@dudousxd/nestjs-durable-core 0.52.0 → 0.53.0

package/dist/index.d.cts

@@ -628,6 +628,16 @@ interface StateStore {
     takeSignalWaiter(token: string): Promise<SignalWaiter | null>;
     /** List waiters whose `token` starts with `prefix` — used to fan out an event to its subscribers. */
     listSignalWaiters(prefix: string): Promise<SignalWaiter[]>;
+    /**
+     * Delete the EXACT waiter row — `token` AND `runId` AND `seq` must all match — no-op if absent.
+     * Unlike {@link takeSignalWaiter}, which deletes ANY row for `token` (fine when the caller just won
+     * the race to consume it), this is for a caller removing its OWN registration after resolving the
+     * wait some other way (a buffered hit, a timeout): blind `takeSignalWaiter(token)` there could steal
+     * a DIFFERENT run's waiter that has since claimed the same token (`token` is the store's primary key,
+     * so a later `putSignalWaiter` for the same token replaces the row). The exact-match variant only
+     * ever removes the row this caller itself put there.
+     */
+    removeSignalWaiter(waiter: SignalWaiter): Promise<void>;
     /**
      * Buffer a signal whose waiter hasn't arrived yet, so the next `waitForSignal(token)` consumes it
      * instead of it being lost (FIFO per token). Makes signals reliable regardless of timing and
@@ -2373,8 +2383,32 @@ declare class WorkflowEngine {
     /**
      * Resume every suspended run whose durable timer is due. Call periodically (a poller) and on
      * boot. A run still not due re-suspends cheaply without running new work.
+     *
+     * Piggy-backs the signal-waiter reconcile safety net (see {@link reconcileSignalWaiter}): a crash
+     * between the waiter/buffer pairing ops on EITHER side (this run's own `putSignalWaiter` →
+     * `takeBufferedSignal`, or a signaler's `takeSignalWaiter` → `bufferSignal` → re-check — see
+     * `signal`'s interleaving proof) can leave both rows stranded with nothing left to pair them: the
+     * waiter's turn already suspended, the signaler that buffered it already returned. Event-wait
+     * suspends already carry a `reconcileMs` fallback `wakeAt` (see {@link reconcileWakeAt}) precisely so
+     * they show up HERE — that's what makes this due-timer pass the natural place for the sweep. One
+     * bulk waiter scan, filtered to just this tick's batch, keeps it cheap regardless of store size.
      */
     resumeDueTimers(nowMs?: number): Promise<RunResult[]>;
+    /**
+     * The reconcile safety net's per-run check (see {@link resumeDueTimers}): if this suspended run has
+     * a registered signal waiter AND its token already has a buffered payload, pair and deliver them
+     * directly instead of falling through to a full replay. Event/child/breakpoint waiter tokens are
+     * never buffered (`publishEvent` doesn't buffer, and a child/breakpoint notifies via `signal` only
+     * once its counterpart is already registered) — so `takeBufferedSignal` on those is a guaranteed
+     * miss, and this is naturally signal-only without needing to classify the token.
+     *
+     * Returns `undefined` (not settled — `resumeLeased` proceeds with its normal `resume`) when there's
+     * no waiter or no buffered hit. Deliberately never returns `null`: a delivered signal always resumes
+     * via {@link deliverSignal}, and even a `NamespaceMismatch` there is reported as a real (non-nullish)
+     * result — returning `null` would read as "not settled" to `resumeLeased`'s `??` fallback and
+     * trigger a second, redundant `resume` call on the same run.
+     */
+    private reconcileSignalWaiter;
     /**
      * Lease and execute one run by id — the worker side of dispatch. Acquires the recovery lease (so
      * exactly one instance runs it), then resumes the body. Returns the result, or null if another
@@ -2447,6 +2481,37 @@ declare class WorkflowEngine {
     publishEvent(name: string, payload: unknown, opts?: {
         id?: string;
     }): Promise<number>;
+    /**
+     * Deliver a signal to an already-known waiter: write its resolving `signal:<token>` checkpoint and
+     * resume the run. Shared by {@link signal}'s direct hit, its post-buffer re-check reclaim, and the
+     * due-timer reconcile sweep ({@link reconcileSignalWaiter}) — all three resolve a waiter the exact
+     * same way.
+     */
+    private deliverSignal;
+    /**
+     * Deliver an external signal to the run waiting on `token`, resume it with `payload`, and return
+     * the run result — or null if no run is (or ends up) waiting for it.
+     *
+     * Race with the waiter side (`waitForSignal`'s check → `putSignalWaiter` → re-check, same shape in
+     * the remote `waitSignal` command): a waiter can register in the sliver between this method's
+     * initial `takeSignalWaiter` miss and its `bufferSignal` write, and the naive old flow (buffer and
+     * return) would then leave BOTH a buffered payload and a registered waiter sitting in the store with
+     * nothing left to pair them — a lost wake, forever suspended.
+     *
+     * The interleaving proof: the waiter side does check → put → re-check, this side does take → buffer
+     * → re-check. Whichever side's SECOND look runs last is guaranteed to observe the other side's
+     * write, because it always follows that write in real time:
+     *  - If the waiter's `put` lands before this method's first `take`, the take just finds it directly
+     *    (the pre-existing, non-racy path).
+     *  - If the waiter's `put` lands after this method's `bufferSignal`, our re-check below either sees
+     *    it (if `put` also lands before the re-check) or the waiter's OWN post-put re-check sees our
+     *    buffer (if `put` lands after our re-check but the waiter hasn't re-checked yet either — its
+     *    re-check strictly follows its own put).
+     *  - If the waiter's `put` lands between this method's `take` and its re-`take`, the re-check below
+     *    catches it.
+     * Either way, the destructive `take*` ops (on the waiter row, on the buffer) arbitrate: whichever
+     * side actually removes the row is the one that delivers, so a signal is never delivered twice.
+     */
     signal(token: string, payload: unknown): Promise<RunResult | null>;
     /**
      * Ensure a run exists for `runId`, then deliver a signal to it — atomically race-free thanks to
@@ -3155,6 +3220,7 @@ declare class CodecStateStore implements StateStore {
     putSignalWaiter(waiter: SignalWaiter): Promise<void>;
     takeSignalWaiter(token: string): Promise<SignalWaiter | null>;
     listSignalWaiters(prefix: string): Promise<SignalWaiter[]>;
+    removeSignalWaiter(waiter: SignalWaiter): Promise<void>;
     bufferSignal(token: string, payload: unknown): Promise<void>;
     takeBufferedSignal(token: string): Promise<{
         payload: unknown;
@@ -3522,6 +3588,7 @@ declare class InMemoryStateStore implements StateStore {
     putSignalWaiter(waiter: SignalWaiter): Promise<void>;
     takeSignalWaiter(token: string): Promise<SignalWaiter | null>;
     listSignalWaiters(prefix: string): Promise<SignalWaiter[]>;
+    removeSignalWaiter(waiter: SignalWaiter): Promise<void>;
     transaction<T>(work: (tx: {
         raw: unknown;
         saveCheckpoint: (cp: StepCheckpoint) => Promise<void>;

package/dist/index.d.ts

@@ -628,6 +628,16 @@ interface StateStore {
     takeSignalWaiter(token: string): Promise<SignalWaiter | null>;
     /** List waiters whose `token` starts with `prefix` — used to fan out an event to its subscribers. */
     listSignalWaiters(prefix: string): Promise<SignalWaiter[]>;
+    /**
+     * Delete the EXACT waiter row — `token` AND `runId` AND `seq` must all match — no-op if absent.
+     * Unlike {@link takeSignalWaiter}, which deletes ANY row for `token` (fine when the caller just won
+     * the race to consume it), this is for a caller removing its OWN registration after resolving the
+     * wait some other way (a buffered hit, a timeout): blind `takeSignalWaiter(token)` there could steal
+     * a DIFFERENT run's waiter that has since claimed the same token (`token` is the store's primary key,
+     * so a later `putSignalWaiter` for the same token replaces the row). The exact-match variant only
+     * ever removes the row this caller itself put there.
+     */
+    removeSignalWaiter(waiter: SignalWaiter): Promise<void>;
     /**
      * Buffer a signal whose waiter hasn't arrived yet, so the next `waitForSignal(token)` consumes it
      * instead of it being lost (FIFO per token). Makes signals reliable regardless of timing and
@@ -2373,8 +2383,32 @@ declare class WorkflowEngine {
     /**
      * Resume every suspended run whose durable timer is due. Call periodically (a poller) and on
      * boot. A run still not due re-suspends cheaply without running new work.
+     *
+     * Piggy-backs the signal-waiter reconcile safety net (see {@link reconcileSignalWaiter}): a crash
+     * between the waiter/buffer pairing ops on EITHER side (this run's own `putSignalWaiter` →
+     * `takeBufferedSignal`, or a signaler's `takeSignalWaiter` → `bufferSignal` → re-check — see
+     * `signal`'s interleaving proof) can leave both rows stranded with nothing left to pair them: the
+     * waiter's turn already suspended, the signaler that buffered it already returned. Event-wait
+     * suspends already carry a `reconcileMs` fallback `wakeAt` (see {@link reconcileWakeAt}) precisely so
+     * they show up HERE — that's what makes this due-timer pass the natural place for the sweep. One
+     * bulk waiter scan, filtered to just this tick's batch, keeps it cheap regardless of store size.
      */
     resumeDueTimers(nowMs?: number): Promise<RunResult[]>;
+    /**
+     * The reconcile safety net's per-run check (see {@link resumeDueTimers}): if this suspended run has
+     * a registered signal waiter AND its token already has a buffered payload, pair and deliver them
+     * directly instead of falling through to a full replay. Event/child/breakpoint waiter tokens are
+     * never buffered (`publishEvent` doesn't buffer, and a child/breakpoint notifies via `signal` only
+     * once its counterpart is already registered) — so `takeBufferedSignal` on those is a guaranteed
+     * miss, and this is naturally signal-only without needing to classify the token.
+     *
+     * Returns `undefined` (not settled — `resumeLeased` proceeds with its normal `resume`) when there's
+     * no waiter or no buffered hit. Deliberately never returns `null`: a delivered signal always resumes
+     * via {@link deliverSignal}, and even a `NamespaceMismatch` there is reported as a real (non-nullish)
+     * result — returning `null` would read as "not settled" to `resumeLeased`'s `??` fallback and
+     * trigger a second, redundant `resume` call on the same run.
+     */
+    private reconcileSignalWaiter;
     /**
      * Lease and execute one run by id — the worker side of dispatch. Acquires the recovery lease (so
      * exactly one instance runs it), then resumes the body. Returns the result, or null if another
@@ -2447,6 +2481,37 @@ declare class WorkflowEngine {
     publishEvent(name: string, payload: unknown, opts?: {
         id?: string;
     }): Promise<number>;
+    /**
+     * Deliver a signal to an already-known waiter: write its resolving `signal:<token>` checkpoint and
+     * resume the run. Shared by {@link signal}'s direct hit, its post-buffer re-check reclaim, and the
+     * due-timer reconcile sweep ({@link reconcileSignalWaiter}) — all three resolve a waiter the exact
+     * same way.
+     */
+    private deliverSignal;
+    /**
+     * Deliver an external signal to the run waiting on `token`, resume it with `payload`, and return
+     * the run result — or null if no run is (or ends up) waiting for it.
+     *
+     * Race with the waiter side (`waitForSignal`'s check → `putSignalWaiter` → re-check, same shape in
+     * the remote `waitSignal` command): a waiter can register in the sliver between this method's
+     * initial `takeSignalWaiter` miss and its `bufferSignal` write, and the naive old flow (buffer and
+     * return) would then leave BOTH a buffered payload and a registered waiter sitting in the store with
+     * nothing left to pair them — a lost wake, forever suspended.
+     *
+     * The interleaving proof: the waiter side does check → put → re-check, this side does take → buffer
+     * → re-check. Whichever side's SECOND look runs last is guaranteed to observe the other side's
+     * write, because it always follows that write in real time:
+     *  - If the waiter's `put` lands before this method's first `take`, the take just finds it directly
+     *    (the pre-existing, non-racy path).
+     *  - If the waiter's `put` lands after this method's `bufferSignal`, our re-check below either sees
+     *    it (if `put` also lands before the re-check) or the waiter's OWN post-put re-check sees our
+     *    buffer (if `put` lands after our re-check but the waiter hasn't re-checked yet either — its
+     *    re-check strictly follows its own put).
+     *  - If the waiter's `put` lands between this method's `take` and its re-`take`, the re-check below
+     *    catches it.
+     * Either way, the destructive `take*` ops (on the waiter row, on the buffer) arbitrate: whichever
+     * side actually removes the row is the one that delivers, so a signal is never delivered twice.
+     */
     signal(token: string, payload: unknown): Promise<RunResult | null>;
     /**
      * Ensure a run exists for `runId`, then deliver a signal to it — atomically race-free thanks to
@@ -3155,6 +3220,7 @@ declare class CodecStateStore implements StateStore {
     putSignalWaiter(waiter: SignalWaiter): Promise<void>;
     takeSignalWaiter(token: string): Promise<SignalWaiter | null>;
     listSignalWaiters(prefix: string): Promise<SignalWaiter[]>;
+    removeSignalWaiter(waiter: SignalWaiter): Promise<void>;
     bufferSignal(token: string, payload: unknown): Promise<void>;
     takeBufferedSignal(token: string): Promise<{
         payload: unknown;
@@ -3522,6 +3588,7 @@ declare class InMemoryStateStore implements StateStore {
     putSignalWaiter(waiter: SignalWaiter): Promise<void>;
     takeSignalWaiter(token: string): Promise<SignalWaiter | null>;
     listSignalWaiters(prefix: string): Promise<SignalWaiter[]>;
+    removeSignalWaiter(waiter: SignalWaiter): Promise<void>;
     transaction<T>(work: (tx: {
         raw: unknown;
         saveCheckpoint: (cp: StepCheckpoint) => Promise<void>;

package/dist/index.js

@@ -865,6 +865,47 @@ var RemoteWorkflowExecutor = class {
   }
 };
 
+// src/run-waiting.ts
+var WEBHOOK_PREFIX = "wh:";
+var CHILD_PREFIX = "child:";
+var BREAKPOINT_PREFIX = "bp:";
+var EVENT_PREFIX = "event:";
+function classifyWaiterToken(token) {
+  if (token.startsWith(WEBHOOK_PREFIX)) return {
+    on: "webhook",
+    name: token
+  };
+  if (token.startsWith(BREAKPOINT_PREFIX)) return {
+    on: "breakpoint",
+    name: "breakpoint"
+  };
+  if (token.startsWith(CHILD_PREFIX)) return {
+    on: "child",
+    name: token.slice(CHILD_PREFIX.length)
+  };
+  if (token.startsWith(EVENT_PREFIX)) return {
+    on: "signal",
+    name: eventNameOf(token)
+  };
+  return {
+    on: "signal",
+    name: token
+  };
+}
+__name(classifyWaiterToken, "classifyWaiterToken");
+function resolveRunWaiting(run, waiterByRun) {
+  if (run.status !== "suspended") return void 0;
+  const waiter = waiterByRun.get(run.id);
+  return waiter ? classifyWaiterToken(waiter.token) : void 0;
+}
+__name(resolveRunWaiting, "resolveRunWaiting");
+function indexWaitersByRun(waiters) {
+  const byRun = /* @__PURE__ */ new Map();
+  for (const w of waiters) if (!byRun.has(w.runId)) byRun.set(w.runId, w);
+  return byRun;
+}
+__name(indexWaitersByRun, "indexWaitersByRun");
+
 // src/singleton-gate.ts
 var SINGLETON_RETRY_MS = 1e3;
 var SINGLETON_RETRY_JITTER_MS = 250;
@@ -1320,6 +1361,15 @@ function createWorkflowCtx(host, runId, compensations, workflow = "", searchAttr
         runId,
         seq: current
       });
+      const lateBuffered2 = await consumeBuffered(token, current);
+      if (lateBuffered2) {
+        await store.removeSignalWaiter({
+          token,
+          runId,
+          seq: current
+        });
+        return lateBuffered2.value;
+      }
       throw new WorkflowSuspended();
     }
     const timeoutMs = opts.timeoutMs;
@@ -1331,7 +1381,11 @@ function createWorkflowCtx(host, runId, compensations, workflow = "", searchAttr
     const buffered = await consumeBuffered(token, waitSeq);
     if (buffered) return buffered.value;
     if (host.clock() >= deadline) {
-      await store.takeSignalWaiter(token).catch(() => void 0);
+      await store.removeSignalWaiter({
+        token,
+        runId,
+        seq: waitSeq
+      }).catch(() => void 0);
       throw new SignalTimeoutError(token, timeoutMs);
     }
     await store.putSignalWaiter({
@@ -1339,6 +1393,15 @@ function createWorkflowCtx(host, runId, compensations, workflow = "", searchAttr
       runId,
       seq: waitSeq
     });
+    const lateBuffered = await consumeBuffered(token, waitSeq);
+    if (lateBuffered) {
+      await store.removeSignalWaiter({
+        token,
+        runId,
+        seq: waitSeq
+      });
+      return lateBuffered.value;
+    }
     throw new WorkflowSuspended(deadline);
   }, "waitForSignal");
   const waitForEvent = /* @__PURE__ */ __name(async (name, opts) => {
@@ -1362,7 +1425,11 @@ function createWorkflowCtx(host, runId, compensations, workflow = "", searchAttr
     const waited = await readCheckpoint(waitSeq);
     if (waited && waited.status === "completed") return waited.output;
     if (host.clock() >= deadline) {
-      await store.takeSignalWaiter(token).catch(() => void 0);
+      await store.removeSignalWaiter({
+        token,
+        runId,
+        seq: waitSeq
+      }).catch(() => void 0);
       throw new SignalTimeoutError(`event:${name}`, timeoutMs);
     }
     await store.putSignalWaiter({
@@ -2508,9 +2575,46 @@ var WorkflowEngine = class {
   /**
   * Resume every suspended run whose durable timer is due. Call periodically (a poller) and on
   * boot. A run still not due re-suspends cheaply without running new work.
+  *
+  * Piggy-backs the signal-waiter reconcile safety net (see {@link reconcileSignalWaiter}): a crash
+  * between the waiter/buffer pairing ops on EITHER side (this run's own `putSignalWaiter` →
+  * `takeBufferedSignal`, or a signaler's `takeSignalWaiter` → `bufferSignal` → re-check — see
+  * `signal`'s interleaving proof) can leave both rows stranded with nothing left to pair them: the
+  * waiter's turn already suspended, the signaler that buffered it already returned. Event-wait
+  * suspends already carry a `reconcileMs` fallback `wakeAt` (see {@link reconcileWakeAt}) precisely so
+  * they show up HERE — that's what makes this due-timer pass the natural place for the sweep. One
+  * bulk waiter scan, filtered to just this tick's batch, keeps it cheap regardless of store size.
   */
   async resumeDueTimers(nowMs = this.clock()) {
-    return this.resumeLeased(await this.store.listDueTimers(nowMs, this.namespace), nowMs);
+    const due = await this.store.listDueTimers(nowMs, this.namespace);
+    if (due.length === 0) return [];
+    const waiterByRun = indexWaitersByRun(await this.store.listSignalWaiters(""));
+    return this.resumeLeased(due, nowMs, (run) => this.reconcileSignalWaiter(run, waiterByRun.get(run.id)));
+  }
+  /**
+  * The reconcile safety net's per-run check (see {@link resumeDueTimers}): if this suspended run has
+  * a registered signal waiter AND its token already has a buffered payload, pair and deliver them
+  * directly instead of falling through to a full replay. Event/child/breakpoint waiter tokens are
+  * never buffered (`publishEvent` doesn't buffer, and a child/breakpoint notifies via `signal` only
+  * once its counterpart is already registered) — so `takeBufferedSignal` on those is a guaranteed
+  * miss, and this is naturally signal-only without needing to classify the token.
+  *
+  * Returns `undefined` (not settled — `resumeLeased` proceeds with its normal `resume`) when there's
+  * no waiter or no buffered hit. Deliberately never returns `null`: a delivered signal always resumes
+  * via {@link deliverSignal}, and even a `NamespaceMismatch` there is reported as a real (non-nullish)
+  * result — returning `null` would read as "not settled" to `resumeLeased`'s `??` fallback and
+  * trigger a second, redundant `resume` call on the same run.
+  */
+  async reconcileSignalWaiter(run, waiter) {
+    if (!waiter) return void 0;
+    const buffered = await this.store.takeBufferedSignal(waiter.token);
+    if (!buffered) return void 0;
+    await this.store.removeSignalWaiter(waiter);
+    const settled = await this.deliverSignal(waiter, buffered.payload);
+    return settled ?? {
+      runId: run.id,
+      status: run.status
+    };
   }
   /**
   * Lease and execute one run by id — the worker side of dispatch. Acquires the recovery lease (so
@@ -2728,16 +2832,17 @@ var WorkflowEngine = class {
     }
     return touched;
   }
-  async signal(token, payload) {
-    const waiter = await this.store.takeSignalWaiter(token);
-    if (!waiter) {
-      await this.store.bufferSignal(token, payload);
-      return null;
-    }
+  /**
+  * Deliver a signal to an already-known waiter: write its resolving `signal:<token>` checkpoint and
+  * resume the run. Shared by {@link signal}'s direct hit, its post-buffer re-check reclaim, and the
+  * due-timer reconcile sweep ({@link reconcileSignalWaiter}) — all three resolve a waiter the exact
+  * same way.
+  */
+  async deliverSignal(waiter, payload) {
     await this.store.saveCheckpoint(instantCheckpoint({
       runId: waiter.runId,
       seq: waiter.seq,
-      name: `signal:${token}`,
+      name: `signal:${waiter.token}`,
       kind: "signal",
       output: payload,
       // Carry the awaiting command's fan group (set when a `ctx.gather_children`/`ctx.all` fan-out
@@ -2752,6 +2857,42 @@ var WorkflowEngine = class {
     });
   }
   /**
+  * Deliver an external signal to the run waiting on `token`, resume it with `payload`, and return
+  * the run result — or null if no run is (or ends up) waiting for it.
+  *
+  * Race with the waiter side (`waitForSignal`'s check → `putSignalWaiter` → re-check, same shape in
+  * the remote `waitSignal` command): a waiter can register in the sliver between this method's
+  * initial `takeSignalWaiter` miss and its `bufferSignal` write, and the naive old flow (buffer and
+  * return) would then leave BOTH a buffered payload and a registered waiter sitting in the store with
+  * nothing left to pair them — a lost wake, forever suspended.
+  *
+  * The interleaving proof: the waiter side does check → put → re-check, this side does take → buffer
+  * → re-check. Whichever side's SECOND look runs last is guaranteed to observe the other side's
+  * write, because it always follows that write in real time:
+  *  - If the waiter's `put` lands before this method's first `take`, the take just finds it directly
+  *    (the pre-existing, non-racy path).
+  *  - If the waiter's `put` lands after this method's `bufferSignal`, our re-check below either sees
+  *    it (if `put` also lands before the re-check) or the waiter's OWN post-put re-check sees our
+  *    buffer (if `put` lands after our re-check but the waiter hasn't re-checked yet either — its
+  *    re-check strictly follows its own put).
+  *  - If the waiter's `put` lands between this method's `take` and its re-`take`, the re-check below
+  *    catches it.
+  * Either way, the destructive `take*` ops (on the waiter row, on the buffer) arbitrate: whichever
+  * side actually removes the row is the one that delivers, so a signal is never delivered twice.
+  */
+  async signal(token, payload) {
+    const waiter = await this.store.takeSignalWaiter(token);
+    if (waiter) return this.deliverSignal(waiter, payload);
+    await this.store.bufferSignal(token, payload);
+    const lateWaiter = await this.store.takeSignalWaiter(token);
+    if (!lateWaiter) return null;
+    const reclaimed = await this.store.takeBufferedSignal(token);
+    if (!reclaimed) {
+      return null;
+    }
+    return this.deliverSignal(lateWaiter, reclaimed.payload);
+  }
+  /**
   * Ensure a run exists for `runId`, then deliver a signal to it — atomically race-free thanks to
   * signal buffering: if the run is new (or busy / not yet waiting), the signal is buffered and
   * consumed when it reaches `waitForSignal(token)`. The canonical **durable-entity / accumulator**
@@ -3224,6 +3365,14 @@ var WorkflowEngine = class {
         error: outcome.error
       };
     }
+    const latest = await this.store.getRun(run.id);
+    if (latest?.status === "cancelled") {
+      return {
+        runId: run.id,
+        status: "cancelled",
+        error: latest.error
+      };
+    }
     await this.store.updateRun(run.id, {
       status: "suspended",
       wakeAt: this.reconcileWakeAt(outcome.wakeAt),
@@ -3566,22 +3715,34 @@ var WorkflowEngine = class {
         }));
         wakeAt = wakeAt == null ? deadline : Math.min(wakeAt, deadline);
       } else if (cmd.kind === "waitSignal") {
-        const buffered = await this.store.takeBufferedSignal(cmd.signal);
-        if (buffered) {
+        const deliverBuffered = /* @__PURE__ */ __name(async (payload) => {
           await this.store.saveCheckpoint(instantCheckpoint({
             runId: run.id,
             seq: cmd.seq,
             name: `signal:${cmd.signal}`,
             kind: "signal",
-            output: buffered.payload
+            output: payload
           }));
           setTimeout(() => void this.resume(run.id).catch(() => void 0), 0);
+        }, "deliverBuffered");
+        const buffered = await this.store.takeBufferedSignal(cmd.signal);
+        if (buffered) {
+          await deliverBuffered(buffered.payload);
         } else {
           await this.store.putSignalWaiter({
             token: cmd.signal,
             runId: run.id,
             seq: cmd.seq
           });
+          const lateBuffered = await this.store.takeBufferedSignal(cmd.signal);
+          if (lateBuffered) {
+            await this.store.removeSignalWaiter({
+              token: cmd.signal,
+              runId: run.id,
+              seq: cmd.seq
+            });
+            await deliverBuffered(lateBuffered.payload);
+          }
         }
       } else if (cmd.kind === "startChild") {
         const childId = `${run.id}.child.${cmd.seq}`;
@@ -4441,47 +4602,6 @@ var TERMINAL_RUN_STATUSES = [
   "dead"
 ];
 
-// src/run-waiting.ts
-var WEBHOOK_PREFIX = "wh:";
-var CHILD_PREFIX = "child:";
-var BREAKPOINT_PREFIX = "bp:";
-var EVENT_PREFIX = "event:";
-function classifyWaiterToken(token) {
-  if (token.startsWith(WEBHOOK_PREFIX)) return {
-    on: "webhook",
-    name: token
-  };
-  if (token.startsWith(BREAKPOINT_PREFIX)) return {
-    on: "breakpoint",
-    name: "breakpoint"
-  };
-  if (token.startsWith(CHILD_PREFIX)) return {
-    on: "child",
-    name: token.slice(CHILD_PREFIX.length)
-  };
-  if (token.startsWith(EVENT_PREFIX)) return {
-    on: "signal",
-    name: eventNameOf(token)
-  };
-  return {
-    on: "signal",
-    name: token
-  };
-}
-__name(classifyWaiterToken, "classifyWaiterToken");
-function resolveRunWaiting(run, waiterByRun) {
-  if (run.status !== "suspended") return void 0;
-  const waiter = waiterByRun.get(run.id);
-  return waiter ? classifyWaiterToken(waiter.token) : void 0;
-}
-__name(resolveRunWaiting, "resolveRunWaiting");
-function indexWaitersByRun(waiters) {
-  const byRun = /* @__PURE__ */ new Map();
-  for (const w of waiters) if (!byRun.has(w.runId)) byRun.set(w.runId, w);
-  return byRun;
-}
-__name(indexWaitersByRun, "indexWaitersByRun");
-
 // src/codec-state-store.ts
 var CodecStateStore = class {
   static {
@@ -4589,6 +4709,9 @@ var CodecStateStore = class {
   listSignalWaiters(prefix) {
     return this.inner.listSignalWaiters(prefix);
   }
+  removeSignalWaiter(waiter) {
+    return this.inner.removeSignalWaiter(waiter);
+  }
   bufferSignal(token, payload) {
     return this.inner.bufferSignal(token, this.enc(payload));
   }
@@ -5041,6 +5164,12 @@ var InMemoryStateStore = class {
       ...w
     }));
   }
+  async removeSignalWaiter(waiter) {
+    const current = this.signalWaiters.get(waiter.token);
+    if (current && current.runId === waiter.runId && current.seq === waiter.seq) {
+      this.signalWaiters.delete(waiter.token);
+    }
+  }
   // No real DB transaction (there's no DB) — run the work and save the checkpoint. Exactly-once
   // across a crash needs a SQL store; this keeps `ctx.transaction` usable in tests / local dev.
   async transaction(work) {