@cybernetyx1/atlasflow-runtime 0.1.0

package/dist/chunk-M4JW76IL.js

@@ -0,0 +1,1161 @@
+// src/url-safety.ts
+function isUnsafeNetworkHost(hostname) {
+  const host = normalizeNetworkHost(hostname);
+  if (!host || host === "localhost" || host.endsWith(".localhost")) return true;
+  const ipv4 = parseIpv4(host);
+  if (ipv4) return isUnsafeIpv4(ipv4);
+  if (host.includes(":")) return isUnsafeIpv6(host);
+  return false;
+}
+function normalizeNetworkHost(hostname) {
+  return hostname.toLowerCase().replace(/^\[|\]$/g, "").replace(/\.$/, "");
+}
+function isNetworkAddressLiteral(hostname) {
+  const host = normalizeNetworkHost(hostname);
+  return parseIpv4(host) !== null || host.includes(":");
+}
+function parseIpv4(host) {
+  const parts = host.split(".");
+  if (parts.length !== 4) return null;
+  const bytes = parts.map((part) => /^(0|[1-9]\d{0,2})$/.test(part) ? Number(part) : NaN);
+  return bytes.every((byte) => Number.isInteger(byte) && byte >= 0 && byte <= 255) ? bytes : null;
+}
+function isUnsafeIpv4(bytes) {
+  const a = bytes[0] ?? -1;
+  const b = bytes[1] ?? -1;
+  if (a === 0 || a === 10 || a === 127 || a === 169 && b === 254 || a === 192 && b === 168) return true;
+  if (a === 172 && b >= 16 && b <= 31) return true;
+  if (a === 100 && b >= 64 && b <= 127) return true;
+  if (a === 192 && b === 0) return true;
+  return false;
+}
+function isUnsafeIpv6(host) {
+  if (host === "::" || host === "::1" || /^0(?::0){7}$/.test(host) || /^0(?::0){6}:1$/.test(host)) return true;
+  const mapped = /(?:^|:)ffff:(\d{1,3}(?:\.\d{1,3}){3})$/.exec(host);
+  if (mapped) {
+    const ipv4 = parseIpv4(mapped[1]);
+    if (ipv4) return isUnsafeIpv4(ipv4);
+  }
+  const first = host.split(":").find((part) => part.length > 0) ?? "";
+  const value = Number.parseInt(first, 16);
+  if (!Number.isFinite(value)) return false;
+  return (value & 65024) === 64512 || (value & 65472) === 65152;
+}
+
+// src/store.ts
+var InMemorySessionStore = class {
+  #data = /* @__PURE__ */ new Map();
+  async get(key) {
+    const d = this.#data.get(key);
+    return d ? structuredClone(d) : null;
+  }
+  async put(key, data) {
+    this.#data.set(key, structuredClone(data));
+  }
+  async delete(key) {
+    this.#data.delete(key);
+  }
+};
+var MAX_RUNS = 1e3;
+var MAX_EVENTS_PER_RUN = 2e3;
+var InMemoryRunStore = class {
+  #runs = /* @__PURE__ */ new Map();
+  #events = /* @__PURE__ */ new Map();
+  async create(record) {
+    this.#runs.set(record.runId, { ...record });
+    if (!this.#events.has(record.runId)) this.#events.set(record.runId, []);
+    if (this.#runs.size > MAX_RUNS) {
+      const oldest = this.#runs.keys().next().value;
+      if (oldest !== void 0) {
+        this.#runs.delete(oldest);
+        this.#events.delete(oldest);
+      }
+    }
+  }
+  async update(runId, patch) {
+    const existing = this.#runs.get(runId);
+    if (existing) this.#runs.set(runId, { ...existing, ...patch });
+  }
+  async get(runId) {
+    const r = this.#runs.get(runId);
+    return r ? { ...r } : null;
+  }
+  async list(filter) {
+    let items = [...this.#runs.values()].sort((a, b) => b.startedAt - a.startedAt);
+    if (filter?.status) items = items.filter((r) => r.status === filter.status);
+    if (filter?.agent) items = items.filter((r) => r.agent === filter.agent);
+    if (filter?.limit) items = items.slice(0, filter.limit);
+    return items.map((r) => ({ ...r }));
+  }
+  async claimLease(runId, owner, now, ttlMs) {
+    const existing = this.#runs.get(runId);
+    if (!existing || existing.status !== "running") return false;
+    if (existing.leaseOwner && existing.leaseOwner !== owner && (existing.leaseExpiresAt ?? 0) > now) return false;
+    this.#runs.set(runId, { ...existing, leaseOwner: owner, leaseAcquiredAt: now, leaseExpiresAt: now + ttlMs });
+    return true;
+  }
+  async claimQueued(runId, owner, now, ttlMs) {
+    const existing = this.#runs.get(runId);
+    if (!existing || existing.status !== "queued") return false;
+    this.#runs.set(runId, { ...existing, status: "running", leaseOwner: owner, leaseAcquiredAt: now, leaseExpiresAt: now + ttlMs });
+    return true;
+  }
+  async heartbeatLease(runId, owner, now, ttlMs) {
+    const existing = this.#runs.get(runId);
+    if (!existing || existing.status !== "running" || existing.leaseOwner !== owner) return false;
+    this.#runs.set(runId, { ...existing, leaseExpiresAt: now + ttlMs });
+    return true;
+  }
+  async releaseLease(runId, owner) {
+    const existing = this.#runs.get(runId);
+    if (!existing || existing.leaseOwner !== owner) return;
+    const { leaseOwner: _owner, leaseExpiresAt: _expires, leaseAcquiredAt: _acquired, ...rest } = existing;
+    this.#runs.set(runId, rest);
+  }
+  async appendEvent(runId, event) {
+    const log = this.#events.get(runId);
+    if (!log) return;
+    if (log.length < MAX_EVENTS_PER_RUN) log.push(event);
+  }
+  async events(runId) {
+    return [...this.#events.get(runId) ?? []];
+  }
+  async eventCount(runId) {
+    return this.#events.get(runId)?.length ?? 0;
+  }
+};
+var MAX_STREAMS = 1e3;
+var MAX_STREAM_MESSAGES_PER_STREAM = 5e3;
+var PRODUCER_STATE_TTL_MS = 7 * 24 * 60 * 60 * 1e3;
+var InMemoryStreamStore = class {
+  #streams = /* @__PURE__ */ new Map();
+  async create(path, opts = {}) {
+    const existing = this.#streams.get(path);
+    if (existing) {
+      const contentType2 = opts.contentType === void 0 ? existing.record.contentType : normalizeStreamContentType(opts.contentType);
+      if (normalizeStreamContentType(existing.record.contentType) !== contentType2 || opts.ttlSeconds !== existing.record.ttlSeconds || opts.expiresAt !== existing.record.expiresAt || (opts.initialData?.length ?? 0) > 0) {
+        throw new Error("stream already exists with different configuration");
+      }
+      return { record: cloneStreamRecord(existing.record), created: false };
+    }
+    let contentType = normalizeStreamContentType(opts.contentType);
+    let forkOffset = "-1";
+    let inheritedMessages = [];
+    if (opts.fork) {
+      const source = this.#streams.get(opts.fork.path);
+      if (!source) throw new Error("fork source not found");
+      contentType = resolveForkContentType(source.record, opts.contentType);
+      forkOffset = resolveForkOffset(source.record, opts.fork.offset);
+      const forkIndex = parseStreamMessageIndex(forkOffset);
+      inheritedMessages = source.messages.filter((message) => message.index <= forkIndex).map(cloneStreamMessage);
+    }
+    const now = Date.now();
+    const record = {
+      path,
+      contentType,
+      closed: opts.closed === true,
+      currentOffset: forkOffset,
+      createdAt: now,
+      updatedAt: now,
+      ...opts.ttlSeconds !== void 0 ? { ttlSeconds: opts.ttlSeconds } : {},
+      ...opts.expiresAt !== void 0 ? { expiresAt: opts.expiresAt } : {}
+    };
+    const entry = { record, messages: inheritedMessages };
+    this.#streams.set(path, entry);
+    if (this.#streams.size > MAX_STREAMS) {
+      const oldest = this.#streams.keys().next().value;
+      if (oldest !== void 0) this.#streams.delete(oldest);
+    }
+    if ((opts.initialData?.length ?? 0) > 0) {
+      const normalized = normalizeStreamBody(opts.initialData, contentType, true);
+      if (normalized.length > 0) appendStreamMessage(entry, normalized);
+    }
+    return { record: cloneStreamRecord(entry.record), created: true };
+  }
+  async get(path) {
+    const entry = this.#streams.get(path);
+    return entry ? cloneStreamRecord(entry.record) : null;
+  }
+  async delete(path) {
+    return this.#streams.delete(path);
+  }
+  async append(path, data, opts) {
+    const entry = this.#streams.get(path);
+    if (!entry) return null;
+    assertStreamContentType(entry.record.contentType, opts.contentType);
+    if (entry.record.closed) throw new Error("stream is closed");
+    assertStreamSeq(entry.record, opts.seq);
+    const normalized = normalizeStreamBody(data, entry.record.contentType, false);
+    const message = appendStreamMessage(entry, normalized);
+    commitStreamSeq(entry.record, opts.seq);
+    entry.record.closed = opts.close === true;
+    entry.record.updatedAt = Date.now();
+    return { record: cloneStreamRecord(entry.record), message: cloneStreamMessage(message) };
+  }
+  async appendWithProducer(path, data, opts) {
+    const entry = this.#streams.get(path);
+    if (!entry) return null;
+    if (entry.record.closed) {
+      return closedStreamProducerAppend(entry.record, opts.producer);
+    }
+    assertStreamContentType(entry.record.contentType, opts.contentType);
+    const producerResult = validateStreamProducer(entry.record, opts.producer);
+    if (producerResult.status !== "accepted") {
+      return { record: cloneStreamRecord(entry.record), message: null, producerResult };
+    }
+    assertStreamSeq(entry.record, opts.seq);
+    const normalized = normalizeStreamBody(data, entry.record.contentType, false);
+    const message = appendStreamMessage(entry, normalized);
+    commitStreamSeq(entry.record, opts.seq);
+    commitStreamProducer(entry.record, producerResult);
+    if (opts.close) {
+      entry.record.closed = true;
+      entry.record.closedBy = { ...opts.producer };
+      entry.record.updatedAt = Date.now();
+    }
+    return {
+      record: cloneStreamRecord(entry.record),
+      message: cloneStreamMessage(message),
+      producerResult,
+      streamClosed: opts.close === true
+    };
+  }
+  async close(path) {
+    const entry = this.#streams.get(path);
+    if (!entry) return null;
+    entry.record.closed = true;
+    entry.record.updatedAt = Date.now();
+    return cloneStreamRecord(entry.record);
+  }
+  async closeWithProducer(path, producer) {
+    const entry = this.#streams.get(path);
+    if (!entry) return null;
+    if (entry.record.closed) {
+      if (producerMatchesClosedBy(entry.record, producer)) {
+        return { record: cloneStreamRecord(entry.record), alreadyClosed: true, producerResult: { status: "duplicate", lastSeq: producer.seq } };
+      }
+      return { record: cloneStreamRecord(entry.record), alreadyClosed: true, producerResult: { status: "stream_closed" } };
+    }
+    const producerResult = validateStreamProducer(entry.record, producer);
+    if (producerResult.status !== "accepted") {
+      return { record: cloneStreamRecord(entry.record), alreadyClosed: false, producerResult };
+    }
+    commitStreamProducer(entry.record, producerResult);
+    entry.record.closed = true;
+    entry.record.closedBy = { ...producer };
+    entry.record.updatedAt = Date.now();
+    return { record: cloneStreamRecord(entry.record), alreadyClosed: false, producerResult };
+  }
+  async messages(path) {
+    return (this.#streams.get(path)?.messages ?? []).map(cloneStreamMessage);
+  }
+  async list() {
+    return [...this.#streams.keys()];
+  }
+};
+var DurableStreamSubscriptionStoreBase = class {
+  constructor(streams, deliveryFetch = fetch, webhookOptions = {}) {
+    this.streams = streams;
+    this.deliveryFetch = deliveryFetch;
+    this.webhookOptions = webhookOptions;
+  }
+  streams;
+  deliveryFetch;
+  webhookOptions;
+  async createOrConfirm(id, input) {
+    const existing = await this.load(id);
+    const configHash = stableSubscriptionConfigHash(input);
+    if (existing) {
+      if (existing.configHash !== configHash) {
+        return subscriptionError(409, "SUBSCRIPTION_ALREADY_EXISTS", "Subscription already exists with different configuration");
+      }
+      return { ok: true, value: { subscription: cloneSubscriptionRecord(existing), created: false } };
+    }
+    if (input.type === "webhook") {
+      const urlValidation = await validateWebhookUrl(input.webhookUrl, this.webhookOptions);
+      if (!urlValidation.ok) return subscriptionError(400, "INVALID_REQUEST", urlValidation.message);
+      const headerValidation = validateWebhookHeaders(input.webhookHeaders, this.webhookOptions);
+      if (!headerValidation.ok) return subscriptionError(400, "INVALID_REQUEST", headerValidation.message);
+    }
+    const record = {
+      id,
+      type: input.type,
+      streams: [],
+      createdAt: (/* @__PURE__ */ new Date()).toISOString(),
+      status: "active",
+      configHash,
+      generation: 0,
+      ...input.wakeStream ? { wakeStream: input.wakeStream } : {},
+      ...input.leaseTtlMs !== void 0 ? { leaseTtlMs: input.leaseTtlMs } : {},
+      ...input.webhookUrl ? { webhookUrl: input.webhookUrl } : {},
+      ...input.webhookHeaders ? { webhookHeaders: { ...input.webhookHeaders } } : {},
+      ...input.pattern ? { pattern: input.pattern } : {},
+      ...input.description ? { description: input.description } : {}
+    };
+    for (const streamPath of input.streams) {
+      await this.linkStream(record, streamPath, "explicit", await this.tailOffset(streamPath));
+    }
+    if (input.pattern) {
+      for (const streamPath of await this.listStreamPaths()) {
+        if (globMatches(input.pattern, streamPath)) {
+          await this.linkStream(record, streamPath, "glob", await this.tailOffset(streamPath));
+        }
+      }
+    }
+    await this.save(record);
+    return { ok: true, value: { subscription: cloneSubscriptionRecord(record), created: true } };
+  }
+  async get(id) {
+    const record = await this.load(id);
+    return record ? cloneSubscriptionRecord(record) : null;
+  }
+  async delete(id) {
+    return this.remove(id);
+  }
+  async addExplicitStreams(id, streams) {
+    const record = await this.load(id);
+    if (!record) return false;
+    for (const streamPath of streams) {
+      await this.linkStream(record, streamPath, "explicit", await this.tailOffset(streamPath));
+    }
+    await this.save(record);
+    return true;
+  }
+  async removeExplicitStream(id, streamPath) {
+    const record = await this.load(id);
+    if (!record) return false;
+    const normalized = normalizeSubscriptionPath(streamPath);
+    const link = record.streams.find((item) => item.path === normalized);
+    if (!link) return true;
+    link.linkTypes = link.linkTypes.filter((type) => type !== "explicit");
+    if (link.linkTypes.length === 0) record.streams = record.streams.filter((item) => item !== link);
+    await this.save(record);
+    return true;
+  }
+  async notifyStreamAppend(streamPath, message) {
+    const normalized = normalizeSubscriptionPath(streamPath);
+    for (const record of await this.listRecords()) {
+      if (record.pattern && globMatches(record.pattern, normalized)) {
+        const existing = record.streams.find((stream) => stream.path === normalized);
+        await this.linkStream(record, normalized, "glob", existing?.ackedOffset ?? "-1");
+      }
+      if (record.streams.some((stream) => stream.path === normalized)) {
+        if (record.type === "webhook") await this.deliverWebhookPending(record, normalized, message);
+        else await this.createWakeIfPending(record, normalized);
+        await this.save(record);
+      }
+    }
+  }
+  async notifyStreamDelete(streamPath) {
+    const normalized = normalizeSubscriptionPath(streamPath);
+    for (const record of await this.listRecords()) {
+      if (record.type === "webhook" && record.streams.some((stream) => stream.path === normalized)) {
+        await this.deliverWebhookDelete(record, normalized);
+      }
+      const next = record.streams.filter((stream) => stream.path !== normalized);
+      if (next.length !== record.streams.length) {
+        record.streams = next;
+        await this.save(record);
+      }
+    }
+  }
+  async claim(id, worker) {
+    const record = await this.load(id);
+    if (!record) return subscriptionError(404, "SUBSCRIPTION_NOT_FOUND", "Subscription not found");
+    if (record.type !== "pull-wake") return subscriptionError(400, "INVALID_REQUEST", "Only pull-wake subscriptions can be claimed");
+    this.clearExpiredLease(record);
+    if (record.holder) {
+      return subscriptionError(409, "ALREADY_CLAIMED", "Subscription already has a live claimant", {
+        currentHolder: record.holder,
+        generation: record.generation
+      });
+    }
+    if (!await this.hasPendingWork(record)) {
+      await this.save(record);
+      return subscriptionError(409, "NO_PENDING_WORK", "Subscription has no pending work");
+    }
+    if (!record.wakeId) await this.createWake(record, await this.firstPendingStream(record));
+    record.holder = worker;
+    record.token = randomSubscriptionToken("subtok");
+    record.leaseExpiresAt = Date.now() + pullWakeLeaseTtl(record);
+    await this.save(record);
+    return {
+      ok: true,
+      value: {
+        wakeId: record.wakeId,
+        generation: record.generation,
+        token: record.token,
+        streams: await this.streamInfos(record),
+        leaseTtlMs: pullWakeLeaseTtl(record)
+      }
+    };
+  }
+  async ack(id, token, input) {
+    const record = await this.load(id);
+    if (!record) return subscriptionError(404, "SUBSCRIPTION_NOT_FOUND", "Subscription not found");
+    const fenced = this.validateWakeToken(record, token, input);
+    if (fenced) return fenced;
+    const ackError = await this.applyAcks(record, input);
+    if (ackError) return ackError;
+    record.leaseExpiresAt = Date.now() + pullWakeLeaseTtl(record);
+    let nextWake = false;
+    if (input.done === true) {
+      this.clearLease(record);
+      nextWake = await this.createWakeIfPending(record, await this.firstPendingStream(record));
+    }
+    await this.save(record);
+    return { ok: true, value: { ok: true, nextWake } };
+  }
+  async release(id, token, input) {
+    const record = await this.load(id);
+    if (!record) return subscriptionError(404, "SUBSCRIPTION_NOT_FOUND", "Subscription not found");
+    const fenced = this.validateWakeToken(record, token, input);
+    if (fenced) return fenced;
+    this.clearLease(record);
+    await this.createWakeIfPending(record, await this.firstPendingStream(record));
+    await this.save(record);
+    return { ok: true, value: void 0 };
+  }
+  async streamInfos(subscription) {
+    const infos = [];
+    for (const link of subscription.streams) {
+      const tailOffset = await this.tailOffset(link.path);
+      infos.push({
+        path: link.path,
+        linkType: link.linkTypes.includes("explicit") ? "explicit" : "glob",
+        ackedOffset: link.ackedOffset,
+        tailOffset,
+        hasPending: compareSubscriptionOffsets(tailOffset, link.ackedOffset) > 0
+      });
+    }
+    return infos;
+  }
+  async linkStream(record, streamPath, linkType, ackedOffset) {
+    const normalized = normalizeSubscriptionPath(streamPath);
+    const existing = record.streams.find((stream) => stream.path === normalized);
+    if (existing) {
+      if (!existing.linkTypes.includes(linkType)) existing.linkTypes.push(linkType);
+      return;
+    }
+    record.streams.push({ path: normalized, linkTypes: [linkType], ackedOffset });
+  }
+  async createWakeIfPending(record, triggeredBy) {
+    this.clearExpiredLease(record);
+    if (record.wakeId || record.holder) return false;
+    if (!await this.hasPendingWork(record)) return false;
+    await this.createWake(record, triggeredBy || await this.firstPendingStream(record));
+    return true;
+  }
+  async createWake(record, triggeredBy) {
+    record.generation += 1;
+    record.wakeId = randomSubscriptionToken("wake");
+    record.wakeSnapshot = Object.fromEntries((await this.streamInfos(record)).map((stream) => [stream.path, stream.tailOffset]));
+    await this.writeWakeEvent(record, triggeredBy);
+  }
+  async writeWakeEvent(record, triggeredBy) {
+    if (!record.wakeStream) return;
+    const wakeStream = normalizeSubscriptionPath(record.wakeStream);
+    if (!await this.streams.get(wakeStream)) return;
+    const event = {
+      type: "wake",
+      subscription_id: record.id,
+      stream: triggeredBy,
+      generation: record.generation,
+      ts: Date.now()
+    };
+    try {
+      await this.streams.append(wakeStream, new TextEncoder().encode(JSON.stringify(event)), { contentType: "application/json" });
+    } catch {
+    }
+  }
+  async hasPendingWork(record) {
+    return (await this.streamInfos(record)).some((stream) => stream.hasPending);
+  }
+  async firstPendingStream(record) {
+    return (await this.streamInfos(record)).find((stream) => stream.hasPending)?.path ?? record.streams[0]?.path ?? "";
+  }
+  validateWakeToken(record, token, input) {
+    this.clearExpiredLease(record);
+    if (!record.token || token !== record.token) return subscriptionError(401, "TOKEN_INVALID", "Token invalid");
+    if (input.generation !== record.generation || input.wakeId !== record.wakeId) {
+      return subscriptionError(409, "FENCED", "Wake generation is stale");
+    }
+    return null;
+  }
+  async applyAcks(record, input) {
+    if (!input.acks) return null;
+    for (const ack of input.acks) {
+      const stream = normalizeSubscriptionPath(ack.stream ?? ack.path ?? "");
+      const link = record.streams.find((item) => item.path === stream);
+      if (!stream || !link) return subscriptionError(409, "INVALID_OFFSET", "Ack references an unknown subscription stream");
+      if (ack.offset === "-1") return subscriptionError(409, "INVALID_OFFSET", "Ack offset must not be -1");
+      if (compareSubscriptionOffsets(ack.offset, link.ackedOffset) < 0) {
+        return subscriptionError(409, "INVALID_OFFSET", "Ack offset regresses the committed cursor");
+      }
+      if (compareSubscriptionOffsets(ack.offset, await this.tailOffset(stream)) > 0) {
+        return subscriptionError(409, "INVALID_OFFSET", "Ack offset is beyond stream tail");
+      }
+    }
+    for (const ack of input.acks) {
+      const stream = normalizeSubscriptionPath(ack.stream ?? ack.path ?? "");
+      const link = record.streams.find((item) => item.path === stream);
+      if (link) link.ackedOffset = ack.offset;
+    }
+    return null;
+  }
+  clearLease(record) {
+    delete record.holder;
+    delete record.token;
+    delete record.wakeId;
+    delete record.wakeSnapshot;
+    delete record.leaseExpiresAt;
+  }
+  clearExpiredLease(record) {
+    if (record.leaseExpiresAt !== void 0 && record.leaseExpiresAt <= Date.now()) this.clearLease(record);
+  }
+  async listStreamPaths() {
+    if (!("list" in this.streams) || typeof this.streams.list !== "function") return [];
+    return this.streams.list();
+  }
+  async tailOffset(streamPath) {
+    return (await this.streams.get(normalizeSubscriptionPath(streamPath)))?.currentOffset ?? "-1";
+  }
+  async deliverWebhookPending(record, triggeredBy, message) {
+    if (!record.webhookUrl) return;
+    const links = record.streams.filter((stream) => stream.path === normalizeSubscriptionPath(triggeredBy));
+    for (const link of links) {
+      const messages = (await this.streams.messages(link.path)).filter((item) => compareSubscriptionOffsets(item.offset, link.ackedOffset) > 0);
+      for (const item of messages.length > 0 ? messages : message ? [message] : []) {
+        if (compareSubscriptionOffsets(item.offset, link.ackedOffset) <= 0) continue;
+        const delivered = await this.deliverWebhookAppend(record, link.path, item);
+        if (!delivered) return;
+        link.ackedOffset = item.offset;
+      }
+    }
+  }
+  async deliverWebhookAppend(record, streamPath, message) {
+    const stream = await this.streams.get(streamPath);
+    const body = webhookPayload(record, "stream.append", streamPath, {
+      offset: message.offset,
+      index: message.index,
+      content_type: stream?.contentType,
+      data_base64: message.dataBase64,
+      created_at: new Date(message.createdAt).toISOString()
+    });
+    return this.postWebhook(record, body);
+  }
+  async deliverWebhookDelete(record, streamPath) {
+    if (!record.webhookUrl) return;
+    await this.postWebhook(record, webhookPayload(record, "stream.delete", streamPath));
+  }
+  async postWebhook(record, payload) {
+    if (!record.webhookUrl) return true;
+    const urlValidation = await validateWebhookUrl(record.webhookUrl, this.webhookOptions);
+    if (!urlValidation.ok) {
+      record.webhookLastError = urlValidation.message;
+      return false;
+    }
+    try {
+      const res = await this.deliveryFetch(record.webhookUrl, {
+        method: "POST",
+        headers: {
+          "content-type": "application/json",
+          ...sanitizeWebhookHeaders(record.webhookHeaders, this.webhookOptions)
+        },
+        redirect: "manual",
+        body: JSON.stringify(payload)
+      });
+      if (!res.ok) throw new Error(`HTTP ${res.status}`);
+      record.webhookLastSuccessAt = (/* @__PURE__ */ new Date()).toISOString();
+      delete record.webhookLastError;
+      return true;
+    } catch (err) {
+      record.webhookLastError = err instanceof Error ? err.message : String(err);
+      return false;
+    }
+  }
+};
+var InMemorySubscriptionStore = class extends DurableStreamSubscriptionStoreBase {
+  #subscriptions = /* @__PURE__ */ new Map();
+  constructor(streams, deliveryFetch, webhookOptions) {
+    super(streams, deliveryFetch, webhookOptions);
+  }
+  async load(id) {
+    const record = this.#subscriptions.get(id);
+    return record ? cloneSubscriptionRecord(record) : null;
+  }
+  async save(record) {
+    this.#subscriptions.set(record.id, cloneSubscriptionRecord(record));
+  }
+  async remove(id) {
+    return this.#subscriptions.delete(id);
+  }
+  async listRecords() {
+    return [...this.#subscriptions.values()].map(cloneSubscriptionRecord);
+  }
+};
+function inMemoryAdapter(options = {}) {
+  const streams = new InMemoryStreamStore();
+  return {
+    sessions: new InMemorySessionStore(),
+    runs: new InMemoryRunStore(),
+    streams,
+    subscriptions: new InMemorySubscriptionStore(streams, void 0, options.webhooks)
+  };
+}
+var EVENT_KEY = (runId, index) => `e:${runId}:${String(index).padStart(12, "0")}`;
+var STREAM_RECORD_KEY = (path) => `ds:r:${encodeURIComponent(path)}`;
+var STREAM_MESSAGE_PREFIX = (path) => `ds:m:${encodeURIComponent(path)}:`;
+var STREAM_MESSAGE_KEY = (path, index) => `${STREAM_MESSAGE_PREFIX(path)}${String(index).padStart(12, "0")}`;
+var SUBSCRIPTION_RECORD_KEY = (id) => `ds:sub:${encodeURIComponent(id)}`;
+var SUBSCRIPTION_RECORD_PREFIX = "ds:sub:";
+function kvAdapter(kv, options = {}) {
+  const streams = {
+    async create(path, opts = {}) {
+      const existing = await kv.get(STREAM_RECORD_KEY(path));
+      if (existing) {
+        const contentType2 = opts.contentType === void 0 ? existing.contentType : normalizeStreamContentType(opts.contentType);
+        if (normalizeStreamContentType(existing.contentType) !== contentType2 || opts.ttlSeconds !== existing.ttlSeconds || opts.expiresAt !== existing.expiresAt || (opts.initialData?.length ?? 0) > 0) {
+          throw new Error("stream already exists with different configuration");
+        }
+        return { record: existing, created: false };
+      }
+      let contentType = normalizeStreamContentType(opts.contentType);
+      let currentOffset = "-1";
+      let inheritedMessages = [];
+      if (opts.fork) {
+        const source = await kv.get(STREAM_RECORD_KEY(opts.fork.path));
+        if (!source) throw new Error("fork source not found");
+        contentType = resolveForkContentType(source, opts.contentType);
+        currentOffset = resolveForkOffset(source, opts.fork.offset);
+        const forkIndex = parseStreamMessageIndex(currentOffset);
+        const sourceMessages = await kv.list({ prefix: STREAM_MESSAGE_PREFIX(opts.fork.path) });
+        inheritedMessages = [...sourceMessages.entries()].sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0).map(([, value]) => value).filter((message) => message.index <= forkIndex).map(cloneStreamMessage);
+      }
+      const now = Date.now();
+      let record = {
+        path,
+        contentType,
+        closed: opts.closed === true,
+        currentOffset,
+        createdAt: now,
+        updatedAt: now,
+        ...opts.ttlSeconds !== void 0 ? { ttlSeconds: opts.ttlSeconds } : {},
+        ...opts.expiresAt !== void 0 ? { expiresAt: opts.expiresAt } : {}
+      };
+      await kv.put(STREAM_RECORD_KEY(path), record);
+      for (const message of inheritedMessages) {
+        await kv.put(STREAM_MESSAGE_KEY(path, message.index), message);
+      }
+      if ((opts.initialData?.length ?? 0) > 0) {
+        const normalized = normalizeStreamBody(opts.initialData, contentType, true);
+        if (normalized.length > 0) {
+          const message = makeStreamMessage(parseStreamMessageIndex(record.currentOffset) + 1, normalized);
+          record = { ...record, currentOffset: message.offset, updatedAt: message.createdAt };
+          await kv.put(STREAM_MESSAGE_KEY(path, message.index), message);
+          await kv.put(STREAM_RECORD_KEY(path), record);
+        }
+      }
+      return { record, created: true };
+    },
+    async get(path) {
+      return await kv.get(STREAM_RECORD_KEY(path)) ?? null;
+    },
+    async delete(path) {
+      const existing = await kv.get(STREAM_RECORD_KEY(path));
+      if (!existing) return false;
+      await kv.delete(STREAM_RECORD_KEY(path));
+      const messages = await kv.list({ prefix: STREAM_MESSAGE_PREFIX(path) });
+      await Promise.all([...messages.keys()].map((key) => kv.delete(key)));
+      return true;
+    },
+    async append(path, data, opts) {
+      const existing = await kv.get(STREAM_RECORD_KEY(path));
+      if (!existing) return null;
+      assertStreamContentType(existing.contentType, opts.contentType);
+      if (existing.closed) throw new Error("stream is closed");
+      assertStreamSeq(existing, opts.seq);
+      const normalized = normalizeStreamBody(data, existing.contentType, false);
+      const currentIndex = parseStreamMessageIndex(existing.currentOffset);
+      const message = makeStreamMessage(currentIndex + 1, normalized);
+      const record = {
+        ...existing,
+        currentOffset: message.offset,
+        ...opts.seq !== void 0 ? { lastSeq: opts.seq } : {},
+        closed: opts.close === true,
+        updatedAt: message.createdAt
+      };
+      await kv.put(STREAM_MESSAGE_KEY(path, message.index), message);
+      await kv.put(STREAM_RECORD_KEY(path), record);
+      return { record, message };
+    },
+    async appendWithProducer(path, data, opts) {
+      const existing = await kv.get(STREAM_RECORD_KEY(path));
+      if (!existing) return null;
+      if (existing.closed) return closedStreamProducerAppend(existing, opts.producer);
+      assertStreamContentType(existing.contentType, opts.contentType);
+      const producerResult = validateStreamProducer(existing, opts.producer);
+      if (producerResult.status !== "accepted") return { record: existing, message: null, producerResult };
+      assertStreamSeq(existing, opts.seq);
+      const normalized = normalizeStreamBody(data, existing.contentType, false);
+      const currentIndex = parseStreamMessageIndex(existing.currentOffset);
+      const message = makeStreamMessage(currentIndex + 1, normalized);
+      const record = {
+        ...existing,
+        currentOffset: message.offset,
+        ...opts.seq !== void 0 ? { lastSeq: opts.seq } : {},
+        closed: opts.close === true,
+        updatedAt: message.createdAt
+      };
+      commitStreamProducer(record, producerResult);
+      if (opts.close) record.closedBy = { ...opts.producer };
+      await kv.put(STREAM_MESSAGE_KEY(path, message.index), message);
+      await kv.put(STREAM_RECORD_KEY(path), record);
+      return { record, message, producerResult, streamClosed: opts.close === true };
+    },
+    async close(path) {
+      const existing = await kv.get(STREAM_RECORD_KEY(path));
+      if (!existing) return null;
+      const record = { ...existing, closed: true, updatedAt: Date.now() };
+      await kv.put(STREAM_RECORD_KEY(path), record);
+      return record;
+    },
+    async closeWithProducer(path, producer) {
+      const existing = await kv.get(STREAM_RECORD_KEY(path));
+      if (!existing) return null;
+      if (existing.closed) {
+        if (producerMatchesClosedBy(existing, producer)) {
+          return { record: existing, alreadyClosed: true, producerResult: { status: "duplicate", lastSeq: producer.seq } };
+        }
+        return { record: existing, alreadyClosed: true, producerResult: { status: "stream_closed" } };
+      }
+      const producerResult = validateStreamProducer(existing, producer);
+      if (producerResult.status !== "accepted") return { record: existing, alreadyClosed: false, producerResult };
+      const record = { ...existing, closed: true, closedBy: { ...producer }, updatedAt: Date.now() };
+      commitStreamProducer(record, producerResult);
+      await kv.put(STREAM_RECORD_KEY(path), record);
+      return { record, alreadyClosed: false, producerResult };
+    },
+    async messages(path) {
+      const map = await kv.list({ prefix: STREAM_MESSAGE_PREFIX(path) });
+      return [...map.entries()].sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0).map(([, v]) => v);
+    },
+    async list() {
+      const map = await kv.list({ prefix: "ds:r:" });
+      return [...map.values()].map((record) => record.path);
+    }
+  };
+  return {
+    sessions: {
+      async get(key) {
+        return await kv.get(`s:${key}`) ?? null;
+      },
+      async put(key, data) {
+        await kv.put(`s:${key}`, data);
+      },
+      async delete(key) {
+        await kv.delete(`s:${key}`);
+      }
+    },
+    runs: {
+      async create(record) {
+        await kv.put(`r:${record.runId}`, record);
+      },
+      async update(runId, patch) {
+        const existing = await kv.get(`r:${runId}`);
+        if (existing) await kv.put(`r:${runId}`, { ...existing, ...patch });
+      },
+      async get(runId) {
+        return await kv.get(`r:${runId}`) ?? null;
+      },
+      async list(filter) {
+        const map = await kv.list({ prefix: "r:" });
+        let items = [...map.values()].sort((a, b) => b.startedAt - a.startedAt);
+        if (filter?.status) items = items.filter((r) => r.status === filter.status);
+        if (filter?.agent) items = items.filter((r) => r.agent === filter.agent);
+        if (filter?.limit) items = items.slice(0, filter.limit);
+        return items;
+      },
+      async claimLease(runId, owner, now, ttlMs) {
+        const existing = await kv.get(`r:${runId}`);
+        if (!existing || existing.status !== "running") return false;
+        if (existing.leaseOwner && existing.leaseOwner !== owner && (existing.leaseExpiresAt ?? 0) > now) return false;
+        await kv.put(`r:${runId}`, { ...existing, leaseOwner: owner, leaseAcquiredAt: now, leaseExpiresAt: now + ttlMs });
+        return true;
+      },
+      async claimQueued(runId, owner, now, ttlMs) {
+        const existing = await kv.get(`r:${runId}`);
+        if (!existing || existing.status !== "queued") return false;
+        await kv.put(`r:${runId}`, { ...existing, status: "running", leaseOwner: owner, leaseAcquiredAt: now, leaseExpiresAt: now + ttlMs });
+        return true;
+      },
+      async heartbeatLease(runId, owner, now, ttlMs) {
+        const existing = await kv.get(`r:${runId}`);
+        if (!existing || existing.status !== "running" || existing.leaseOwner !== owner) return false;
+        await kv.put(`r:${runId}`, { ...existing, leaseExpiresAt: now + ttlMs });
+        return true;
+      },
+      async releaseLease(runId, owner) {
+        const existing = await kv.get(`r:${runId}`);
+        if (!existing || existing.leaseOwner !== owner) return;
+        const { leaseOwner: _owner, leaseExpiresAt: _expires, leaseAcquiredAt: _acquired, ...rest } = existing;
+        await kv.put(`r:${runId}`, rest);
+      },
+      async appendEvent(runId, event) {
+        await kv.put(EVENT_KEY(runId, event.index), event);
+      },
+      async events(runId) {
+        const map = await kv.list({ prefix: `e:${runId}:` });
+        return [...map.entries()].sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0).map(([, v]) => v);
+      },
+      async eventCount(runId) {
+        const map = await kv.list({ prefix: `e:${runId}:` });
+        return map.size;
+      }
+    },
+    streams,
+    subscriptions: new KvSubscriptionStore(kv, streams, options.webhooks)
+  };
+}
+var KvSubscriptionStore = class extends DurableStreamSubscriptionStoreBase {
+  constructor(kv, streams, webhookOptions) {
+    super(streams, void 0, webhookOptions);
+    this.kv = kv;
+  }
+  kv;
+  async load(id) {
+    const record = await this.kv.get(SUBSCRIPTION_RECORD_KEY(id));
+    return record ? cloneSubscriptionRecord(record) : null;
+  }
+  async save(record) {
+    await this.kv.put(SUBSCRIPTION_RECORD_KEY(record.id), cloneSubscriptionRecord(record));
+  }
+  async remove(id) {
+    const existing = await this.load(id);
+    if (!existing) return false;
+    await this.kv.delete(SUBSCRIPTION_RECORD_KEY(id));
+    return true;
+  }
+  async listRecords() {
+    const map = await this.kv.list({ prefix: SUBSCRIPTION_RECORD_PREFIX });
+    return [...map.values()].map(cloneSubscriptionRecord);
+  }
+};
+function normalizeStreamContentType(value) {
+  const normalized = value?.split(";")[0]?.trim().toLowerCase();
+  return normalized && /^[\w.+-]+\/[\w.+-]+$/.test(normalized) ? normalized : "application/octet-stream";
+}
+function isJsonStreamContentType(contentType) {
+  return normalizeStreamContentType(contentType) === "application/json";
+}
+function streamMessageBytes(message) {
+  return base64ToBytes(message.dataBase64);
+}
+function appendStreamMessage(entry, data) {
+  if (entry.messages.length >= MAX_STREAM_MESSAGES_PER_STREAM) throw new Error("stream message limit exceeded");
+  const message = makeStreamMessage(entry.messages.length, data);
+  entry.messages.push(message);
+  entry.record.currentOffset = message.offset;
+  entry.record.updatedAt = message.createdAt;
+  return message;
+}
+function assertStreamSeq(record, seq) {
+  if (seq === void 0) return;
+  if (seq.length === 0) throw new Error("Invalid Stream-Seq");
+  if (record.lastSeq !== void 0 && seq <= record.lastSeq) throw new Error("Stream sequence conflict");
+}
+function commitStreamSeq(record, seq) {
+  if (seq !== void 0) record.lastSeq = seq;
+}
+function resolveForkContentType(source, requested) {
+  const sourceContentType = normalizeStreamContentType(source.contentType);
+  if (requested === void 0) return sourceContentType;
+  const requestedContentType = normalizeStreamContentType(requested);
+  if (requestedContentType !== sourceContentType) throw new Error("Content-type mismatch");
+  return requestedContentType;
+}
+function resolveForkOffset(source, requested) {
+  const offset = requested ?? source.currentOffset;
+  const index = parseStreamMessageIndex(offset);
+  const tail = parseStreamMessageIndex(source.currentOffset);
+  if (index > tail) throw new Error("Fork offset is beyond source tail");
+  return offset;
+}
+function makeStreamMessage(index, data) {
+  return { index, offset: formatStoreOffset(index), dataBase64: bytesToBase64(data), createdAt: Date.now() };
+}
+function formatStoreOffset(index) {
+  if (index < 0) return "-1";
+  return `0000000000000000_${String(index).padStart(16, "0")}`;
+}
+function parseStreamMessageIndex(offset) {
+  if (offset === "-1") return -1;
+  const match = /^\d+_(\d+)$/.exec(offset);
+  if (!match) throw new Error(`Invalid stream offset: ${offset}`);
+  return Number(match[1]);
+}
+function normalizeStreamBody(data, contentType, initialCreate) {
+  if (!isJsonStreamContentType(contentType)) return data;
+  let parsed;
+  try {
+    parsed = JSON.parse(new TextDecoder().decode(data));
+  } catch {
+    throw new Error("Invalid JSON");
+  }
+  if (Array.isArray(parsed)) {
+    if (parsed.length === 0) {
+      if (initialCreate) return new Uint8Array(0);
+      throw new Error("Empty arrays are not allowed");
+    }
+    return new TextEncoder().encode(JSON.stringify(parsed));
+  }
+  return new TextEncoder().encode(JSON.stringify([parsed]));
+}
+function assertStreamContentType(expected, actual) {
+  if (normalizeStreamContentType(expected) !== normalizeStreamContentType(actual)) throw new Error("Content-type mismatch");
+}
+function cloneStreamRecord(record) {
+  return {
+    ...record,
+    ...record.producers ? { producers: structuredClone(record.producers) } : {},
+    ...record.closedBy ? { closedBy: { ...record.closedBy } } : {}
+  };
+}
+function cloneStreamMessage(message) {
+  return { ...message };
+}
+function cloneSubscriptionRecord(record) {
+  return structuredClone(record);
+}
+function normalizeSubscriptionPath(path) {
+  return path.replace(/^\/+/, "").replace(/\/+$/, "").split("/").filter((part) => part.length > 0 && part !== "." && part !== "..").join("/");
+}
+function stableSubscriptionConfigHash(input) {
+  const canonical = JSON.stringify({
+    type: input.type,
+    pattern: input.pattern,
+    streams: [...new Set(input.streams.map(normalizeSubscriptionPath))].sort(),
+    wakeStream: input.wakeStream ? normalizeSubscriptionPath(input.wakeStream) : void 0,
+    leaseTtlMs: input.leaseTtlMs,
+    webhookUrl: input.webhookUrl,
+    webhookHeaders: input.webhookHeaders ? Object.fromEntries(Object.entries(input.webhookHeaders).sort(([a], [b]) => a.localeCompare(b))) : void 0,
+    description: input.description
+  });
+  let hash = 2166136261;
+  for (let i = 0; i < canonical.length; i++) {
+    hash ^= canonical.charCodeAt(i);
+    hash = Math.imul(hash, 16777619);
+  }
+  return (hash >>> 0).toString(16).padStart(8, "0");
+}
+async function validateWebhookUrl(value, options) {
+  if (!value) return { ok: false, message: "webhook subscriptions require a webhook_url" };
+  let url;
+  try {
+    url = new URL(value);
+  } catch {
+    return { ok: false, message: "webhook_url must be a valid URL" };
+  }
+  if (options.allowUnsafeWebhookUrls) return { ok: true };
+  if (url.protocol !== "https:") return { ok: false, message: "webhook_url must use https unless unsafe local webhooks are explicitly enabled" };
+  if (!webhookHostAllowed(url.hostname, options.allowedWebhookHosts)) return { ok: false, message: "webhook_url host is not in the configured allowlist" };
+  if (isUnsafeNetworkHost(url.hostname)) return { ok: false, message: "webhook_url must not target localhost, private, loopback, link-local, or unspecified hosts" };
+  let resolved;
+  try {
+    resolved = await resolveWebhookHostAddresses(url.hostname, options);
+  } catch (err) {
+    return { ok: false, message: err instanceof Error ? err.message : String(err) };
+  }
+  const unsafe = resolved.find(isUnsafeNetworkHost);
+  if (unsafe) return { ok: false, message: `webhook_url hostname resolves to an unsafe address (${unsafe})` };
+  return { ok: true };
+}
+function validateWebhookHeaders(headers, options) {
+  if (!headers || options.allowSensitiveWebhookHeaders) return { ok: true };
+  const blocked = Object.keys(headers).find(isSensitiveWebhookHeader);
+  return blocked ? { ok: false, message: `webhook header "${blocked}" is not allowed` } : { ok: true };
+}
+function sanitizeWebhookHeaders(headers, options) {
+  if (!headers) return {};
+  if (options.allowSensitiveWebhookHeaders) return { ...headers };
+  return Object.fromEntries(Object.entries(headers).filter(([name]) => !isSensitiveWebhookHeader(name)));
+}
+function isSensitiveWebhookHeader(name) {
+  const normalized = name.toLowerCase();
+  return normalized === "authorization" || normalized === "cookie" || normalized === "proxy-authorization" || normalized === "set-cookie";
+}
+function webhookHostAllowed(hostname, allowedHosts) {
+  if (!allowedHosts || allowedHosts.length === 0) return true;
+  const host = normalizeNetworkHost(hostname);
+  return allowedHosts.some((entry) => {
+    const allowed = normalizeNetworkHost(entry);
+    if (!allowed) return false;
+    if (allowed.startsWith("*.")) {
+      const suffix = allowed.slice(1);
+      return host.endsWith(suffix) && host.length > suffix.length;
+    }
+    return host === allowed;
+  });
+}
+async function resolveWebhookHostAddresses(hostname, options) {
+  const host = normalizeNetworkHost(hostname);
+  if (isNetworkAddressLiteral(host)) return [host];
+  if (options.resolveWebhookHost === false) return [];
+  const resolver = options.resolveWebhookHost ?? ((name) => dohResolveWebhookHost(name, options.dnsTimeoutMs));
+  let addresses;
+  try {
+    addresses = await resolver(host);
+  } catch (err) {
+    const reason = err instanceof Error ? err.message : String(err);
+    throw new Error(`webhook_url hostname could not be resolved safely: ${reason}`);
+  }
+  const clean = [...new Set(addresses.map(normalizeNetworkHost).filter(Boolean))];
+  if (clean.length === 0) throw new Error("webhook_url hostname could not be resolved safely");
+  return clean;
+}
+async function dohResolveWebhookHost(hostname, timeoutMs = 1500) {
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), timeoutMs);
+  try {
+    const [a, aaaa] = await Promise.all([dohQuery(hostname, "A", controller.signal), dohQuery(hostname, "AAAA", controller.signal)]);
+    return [...a, ...aaaa];
+  } finally {
+    clearTimeout(timer);
+  }
+}
+async function dohQuery(hostname, type, signal) {
+  const url = `https://cloudflare-dns.com/dns-query?name=${encodeURIComponent(hostname)}&type=${type}`;
+  const res = await fetch(url, { headers: { accept: "application/dns-json" }, signal });
+  if (!res.ok) throw new Error(`DNS ${type} lookup failed with HTTP ${res.status}`);
+  const body = await res.json();
+  const expected = type === "A" ? 1 : 28;
+  return (body.Answer ?? []).filter((answer) => answer.type === expected && typeof answer.data === "string").map((answer) => answer.data);
+}
+function pullWakeLeaseTtl(record) {
+  return record.leaseTtlMs ?? 3e4;
+}
+function webhookPayload(record, type, streamPath, extra = {}) {
+  return {
+    type,
+    subscription_id: record.id,
+    stream: streamPath,
+    generation: record.generation,
+    ts: Date.now(),
+    ...extra
+  };
+}
+function subscriptionError(status, code, message, extra = {}) {
+  return { ok: false, status, error: { code, message, ...extra } };
+}
+function compareSubscriptionOffsets(a, b) {
+  const ai = subscriptionOffsetIndex(a);
+  const bi = subscriptionOffsetIndex(b);
+  return ai === bi ? 0 : ai < bi ? -1 : 1;
+}
+function subscriptionOffsetIndex(offset) {
+  if (offset === "-1") return -1;
+  const match = /^\d+_(\d+)$/.exec(offset);
+  if (!match) return Number.NEGATIVE_INFINITY;
+  return Number(match[1]);
+}
+function globMatches(pattern, value) {
+  const escaped = normalizeSubscriptionPath(pattern).split("*").map((part) => part.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")).join(".*");
+  return new RegExp(`^${escaped}$`).test(value);
+}
+function randomSubscriptionToken(prefix) {
+  const cryptoObj = globalThis.crypto;
+  if (cryptoObj && "randomUUID" in cryptoObj && typeof cryptoObj.randomUUID === "function") {
+    return `${prefix}_${cryptoObj.randomUUID()}`;
+  }
+  const bytes = new Uint8Array(16);
+  cryptoObj?.getRandomValues?.(bytes);
+  return `${prefix}_${bytesToBase64(bytes).replace(/[^A-Za-z0-9]/g, "").slice(0, 24)}`;
+}
+function bytesToBase64(bytes) {
+  let binary = "";
+  for (let i = 0; i < bytes.length; i += 32768) {
+    binary += String.fromCharCode(...bytes.slice(i, i + 32768));
+  }
+  return btoa(binary);
+}
+function base64ToBytes(value) {
+  const binary = atob(value);
+  const bytes = new Uint8Array(binary.length);
+  for (let i = 0; i < binary.length; i++) bytes[i] = binary.charCodeAt(i);
+  return bytes;
+}
+function validateStreamProducer(record, producer) {
+  cleanupExpiredProducers(record);
+  const state = record.producers?.[producer.producerId];
+  const now = Date.now();
+  if (!state) {
+    if (producer.seq !== 0) return { status: "sequence_gap", expectedSeq: 0, receivedSeq: producer.seq };
+    return {
+      status: "accepted",
+      isNew: true,
+      producerId: producer.producerId,
+      proposedState: { epoch: producer.epoch, lastSeq: 0, lastUpdated: now }
+    };
+  }
+  if (producer.epoch < state.epoch) return { status: "stale_epoch", currentEpoch: state.epoch };
+  if (producer.epoch > state.epoch) {
+    if (producer.seq !== 0) return { status: "invalid_epoch_seq" };
+    return {
+      status: "accepted",
+      isNew: true,
+      producerId: producer.producerId,
+      proposedState: { epoch: producer.epoch, lastSeq: 0, lastUpdated: now }
+    };
+  }
+  if (producer.seq <= state.lastSeq) return { status: "duplicate", lastSeq: state.lastSeq };
+  if (producer.seq === state.lastSeq + 1) {
+    return {
+      status: "accepted",
+      isNew: false,
+      producerId: producer.producerId,
+      proposedState: { epoch: producer.epoch, lastSeq: producer.seq, lastUpdated: now }
+    };
+  }
+  return { status: "sequence_gap", expectedSeq: state.lastSeq + 1, receivedSeq: producer.seq };
+}
+function commitStreamProducer(record, result) {
+  if (result.status !== "accepted") return;
+  record.producers = { ...record.producers ?? {}, [result.producerId]: { ...result.proposedState } };
+}
+function cleanupExpiredProducers(record) {
+  if (!record.producers) return;
+  const now = Date.now();
+  const next = {};
+  for (const [id, state] of Object.entries(record.producers)) {
+    if (now - state.lastUpdated <= PRODUCER_STATE_TTL_MS) next[id] = state;
+  }
+  record.producers = Object.keys(next).length ? next : void 0;
+}
+function producerMatchesClosedBy(record, producer) {
+  return record.closedBy?.producerId === producer.producerId && record.closedBy.epoch === producer.epoch && record.closedBy.seq === producer.seq;
+}
+function closedStreamProducerAppend(record, producer) {
+  if (producerMatchesClosedBy(record, producer)) {
+    return {
+      record: cloneStreamRecord(record),
+      message: null,
+      streamClosed: true,
+      producerResult: { status: "duplicate", lastSeq: producer.seq }
+    };
+  }
+  return { record: cloneStreamRecord(record), message: null, streamClosed: true, producerResult: { status: "stream_closed" } };
+}
+
+export {
+  isUnsafeNetworkHost,
+  InMemorySessionStore,
+  InMemoryRunStore,
+  InMemoryStreamStore,
+  DurableStreamSubscriptionStoreBase,
+  InMemorySubscriptionStore,
+  inMemoryAdapter,
+  kvAdapter,
+  normalizeStreamContentType,
+  isJsonStreamContentType,
+  streamMessageBytes
+};