta.generation) + "eventSeq";
+      const sequence = transaction.kv.get(sequenceKey) ?? 0;
+      transaction.kv.put(sequenceKey, sequence + 1);
+      transaction.kv.put(__wfEventKey(meta.generation, sequence), {
+        type,
+        payload,
+        timestampMs: Date.now(),
+      });
+      // Allocation, the event body, and the nudge are one commit. Parallel
+      // writers cannot reuse a sequence and a crash cannot expose a partial
+      // acknowledged send.
+      if (meta.status !== "paused" && meta.status !== "waitingForPause") {
+        transaction.setAlarm(Date.now());
+      }
+    });
+  }
+  async alarm() {
+    const storage = this._state.storage;
+    // One drive at a time. A sendEvent nudge (setAlarm(now)) landing
+    // mid-fire replaces the firing alarm in the core, and the replacement
+    // can dispatch a second alarm() into this isolate while the first drive
+    // still awaits user code. Two concurrent replays would both see the
+    // same incomplete steps and double-execute their callbacks. The guard
+    // is isolate-local and that is sufficient: every drive for a cell runs
+    // in its owner's isolate, and a takeover starts a fresh isolate with no
+    // drive in flight. The nudge is not lost -- the in-flight drive folds
+    // `_wfNudge` into the minimum it re-arms, and if it suspended before
+    // seeing the flag, the re-arm below starts a fresh drive immediately.
+    // A failed drive is not re-raised here: the engine already retries the
+    // alarm that fired it.
+    if (this._wfDriving !== undefined) {
+      this._wfNudge = Date.now();
+      await this._wfDriving.catch(() => {});
+      if (this._wfNudge !== undefined) {
+        this._wfNudge = undefined;
+        const meta = await storage.get("__wf.meta");
+        if (
+          meta !== undefined && !__wfTerminal(meta.status) &&
+          meta.status !== "paused" && meta.status !== "waitingForPause"
+        ) {
+          await storage.setAlarm(Date.now());
+        }
+      }
+      return;
+    }
+    const meta = await storage.get("__wf.meta");
+    // A terminal instance's pending alarm can still fire. It owns retention:
+    // remove expired state, or restore the expiry wake after a stale nudge.
+    if (meta === undefined) {
+      await storage.deleteAlarm();
+      return;
+    }
+    if (__wfTerminal(meta.status)) {
+      transactionSync(storage, (transaction) => {
+        const current = transaction.kv.get("__wf.meta");
+        if (current === undefined) {
+          transaction.deleteAlarm();
+          return;
+        }
+        if (!expireTerminal(transaction, current, Date.now())) {
+          transaction.setAlarm(current.expiresMs);
+        }
+      });
+      return;
+    }
+    if (meta.status === "paused") {
+      await storage.deleteAlarm();
+      return;
+    }
+    if (meta.status === "waitingForPause") {
+      transactionSync(storage, (transaction) => {
+        const current = transaction.kv.get("__wf.meta");
+        if (current === undefined || current.generation !== meta.generation ||
+            current.status !== "waitingForPause") return;
+        current.status = "paused";
+        current.pausedMs = Date.now();
+        transaction.kv.put("__wf.meta", current);
+        transaction.deleteAlarm();
+      });
+      return;
+    }
+    // The fired alarm stays armed while the drive runs. The engine consumes
+    // it only when this handler returns cleanly, and retries it when the
+    // handler fails -- that retry is the crash safety net. Deleting it here
+    // would commit the deletion durably mid-drive (durability is per SQLite
+    // commit, and replication ships frames per commit), so a SIGKILL before
+    // the suspend-time re-arm would strand a "running" instance with no
+    // alarm and no wake entry. The suspend path re-arms explicitly, and a
+    // terminal drive deletes.
+    const driving = this._drive(meta);
+    this._wfDriving = driving;
+    try {
+      await driving;
+    } finally {
+      this._wfDriving = undefined;
+    }
+  }
+  async _drive(meta) {
+    const storage = this._state.storage;
+    // The drive owns `status`, `output`, and `error`; every other piece of
+    // instance state belongs to the RPCs (sendEvent's sequence lives in its
+    // own key for the same reason). The gate is open at every await, so a
+    // terminate can land mid-drive: re-reading before each write, and
+    // writing nothing once the status is terminal, is what makes "terminate
+    // wins the race" true rather than asserted. Writing back the meta this
+    // drive entered with would resurrect a terminated instance as "waiting"
+    // and re-arm the alarm its terminate deleted.
+    const settle = (mutate) => transactionSync(storage, (transaction) => {
+      const current = transaction.kv.get("__wf.meta");
+      if (current === undefined || __wfTerminal(current.status) ||
+          current.generation !== meta.generation) return false;
+      mutate(current, transaction);
+      transaction.kv.put("__wf.meta", current);
+      return true;
+    });
+    const className = __cell.workflows[meta.workflowName];
+    const cls = className === undefined ? undefined : __cf.exports[className];
+    if (typeof cls !== "function" ||
+        typeof (cls.prototype && cls.prototype.run) !== "function") {
+      // Deploy cannot see inside the bundle, so a missing export fails
+      // here, loudly, with the class and the config key named.
+      settle((current, transaction) => {
+        current.status = "errored";
+        current.error = {
+          name: "Error",
+          message: className === undefined
+            ? `workflow ${JSON.stringify(meta.workflowName)} is not declared ` +
+              "in this deployment's `workflows`"
+            : `workflow class ${JSON.stringify(className)} is not a module ` +
+              "export with a run() method; export it and extend " +
+              "WorkflowEntrypoint",
+        };
+        __wfFinishRetention(current, transaction);
+        /*__CELLD_TEST_WORKFLOW_TERMINAL_ALARM_SET__*/
+      });
+      return;
+    }
+    const driver = {
+      storage: undefined,
+      storageFailure: undefined,
+      generation: meta.generation,
+      ledgerPrefix: __wfLedgerPrefix(meta.generation),
+      counts: new Map(),
+      ordinal: 0,
+      running: 0,
+      blocked: [],
+      pauseRequested: false,
+      finished: false,
+      checkQueued: false,
+      stallTimer: undefined,
+      clearStall() {
+        if (this.stallTimer !== undefined) {
+          clearTimeout(this.stallTimer);
+          this.stallTimer = undefined;
+        }
+      },
+    };
+    driver.storage = __wfTrackStorageFailures(storage, driver);
+    const outcome = new Promise((resolve) => {
+      driver.finish = (result) => {
+        if (driver.finished) return;
+        driver.finished = true;
+        driver.clearStall();
+        resolve(result);
+      };
+    });
+    // Quiescence: when a step is blocked, no step callback is executing,
+    // and a macrotask has passed, nothing can progress, so the invocation
+    // suspends. The macrotask lets every microtask chain a completed step
+    // unblocked drain first; checking on the spot would suspend an instance
+    // whose next step is one `await` away from starting.
+    driver.check = () => {
+      if (driver.checkQueued || driver.finished) return;
+      driver.checkQueued = true;
+      setTimeout(() => {
+        driver.checkQueued = false;
+        if (driver.finished || driver.running !== 0) return;
+        if (driver.pauseRequested) {
+          driver.finish({ kind: "pause" });
+          return;
+        }
+        if (driver.blocked.length > 0) {
+          driver.finish({ kind: "suspend" });
+          return;
+        }
+        // No step runs, none is blocked, and run() has not settled: it
+        // awaits something that is not a step. Upstream permits that -- an
+        // un-stepped `await fetch()` between steps is legal, merely
+        // non-durable -- so this is not yet an error; but a promise that
+        // never settles would wedge the alarm handler in silence, with the
+        // instance "running" forever. A grace timer splits the two: if the
+        // same nothing-can-progress state still holds when it fires, the
+        // instance fails loudly. The timer is a plain in-isolate timeout,
+        // not a durable alarm, on purpose: an eviction or a restart replays
+        // run() from the top anyway, so losing the timer loses nothing --
+        // the replay re-enters the same stall and re-arms its own grace.
+        if (driver.stallTimer !== undefined) return;
+        driver.stallTimer = setTimeout(() => {
+          driver.stallTimer = undefined;
+          if (driver.finished || driver.running !== 0 || driver.blocked.length > 0) {
+            return;
+          }
+          driver.finish({
+            kind: "error",
+            error: __wfError(
+              "run() has been awaiting something that is not a step for " +
+                (__WF_STALL_GRACE_MS / 1000) + " seconds while no step is " +
+                "running or blocked; a replay cannot resume this wait, so " +
+                "wrap long async work in step.do",
+            ),
+          });
+        }, __WF_STALL_GRACE_MS);
+      }, 0);
+    };
+    if (
+      meta.status !== "running" &&
+      !(await settle((current) => {
+        current.status = "running";
+      }))
+    ) {
+      return;
+    }
+    const step = __wfMakeStep(driver);
+    const event = {
+      payload: meta.params,
+      timestamp: new Date(meta.createdMs),
+      instanceId: meta.instanceId,
+      workflowName: meta.workflowName,
+    };
+    // ExecutionContext-shaped, as the WorkflowEntrypoint constructor
+    // documents upstream.
+    const ctx = {
+      waitUntil: __registerWaitUntil,
+      passThroughOnException() {},
+    };
+    (async () => new cls(ctx, __cell.env).run(event, step))().then(
+      (value) => driver.finish({ kind: "complete", value }),
+      (error) => driver.finish({ kind: "error", error }),
+    );
+    /*__CELLD_TEST_WORKFLOW_AFTER_RUN_STARTED__*/
+    let result = await outcome;
+    // The workflow can catch a rejected step promise, but it cannot turn an
+    // engine storage failure into a successful run. Preserve the alarm so
+    // the runtime retries over the last committed ledger prefix.
+    if (driver.storageFailure !== undefined) {
+      throw driver.storageFailure;
+    }
+    const currentMeta = await storage.get("__wf.meta");
+    if (
+      result.kind === "pause" ||
+      (currentMeta !== undefined &&
+        currentMeta.generation === meta.generation &&
+        currentMeta.status === "waitingForPause")
+    ) {
+      /*__CELLD_TEST_WORKFLOW_BEFORE_PAUSE_SETTLE__*/
+      settle((current, transaction) => {
+        // A resume can cancel waitingForPause after this drive selected its
+        // pause result. Preserve that newer running state and its alarm, or
+        // this stale settlement strands an acknowledged resume as paused.
+        if (current.status !== "waitingForPause") return;
+        current.status = "paused";
+        current.pausedMs = Date.now();
+        transaction.deleteAlarm();
+      });
+      return;
+    }
+    if (result.kind === "suspend") {
+      let at = Math.min(...driver.blocked.map((entry) => entry.at));
+      // A nudge that landed mid-drive must not wait out the pending
+      // deadline. It is visible in one of two places: getAlarm(), when the
+      // nudge re-armed and no second alarm dispatched yet, or `_wfNudge`,
+      // when a second alarm() already entered and parked on the drive
+      // guard -- its dispatch consumed the armed alarm, so getAlarm()
+      // alone would miss it.
+      const nudge = await storage.getAlarm();
+      if (nudge !== null) at = Math.min(at, nudge);
+      if (this._wfNudge !== undefined) {
+        at = Math.min(at, this._wfNudge);
+        this._wfNudge = undefined;
+      }
+      settle((current, transaction) => {
+        current.status = "waiting";
+        transaction.setAlarm(at);
+      });
+      // The explicit re-arm replaces the alarm that fired this drive.
+      // Durability is per SQLite commit, not per turn: a crash can persist
+      // any prefix of this invocation's ledger writes, and the unconsumed
+      // fired alarm is what re-drives the replay over whatever prefix
+      // survived. A terminated instance re-arms nothing; its leftover
+      // alarm fires once, sees the terminal status, and retires itself.
+      return;
+    }
+    if (result.kind === "complete") {
+      try {
+        if (result.value !== undefined) {
+          __wfCheckValue(result.value, "the run() return value");
+        }
+      } catch (error) {
+        result = { kind: "error", error };
+      }
+      if (result.kind === "complete") {
+        // Keep settlement outside the value-validation catch. A storage
+        // failure must escape the alarm handler so the engine retries the
+        // still-armed drive; converting it to a user error would consume the
+        // alarm and make a transient commit failure terminal.
+        settle((current, transaction) => {
+          current.status = "complete";
+          if (result.value !== undefined) current.output = result.value;
+          // The terminal commit installs the expiry wake with the retained
+          // state, so a crash can expose neither without the other.
+          __wfFinishRetention(current, transaction);
+          /*__CELLD_TEST_WORKFLOW_TERMINAL_ALARM_SET__*/
+        });
+        return;
+      }
+    }
+    settle((current, transaction) => {
+      current.status = "errored";
+      current.error = __wfErrorRecord(result.error);
+      __wfFinishRetention(current, transaction);
+      /*__CELLD_TEST_WORKFLOW_TERMINAL_ALARM_SET__*/
+    });
+  }
+  };
+})();
+__runtimeClass("__Workflow", __WorkflowCell);
+
+class NonRetryableError extends Error {
+  constructor(message, name = "NonRetryableError") {
+    super(message);
+    this.name = name;
+  }
+}
+// Backing object for the `cloudflare:workflows` builtin module.
+__celld.__cfWorkflows = { NonRetryableError };
+// `celld:python`, imported only by the Python Worker bundle.
+__celld.__pythonHost = {
+  condemnIsolate: (reason) => __isolate_condemn(String(reason)),
+};
+
+const __wfValidInstanceId = (id) =>
+  typeof id === "string" && id.length >= 1 && id.length <= 100 &&
+  __WF_NAME_RE.test(id);
+const __wfCreateOptions = (options, what, validateParams = true) => {
+  if (!__wfOwnObject(options)) {
+    throw __wfError(`${what} needs an object`);
+  }
+  const retention = __wfRetentionOptions(options.retention, what);
+  const locationHint = __wfLocationHint(options.locationHint, what);
+  const id = options.id === undefined ? crypto.randomUUID() : options.id;
+  if (!__wfValidInstanceId(id)) {
+    throw __wfError(
+      `invalid instance id ${JSON.stringify(id)}: use letters, digits, ` +
+        "\"-\" and \"_\" (not starting with \"-\"), at most 100 characters",
+    );
+  }
+  if (validateParams && options.params !== undefined) {
+    // The cell repeats this serialization check because it owns the durable
+    // create invariant. A single create rejects before it addresses the cell.
+    __wfCheckValue(options.params, "the workflow params");
+  }
+  return { id, params: options.params, retention, locationHint };
+};
+
+// Named so SDKs that sniff a binding by `constructor.name` recognise it.
+class WorkflowInstance {
+  constructor(workflowName, id) {
+    Object.defineProperty(this, "_workflowName", { value: workflowName });
+    this.id = id;
+  }
+  // Resolved per call rather than cached: a cell can move between calls.
+  get _stub() {
+    // The reserved class is script-scoped (`deploy::workflow_class`), because
+    // a workflow instance is: two co-hosted scripts must not share one entry
+    // in the deployment's flat class registry. `__cell.script` is injected
+    // before any binding runs, so this resolves at call time.
+    return __cell.makeNamespace("__Workflow." + __cell.script)
+      .getByName(this._workflowName + "/" + this.id);
+  }
+  async status() {
+    return await this._stub.__wfStatus();
+  }
+  async terminate(options) {
+    if (options && options.rollback) {
+      throw __wfError(
+        "terminate({rollback: true}) is not implemented in celld; step " +
+          "rollbackOptions are not implemented, so no handler could run",
+      );
+    }
+    await this._stub.__wfTerminate();
+  }
+  async sendEvent(options) {
+    await this._stub.__wfSendEvent(__wfEventOptions(options));
+  }
+  async pause() {
+    await this._stub.__wfPause();
+  }
+  async resume() {
+    await this._stub.__wfResume();
+  }
+  async restart(options) {
+    await this._stub.__wfRestart(__wfRestartOptions(options));
+  }
+  async delete() {
+    try {
+      await this._stub.__wfDelete();
+    } catch (error) {
+      // The deletion commit resets an active Workflow cell so an in-flight
+      // callback cannot put old ledger state back. That reset rejects this
+      // RPC with its private completion marker; it is the successful path.
+      if (!String(error && error.message || error).includes("WORKFLOW_INSTANCE_DELETED")) {
+        throw error;
+      }
+    }
+  }
+}
+
+class Workflow {
+  constructor(workflowName) {
+    Object.defineProperty(this, "_workflowName", { value: workflowName });
+  }
+  async _create(options, skipExisting) {
+    const { id, params, retention, locationHint } = options;
+    const instance = new WorkflowInstance(this._workflowName, id);
+    const result = await instance._stub.__wfCreate({
+      workflowName: this._workflowName,
+      instanceId: id,
+      params,
+      retention,
+      locationHint,
+      skipExisting,
+    });
+    return result.created ? instance : undefined;
+  }
+  async create(options = {}) {
+    return await this._create(__wfCreateOptions(options, "create()"), false);
+  }
+  async createBatch(batch) {
+    if (!Array.isArray(batch)) {
+      throw __wfError("createBatch() needs an array of create options");
+    }
+    if (batch.length > 100) {
+      throw __wfError(
+        `createBatch() accepts at most 100 instances, got ${batch.length}`,
+      );
+    }
+    if (batch.length === 0) {
+      throw __wfError("createBatch() needs at least one instance");
+    }
+    // Cloudflare rejects a structural error in any item before it creates the
+    // first instance, but it filters a params clone failure per item. Keep
+    // these two gates separate so a bad ID stays atomic while a clone failure
+    // does not suppress the valid items around it.
+    const optionsList = batch.map((options, index) =>
+      __wfCreateOptions(options, `createBatch() item ${index}`, false));
+    const creatable = [];
+    for (const options of optionsList) {
+      let encoded;
+      try {
+        if (options.params !== undefined) {
+          encoded = __wfEncodeValue(options.params, "the workflow params");
+        }
+      } catch {
+        continue;
+      }
+      if (encoded !== undefined) {
+        __wfCheckEncodedValue(encoded, "the workflow params");
+      }
+      creatable.push(options);
+    }
+    const created = [];
+    for (const options of creatable) {
+      const instance = await this._create(options, true);
+      if (instance !== undefined) created.push(instance);
+    }
+    return created;
+  }
+  async get(id) {
+    if (!__wfValidInstanceId(id)) {
+      throw __wfError(`invalid instance id ${JSON.stringify(id)}`);
+    }
+    const instance = new WorkflowInstance(this._workflowName, id);
+    // The cell exists on first address like any cell, but get() must not
+    // mint an instance for a typo: an id with no ledger rejects here.
+    await instance._stub.__wfStatus();
+    return instance;
+  }
+  async deleteBatch(instanceIds) {
+    if (!Array.isArray(instanceIds)) {
+      throw __wfError("deleteBatch() needs an array of instance ids");
+    }
+    if (instanceIds.length < 1 || instanceIds.length > 100) {
+      throw __wfError(
+        `deleteBatch() accepts 1 to 100 instance ids, got ${instanceIds.length}`,
+      );
+    }
+    for (const id of instanceIds) {
+      if (!__wfValidInstanceId(id)) {
+        throw __wfError(`invalid instance id ${JSON.stringify(id)}`);
+      }
+    }
+    const uniqueIds = [...new Set(instanceIds)];
+    const settled = await Promise.allSettled(uniqueIds.map(async (id) => {
+      const instance = new WorkflowInstance(this._workflowName, id);
+      await instance.delete();
+    }));
+    const results = new Map(uniqueIds.map((id, index) => [id, settled[index]]));
+    const output = { deleted: [], errors: [] };
+    for (const id of instanceIds) {
+      const result = results.get(id);
+      if (result.status === "fulfilled") {
+        output.deleted.push({ id });
+        continue;
+      }
+      const notFound = String(result.reason && result.reason.message || result.reason)
+        .includes("instance does not exist");
+      output.errors.push({
+        id,
+        code: notFound ? 10400 : 10001,
+        message: notFound
+          ? "workflows.api.error.instance.not_found"
+          : "workflows.api.error.internal_server",
+      });
+    }
+    return output;
+  }
+}
+
+const __makeWorkflow = __celld.__makeWorkflow =
+  (workflowName) => new Workflow(workflowName);
+
+  return { WorkflowCell: classes.__Workflow, makeWorkflow: __celld.__makeWorkflow,
+    NonRetryableError: __celld.__cfWorkflows.NonRetryableError };
+}