v0.3.0

- v0.3.0 adds a replicated write-behind log. Fleets of two or more nodes
  acknowledge writes after peer fsync while bucket upload finishes later. In
  testing, this delivers 10× lower write latency and over 100× fewer Class A
  S3 operations. A v0.2.1 fleet can roll forward one node at a time.

- Added support for Azure Blob Storage (`az://<BUCKET_NAME>`).

- Added support for D1 databases, including the `celld d1` CLI for migrations
  and SQL execution.

- Added support for cron triggers, with durable fleet-wide scheduling, retries
  for failed handlers, and recovery of one missed run after downtime.

- Streaming and rewrapping request bodies are up to 70× faster, and text
  decoding is up to 44× faster.

- WebSocket upgrades now work correctly for Durable Object subrequests and
  cross-script service bindings.

- `setInterval()` now works correctly.

- `celld deploy` now accepts Node built-in specifiers (E.G. `node:util`)

- Each isolate now has a configurable V8 heap limit. celld refuses new
  hibernatable WebSockets and oversized SQL materialization near that limit,
  then resumes service after memory use falls.

- Correctness fixes prevent overlapping alarm handlers, events from resuming in
  freed isolates, lost transactions at replication segment boundaries, and
  database corruption after eviction and reactivation.

- Closed issues: [#139](#139),
  [#144](#144),
  [#147](#147),
  [#149](#149),
  [#150](#150),
  [#152](#152),
  [#154](#154),
  [#155](#155),
  [#156](#156),
  [#157](#157), and
  [#158](#158).

Co-authored-by: Bartek Iwańczuk <biwanczuk@gmail.com>
Co-authored-by: Ben Plotnick <bplotnick@users.noreply.github.com>
Co-authored-by: Nathan Whitaker <17734409+nathanwhit@users.noreply.github.com>
Co-authored-by: Yusuke Tanaka <yusuktan@maguro.dev>
Co-authored-by: magurotuna <23649474+magurotuna@users.noreply.github.com>

Author: 5 people

Cargo.lock

@@ -46,7 +46,7 @@ encoding_rs = "0.8"
 # unstable-split gives the read and write halves as separate objects. The
 # tunnel needs them: a WebSocket read is not cancel-safe, so a live read
 # future must survive while the same socket is written, and that is only
-# possible when the halves are not one borrow. See tests/p0/runtime/tunnel_cancel.rs.
+# possible when the halves are not one borrow.
 #
 # The feature is unstable by name, so a 0.8.x release can rename or drop it
 # without upstream calling that a break, and a caret range would take it. Deno
@@ -64,6 +64,7 @@ hyper-util = { version = "0.1", features = ["tokio"] }
 libc = "0.2"
 lz4_flex = { version = "0.11", features = ["frame"] }
 md-5 = "0.10"
+nix = { version = "0.31", features = ["feature", "fs"] }
 object_store = { version = "0.11", default-features = false }
 # The native column-writer API only: no `arrow` feature, so the arrow
 # crate stack stays out of the binary. Revisit only if the telemetry

Cargo.toml

@@ -5,22 +5,24 @@ Self-hosted, distributed **Durable Objects**.
 celld is an open-source daemon that runs Cloudflare Workers and Durable
 Objects on your own machines. Each object is its own SQLite database.
 celld addresses an object by name and replicates it to a bucket that you
-own. The bucket can be S3-compatible or Google Cloud Storage. The nodes
-coordinate through that bucket alone, with no control plane and no
-consensus. Because every object is its own small database,
-applications shard by construction — the contention and blast-radius failures
-of one shared database are designed out, not managed. A cell that no node
-holds is inactive, and an inactive cell costs nearly nothing. Learn more at
+own. The bucket can be S3-compatible, Google Cloud Storage, or Azure
+Blob Storage. The nodes coordinate through that bucket alone, with no
+control plane and no consensus. Because every object is its own small
+database, applications shard by construction — the contention and
+blast-radius failures of one shared database are designed out, not
+managed. A cell that no node holds is inactive, and an inactive cell
+costs nearly nothing. Learn more at
 [celld.dev](https://celld.dev) or read the
 [documentation](https://celld.dev/docs).
 
 ## How it works
 
 Every `celld` node embeds V8 and executes Wrangler bundles. The fleet shares
 one bucket, which contains deployments, cell state, and small ownership
-records. The bucket can be S3-compatible or Google Cloud Storage. Object-storage compare-and-swap ensures that exactly one node owns a
-cell at a time, without a membership protocol, failure detector, or consensus
-service.
+records. The bucket can be S3-compatible, Google Cloud Storage, or Azure
+Blob Storage. Object-storage compare-and-swap ensures that exactly one
+node owns a cell at a time, without a membership protocol, failure
+detector, or consensus service.
 
 celld continuously replicates each cell's SQLite database to the bucket.
 When a cell moves, or when an inactive cell activates, its new owner restores
@@ -109,6 +111,27 @@ celld --bucket gs://my-cells-bucket --listen 0.0.0.0:8080 \
   --internal-listen 10.0.0.12:8081 --advertise 10.0.0.12:8081
 ```
 
+An `az://` bucket selects Azure Blob Storage, where the NAME is the
+container. The storage account comes from `AZURE_STORAGE_ACCOUNT_NAME`.
+celld requires exactly one storage account key, managed identity, or workload
+identity. An AKS workload identity uses `AZURE_AUTHORITY_HOST`,
+`AZURE_CLIENT_ID`, `AZURE_TENANT_ID`, and `AZURE_FEDERATED_TOKEN_FILE`.
+The authority host must identify the public Azure cloud. A Microsoft Entra
+identity needs data-plane permission to read, write, list, and delete blobs.
+The `Storage Blob Data Contributor` role supplies these permissions. celld
+rejects an S3 `--endpoint` for an `az://` bucket, and it ignores the storage
+region. celld qualifies an `az://` bucket: the conditional-write contract and
+the multipart upload path were tested against a live Azure account on
+2026-08-18, under each of the three credential families named above. See
+[ownership and fencing](docs/fencing.md):
+
+```sh
+export AZURE_STORAGE_ACCOUNT_NAME=myaccount
+celld deploy . --bucket az://my-cells-container
+celld --bucket az://my-cells-container --listen 0.0.0.0:8080 \
+  --internal-listen 10.0.0.12:8081 --advertise 10.0.0.12:8081
+```
+
 A fleet runs one application, and every node loads its
 latest successfully committed deployment from `deploy/current.json`. Run
 `celld --help` for the complete command line.
@@ -145,6 +168,14 @@ and incompatible protocols. It also prints each node's coarse resident-cell,
 WebSocket, RSS, CPU, file-descriptor, pressure, and shedding sample. Pass one
 or more `--peer NODE_ID` options to restrict the check.
 
+`celld d1` runs SQL and migrations against a deployed D1 database. It finds a
+node through the same node leases, and that node sends the work to the node
+that owns the database:
+
+```sh
+celld d1 migrations apply ledger --bucket s3://my-cells-bucket
+```
+
 Set a hard resident-cell limit on each loaded node:
 
 ```sh
@@ -175,6 +206,25 @@ set size, and celld reports this at startup. `CELLD_MAX_RSS_MB=0`
 disables the threshold and the cap together. When celld cannot read the size of
 the available memory, it applies a cap of 125% of an explicit threshold.
 
+Each isolate also has a V8 heap limit, and this limit is separate from the
+memory of the node. The default is 128 MB, and it matches the limit of a
+Durable Object on Cloudflare. Set `CELLD_V8_HEAP_LIMIT_MB` to change it. The
+limit decides how much state one isolate can hold, so it decides how many
+hibernatable WebSocket clients a cell can carry. Each client holds state in the
+heap. A cell holds approximately 50,000 clients with the default limit, and it
+needs approximately 512 MB to hold 100,000 clients.
+
+An isolate that uses more than 90% of this limit refuses a new hibernatable
+WebSocket, and the error names the heap. The refusal is not permanent, and the
+isolate accepts a WebSocket again when the use of the heap falls under 90%.
+
+An isolate that reaches the limit stops more than an accept. It also stops the
+materialization of a SQL result set, and that error names the heap too. celld
+measures the heap before each event, and the isolate serves again when the use
+of the heap falls under 75% of the limit. An idle isolate holds a dead heap
+until something allocates again, so celld forces a collection when a
+measurement is above that share. A restart of the process is not necessary.
+
 Under pressure, celld durably replicates and fences the least-recently used idle
 cells. It then publishes the cells as unowned without resetting their epochs.
 Those cells become inactive, and celld refuses to reacquire new unowned cells.

README.md

@@ -0,0 +1,85 @@
+# The execution boundary must use celld::asyncrt. Modules which never execute
+# in the World carry an explicit lint allow and are listed in the S0 audit.
+disallowed-methods = [
+  { path = "tokio::spawn", reason = "use celld::asyncrt::spawn inside the World boundary" },
+  { path = "tokio::runtime::Handle::spawn", reason = "use celld::asyncrt::spawn inside the World boundary" },
+  { path = "tokio::task::spawn_blocking", reason = "use celld::asyncrt::blocking inside the World boundary" },
+  { path = "tokio::runtime::Handle::spawn_blocking", reason = "use celld::asyncrt::blocking inside the World boundary" },
+  { path = "tokio::time::sleep", reason = "use celld::asyncrt::sleep inside the World boundary" },
+  { path = "tokio::time::sleep_until", reason = "use celld::asyncrt::sleep_until inside the World boundary" },
+  { path = "tokio::time::timeout", reason = "use celld::asyncrt::timeout inside the World boundary" },
+  { path = "tokio::time::timeout_at", reason = "use celld::asyncrt::timeout_at inside the World boundary" },
+  { path = "tokio::time::interval", reason = "use celld::asyncrt::interval inside the World boundary" },
+  { path = "tokio::time::interval_at", reason = "use celld::asyncrt::interval_at inside the World boundary" },
+  { path = "std::time::SystemTime::now", reason = "use the execution-domain wall clock inside the World boundary" },
+  { path = "std::time::Instant::now", reason = "use the execution-domain monotonic clock inside the World boundary" },
+  { path = "rand::random", reason = "use a labeled execution-domain RNG inside the World boundary" },
+  { path = "std::process::id", reason = "use the execution-domain process tag inside the World boundary" },
+  { path = "std::fs::read", reason = "use the injected whole-node filesystem for celld node storage" },
+  { path = "std::fs::read_to_string", reason = "use the injected whole-node filesystem for celld node storage" },
+  { path = "std::fs::read_dir", reason = "use the injected whole-node filesystem for celld node storage" },
+  { path = "std::fs::metadata", reason = "use the injected whole-node filesystem for celld node storage" },
+  { path = "std::fs::symlink_metadata", reason = "use the injected whole-node filesystem for celld node storage" },
+  { path = "std::fs::canonicalize", reason = "use the injected whole-node filesystem for celld node storage" },
+  { path = "std::fs::copy", reason = "use the injected whole-node filesystem for celld node storage" },
+  { path = "std::fs::exists", reason = "use injected filesystem metadata for celld node storage" },
+  { path = "std::fs::hard_link", reason = "use the injected whole-node filesystem for celld node storage" },
+  { path = "std::fs::read_link", reason = "use the injected whole-node filesystem for celld node storage" },
+  { path = "std::fs::File::create", reason = "use the injected whole-node filesystem for celld node storage" },
+  { path = "std::fs::File::open", reason = "use the injected whole-node filesystem for celld node storage" },
+  { path = "std::fs::File::options", reason = "use the injected whole-node filesystem for celld node storage" },
+  { path = "std::fs::File::sync_all", reason = "use the injected whole-node filesystem for celld node storage" },
+  { path = "std::fs::File::sync_data", reason = "use the injected whole-node filesystem for celld node storage" },
+  { path = "std::fs::OpenOptions::new", reason = "use the injected whole-node filesystem for celld node storage" },
+  { path = "std::fs::OpenOptions::open", reason = "use the injected whole-node filesystem for celld node storage" },
+  { path = "std::fs::write", reason = "use the injected whole-node filesystem for celld node storage" },
+  { path = "std::fs::rename", reason = "use the injected whole-node filesystem for celld node storage" },
+  { path = "std::fs::remove_file", reason = "use the injected whole-node filesystem for celld node storage" },
+  { path = "std::fs::remove_dir", reason = "use the injected whole-node filesystem for celld node storage" },
+  { path = "std::fs::remove_dir_all", reason = "use the injected whole-node filesystem for celld node storage" },
+  { path = "std::fs::create_dir", reason = "use the injected whole-node filesystem for celld node storage" },
+  { path = "std::fs::create_dir_all", reason = "use the injected whole-node filesystem for celld node storage" },
+  { path = "std::fs::set_permissions", reason = "use the injected whole-node filesystem for celld node storage" },
+  { path = "std::path::Path::exists", reason = "use injected filesystem metadata for celld node storage" },
+  { path = "std::path::Path::try_exists", reason = "use injected filesystem metadata for celld node storage" },
+  { path = "std::path::Path::is_file", reason = "use injected filesystem metadata for celld node storage" },
+  { path = "std::path::Path::is_dir", reason = "use injected filesystem metadata for celld node storage" },
+  { path = "std::path::Path::is_symlink", reason = "use injected filesystem metadata for celld node storage" },
+  { path = "std::path::Path::metadata", reason = "use injected filesystem metadata for celld node storage" },
+  { path = "std::path::Path::symlink_metadata", reason = "use injected filesystem metadata for celld node storage" },
+  { path = "std::path::Path::canonicalize", reason = "use the injected whole-node filesystem for celld node storage" },
+  { path = "std::path::Path::read_link", reason = "use the injected whole-node filesystem for celld node storage" },
+  { path = "std::path::Path::read_dir", reason = "use the injected whole-node filesystem for celld node storage" },
+  { path = "tokio::fs::read", reason = "use the injected whole-node filesystem for celld node storage" },
+  { path = "tokio::fs::read_dir", reason = "use the injected whole-node filesystem for celld node storage" },
+  { path = "tokio::fs::read_to_string", reason = "use the injected whole-node filesystem for celld node storage" },
+  { path = "tokio::fs::metadata", reason = "use the injected whole-node filesystem for celld node storage" },
+  { path = "tokio::fs::symlink_metadata", reason = "use the injected whole-node filesystem for celld node storage" },
+  { path = "tokio::fs::canonicalize", reason = "use the injected whole-node filesystem for celld node storage" },
+  { path = "tokio::fs::copy", reason = "use the injected whole-node filesystem for celld node storage" },
+  { path = "tokio::fs::try_exists", reason = "use injected filesystem metadata for celld node storage" },
+  { path = "tokio::fs::hard_link", reason = "use the injected whole-node filesystem for celld node storage" },
+  { path = "tokio::fs::read_link", reason = "use the injected whole-node filesystem for celld node storage" },
+  { path = "tokio::fs::File::create", reason = "use the injected whole-node filesystem for celld node storage" },
+  { path = "tokio::fs::File::open", reason = "use the injected whole-node filesystem for celld node storage" },
+  { path = "tokio::fs::File::sync_all", reason = "use the injected whole-node filesystem for celld node storage" },
+  { path = "tokio::fs::File::sync_data", reason = "use the injected whole-node filesystem for celld node storage" },
+  { path = "tokio::fs::OpenOptions::new", reason = "use the injected whole-node filesystem for celld node storage" },
+  { path = "tokio::fs::OpenOptions::open", reason = "use the injected whole-node filesystem for celld node storage" },
+  { path = "tokio::fs::write", reason = "use the injected whole-node filesystem for celld node storage" },
+  { path = "tokio::fs::rename", reason = "use the injected whole-node filesystem for celld node storage" },
+  { path = "tokio::fs::remove_file", reason = "use the injected whole-node filesystem for celld node storage" },
+  { path = "tokio::fs::remove_dir", reason = "use the injected whole-node filesystem for celld node storage" },
+  { path = "tokio::fs::remove_dir_all", reason = "use the injected whole-node filesystem for celld node storage" },
+  { path = "tokio::fs::create_dir", reason = "use the injected whole-node filesystem for celld node storage" },
+  { path = "tokio::fs::create_dir_all", reason = "use the injected whole-node filesystem for celld node storage" },
+  { path = "tokio::fs::set_permissions", reason = "use the injected whole-node filesystem for celld node storage" },
+]
+
+disallowed-macros = [
+  { path = "tokio::select", reason = "use celld::asyncrt::select with a declared priority inside the World boundary" },
+]
+
+disallowed-types = [
+  { path = "rand::rngs::OsRng", reason = "use a labeled execution-domain RNG inside the World boundary" },
+]

clippy.toml

@@ -1,6 +1,6 @@
 [package]
 name = "celld"
-version = "0.2.1"
+version = "0.3.0"
 edition = "2021"
 rust-version = "1.94.1"
 license = "Apache-2.0"
@@ -39,7 +39,7 @@ http-body-util.workspace = true
 hyper.workspace = true
 hyper-util.workspace = true
 md-5.workspace = true
-object_store = { workspace = true, features = ["aws", "gcp"] }
+object_store = { workspace = true, features = ["aws", "azure", "gcp"] }
 parquet.workspace = true
 percent-encoding.workspace = true
 p256.workspace = true
@@ -78,3 +78,8 @@ webpki-roots.workspace = true
 
 [target.'cfg(unix)'.dependencies]
 libc.workspace = true
+nix.workspace = true
+
+[dev-dependencies]
+async-trait.workspace = true
+lz4_flex.workspace = true