@durable-streams/server 0.3.1 → 0.3.3

package/dist/index.js

@@ -1,13 +1,12 @@
 import { createServer } from "node:http";
 import { deflateSync, gzipSync } from "node:zlib";
+import { CURSOR_QUERY_PARAM, DurableStream, LIVE_QUERY_PARAM, OFFSET_QUERY_PARAM, PRODUCER_EPOCH_HEADER, PRODUCER_EXPECTED_SEQ_HEADER, PRODUCER_ID_HEADER, PRODUCER_RECEIVED_SEQ_HEADER, PRODUCER_SEQ_HEADER, SSE_CLOSED_FIELD, SSE_CURSOR_FIELD, SSE_OFFSET_FIELD, STREAM_CLOSED_HEADER, STREAM_CURSOR_HEADER, STREAM_EXPIRES_AT_HEADER, STREAM_OFFSET_HEADER, STREAM_SEQ_HEADER, STREAM_TTL_HEADER, STREAM_UP_TO_DATE_HEADER } from "@durable-streams/client";
 import * as fs from "node:fs";
-import * as path$1 from "node:path";
 import * as path from "node:path";
-import { createHash, randomBytes } from "node:crypto";
+import { createHash, createHmac, generateKeyPairSync, randomBytes, sign, timingSafeEqual } from "node:crypto";
 import { open } from "lmdb";
 import { SieveCache } from "@neophi/sieve-cache";
-import * as fs$1 from "node:fs/promises";
-import { DurableStream } from "@durable-streams/client";
+import { isIP } from "node:net";
 import { createStateSchema } from "@durable-streams/state";
 
 //#region src/store.ts
@@ -50,17 +49,35 @@ function processJsonAppend(data, isInitialCreate = false) {
 	} else result = JSON.stringify(parsed) + `,`;
 	return new TextEncoder().encode(result);
 }
-/**
-* Format JSON mode response by wrapping in array brackets.
-* Strips trailing comma before wrapping.
-*/
-function formatJsonResponse(data) {
-	if (data.length === 0) return new TextEncoder().encode(`[]`);
-	let text = new TextDecoder().decode(data);
-	text = text.trimEnd();
+function decodeStoredJsonMessage(data) {
+	let text = new TextDecoder().decode(data).trimEnd();
 	if (text.endsWith(`,`)) text = text.slice(0, -1);
-	const wrapped = `[${text}]`;
-	return new TextEncoder().encode(wrapped);
+	return text;
+}
+function enrichJsonValueWithOffset(parsed, offset) {
+	if (!parsed || typeof parsed !== `object` || Array.isArray(parsed)) return JSON.stringify(parsed);
+	const candidate = parsed;
+	const headers = candidate.headers;
+	if (!headers || typeof headers !== `object`) return JSON.stringify(parsed);
+	const isStateChange = typeof headers.operation === `string`;
+	const isStateControl = typeof headers.control === `string`;
+	if (!isStateChange && !isStateControl) return JSON.stringify(parsed);
+	return JSON.stringify({
+		...candidate,
+		headers: {
+			...headers,
+			offset
+		}
+	});
+}
+function formatJsonMessages(messages) {
+	if (messages.length === 0) return new TextEncoder().encode(`[]`);
+	const items = messages.flatMap((message) => {
+		const rawFragment = decodeStoredJsonMessage(message.data);
+		const parsed = JSON.parse(`[${rawFragment}]`);
+		return parsed.map((value) => enrichJsonValueWithOffset(value, message.offset));
+	});
+	return new TextEncoder().encode(`[${items.join(`,`)}]`);
 }
 var StreamStore = class {
 	streams = new Map();
@@ -90,15 +107,15 @@ var StreamStore = class {
 	* Returns undefined if stream doesn't exist or is expired (and has no refs).
 	* Expired streams with refCount > 0 are soft-deleted instead of fully deleted.
 	*/
-	getIfNotExpired(path$2) {
-		const stream = this.streams.get(path$2);
+	getIfNotExpired(path$1) {
+		const stream = this.streams.get(path$1);
 		if (!stream) return void 0;
 		if (this.isExpired(stream)) {
 			if (stream.refCount > 0) {
 				stream.softDeleted = true;
 				return stream;
 			}
-			this.delete(path$2);
+			this.delete(path$1);
 			return void 0;
 		}
 		return stream;
@@ -106,8 +123,8 @@ var StreamStore = class {
 	/**
 	* Update lastAccessedAt to now. Called on reads and appends (not HEAD).
 	*/
-	touchAccess(path$2) {
-		const stream = this.streams.get(path$2);
+	touchAccess(path$1) {
+		const stream = this.streams.get(path$1);
 		if (stream) stream.lastAccessedAt = Date.now();
 	}
 	/**
@@ -116,12 +133,12 @@ var StreamStore = class {
 	* @throws Error if fork source not found, soft-deleted, or offset invalid
 	* @returns existing stream if config matches (idempotent)
 	*/
-	create(path$2, options = {}) {
-		const existingRaw = this.streams.get(path$2);
+	create(path$1, options = {}) {
+		const existingRaw = this.streams.get(path$1);
 		if (existingRaw) if (this.isExpired(existingRaw)) {
-			this.streams.delete(path$2);
-			this.cancelLongPollsForStream(path$2);
-		} else if (existingRaw.softDeleted) throw new Error(`Stream has active forks — path cannot be reused until all forks are removed: ${path$2}`);
+			this.streams.delete(path$1);
+			this.cancelLongPollsForStream(path$1);
+		} else if (existingRaw.softDeleted) throw new Error(`Stream has active forks — path cannot be reused until all forks are removed: ${path$1}`);
 		else {
 			const contentTypeMatches = (normalizeContentType(options.contentType) || `application/octet-stream`) === (normalizeContentType(existingRaw.contentType) || `application/octet-stream`);
 			const ttlMatches = options.ttlSeconds === existingRaw.ttlSeconds;
@@ -130,7 +147,7 @@ var StreamStore = class {
 			const forkedFromMatches = (options.forkedFrom ?? void 0) === existingRaw.forkedFrom;
 			const forkOffsetMatches = options.forkOffset === void 0 || options.forkOffset === existingRaw.forkOffset;
 			if (contentTypeMatches && ttlMatches && expiresMatches && closedMatches && forkedFromMatches && forkOffsetMatches) return existingRaw;
-			else throw new Error(`Stream already exists with different configuration: ${path$2}`);
+			else throw new Error(`Stream already exists with different configuration: ${path$1}`);
 		}
 		const isFork = !!options.forkedFrom;
 		let forkOffset = `0000000000000000_0000000000000000`;
@@ -160,7 +177,7 @@ var StreamStore = class {
 			effectiveTtlSeconds = resolved.ttlSeconds;
 		}
 		const stream = {
-			path: path$2,
+			path: path$1,
 			contentType,
 			messages: [],
 			currentOffset: isFork ? forkOffset : `0000000000000000_0000000000000000`,
@@ -179,7 +196,7 @@ var StreamStore = class {
 			if (isFork && sourceStream) sourceStream.refCount--;
 			throw err;
 		}
-		this.streams.set(path$2, stream);
+		this.streams.set(path$1, stream);
 		return stream;
 	}
 	/**
@@ -198,15 +215,15 @@ var StreamStore = class {
 	* Returns undefined if stream doesn't exist or is expired.
 	* Returns soft-deleted streams (caller should check stream.softDeleted).
 	*/
-	get(path$2) {
-		const stream = this.streams.get(path$2);
+	get(path$1) {
+		const stream = this.streams.get(path$1);
 		if (!stream) return void 0;
 		if (this.isExpired(stream)) {
 			if (stream.refCount > 0) {
 				stream.softDeleted = true;
 				return stream;
 			}
-			this.delete(path$2);
+			this.delete(path$1);
 			return void 0;
 		}
 		return stream;
@@ -214,8 +231,8 @@ var StreamStore = class {
 	/**
 	* Check if a stream exists, is not expired, and is not soft-deleted.
 	*/
-	has(path$2) {
-		const stream = this.get(path$2);
+	has(path$1) {
+		const stream = this.get(path$1);
 		if (!stream) return false;
 		if (stream.softDeleted) return false;
 		return true;
@@ -225,27 +242,27 @@ var StreamStore = class {
 	* If the stream has forks (refCount > 0), it is soft-deleted instead of fully removed.
 	* Returns true if the stream was found and deleted (or soft-deleted).
 	*/
-	delete(path$2) {
-		const stream = this.streams.get(path$2);
+	delete(path$1) {
+		const stream = this.streams.get(path$1);
 		if (!stream) return false;
 		if (stream.softDeleted) return true;
 		if (stream.refCount > 0) {
 			stream.softDeleted = true;
 			return true;
 		}
-		this.deleteWithCascade(path$2);
+		this.deleteWithCascade(path$1);
 		return true;
 	}
 	/**
 	* Fully delete a stream and cascade to soft-deleted parents
 	* whose refcount drops to zero.
 	*/
-	deleteWithCascade(path$2) {
-		const stream = this.streams.get(path$2);
+	deleteWithCascade(path$1) {
+		const stream = this.streams.get(path$1);
 		if (!stream) return;
 		const forkedFrom = stream.forkedFrom;
-		this.streams.delete(path$2);
-		this.cancelLongPollsForStream(path$2);
+		this.streams.delete(path$1);
+		this.cancelLongPollsForStream(path$1);
 		if (forkedFrom) {
 			const parent = this.streams.get(forkedFrom);
 			if (parent) {
@@ -344,8 +361,8 @@ var StreamStore = class {
 	* Acquire a lock for serialized producer operations.
 	* Returns a release function.
 	*/
-	async acquireProducerLock(path$2, producerId) {
-		const lockKey = `${path$2}:${producerId}`;
+	async acquireProducerLock(path$1, producerId) {
+		const lockKey = `${path$1}:${producerId}`;
 		while (this.producerLocks.has(lockKey)) await this.producerLocks.get(lockKey);
 		let releaseLock;
 		const lockPromise = new Promise((resolve) => {
@@ -363,10 +380,10 @@ var StreamStore = class {
 	* @throws Error if seq is lower than lastSeq
 	* @throws Error if JSON mode and array is empty
 	*/
-	append(path$2, data, options = {}) {
-		const stream = this.getIfNotExpired(path$2);
-		if (!stream) throw new Error(`Stream not found: ${path$2}`);
-		if (stream.softDeleted) throw new Error(`Stream is soft-deleted: ${path$2}`);
+	append(path$1, data, options = {}) {
+		const stream = this.getIfNotExpired(path$1);
+		if (!stream) throw new Error(`Stream not found: ${path$1}`);
+		if (stream.softDeleted) throw new Error(`Stream is soft-deleted: ${path$1}`);
 		if (stream.closed) {
 			if (options.producerId && stream.closedBy && stream.closedBy.producerId === options.producerId && stream.closedBy.epoch === options.producerEpoch && stream.closedBy.seq === options.producerSeq) return {
 				message: null,
@@ -407,9 +424,9 @@ var StreamStore = class {
 				epoch: options.producerEpoch,
 				seq: options.producerSeq
 			};
-			this.notifyLongPollsClosed(path$2);
 		}
-		this.notifyLongPolls(path$2);
+		this.notifyLongPolls(path$1);
+		if (options.close) this.notifyLongPollsClosed(path$1);
 		if (producerResult || options.close) return {
 			message,
 			producerResult,
@@ -421,15 +438,15 @@ var StreamStore = class {
 	* Append with producer serialization for concurrent request handling.
 	* This ensures that validation+append is atomic per producer.
 	*/
-	async appendWithProducer(path$2, data, options) {
+	async appendWithProducer(path$1, data, options) {
 		if (!options.producerId) {
-			const result = this.append(path$2, data, options);
+			const result = this.append(path$1, data, options);
 			if (`message` in result) return result;
 			return { message: result };
 		}
-		const releaseLock = await this.acquireProducerLock(path$2, options.producerId);
+		const releaseLock = await this.acquireProducerLock(path$1, options.producerId);
 		try {
-			const result = this.append(path$2, data, options);
+			const result = this.append(path$1, data, options);
 			if (`message` in result) return result;
 			return { message: result };
 		} finally {
@@ -440,13 +457,13 @@ var StreamStore = class {
 	* Close a stream without appending data.
 	* @returns The final offset, or null if stream doesn't exist
 	*/
-	closeStream(path$2) {
-		const stream = this.getIfNotExpired(path$2);
+	closeStream(path$1) {
+		const stream = this.getIfNotExpired(path$1);
 		if (!stream) return null;
-		if (stream.softDeleted) throw new Error(`Stream is soft-deleted: ${path$2}`);
+		if (stream.softDeleted) throw new Error(`Stream is soft-deleted: ${path$1}`);
 		const alreadyClosed = stream.closed ?? false;
 		stream.closed = true;
-		this.notifyLongPollsClosed(path$2);
+		this.notifyLongPollsClosed(path$1);
 		return {
 			finalOffset: stream.currentOffset,
 			alreadyClosed
@@ -457,10 +474,10 @@ var StreamStore = class {
 	* Participates in producer sequencing for deduplication.
 	* @returns The final offset and producer result, or null if stream doesn't exist
 	*/
-	async closeStreamWithProducer(path$2, options) {
-		const releaseLock = await this.acquireProducerLock(path$2, options.producerId);
+	async closeStreamWithProducer(path$1, options) {
+		const releaseLock = await this.acquireProducerLock(path$1, options.producerId);
 		try {
-			const stream = this.getIfNotExpired(path$2);
+			const stream = this.getIfNotExpired(path$1);
 			if (!stream) return null;
 			if (stream.closed) {
 				if (stream.closedBy && stream.closedBy.producerId === options.producerId && stream.closedBy.epoch === options.producerEpoch && stream.closedBy.seq === options.producerSeq) return {
@@ -490,7 +507,7 @@ var StreamStore = class {
 				epoch: options.producerEpoch,
 				seq: options.producerSeq
 			};
-			this.notifyLongPollsClosed(path$2);
+			this.notifyLongPollsClosed(path$1);
 			return {
 				finalOffset: stream.currentOffset,
 				alreadyClosed: false,
@@ -504,8 +521,8 @@ var StreamStore = class {
 	* Get the current epoch for a producer on a stream.
 	* Returns undefined if the producer doesn't exist or stream not found.
 	*/
-	getProducerEpoch(path$2, producerId) {
-		const stream = this.getIfNotExpired(path$2);
+	getProducerEpoch(path$1, producerId) {
+		const stream = this.getIfNotExpired(path$1);
 		if (!stream?.producers) return void 0;
 		return stream.producers.get(producerId)?.epoch;
 	}
@@ -514,9 +531,9 @@ var StreamStore = class {
 	* For forked streams, stitches messages from the source chain and the fork's own messages.
 	* @throws Error if stream doesn't exist or is expired
 	*/
-	read(path$2, offset) {
-		const stream = this.getIfNotExpired(path$2);
-		if (!stream) throw new Error(`Stream not found: ${path$2}`);
+	read(path$1, offset) {
+		const stream = this.getIfNotExpired(path$1);
+		if (!stream) throw new Error(`Stream not found: ${path$1}`);
 		if (!offset || offset === `-1`) {
 			if (stream.forkedFrom) {
 				const inherited = this.readForkedMessages(stream.forkedFrom, void 0, stream.forkOffset);
@@ -595,9 +612,10 @@ var StreamStore = class {
 	* For JSON mode, wraps concatenated data in array brackets.
 	* @throws Error if stream doesn't exist or is expired
 	*/
-	formatResponse(path$2, messages) {
-		const stream = this.getIfNotExpired(path$2);
-		if (!stream) throw new Error(`Stream not found: ${path$2}`);
+	formatResponse(path$1, messages) {
+		const stream = this.getIfNotExpired(path$1);
+		if (!stream) throw new Error(`Stream not found: ${path$1}`);
+		if (normalizeContentType(stream.contentType) === `application/json`) return formatJsonMessages(messages);
 		const totalSize = messages.reduce((sum, m) => sum + m.data.length, 0);
 		const concatenated = new Uint8Array(totalSize);
 		let offset = 0;
@@ -605,24 +623,23 @@ var StreamStore = class {
 			concatenated.set(msg.data, offset);
 			offset += msg.data.length;
 		}
-		if (normalizeContentType(stream.contentType) === `application/json`) return formatJsonResponse(concatenated);
 		return concatenated;
 	}
 	/**
 	* Wait for new messages (long-poll).
 	* @throws Error if stream doesn't exist or is expired
 	*/
-	async waitForMessages(path$2, offset, timeoutMs) {
-		const stream = this.getIfNotExpired(path$2);
-		if (!stream) throw new Error(`Stream not found: ${path$2}`);
+	async waitForMessages(path$1, offset, timeoutMs) {
+		const stream = this.getIfNotExpired(path$1);
+		if (!stream) throw new Error(`Stream not found: ${path$1}`);
 		if (stream.forkedFrom && offset < stream.forkOffset) {
-			const { messages: messages$1 } = this.read(path$2, offset);
+			const { messages: messages$1 } = this.read(path$1, offset);
 			return {
 				messages: messages$1,
 				timedOut: false
 			};
 		}
-		const { messages } = this.read(path$2, offset);
+		const { messages } = this.read(path$1, offset);
 		if (messages.length > 0) return {
 			messages,
 			timedOut: false
@@ -635,7 +652,7 @@ var StreamStore = class {
 		return new Promise((resolve) => {
 			const timeoutId = setTimeout(() => {
 				this.removePendingLongPoll(pending);
-				const currentStream = this.getIfNotExpired(path$2);
+				const currentStream = this.getIfNotExpired(path$1);
 				const streamClosed = currentStream?.closed ?? false;
 				resolve({
 					messages: [],
@@ -644,12 +661,12 @@ var StreamStore = class {
 				});
 			}, timeoutMs);
 			const pending = {
-				path: path$2,
+				path: path$1,
 				offset,
 				resolve: (msgs) => {
 					clearTimeout(timeoutId);
 					this.removePendingLongPoll(pending);
-					const currentStream = this.getIfNotExpired(path$2);
+					const currentStream = this.getIfNotExpired(path$1);
 					const streamClosed = currentStream?.closed && msgs.length === 0 ? true : void 0;
 					resolve({
 						messages: msgs,
@@ -666,8 +683,8 @@ var StreamStore = class {
 	* Get the current offset for a stream.
 	* Returns undefined if stream doesn't exist or is expired.
 	*/
-	getCurrentOffset(path$2) {
-		return this.getIfNotExpired(path$2)?.currentOffset;
+	getCurrentOffset(path$1) {
+		return this.getIfNotExpired(path$1)?.currentOffset;
 	}
 	/**
 	* Clear all streams.
@@ -705,7 +722,8 @@ var StreamStore = class {
 		const parts = stream.currentOffset.split(`_`).map(Number);
 		const readSeq = parts[0];
 		const byteOffset = parts[1];
-		const newByteOffset = byteOffset + processedData.length;
+		const FRAME_OVERHEAD = 5;
+		const newByteOffset = byteOffset + FRAME_OVERHEAD + processedData.length;
 		const newOffset = `${String(readSeq).padStart(16, `0`)}_${String(newByteOffset).padStart(16, `0`)}`;
 		const message = {
 			data: processedData,
@@ -720,10 +738,10 @@ var StreamStore = class {
 		for (let i = 0; i < stream.messages.length; i++) if (stream.messages[i].offset > offset) return i;
 		return -1;
 	}
-	notifyLongPolls(path$2) {
-		const toNotify = this.pendingLongPolls.filter((p) => p.path === path$2);
+	notifyLongPolls(path$1) {
+		const toNotify = this.pendingLongPolls.filter((p) => p.path === path$1);
 		for (const pending of toNotify) {
-			const { messages } = this.read(path$2, pending.offset);
+			const { messages } = this.read(path$1, pending.offset);
 			if (messages.length > 0) pending.resolve(messages);
 		}
 	}
@@ -731,17 +749,17 @@ var StreamStore = class {
 	* Notify pending long-polls that a stream has been closed.
 	* They should wake up immediately and return Stream-Closed: true.
 	*/
-	notifyLongPollsClosed(path$2) {
-		const toNotify = this.pendingLongPolls.filter((p) => p.path === path$2);
+	notifyLongPollsClosed(path$1) {
+		const toNotify = this.pendingLongPolls.filter((p) => p.path === path$1);
 		for (const pending of toNotify) pending.resolve([]);
 	}
-	cancelLongPollsForStream(path$2) {
-		const toCancel = this.pendingLongPolls.filter((p) => p.path === path$2);
+	cancelLongPollsForStream(path$1) {
+		const toCancel = this.pendingLongPolls.filter((p) => p.path === path$1);
 		for (const pending of toCancel) {
 			clearTimeout(pending.timeoutId);
 			pending.resolve([]);
 		}
-		this.pendingLongPolls = this.pendingLongPolls.filter((p) => p.path !== path$2);
+		this.pendingLongPolls = this.pendingLongPolls.filter((p) => p.path !== path$1);
 	}
 	removePendingLongPoll(pending) {
 		const index = this.pendingLongPolls.indexOf(pending);
@@ -749,6 +767,48 @@ var StreamStore = class {
 	}
 };
 
+//#endregion
+//#region src/log.ts
+const streamsLogFile = process.env.STREAMS_LOG_FILE;
+async function appendLogLine(line) {
+	if (!streamsLogFile) return;
+	const fs$1 = await import(`node:fs/promises`);
+	const path$1 = await import(`node:path`);
+	await fs$1.mkdir(path$1.dirname(streamsLogFile), { recursive: true });
+	await fs$1.appendFile(streamsLogFile, `${line}\n`);
+}
+function serializeArg(arg) {
+	if (arg instanceof Error) return arg.stack ?? arg.message;
+	if (typeof arg === `string`) return arg;
+	try {
+		return JSON.stringify(arg);
+	} catch {
+		return String(arg);
+	}
+}
+function write(level, args) {
+	const line = args.map(serializeArg).join(` `);
+	const formatted = `[${level}] ${line}`;
+	if (level === `error`) console.error(formatted);
+	else if (level === `warn`) console.warn(formatted);
+	else console.info(formatted);
+	appendLogLine(formatted).catch(() => void 0);
+}
+const serverLog = {
+	info(...args) {
+		write(`info`, args);
+	},
+	warn(...args) {
+		write(`warn`, args);
+	},
+	error(...args) {
+		write(`error`, args);
+	},
+	event(obj, msg) {
+		write(`info`, [msg, obj]);
+	}
+};
+
 //#endregion
 //#region src/path-encoding.ts
 const MAX_ENCODED_LENGTH = 200;
@@ -759,10 +819,10 @@ const MAX_ENCODED_LENGTH = 200;
 * @example
 * encodeStreamPath("/stream/users:created") → "L3N0cmVhbS91c2VyczpjcmVhdGVk"
 */
-function encodeStreamPath(path$2) {
-	const base64 = Buffer.from(path$2, `utf-8`).toString(`base64`).replace(/\+/g, `-`).replace(/\//g, `_`).replace(/=/g, ``);
+function encodeStreamPath(path$1) {
+	const base64 = Buffer.from(path$1, `utf-8`).toString(`base64`).replace(/\+/g, `-`).replace(/\//g, `_`).replace(/=/g, ``);
 	if (base64.length > MAX_ENCODED_LENGTH) {
-		const hash = createHash(`sha256`).update(path$2).digest(`hex`).slice(0, 16);
+		const hash = createHash(`sha256`).update(path$1).digest(`hex`).slice(0, 16);
 		return `${base64.slice(0, 180)}~${hash}`;
 	}
 	return base64;
@@ -785,82 +845,6 @@ function decodeStreamPath(encoded) {
 	return Buffer.from(padded, `base64`).toString(`utf-8`);
 }
 
-//#endregion
-//#region src/file-manager.ts
-var StreamFileManager = class {
-	constructor(streamsDir) {
-		this.streamsDir = streamsDir;
-	}
-	/**
-	* Create a directory for a new stream and initialize the first segment file.
-	* Returns the absolute path to the stream directory.
-	*/
-	async createStreamDirectory(streamPath) {
-		const encoded = encodeStreamPath(streamPath);
-		const dir = path$1.join(this.streamsDir, encoded);
-		await fs$1.mkdir(dir, { recursive: true });
-		const segmentPath = path$1.join(dir, `segment_00000.log`);
-		await fs$1.writeFile(segmentPath, ``);
-		return dir;
-	}
-	/**
-	* Delete a stream directory and all its contents.
-	*/
-	async deleteStreamDirectory(streamPath) {
-		const encoded = encodeStreamPath(streamPath);
-		const dir = path$1.join(this.streamsDir, encoded);
-		await fs$1.rm(dir, {
-			recursive: true,
-			force: true
-		});
-	}
-	/**
-	* Delete a directory by its exact name (used for unique directory names).
-	*/
-	async deleteDirectoryByName(directoryName) {
-		const dir = path$1.join(this.streamsDir, directoryName);
-		await fs$1.rm(dir, {
-			recursive: true,
-			force: true
-		});
-	}
-	/**
-	* Get the absolute path to a stream's directory.
-	* Returns null if the directory doesn't exist.
-	*/
-	async getStreamDirectory(streamPath) {
-		const encoded = encodeStreamPath(streamPath);
-		const dir = path$1.join(this.streamsDir, encoded);
-		try {
-			await fs$1.access(dir);
-			return dir;
-		} catch {
-			return null;
-		}
-	}
-	/**
-	* List all stream paths by scanning the streams directory.
-	*/
-	async listStreamPaths() {
-		try {
-			const entries = await fs$1.readdir(this.streamsDir, { withFileTypes: true });
-			return entries.filter((e) => e.isDirectory()).map((e) => decodeStreamPath(e.name));
-		} catch {
-			return [];
-		}
-	}
-	/**
-	* Get the path to a segment file within a stream directory.
-	*
-	* @param streamDir - Absolute path to the stream directory
-	* @param index - Segment index (0-based)
-	*/
-	getSegmentPath(streamDir, index) {
-		const paddedIndex = String(index).padStart(5, `0`);
-		return path$1.join(streamDir, `segment_${paddedIndex}.log`);
-	}
-};
-
 //#endregion
 //#region src/file-store.ts
 var FileHandlePool = class {
@@ -868,7 +852,7 @@ var FileHandlePool = class {
 	constructor(maxSize) {
 		this.cache = new SieveCache(maxSize, { evictHook: (_key, handle) => {
 			this.closeHandle(handle).catch((err) => {
-				console.error(`[FileHandlePool] Error closing evicted handle:`, err);
+				serverLog.error(`[FileHandlePool] Error closing evicted handle:`, err);
 			});
 		} });
 	}
@@ -876,41 +860,70 @@ var FileHandlePool = class {
 		let handle = this.cache.get(filePath);
 		if (!handle) {
 			const stream = fs.createWriteStream(filePath, { flags: `a` });
-			handle = { stream };
+			handle = {
+				stream,
+				syncLeader: null
+			};
 			this.cache.set(filePath, handle);
 		}
 		return handle.stream;
 	}
 	/**
+	* Open a write stream eagerly so the first write does not pay the lazy
+	* `open()` stall. Resolves once the underlying fd is ready.
+	*/
+	async openWriteStream(filePath) {
+		const stream = this.getWriteStream(filePath);
+		const fd = stream.fd;
+		if (typeof fd === `number`) return stream;
+		await new Promise((resolve, reject) => {
+			stream.once(`open`, () => resolve());
+			stream.once(`error`, (err) => reject(err));
+		});
+		return stream;
+	}
+	/**
 	* Flush a specific file to disk immediately.
-	* This is called after each append to ensure durability.
+	* Concurrent callers on the same fd share one in-flight fdatasync: the
+	* first caller issues the syscall, later arrivals during that window wait
+	* for it to finish and then issue a fresh syscall (because their writes
+	* may have landed after the in-flight syscall started). This preserves
+	* durability without adding scheduling latency.
 	*/
-	async fsyncFile(filePath) {
+	fsyncFile(filePath) {
 		const handle = this.cache.get(filePath);
-		if (!handle) return;
-		return new Promise((resolve, reject) => {
-			const fd = handle.stream.fd;
-			if (typeof fd !== `number`) {
-				const onOpen = (openedFd) => {
-					handle.stream.off(`error`, onError);
-					fs.fdatasync(openedFd, (err) => {
-						if (err) reject(err);
-						else resolve();
-					});
-				};
-				const onError = (err) => {
-					handle.stream.off(`open`, onOpen);
-					reject(err);
-				};
-				handle.stream.once(`open`, onOpen);
-				handle.stream.once(`error`, onError);
-				return;
-			}
-			fs.fdatasync(fd, (err) => {
-				if (err) reject(err);
-				else resolve();
-			});
+		if (!handle) return Promise.reject(new Error(`[FileHandlePool] Cannot fsync: handle not found for ${filePath}`));
+		const existing = handle.syncLeader;
+		if (existing && existing.scheduled) return existing.promise;
+		let resolveFn;
+		let rejectFn;
+		const promise = new Promise((res, rej) => {
+			resolveFn = res;
+			rejectFn = rej;
 		});
+		const leader = {
+			promise,
+			scheduled: true
+		};
+		handle.syncLeader = leader;
+		const runSyscall = (fd$1) => {
+			leader.scheduled = false;
+			fs.fdatasync(fd$1, (err) => {
+				if (handle.syncLeader === leader) handle.syncLeader = null;
+				if (err) rejectFn(err);
+				else resolveFn();
+			});
+		};
+		const fd = handle.stream.fd;
+		if (typeof fd === `number`) runSyscall(fd);
+		else {
+			handle.stream.once(`open`, (openedFd) => runSyscall(openedFd));
+			handle.stream.once(`error`, (err) => {
+				if (handle.syncLeader === leader) handle.syncLeader = null;
+				rejectFn(err);
+			});
+		}
+		return promise;
 	}
 	async closeAll() {
 		const promises = [];
@@ -946,13 +959,15 @@ function generateUniqueDirectoryName(streamPath) {
 	const random = randomBytes(4).toString(`hex`);
 	return `${encoded}~${timestamp}~${random}`;
 }
+function segmentFile(dataDir, dirName) {
+	return path.join(dataDir, `streams`, `${dirName}.log`);
+}
 /**
 * File-backed implementation of StreamStore.
 * Maintains the same interface as the in-memory StreamStore for drop-in compatibility.
 */
 var FileBackedStreamStore = class {
 	db;
-	fileManager;
 	fileHandlePool;
 	pendingLongPolls = [];
 	dataDir;
@@ -961,13 +976,23 @@ var FileBackedStreamStore = class {
 	* Key: "{streamPath}:{producerId}"
 	*/
 	producerLocks = new Map();
+	/**
+	* Per-stream append locks. Serializes the read-modify-write of currentOffset
+	* across all concurrent appenders on the same stream so the LMDB-tracked
+	* offset cannot drift behind the file's actual byte position.
+	* Key: streamPath
+	*/
+	streamAppendLocks = new Map();
 	constructor(options) {
 		this.dataDir = options.dataDir;
 		this.db = open({
 			path: path.join(this.dataDir, `metadata.lmdb`),
-			compression: true
+			compression: true,
+			noMemInit: true,
+			cache: true,
+			sharedStructuresKey: Symbol.for(`structures`)
 		});
-		this.fileManager = new StreamFileManager(path.join(this.dataDir, `streams`));
+		fs.mkdirSync(path.join(this.dataDir, `streams`), { recursive: true });
 		const maxFileHandles = options.maxFileHandles ?? 100;
 		this.fileHandlePool = new FileHandlePool(maxFileHandles);
 		this.recover();
@@ -977,7 +1002,7 @@ var FileBackedStreamStore = class {
 	* Validates that LMDB metadata matches actual file contents and reconciles any mismatches.
 	*/
 	recover() {
-		console.log(`[FileBackedStreamStore] Starting recovery...`);
+		serverLog.info(`[FileBackedStreamStore] Starting recovery...`);
 		let recovered = 0;
 		let reconciled = 0;
 		let errors = 0;
@@ -990,9 +1015,9 @@ var FileBackedStreamStore = class {
 			if (typeof key !== `string`) continue;
 			const streamMeta = value;
 			const streamPath = key.replace(`stream:`, ``);
-			const segmentPath = path.join(this.dataDir, `streams`, streamMeta.directoryName, `segment_00000.log`);
+			const segmentPath = segmentFile(this.dataDir, streamMeta.directoryName);
 			if (!fs.existsSync(segmentPath)) {
-				console.warn(`[FileBackedStreamStore] Recovery: Stream file missing for ${streamPath}, removing from LMDB`);
+				serverLog.warn(`[FileBackedStreamStore] Recovery: Stream file missing for ${streamPath}, removing from LMDB`);
 				this.db.removeSync(key);
 				errors++;
 				continue;
@@ -1006,7 +1031,7 @@ var FileBackedStreamStore = class {
 				trueOffset = `${String(0).padStart(16, `0`)}_${String(logicalBytes).padStart(16, `0`)}`;
 			} else trueOffset = physicalOffset;
 			if (trueOffset !== streamMeta.currentOffset) {
-				console.warn(`[FileBackedStreamStore] Recovery: Offset mismatch for ${streamPath}: LMDB says ${streamMeta.currentOffset}, file says ${trueOffset}. Reconciling to file.`);
+				serverLog.warn(`[FileBackedStreamStore] Recovery: Offset mismatch for ${streamPath}: LMDB says ${streamMeta.currentOffset}, file says ${trueOffset}. Reconciling to file.`);
 				const reconciledMeta = {
 					...streamMeta,
 					currentOffset: trueOffset
@@ -1016,10 +1041,10 @@ var FileBackedStreamStore = class {
 			}
 			recovered++;
 		} catch (err) {
-			console.error(`[FileBackedStreamStore] Error recovering stream:`, err);
+			serverLog.error(`[FileBackedStreamStore] Error recovering stream:`, err);
 			errors++;
 		}
-		console.log(`[FileBackedStreamStore] Recovery complete: ${recovered} streams, ${reconciled} reconciled, ${errors} errors`);
+		serverLog.info(`[FileBackedStreamStore] Recovery complete: ${recovered} streams, ${reconciled} reconciled, ${errors} errors`);
 	}
 	/**
 	* Scan a segment file to compute the true last offset.
@@ -1029,19 +1054,16 @@ var FileBackedStreamStore = class {
 		try {
 			const fileContent = fs.readFileSync(segmentPath);
 			let filePos = 0;
-			let currentDataOffset = 0;
 			while (filePos < fileContent.length) {
 				if (filePos + 4 > fileContent.length) break;
 				const messageLength = fileContent.readUInt32BE(filePos);
-				filePos += 4;
-				if (filePos + messageLength > fileContent.length) break;
-				filePos += messageLength;
-				if (filePos < fileContent.length) filePos += 1;
-				currentDataOffset += messageLength;
+				const frameEnd = filePos + 4 + messageLength + 1;
+				if (frameEnd > fileContent.length) break;
+				filePos = frameEnd;
 			}
-			return `0000000000000000_${String(currentDataOffset).padStart(16, `0`)}`;
+			return `0000000000000000_${String(filePos).padStart(16, `0`)}`;
 		} catch (err) {
-			console.error(`[FileBackedStreamStore] Error scanning file ${segmentPath}:`, err);
+			serverLog.error(`[FileBackedStreamStore] Error scanning file ${segmentPath}:`, err);
 			return `0000000000000000_0000000000000000`;
 		}
 	}
@@ -1157,6 +1179,26 @@ var FileBackedStreamStore = class {
 		};
 	}
 	/**
+	* Acquire a per-stream append lock that serializes the read-modify-write
+	* of currentOffset across all concurrent appenders on the same stream.
+	* Without this, two concurrent appends can read the same starting
+	* currentOffset, both compute their newOffset, both write a frame to the
+	* file, but only one of their LMDB updates wins — leaving currentOffset
+	* lagging the file's actual byte position. Returns a release function.
+	*/
+	async acquireStreamAppendLock(streamPath) {
+		while (this.streamAppendLocks.has(streamPath)) await this.streamAppendLocks.get(streamPath);
+		let releaseLock;
+		const lockPromise = new Promise((resolve) => {
+			releaseLock = resolve;
+		});
+		this.streamAppendLocks.set(streamPath, lockPromise);
+		return () => {
+			this.streamAppendLocks.delete(streamPath);
+			releaseLock();
+		};
+	}
+	/**
 	* Get the current epoch for a producer on a stream.
 	* Returns undefined if the producer doesn't exist or stream not found.
 	*/
@@ -1289,6 +1331,7 @@ var FileBackedStreamStore = class {
 			effectiveTtlSeconds = resolved.ttlSeconds;
 		}
 		const key = `stream:${streamPath}`;
+		const t0 = performance.now();
 		const streamMeta = {
 			path: streamPath,
 			contentType,
@@ -1306,11 +1349,10 @@ var FileBackedStreamStore = class {
 			forkOffset: isFork ? forkOffset : void 0,
 			refCount: 0
 		};
-		const streamDir = path.join(this.dataDir, `streams`, streamMeta.directoryName);
+		const tAfterMeta = performance.now();
+		const segmentPath = segmentFile(this.dataDir, streamMeta.directoryName);
 		try {
-			fs.mkdirSync(streamDir, { recursive: true });
-			const segmentPath = path.join(streamDir, `segment_00000.log`);
-			fs.writeFileSync(segmentPath, ``);
+			await this.db.put(key, streamMeta);
 		} catch (err) {
 			if (isFork && sourceMeta) {
 				const sourceKey = `stream:${options.forkedFrom}`;
@@ -1323,10 +1365,18 @@ var FileBackedStreamStore = class {
 					this.db.putSync(sourceKey, updatedSource);
 				}
 			}
-			console.error(`[FileBackedStreamStore] Error creating stream directory:`, err);
+			serverLog.error(`[FileBackedStreamStore] Error creating stream (LMDB put):`, err);
 			throw err;
 		}
-		this.db.putSync(key, streamMeta);
+		const tAfterLmdb = performance.now();
+		try {
+			await this.fileHandlePool.openWriteStream(segmentPath);
+		} catch (err) {
+			this.db.removeSync(key);
+			serverLog.error(`[FileBackedStreamStore] Error creating stream (file open):`, err);
+			throw err;
+		}
+		const tAfterOpen = performance.now();
 		if (options.initialData && options.initialData.length > 0) try {
 			await this.append(streamPath, options.initialData, {
 				contentType: options.contentType,
@@ -1346,12 +1396,24 @@ var FileBackedStreamStore = class {
 			}
 			throw err;
 		}
+		const tAfterAppend = performance.now();
 		if (options.closed) {
 			const updatedMeta = this.db.get(key);
 			updatedMeta.closed = true;
-			this.db.putSync(key, updatedMeta);
+			await this.db.put(key, updatedMeta);
 		}
 		const updated = this.db.get(key);
+		const totalMs = performance.now() - t0;
+		if (totalMs > 50) serverLog.event({
+			event: `store.create`,
+			path: streamPath,
+			totalMs: +totalMs.toFixed(2),
+			metaMs: +(tAfterMeta - t0).toFixed(2),
+			lmdbMs: +(tAfterLmdb - tAfterMeta).toFixed(2),
+			openMs: +(tAfterOpen - tAfterLmdb).toFixed(2),
+			appendMs: +(tAfterAppend - tAfterOpen).toFixed(2),
+			initBytes: options.initialData?.length ?? 0
+		}, `store.create slow`);
 		return this.streamMetaToStream(updated);
 	}
 	get(streamPath) {
@@ -1392,13 +1454,10 @@ var FileBackedStreamStore = class {
 		if (!streamMeta) return;
 		const forkedFrom = streamMeta.forkedFrom;
 		this.cancelLongPollsForStream(streamPath);
-		const segmentPath = path.join(this.dataDir, `streams`, streamMeta.directoryName, `segment_00000.log`);
-		this.fileHandlePool.closeFileHandle(segmentPath).catch((err) => {
-			console.error(`[FileBackedStreamStore] Error closing file handle:`, err);
-		});
+		const segmentPath = segmentFile(this.dataDir, streamMeta.directoryName);
 		this.db.removeSync(key);
-		this.fileManager.deleteDirectoryByName(streamMeta.directoryName).catch((err) => {
-			console.error(`[FileBackedStreamStore] Error deleting stream directory:`, err);
+		this.fileHandlePool.closeFileHandle(segmentPath).then(() => fs.promises.unlink(segmentPath)).catch((err) => {
+			serverLog.error(`[FileBackedStreamStore] Error cleaning up stream file:`, err);
 		});
 		if (forkedFrom) {
 			const parentKey = `stream:${forkedFrom}`;
@@ -1414,7 +1473,20 @@ var FileBackedStreamStore = class {
 			}
 		}
 	}
+	/**
+	* Public append entry point. Serializes concurrent appends to the same
+	* stream so the read-modify-write of currentOffset cannot interleave —
+	* see acquireStreamAppendLock for the underlying race.
+	*/
 	async append(streamPath, data, options = {}) {
+		const releaseLock = await this.acquireStreamAppendLock(streamPath);
+		try {
+			return await this.appendInner(streamPath, data, options);
+		} finally {
+			releaseLock();
+		}
+	}
+	async appendInner(streamPath, data, options = {}) {
 		const streamMeta = this.getMetaIfNotExpired(streamPath);
 		if (!streamMeta) throw new Error(`Stream not found: ${streamPath}`);
 		if (streamMeta.softDeleted) throw new Error(`Stream is soft-deleted: ${streamPath}`);
@@ -1456,10 +1528,11 @@ var FileBackedStreamStore = class {
 		const parts = streamMeta.currentOffset.split(`_`).map(Number);
 		const readSeq = parts[0];
 		const byteOffset = parts[1];
-		const newByteOffset = byteOffset + processedData.length;
+		const FRAME_OVERHEAD = 5;
+		const newByteOffset = byteOffset + FRAME_OVERHEAD + processedData.length;
 		const newOffset = `${String(readSeq).padStart(16, `0`)}_${String(newByteOffset).padStart(16, `0`)}`;
-		const streamDir = path.join(this.dataDir, `streams`, streamMeta.directoryName);
-		const segmentPath = path.join(streamDir, `segment_00000.log`);
+		const segmentPath = segmentFile(this.dataDir, streamMeta.directoryName);
+		const tAppendStart = performance.now();
 		const stream = this.fileHandlePool.getWriteStream(segmentPath);
 		const lengthBuf = Buffer.allocUnsafe(4);
 		lengthBuf.writeUInt32BE(processedData.length, 0);
@@ -1474,12 +1547,14 @@ var FileBackedStreamStore = class {
 				else resolve();
 			});
 		});
+		const tAfterWrite = performance.now();
 		const message = {
 			data: processedData,
 			offset: newOffset,
 			timestamp: Date.now()
 		};
 		await this.fileHandlePool.fsyncFile(segmentPath);
+		const tAfterFsync = performance.now();
 		const updatedProducers = { ...streamMeta.producers };
 		if (producerResult && producerResult.status === `accepted`) updatedProducers[producerResult.producerId] = producerResult.proposedState;
 		let closedBy = void 0;
@@ -1498,7 +1573,19 @@ var FileBackedStreamStore = class {
 			closedBy: closedBy ?? streamMeta.closedBy
 		};
 		const key = `stream:${streamPath}`;
-		this.db.putSync(key, updatedMeta);
+		await this.db.put(key, updatedMeta);
+		const tAfterLmdb = performance.now();
+		const appendTotal = tAfterLmdb - tAppendStart;
+		if (appendTotal > 50) serverLog.event({
+			event: `store.append`,
+			path: streamPath,
+			totalMs: +appendTotal.toFixed(2),
+			writeMs: +(tAfterWrite - tAppendStart).toFixed(2),
+			fsyncMs: +(tAfterFsync - tAfterWrite).toFixed(2),
+			lmdbMs: +(tAfterLmdb - tAfterFsync).toFixed(2),
+			bytes: processedData.length,
+			isInitial: options.isInitialCreate ?? false
+		}, `store.append slow`);
 		this.notifyLongPolls(streamPath);
 		if (options.close) this.notifyLongPollsClosed(streamPath);
 		if (producerResult || options.close) return {
@@ -1591,7 +1678,7 @@ var FileBackedStreamStore = class {
 				},
 				producers: updatedProducers
 			};
-			this.db.putSync(key, updatedMeta);
+			await this.db.put(key, updatedMeta);
 			this.notifyLongPollsClosed(streamPath);
 			return {
 				finalOffset: streamMeta.currentOffset,
@@ -1625,7 +1712,7 @@ var FileBackedStreamStore = class {
 				const messageData = fileContent.subarray(filePos, filePos + messageLength);
 				filePos += messageLength;
 				filePos += 1;
-				physicalDataOffset += messageLength;
+				physicalDataOffset += messageLength + 5;
 				const logicalOffset = baseByteOffset + physicalDataOffset;
 				if (capByte !== void 0 && logicalOffset > capByte) break;
 				if (logicalOffset > startByte) messages.push({
@@ -1635,7 +1722,7 @@ var FileBackedStreamStore = class {
 				});
 			}
 		} catch (err) {
-			console.error(`[FileBackedStreamStore] Error reading segment file:`, err);
+			serverLog.error(`[FileBackedStreamStore] Error reading segment file:`, err);
 		}
 		return messages;
 	}
@@ -1657,7 +1744,7 @@ var FileBackedStreamStore = class {
 				messages.push(...inherited);
 			}
 		}
-		const segmentPath = path.join(this.dataDir, `streams`, sourceMeta.directoryName, `segment_00000.log`);
+		const segmentPath = segmentFile(this.dataDir, sourceMeta.directoryName);
 		const sourceBaseByte = sourceMeta.forkOffset ? Number(sourceMeta.forkOffset.split(`_`)[1] ?? 0) : 0;
 		const ownMessages = this.readMessagesFromSegmentFile(segmentPath, startByte, sourceBaseByte, capByte);
 		messages.push(...ownMessages);
@@ -1684,11 +1771,11 @@ var FileBackedStreamStore = class {
 				const inherited = this.readForkedMessages(streamMeta.forkedFrom, startByte, forkByte);
 				messages.push(...inherited);
 			}
-			const segmentPath = path.join(this.dataDir, `streams`, streamMeta.directoryName, `segment_00000.log`);
+			const segmentPath = segmentFile(this.dataDir, streamMeta.directoryName);
 			const ownMessages = this.readMessagesFromSegmentFile(segmentPath, startByte, forkByte);
 			messages.push(...ownMessages);
 		} else {
-			const segmentPath = path.join(this.dataDir, `streams`, streamMeta.directoryName, `segment_00000.log`);
+			const segmentPath = segmentFile(this.dataDir, streamMeta.directoryName);
 			const ownMessages = this.readMessagesFromSegmentFile(segmentPath, startByte, 0);
 			messages.push(...ownMessages);
 		}
@@ -1759,6 +1846,7 @@ var FileBackedStreamStore = class {
 	formatResponse(streamPath, messages) {
 		const streamMeta = this.getMetaIfNotExpired(streamPath);
 		if (!streamMeta) throw new Error(`Stream not found: ${streamPath}`);
+		if (normalizeContentType(streamMeta.contentType) === `application/json`) return formatJsonMessages(messages);
 		const totalSize = messages.reduce((sum, m) => sum + m.data.length, 0);
 		const concatenated = new Uint8Array(totalSize);
 		let offset = 0;
@@ -1766,7 +1854,6 @@ var FileBackedStreamStore = class {
 			concatenated.set(msg.data, offset);
 			offset += msg.data.length;
 		}
-		if (normalizeContentType(streamMeta.contentType) === `application/json`) return formatJsonResponse(concatenated);
 		return concatenated;
 	}
 	getCurrentOffset(streamPath) {
@@ -1786,7 +1873,7 @@ var FileBackedStreamStore = class {
 		const entries = Array.from(range);
 		for (const { key } of entries) this.db.removeSync(key);
 		this.fileHandlePool.closeAll().catch((err) => {
-			console.error(`[FileBackedStreamStore] Error closing handles:`, err);
+			serverLog.error(`[FileBackedStreamStore] Error closing handles:`, err);
 		});
 	}
 	/**
@@ -1940,30 +2027,985 @@ function handleCursorCollision(currentCursor, previousCursor, options = {}) {
 	return generateResponseCursor(previousCursor, options);
 }
 
+//#endregion
+//#region src/crypto.ts
+/**
+* Generate a unique wake ID.
+*/
+function generateWakeId() {
+	return `w_${randomBytes(12).toString(`hex`)}`;
+}
+const WEBHOOK_KEYPAIR = generateKeyPairSync(`ed25519`);
+const WEBHOOK_PUBLIC_JWK = buildWebhookPublicJwk();
+function buildWebhookPublicJwk() {
+	const exported = WEBHOOK_KEYPAIR.publicKey.export({ format: `jwk` });
+	if (exported.kty !== `OKP` || exported.crv !== `Ed25519` || !exported.x) throw new Error(`Failed to export Ed25519 webhook signing key`);
+	const thumbprintInput = JSON.stringify({
+		crv: exported.crv,
+		kty: exported.kty,
+		x: exported.x
+	});
+	const kid = `ds_${createHash(`sha256`).update(thumbprintInput).digest(`base64url`)}`;
+	return {
+		kty: `OKP`,
+		crv: `Ed25519`,
+		x: exported.x,
+		kid,
+		use: `sig`,
+		alg: `EdDSA`
+	};
+}
+function getWebhookSigningKeyId() {
+	return WEBHOOK_PUBLIC_JWK.kid;
+}
+function getWebhookJwks() {
+	return { keys: [{ ...WEBHOOK_PUBLIC_JWK }] };
+}
+/**
+* Sign a webhook payload for the Webhook-Signature header.
+* Format: t=<timestamp>,kid=<key_id>,ed25519=<base64url_signature>
+*/
+function signWebhookPayload(body) {
+	const timestamp = Math.floor(Date.now() / 1e3);
+	const payload = `${timestamp}.${body}`;
+	const signature = sign(null, Buffer.from(payload), WEBHOOK_KEYPAIR.privateKey).toString(`base64url`);
+	return `t=${timestamp},kid=${WEBHOOK_PUBLIC_JWK.kid},ed25519=${signature}`;
+}
+const TOKEN_KEY = randomBytes(32);
+/**
+* Generate a signed callback token.
+* Token format: base64url(json_payload).base64url(hmac_signature)
+* Payload: { consumer_id, epoch, exp }
+*/
+function generateCallbackToken(consumerId, epoch) {
+	const payload = {
+		sub: consumerId,
+		epoch,
+		exp: Math.floor(Date.now() / 1e3) + 3600,
+		jti: randomBytes(8).toString(`hex`)
+	};
+	const payloadStr = Buffer.from(JSON.stringify(payload)).toString(`base64url`);
+	const sig = createHmac(`sha256`, TOKEN_KEY).update(payloadStr).digest(`base64url`);
+	return `${payloadStr}.${sig}`;
+}
+/**
+* Validate a callback token. Returns the decoded payload or null.
+* On success, includes `exp` (unix seconds) so callers can decide
+* whether the token needs refreshing.
+*/
+function validateCallbackToken(token, consumerId) {
+	const parts = token.split(`.`);
+	if (parts.length !== 2) return {
+		valid: false,
+		code: `TOKEN_INVALID`
+	};
+	const [payloadStr, sig] = parts;
+	const expectedSig = createHmac(`sha256`, TOKEN_KEY).update(payloadStr).digest(`base64url`);
+	try {
+		if (!timingSafeEqual(Buffer.from(sig), Buffer.from(expectedSig))) return {
+			valid: false,
+			code: `TOKEN_INVALID`
+		};
+	} catch {
+		return {
+			valid: false,
+			code: `TOKEN_INVALID`
+		};
+	}
+	let payload;
+	try {
+		payload = JSON.parse(Buffer.from(payloadStr, `base64url`).toString());
+	} catch {
+		return {
+			valid: false,
+			code: `TOKEN_INVALID`
+		};
+	}
+	if (payload.sub !== consumerId) return {
+		valid: false,
+		code: `TOKEN_INVALID`
+	};
+	const now = Math.floor(Date.now() / 1e3);
+	if (now > payload.exp) return {
+		valid: false,
+		code: `TOKEN_EXPIRED`
+	};
+	return {
+		valid: true,
+		exp: payload.exp,
+		epoch: payload.epoch
+	};
+}
+
+//#endregion
+//#region src/glob.ts
+/**
+* Glob pattern matching for webhook subscription patterns.
+*
+* Supports:
+* - `*` matches exactly one path segment
+* - `**` matches zero or more path segments (recursive)
+* - Literal segments match exactly
+*/
+/**
+* Match a stream path against a glob pattern.
+*/
+function globMatch(pattern, path$1) {
+	const patternParts = splitPath(pattern);
+	const pathParts = splitPath(path$1);
+	return matchParts(patternParts, 0, pathParts, 0);
+}
+function splitPath(p) {
+	return p.replace(/^\/+/, ``).replace(/\/+$/, ``).split(`/`).filter((s) => s.length > 0);
+}
+function matchParts(pattern, pi, path$1, si) {
+	while (pi < pattern.length && si < path$1.length) {
+		const seg = pattern[pi];
+		if (seg === `**`) {
+			for (let i = si; i <= path$1.length; i++) if (matchParts(pattern, pi + 1, path$1, i)) return true;
+			return false;
+		}
+		if (seg === `*`) {
+			pi++;
+			si++;
+			continue;
+		}
+		const decodedSeg = seg.replace(/%2[Aa]/g, `*`);
+		if (decodedSeg !== path$1[si]) return false;
+		pi++;
+		si++;
+	}
+	while (pi < pattern.length && pattern[pi] === `**`) pi++;
+	return pi === pattern.length && si === path$1.length;
+}
+
+//#endregion
+//#region src/subscription-manager.ts
+const DEFAULT_LEASE_TTL_MS = 3e4;
+const MIN_LEASE_TTL_MS = 1e3;
+const MAX_LEASE_TTL_MS = 10 * 6e4;
+const ZERO_OFFSET = `0000000000000000_0000000000000000`;
+const BEFORE_FIRST_OFFSET = `-1`;
+const MAX_RETRY_DELAY_MS = 6e4;
+function compareOffsets(a, b) {
+	if (a < b) return -1;
+	if (a > b) return 1;
+	return 0;
+}
+function normalizeRelativePath(path$1) {
+	return path$1.replace(/^\/+/, ``).replace(/\/+$/, ``);
+}
+function toAbsoluteStreamPath(streamPath) {
+	return `/v1/stream/${normalizeRelativePath(streamPath)}`;
+}
+function toStreamRelativePath(absolutePath) {
+	const streamRoot = `/v1/stream/`;
+	if (!absolutePath.startsWith(streamRoot)) return null;
+	const path$1 = absolutePath.slice(streamRoot.length);
+	if (path$1 === `__ds` || path$1.startsWith(`__ds/`)) return null;
+	return path$1.length > 0 ? path$1 : null;
+}
+function stableConfigHash(input) {
+	const canonical = {
+		type: input.type,
+		pattern: input.pattern,
+		streams: [...new Set(input.streams)].sort(),
+		webhook: input.webhook ? { url: input.webhook.url } : void 0,
+		wake_stream: input.wake_stream,
+		lease_ttl_ms: input.lease_ttl_ms,
+		description: input.description
+	};
+	return createHash(`sha256`).update(JSON.stringify(canonical)).digest(`hex`);
+}
+function isPrivateOrLinkLocalIpv4(host) {
+	const parts = host.split(`.`).map((part) => Number(part));
+	if (parts.length !== 4 || parts.some((part) => !Number.isInteger(part))) return false;
+	const [a, b] = parts;
+	return a === 10 || a === 127 || a === 0 || a === 172 && b >= 16 && b <= 31 || a === 192 && b === 168 || a === 169 && b === 254;
+}
+function isLocalDevHost(host) {
+	return host === `localhost` || /^127\.\d{1,3}\.\d{1,3}\.\d{1,3}$/.test(host);
+}
+function validateWebhookUrl(rawUrl) {
+	let url;
+	try {
+		url = new URL(rawUrl);
+	} catch {
+		return {
+			ok: false,
+			message: `webhook.url must be a valid URL`
+		};
+	}
+	const host = url.hostname.toLowerCase();
+	if (url.protocol === `http:`) {
+		if (isLocalDevHost(host)) return { ok: true };
+		return {
+			ok: false,
+			message: `http webhook URLs are only allowed for localhost or 127.0.0.x`
+		};
+	}
+	if (url.protocol !== `https:`) return {
+		ok: false,
+		message: `webhook.url must use https`
+	};
+	if (host === `localhost`) return {
+		ok: false,
+		message: `localhost webhook URLs must use http for dev`
+	};
+	if (isIP(host) === 4 && isPrivateOrLinkLocalIpv4(host)) return {
+		ok: false,
+		message: `webhook.url must not target private or link-local hosts`
+	};
+	if (isIP(host) === 6) return {
+		ok: false,
+		message: `IPv6 webhook hosts are not accepted by the reference server`
+	};
+	return { ok: true };
+}
+var SubscriptionManager = class {
+	subscriptions = new Map();
+	streamStore;
+	callbackBaseUrl;
+	webhooksEnabled;
+	isShuttingDown = false;
+	constructor(opts) {
+		this.callbackBaseUrl = opts.callbackBaseUrl;
+		this.streamStore = opts.streamStore;
+		this.webhooksEnabled = opts.webhooksEnabled ?? true;
+	}
+	createOrConfirm(id, input) {
+		const configHash = stableConfigHash(input);
+		const existing = this.subscriptions.get(id);
+		if (existing) {
+			if (existing.config_hash !== configHash) return { error: {
+				code: `SUBSCRIPTION_ALREADY_EXISTS`,
+				message: `Subscription already exists with different configuration`
+			} };
+			return {
+				subscription: existing,
+				created: false
+			};
+		}
+		if (input.type === `webhook`) {
+			if (!this.webhooksEnabled) return { error: {
+				code: `INVALID_REQUEST`,
+				message: `webhook subscriptions are not enabled on this server`
+			} };
+			if (!input.webhook) return { error: {
+				code: `INVALID_REQUEST`,
+				message: `webhook subscriptions require webhook.url`
+			} };
+			const validation = validateWebhookUrl(input.webhook.url);
+			if (!validation.ok) return { error: {
+				code: `WEBHOOK_URL_REJECTED`,
+				message: validation.message
+			} };
+		}
+		if (input.type === `pull-wake` && !input.wake_stream) return { error: {
+			code: `INVALID_REQUEST`,
+			message: `pull-wake subscriptions require wake_stream`
+		} };
+		const subscription = {
+			id,
+			type: input.type,
+			pattern: input.pattern,
+			webhook: input.webhook ? { url: input.webhook.url } : void 0,
+			wake_stream: input.wake_stream,
+			lease_ttl_ms: input.lease_ttl_ms,
+			description: input.description,
+			created_at: new Date().toISOString(),
+			status: `active`,
+			config_hash: configHash,
+			streams: new Map(),
+			generation: 0,
+			wake_id: null,
+			wake_snapshot: new Map(),
+			token: null,
+			holder: null,
+			lease_timer: null,
+			retry_count: 0,
+			retry_timer: null,
+			next_attempt_at: null
+		};
+		for (const stream of input.streams) this.linkStream(subscription, stream, `explicit`, this.getTailOffset(stream));
+		if (input.pattern) {
+			for (const stream of this.listStreams()) if (globMatch(input.pattern, stream)) this.linkStream(subscription, stream, `glob`, this.getTailOffset(stream));
+		}
+		this.subscriptions.set(id, subscription);
+		return {
+			subscription,
+			created: true
+		};
+	}
+	get(id) {
+		return this.subscriptions.get(id);
+	}
+	delete(id) {
+		const subscription = this.subscriptions.get(id);
+		if (!subscription) return false;
+		this.clearLease(subscription);
+		if (subscription.retry_timer) clearTimeout(subscription.retry_timer);
+		this.subscriptions.delete(id);
+		return true;
+	}
+	addExplicitStreams(id, streams) {
+		const subscription = this.get(id);
+		if (!subscription) return false;
+		for (const stream of streams) this.linkStream(subscription, stream, `explicit`, this.getTailOffset(stream));
+		return true;
+	}
+	removeExplicitStream(id, streamPath) {
+		const subscription = this.get(id);
+		if (!subscription) return false;
+		const normalized = normalizeRelativePath(streamPath);
+		const link = subscription.streams.get(normalized);
+		if (!link) return true;
+		link.link_types.delete(`explicit`);
+		if (link.link_types.size === 0) subscription.streams.delete(normalized);
+		return true;
+	}
+	async onStreamAppend(absolutePath) {
+		if (this.isShuttingDown) return;
+		for (const subscription of this.subscriptions.values()) {
+			const relative = toStreamRelativePath(absolutePath);
+			if (!relative) continue;
+			if (subscription.pattern && globMatch(subscription.pattern, relative)) {
+				const existing = subscription.streams.get(relative);
+				this.linkStream(subscription, relative, `glob`, existing?.acked_offset ?? BEFORE_FIRST_OFFSET);
+			}
+			if (subscription.streams.has(relative)) await this.maybeWake(subscription, relative);
+		}
+	}
+	onStreamDeleted(absolutePath) {
+		for (const subscription of this.subscriptions.values()) {
+			const relative = toStreamRelativePath(absolutePath);
+			if (relative) subscription.streams.delete(relative);
+		}
+	}
+	async handleWebhookCallback(id, token, request) {
+		const subscription = this.get(id);
+		if (!subscription) return this.errorResponse(404, `SUBSCRIPTION_NOT_FOUND`, `Subscription not found`);
+		const fenced = this.validateWakeToken(subscription, token, request);
+		if (fenced) return fenced;
+		const ackError = this.applyAcks(subscription, request);
+		if (ackError) return ackError;
+		this.extendLease(subscription);
+		let nextWake = false;
+		if (request.done === true) {
+			this.clearLease(subscription);
+			subscription.token = null;
+			subscription.holder = null;
+			subscription.wake_id = null;
+			subscription.wake_snapshot.clear();
+			nextWake = await this.triggerNextWakeIfPending(subscription);
+		}
+		return {
+			status: 200,
+			body: {
+				ok: true,
+				next_wake: nextWake
+			}
+		};
+	}
+	async claim(id, worker) {
+		const subscription = this.get(id);
+		if (!subscription) return this.errorResponse(404, `SUBSCRIPTION_NOT_FOUND`, `Subscription not found`);
+		if (subscription.type !== `pull-wake`) return this.errorResponse(400, `INVALID_REQUEST`, `Subscription is not pull-wake`);
+		if (subscription.holder) return {
+			status: 409,
+			body: { error: {
+				code: `ALREADY_CLAIMED`,
+				current_holder: subscription.holder,
+				generation: subscription.generation
+			} }
+		};
+		if (!this.hasPendingWork(subscription)) return this.errorResponse(409, `NO_PENDING_WORK`, `Subscription has no pending work`);
+		if (!subscription.wake_id) await this.createWake(subscription, this.firstPendingStream(subscription));
+		subscription.holder = worker;
+		subscription.token = generateCallbackToken(this.tokenSubject(subscription), subscription.generation);
+		this.extendLease(subscription);
+		return {
+			status: 200,
+			body: {
+				wake_id: subscription.wake_id,
+				generation: subscription.generation,
+				token: subscription.token,
+				streams: this.streamInfos(subscription),
+				lease_ttl_ms: subscription.lease_ttl_ms
+			}
+		};
+	}
+	async ack(id, token, request) {
+		const subscription = this.get(id);
+		if (!subscription) return this.errorResponse(404, `SUBSCRIPTION_NOT_FOUND`, `Subscription not found`);
+		if (subscription.type !== `pull-wake`) return this.errorResponse(400, `INVALID_REQUEST`, `Subscription is not pull-wake`);
+		const fenced = this.validateWakeToken(subscription, token, request);
+		if (fenced) return fenced;
+		const ackError = this.applyAcks(subscription, request);
+		if (ackError) return ackError;
+		this.extendLease(subscription);
+		let nextWake = false;
+		if (request.done === true) {
+			this.clearLease(subscription);
+			subscription.token = null;
+			subscription.holder = null;
+			subscription.wake_id = null;
+			subscription.wake_snapshot.clear();
+			nextWake = await this.triggerNextWakeIfPending(subscription);
+		}
+		return {
+			status: 200,
+			body: {
+				ok: true,
+				next_wake: nextWake
+			}
+		};
+	}
+	async release(id, token, request) {
+		const subscription = this.get(id);
+		if (!subscription) return this.errorResponse(404, `SUBSCRIPTION_NOT_FOUND`, `Subscription not found`);
+		if (subscription.type !== `pull-wake`) return this.errorResponse(400, `INVALID_REQUEST`, `Subscription is not pull-wake`);
+		const fenced = this.validateWakeToken(subscription, token, request);
+		if (fenced) return fenced;
+		this.clearLease(subscription);
+		subscription.token = null;
+		subscription.holder = null;
+		subscription.wake_id = null;
+		subscription.wake_snapshot.clear();
+		await this.triggerNextWakeIfPending(subscription);
+		return { status: 204 };
+	}
+	serialize(subscription) {
+		return {
+			id: subscription.id,
+			subscription_id: subscription.id,
+			type: subscription.type,
+			pattern: subscription.pattern,
+			streams: this.streamInfos(subscription).map((stream) => ({
+				path: stream.path,
+				link_type: stream.link_type,
+				acked_offset: stream.acked_offset
+			})),
+			webhook: subscription.webhook ? {
+				url: subscription.webhook.url,
+				signing: this.webhookSigningMetadata()
+			} : void 0,
+			wake_stream: subscription.wake_stream,
+			lease_ttl_ms: subscription.lease_ttl_ms,
+			created_at: subscription.created_at,
+			status: subscription.status,
+			description: subscription.description
+		};
+	}
+	getWebhookJwks() {
+		return getWebhookJwks();
+	}
+	shutdown() {
+		this.isShuttingDown = true;
+		for (const subscription of this.subscriptions.values()) {
+			this.clearLease(subscription);
+			if (subscription.retry_timer) clearTimeout(subscription.retry_timer);
+		}
+		this.subscriptions.clear();
+	}
+	async maybeWake(subscription, triggeredBy) {
+		if (subscription.wake_id || subscription.holder) return;
+		if (!this.hasPendingWork(subscription)) return;
+		await this.createWake(subscription, triggeredBy);
+	}
+	async createWake(subscription, triggeredBy) {
+		subscription.generation++;
+		subscription.wake_id = generateWakeId();
+		subscription.wake_snapshot = new Map(this.streamInfos(subscription).map((stream) => [stream.path, stream.tail_offset]));
+		if (subscription.type === `webhook`) {
+			subscription.token = generateCallbackToken(this.tokenSubject(subscription), subscription.generation);
+			this.extendLease(subscription);
+			this.deliverWebhook(subscription, [triggeredBy]);
+			return;
+		}
+		await this.writePullWakeEvent(subscription, triggeredBy);
+	}
+	async deliverWebhook(subscription, triggeredBy) {
+		if (!subscription.webhook || !subscription.wake_id || !subscription.token) return;
+		const body = JSON.stringify({
+			subscription_id: subscription.id,
+			wake_id: subscription.wake_id,
+			generation: subscription.generation,
+			streams: this.streamInfos(subscription),
+			callback_url: this.subscriptionActionUrl(subscription, `callback`),
+			callback_token: subscription.token
+		});
+		const headers = {
+			"content-type": `application/json`,
+			"webhook-signature": signWebhookPayload(body)
+		};
+		try {
+			const response = await fetch(subscription.webhook.url, {
+				method: `POST`,
+				headers,
+				body
+			});
+			if (!response.ok) {
+				this.scheduleWebhookRetry(subscription, triggeredBy);
+				return;
+			}
+			subscription.status = `active`;
+			subscription.retry_count = 0;
+			subscription.next_attempt_at = null;
+			let parsed = null;
+			try {
+				parsed = await response.json();
+			} catch {
+				parsed = null;
+			}
+			if (parsed?.done === true) {
+				this.autoAckWakeSnapshot(subscription);
+				this.clearLease(subscription);
+				subscription.token = null;
+				subscription.holder = null;
+				subscription.wake_id = null;
+				subscription.wake_snapshot.clear();
+				await this.triggerNextWakeIfPending(subscription);
+			}
+		} catch (err) {
+			serverLog.warn(`[subscriptions] webhook delivery failed:`, err);
+			this.scheduleWebhookRetry(subscription, triggeredBy);
+		}
+	}
+	scheduleWebhookRetry(subscription, triggeredBy) {
+		if (this.isShuttingDown) return;
+		subscription.retry_count++;
+		const baseDelay = Math.min(1e3 * Math.pow(2, Math.max(0, subscription.retry_count - 1)), MAX_RETRY_DELAY_MS);
+		const jitter = baseDelay * .2 * (Math.random() * 2 - 1);
+		const delay = Math.max(0, Math.round(baseDelay + jitter));
+		subscription.status = `failed`;
+		subscription.next_attempt_at = Date.now() + delay;
+		if (subscription.retry_timer) clearTimeout(subscription.retry_timer);
+		subscription.retry_timer = setTimeout(() => {
+			subscription.retry_timer = null;
+			this.deliverWebhook(subscription, triggeredBy);
+		}, delay);
+	}
+	async writePullWakeEvent(subscription, streamPath) {
+		if (!subscription.wake_stream) return;
+		const wakeStream = toAbsoluteStreamPath(subscription.wake_stream);
+		if (!this.streamStore.has(wakeStream)) {
+			serverLog.warn(`[subscriptions] wake stream does not exist: ${wakeStream}`);
+			return;
+		}
+		const event = {
+			type: `wake`,
+			subscription_id: subscription.id,
+			stream: streamPath,
+			generation: subscription.generation,
+			ts: Date.now()
+		};
+		await Promise.resolve(this.streamStore.append(wakeStream, new TextEncoder().encode(JSON.stringify(event))));
+	}
+	autoAckWakeSnapshot(subscription) {
+		for (const [stream, tail] of subscription.wake_snapshot) {
+			const link = subscription.streams.get(stream);
+			if (link) link.acked_offset = tail;
+		}
+	}
+	applyAcks(subscription, request) {
+		if (!request.acks) return null;
+		for (const ack of request.acks) {
+			const stream = normalizeRelativePath(ack.stream ?? ack.path ?? ``);
+			const link = subscription.streams.get(stream);
+			if (!stream || !link) return this.errorResponse(409, `INVALID_OFFSET`, `Ack references an unknown subscription stream`);
+			if (ack.offset === BEFORE_FIRST_OFFSET) return this.errorResponse(409, `INVALID_OFFSET`, `Ack offset must not be -1`);
+			if (compareOffsets(ack.offset, link.acked_offset) < 0) return this.errorResponse(409, `INVALID_OFFSET`, `Ack offset regresses the committed cursor`);
+			if (compareOffsets(ack.offset, this.getTailOffset(stream)) > 0) return this.errorResponse(409, `INVALID_OFFSET`, `Ack offset is beyond stream tail`);
+		}
+		for (const ack of request.acks) {
+			const stream = normalizeRelativePath(ack.stream ?? ack.path ?? ``);
+			subscription.streams.get(stream).acked_offset = ack.offset;
+		}
+		return null;
+	}
+	validateWakeToken(subscription, token, request) {
+		const tokenResult = validateCallbackToken(token, this.tokenSubject(subscription));
+		if (!tokenResult.valid) return this.errorResponse(401, tokenResult.code, tokenResult.code === `TOKEN_EXPIRED` ? `Token expired` : `Token invalid`);
+		if (tokenResult.epoch !== subscription.generation || request.generation !== subscription.generation || request.wake_id !== subscription.wake_id) return this.errorResponse(409, `FENCED`, `Wake generation is stale`);
+		return null;
+	}
+	async triggerNextWakeIfPending(subscription) {
+		if (!this.hasPendingWork(subscription)) return false;
+		await this.createWake(subscription, this.firstPendingStream(subscription));
+		return true;
+	}
+	hasPendingWork(subscription) {
+		return this.streamInfos(subscription).some((stream) => stream.has_pending);
+	}
+	firstPendingStream(subscription) {
+		return this.streamInfos(subscription).find((stream) => stream.has_pending)?.path ?? ``;
+	}
+	streamInfos(subscription) {
+		return Array.from(subscription.streams.values()).map((link) => {
+			const tail = this.getTailOffset(link.path);
+			return {
+				path: link.path,
+				link_type: link.link_types.has(`explicit`) ? `explicit` : `glob`,
+				acked_offset: link.acked_offset,
+				tail_offset: tail,
+				has_pending: compareOffsets(tail, link.acked_offset) > 0
+			};
+		});
+	}
+	linkStream(subscription, streamPath, linkType, ackedOffset) {
+		const normalized = normalizeRelativePath(streamPath);
+		const existing = subscription.streams.get(normalized);
+		if (existing) {
+			existing.link_types.add(linkType);
+			return existing;
+		}
+		const link = {
+			path: normalized,
+			link_types: new Set([linkType]),
+			acked_offset: ackedOffset
+		};
+		subscription.streams.set(normalized, link);
+		return link;
+	}
+	listStreams() {
+		return this.streamStore.list().map((path$1) => toStreamRelativePath(path$1)).filter((path$1) => path$1 !== null);
+	}
+	getTailOffset(streamPath) {
+		return this.streamStore.get(toAbsoluteStreamPath(streamPath))?.currentOffset ?? ZERO_OFFSET;
+	}
+	subscriptionActionUrl(subscription, action) {
+		const url = new URL(`/v1/stream/__ds/subscriptions/${encodeURIComponent(subscription.id)}/${action}`, this.callbackBaseUrl);
+		return url.toString();
+	}
+	webhookJwksUrl() {
+		const url = new URL(`/v1/stream/__ds/jwks.json`, this.callbackBaseUrl);
+		return url.toString();
+	}
+	webhookSigningMetadata() {
+		return {
+			alg: `ed25519`,
+			kid: getWebhookSigningKeyId(),
+			jwks_url: this.webhookJwksUrl()
+		};
+	}
+	extendLease(subscription) {
+		this.clearLease(subscription);
+		subscription.lease_timer = setTimeout(() => {
+			subscription.lease_timer = null;
+			subscription.holder = null;
+			subscription.token = null;
+			subscription.wake_id = null;
+			subscription.wake_snapshot.clear();
+			this.triggerNextWakeIfPending(subscription);
+		}, subscription.lease_ttl_ms);
+	}
+	clearLease(subscription) {
+		if (subscription.lease_timer) {
+			clearTimeout(subscription.lease_timer);
+			subscription.lease_timer = null;
+		}
+	}
+	tokenSubject(subscription) {
+		return `subscription:${subscription.id}`;
+	}
+	errorResponse(status, code, message) {
+		return {
+			status,
+			body: { error: {
+				code,
+				message
+			} }
+		};
+	}
+};
+
+//#endregion
+//#region src/subscription-routes.ts
+const RESERVED_CONTROL_PREFIX = `/v1/stream/__ds`;
+const SUBSCRIPTION_PREFIX = `${RESERVED_CONTROL_PREFIX}/subscriptions/`;
+const JWKS_PATH = `${RESERVED_CONTROL_PREFIX}/jwks.json`;
+const ERROR_STATUS = {
+	INVALID_REQUEST: 400,
+	SUBSCRIPTION_NOT_FOUND: 404,
+	SUBSCRIPTION_ALREADY_EXISTS: 409,
+	WEBHOOK_URL_REJECTED: 400,
+	TOKEN_INVALID: 401,
+	TOKEN_EXPIRED: 401,
+	FENCED: 409,
+	ALREADY_CLAIMED: 409,
+	NO_PENDING_WORK: 409,
+	INVALID_OFFSET: 409
+};
+var SubscriptionRoutes = class {
+	manager;
+	constructor(manager) {
+		this.manager = manager;
+	}
+	async handleRequest(method, path$1, req, res) {
+		if (path$1 === JWKS_PATH) {
+			this.handleJwks(method, res);
+			return true;
+		}
+		const route = this.parseRoute(path$1);
+		if (!route) {
+			if (path$1 === RESERVED_CONTROL_PREFIX || path$1.startsWith(`${RESERVED_CONTROL_PREFIX}/`)) {
+				this.writeError(res, 404, `SUBSCRIPTION_NOT_FOUND`, `Durable Streams control route not found`);
+				return true;
+			}
+			return false;
+		}
+		try {
+			switch (route.action) {
+				case `base`:
+					await this.handleBase(route, method, req, res);
+					return true;
+				case `streams`:
+					await this.handleStreams(route, method, req, res);
+					return true;
+				case `stream`:
+					this.handleStream(route, method, res);
+					return true;
+				case `callback`:
+					await this.handleCallback(route, req, res);
+					return true;
+				case `claim`:
+					await this.handleClaim(route, req, res);
+					return true;
+				case `ack`:
+					await this.handleAck(route, req, res);
+					return true;
+				case `release`:
+					await this.handleRelease(route, req, res);
+					return true;
+			}
+		} catch (err) {
+			if (err instanceof SyntaxError) {
+				this.writeError(res, 400, `INVALID_REQUEST`, `Invalid JSON body`);
+				return true;
+			}
+			throw err;
+		}
+	}
+	async handleBase(route, method, req, res) {
+		if (method === `PUT`) {
+			const parsed = await this.readJson(req);
+			const input = this.parseCreateInput(parsed);
+			if (`error` in input) {
+				this.writeError(res, 400, `INVALID_REQUEST`, input.error);
+				return;
+			}
+			const result = this.manager.createOrConfirm(route.subscriptionId, input.value);
+			if (`error` in result) {
+				this.writeError(res, ERROR_STATUS[result.error.code], result.error.code, result.error.message);
+				return;
+			}
+			this.writeJson(res, result.created ? 201 : 200, this.manager.serialize(result.subscription));
+			return;
+		}
+		if (method === `GET`) {
+			const subscription = this.manager.get(route.subscriptionId);
+			if (!subscription) {
+				this.writeError(res, 404, `SUBSCRIPTION_NOT_FOUND`, `Subscription not found`);
+				return;
+			}
+			this.writeJson(res, 200, this.manager.serialize(subscription));
+			return;
+		}
+		if (method === `DELETE`) {
+			this.manager.delete(route.subscriptionId);
+			res.writeHead(204);
+			res.end();
+			return;
+		}
+		this.methodNotAllowed(res);
+	}
+	handleJwks(method, res) {
+		if (method !== `GET`) {
+			this.methodNotAllowed(res);
+			return;
+		}
+		res.writeHead(200, {
+			"content-type": `application/jwk-set+json`,
+			"cache-control": `public, max-age=300`
+		});
+		res.end(JSON.stringify(this.manager.getWebhookJwks()));
+	}
+	async handleStreams(route, method, req, res) {
+		if (method !== `POST`) {
+			this.methodNotAllowed(res);
+			return;
+		}
+		const parsed = await this.readJson(req);
+		const streams = parsed.streams;
+		if (!Array.isArray(streams) || streams.some((stream) => typeof stream !== `string` || stream.length === 0)) {
+			this.writeError(res, 400, `INVALID_REQUEST`, `streams must be a non-empty string array`);
+			return;
+		}
+		const ok = this.manager.addExplicitStreams(route.subscriptionId, streams.map(normalizeRelativePath));
+		if (!ok) {
+			this.writeError(res, 404, `SUBSCRIPTION_NOT_FOUND`, `Subscription not found`);
+			return;
+		}
+		res.writeHead(204);
+		res.end();
+	}
+	handleStream(route, method, res) {
+		if (method !== `DELETE`) {
+			this.methodNotAllowed(res);
+			return;
+		}
+		const ok = this.manager.removeExplicitStream(route.subscriptionId, route.streamPath ?? ``);
+		if (!ok) {
+			this.writeError(res, 404, `SUBSCRIPTION_NOT_FOUND`, `Subscription not found`);
+			return;
+		}
+		res.writeHead(204);
+		res.end();
+	}
+	async handleCallback(route, req, res) {
+		const token = this.readBearerToken(req);
+		if (!token) {
+			this.writeError(res, 401, `TOKEN_INVALID`, `Missing or malformed Authorization header`);
+			return;
+		}
+		const body = await this.readJson(req);
+		const result = await this.manager.handleWebhookCallback(route.subscriptionId, token, body);
+		this.writeManagerResult(res, result);
+	}
+	async handleClaim(route, req, res) {
+		const parsed = await this.readJson(req);
+		const worker = parsed.worker;
+		if (typeof worker !== `string` || worker.length === 0) {
+			this.writeError(res, 400, `INVALID_REQUEST`, `worker must be a non-empty string`);
+			return;
+		}
+		const result = await this.manager.claim(route.subscriptionId, worker);
+		this.writeManagerResult(res, result);
+	}
+	async handleAck(route, req, res) {
+		const token = this.readBearerToken(req);
+		if (!token) {
+			this.writeError(res, 401, `TOKEN_INVALID`, `Missing or malformed Authorization header`);
+			return;
+		}
+		const body = await this.readJson(req);
+		const result = await this.manager.ack(route.subscriptionId, token, body);
+		this.writeManagerResult(res, result);
+	}
+	async handleRelease(route, req, res) {
+		const token = this.readBearerToken(req);
+		if (!token) {
+			this.writeError(res, 401, `TOKEN_INVALID`, `Missing or malformed Authorization header`);
+			return;
+		}
+		const body = await this.readJson(req);
+		const result = await this.manager.release(route.subscriptionId, token, body);
+		this.writeManagerResult(res, result);
+	}
+	parseCreateInput(value) {
+		if (!value || typeof value !== `object`) return { error: `Request body must be a JSON object` };
+		const payload = value;
+		if (payload.type !== `webhook` && payload.type !== `pull-wake`) return { error: `type must be "webhook" or "pull-wake"` };
+		const type = payload.type;
+		const pattern = typeof payload.pattern === `string` && payload.pattern.length > 0 ? normalizeRelativePath(payload.pattern) : void 0;
+		const streams = Array.isArray(payload.streams) && payload.streams.length > 0 ? payload.streams.map((stream) => typeof stream === `string` ? normalizeRelativePath(stream) : null) : [];
+		if (streams.some((stream) => stream === null)) return { error: `streams must contain only strings` };
+		if (!pattern && streams.length === 0) return { error: `At least one of pattern or streams is required` };
+		const leaseTtl = payload.lease_ttl_ms === void 0 ? DEFAULT_LEASE_TTL_MS : payload.lease_ttl_ms;
+		if (typeof leaseTtl !== `number` || !Number.isInteger(leaseTtl) || leaseTtl < MIN_LEASE_TTL_MS || leaseTtl > MAX_LEASE_TTL_MS) return { error: `lease_ttl_ms must be an integer from 1000 to 600000` };
+		let webhook;
+		if (type === `webhook`) {
+			const rawWebhook = payload.webhook;
+			if (!rawWebhook || typeof rawWebhook !== `object`) return { error: `webhook subscriptions require webhook.url` };
+			const url = rawWebhook.url;
+			if (typeof url !== `string` || url.length === 0) return { error: `webhook subscriptions require webhook.url` };
+			webhook = { url };
+		}
+		const wakeStream = typeof payload.wake_stream === `string` && payload.wake_stream.length > 0 ? normalizeRelativePath(payload.wake_stream) : void 0;
+		if (type === `pull-wake` && !wakeStream) return { error: `pull-wake subscriptions require wake_stream` };
+		return { value: {
+			type,
+			pattern,
+			streams,
+			webhook,
+			wake_stream: wakeStream,
+			lease_ttl_ms: leaseTtl,
+			description: typeof payload.description === `string` ? payload.description : void 0
+		} };
+	}
+	parseRoute(path$1) {
+		if (!path$1.startsWith(SUBSCRIPTION_PREFIX)) return null;
+		const rest = path$1.slice(SUBSCRIPTION_PREFIX.length);
+		const parts = rest.split(`/`);
+		const subscriptionId = parts[0] ? decodeURIComponent(parts[0]) : ``;
+		if (!subscriptionId) return null;
+		const tail = parts.slice(1);
+		if (tail.length === 0) return {
+			subscriptionId,
+			action: `base`
+		};
+		if (tail[0] === `streams` && tail.length === 1) return {
+			subscriptionId,
+			action: `streams`
+		};
+		if (tail[0] === `streams` && tail.length > 1) return {
+			subscriptionId,
+			action: `stream`,
+			streamPath: normalizeRelativePath(decodeURIComponent(tail.slice(1).join(`/`)))
+		};
+		if (tail.length === 1 && [
+			`callback`,
+			`claim`,
+			`ack`,
+			`release`
+		].includes(tail[0])) return {
+			subscriptionId,
+			action: tail[0]
+		};
+		return null;
+	}
+	readBearerToken(req) {
+		const authHeader = req.headers.authorization;
+		if (!authHeader || !authHeader.startsWith(`Bearer `)) return null;
+		return authHeader.slice(`Bearer `.length);
+	}
+	async readJson(req) {
+		const chunks = [];
+		for await (const chunk of req) chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk));
+		const raw = Buffer.concat(chunks).toString(`utf8`);
+		return raw.length > 0 ? JSON.parse(raw) : {};
+	}
+	writeManagerResult(res, result) {
+		if (result.status === 204) {
+			res.writeHead(204);
+			res.end();
+			return;
+		}
+		this.writeJson(res, result.status, result.body ?? {});
+	}
+	writeJson(res, status, body) {
+		res.writeHead(status, { "content-type": `application/json` });
+		res.end(JSON.stringify(body));
+	}
+	writeError(res, status, code, message) {
+		this.writeJson(res, status, { error: {
+			code,
+			message
+		} });
+	}
+	methodNotAllowed(res) {
+		res.writeHead(405, { "content-type": `text/plain` });
+		res.end(`Method not allowed`);
+	}
+};
+
 //#endregion
 //#region src/server.ts
-const STREAM_OFFSET_HEADER = `Stream-Next-Offset`;
-const STREAM_CURSOR_HEADER = `Stream-Cursor`;
-const STREAM_UP_TO_DATE_HEADER = `Stream-Up-To-Date`;
-const STREAM_SEQ_HEADER = `Stream-Seq`;
-const STREAM_TTL_HEADER = `Stream-TTL`;
-const STREAM_EXPIRES_AT_HEADER = `Stream-Expires-At`;
 const STREAM_SSE_DATA_ENCODING_HEADER = `Stream-SSE-Data-Encoding`;
-const PRODUCER_ID_HEADER = `Producer-Id`;
-const PRODUCER_EPOCH_HEADER = `Producer-Epoch`;
-const PRODUCER_SEQ_HEADER = `Producer-Seq`;
-const PRODUCER_EXPECTED_SEQ_HEADER = `Producer-Expected-Seq`;
-const PRODUCER_RECEIVED_SEQ_HEADER = `Producer-Received-Seq`;
-const SSE_OFFSET_FIELD = `streamNextOffset`;
-const SSE_CURSOR_FIELD = `streamCursor`;
 const SSE_UP_TO_DATE_FIELD = `upToDate`;
-const SSE_CLOSED_FIELD = `streamClosed`;
-const STREAM_CLOSED_HEADER = `Stream-Closed`;
 const STREAM_FORKED_FROM_HEADER = `Stream-Forked-From`;
 const STREAM_FORK_OFFSET_HEADER = `Stream-Fork-Offset`;
-const OFFSET_QUERY_PARAM = `offset`;
-const LIVE_QUERY_PARAM = `live`;
-const CURSOR_QUERY_PARAM = `cursor`;
 /**
 * Encode data for SSE format.
 * Per SSE spec, each line in the payload needs its own "data:" prefix.
@@ -2017,6 +3059,8 @@ var DurableStreamTestServer = class {
 	isShuttingDown = false;
 	/** Injected faults for testing retry/resilience */
 	injectedFaults = new Map();
+	subscriptionManager = null;
+	subscriptionRoutes = null;
 	constructor(options = {}) {
 		if (options.dataDir) this.store = new FileBackedStreamStore({ dataDir: options.dataDir });
 		else this.store = new StreamStore();
@@ -2031,7 +3075,8 @@ var DurableStreamTestServer = class {
 			cursorOptions: {
 				intervalSeconds: options.cursorIntervalSeconds,
 				epoch: options.cursorEpoch
-			}
+			},
+			webhooks: options.webhooks ?? false
 		};
 	}
 	/**
@@ -2042,7 +3087,7 @@ var DurableStreamTestServer = class {
 		return new Promise((resolve, reject) => {
 			this.server = createServer((req, res) => {
 				this.handleRequest(req, res).catch((err) => {
-					console.error(`Request error:`, err);
+					serverLog.error(`Request error:`, err);
 					if (!res.headersSent) {
 						res.writeHead(500, { "content-type": `text/plain` });
 						res.end(`Internal server error`);
@@ -2054,6 +3099,12 @@ var DurableStreamTestServer = class {
 				const addr = this.server.address();
 				if (typeof addr === `string`) this._url = addr;
 				else if (addr) this._url = `http://${this.options.host}:${addr.port}`;
+				this.subscriptionManager = new SubscriptionManager({
+					callbackBaseUrl: this._url,
+					streamStore: this.store,
+					webhooksEnabled: this.options.webhooks
+				});
+				this.subscriptionRoutes = new SubscriptionRoutes(this.subscriptionManager);
 				resolve(this._url);
 			});
 		});
@@ -2064,6 +3115,11 @@ var DurableStreamTestServer = class {
 	async stop() {
 		if (!this.server) return;
 		this.isShuttingDown = true;
+		if (this.subscriptionManager) {
+			this.subscriptionManager.shutdown();
+			this.subscriptionManager = null;
+			this.subscriptionRoutes = null;
+		}
 		if (`cancelAllWaits` in this.store) this.store.cancelAllWaits();
 		for (const res of this.activeSSEResponses) res.end();
 		this.activeSSEResponses.clear();
@@ -2103,8 +3159,8 @@ var DurableStreamTestServer = class {
 	* Used for testing retry/resilience behavior.
 	* @deprecated Use injectFault for full fault injection capabilities
 	*/
-	injectError(path$2, status, count = 1, retryAfter) {
-		this.injectedFaults.set(path$2, {
+	injectError(path$1, status, count = 1, retryAfter) {
+		this.injectedFaults.set(path$1, {
 			status,
 			count,
 			retryAfter
@@ -2114,8 +3170,8 @@ var DurableStreamTestServer = class {
 	* Inject a fault to be triggered on the next N requests to a path.
 	* Supports various fault types: delays, connection drops, body corruption, etc.
 	*/
-	injectFault(path$2, fault) {
-		this.injectedFaults.set(path$2, {
+	injectFault(path$1, fault) {
+		this.injectedFaults.set(path$1, {
 			count: 1,
 			...fault
 		});
@@ -2130,13 +3186,13 @@ var DurableStreamTestServer = class {
 	* Check if there's an injected fault for this path/method and consume it.
 	* Returns the fault config if one should be triggered, null otherwise.
 	*/
-	consumeInjectedFault(path$2, method) {
-		const fault = this.injectedFaults.get(path$2);
+	consumeInjectedFault(path$1, method) {
+		const fault = this.injectedFaults.get(path$1);
 		if (!fault) return null;
 		if (fault.method && fault.method.toUpperCase() !== method.toUpperCase()) return null;
 		if (fault.probability !== void 0 && Math.random() > fault.probability) return null;
 		fault.count--;
-		if (fault.count <= 0) this.injectedFaults.delete(path$2);
+		if (fault.count <= 0) this.injectedFaults.delete(path$1);
 		return fault;
 	}
 	/**
@@ -2171,7 +3227,7 @@ var DurableStreamTestServer = class {
 	}
 	async handleRequest(req, res) {
 		const url = new URL(req.url ?? `/`, `http://${req.headers.host}`);
-		const path$2 = url.pathname;
+		const path$1 = url.pathname;
 		const method = req.method?.toUpperCase();
 		res.setHeader(`access-control-allow-origin`, `*`);
 		res.setHeader(`access-control-allow-methods`, `GET, POST, PUT, DELETE, HEAD, OPTIONS`);
@@ -2184,11 +3240,11 @@ var DurableStreamTestServer = class {
 			res.end();
 			return;
 		}
-		if (path$2 === `/_test/inject-error`) {
+		if (path$1 === `/_test/inject-error`) {
 			await this.handleTestInjectError(method, req, res);
 			return;
 		}
-		const fault = this.consumeInjectedFault(path$2, method ?? `GET`);
+		const fault = this.consumeInjectedFault(path$1, method ?? `GET`);
 		if (fault) {
 			await this.applyFaultDelay(fault);
 			if (fault.dropConnection) {
@@ -2204,22 +3260,26 @@ var DurableStreamTestServer = class {
 			}
 			if (fault.truncateBodyBytes !== void 0 || fault.corruptBody || fault.injectSseEvent) res._injectedFault = fault;
 		}
+		if (this.subscriptionRoutes && method) {
+			const handled = await this.subscriptionRoutes.handleRequest(method, path$1, req, res);
+			if (handled) return;
+		}
 		try {
 			switch (method) {
 				case `PUT`:
-					await this.handleCreate(path$2, req, res);
+					await this.handleCreate(path$1, req, res);
 					break;
 				case `HEAD`:
-					this.handleHead(path$2, res);
+					this.handleHead(path$1, res);
 					break;
 				case `GET`:
-					await this.handleRead(path$2, url, req, res);
+					await this.handleRead(path$1, url, req, res);
 					break;
 				case `POST`:
-					await this.handleAppend(path$2, req, res);
+					await this.handleAppend(path$1, req, res);
 					break;
 				case `DELETE`:
-					await this.handleDelete(path$2, res);
+					await this.handleDelete(path$1, res);
 					break;
 				default:
 					res.writeHead(405, { "content-type": `text/plain` });
@@ -2257,15 +3317,15 @@ var DurableStreamTestServer = class {
 	/**
 	* Handle PUT - create stream
 	*/
-	async handleCreate(path$2, req, res) {
+	async handleCreate(path$1, req, res) {
 		let contentType = req.headers[`content-type`];
-		if (!contentType || contentType.trim() === `` || !/^[\w-]+\/[\w-]+/.test(contentType)) contentType = `application/octet-stream`;
+		const forkedFromHeader = req.headers[STREAM_FORKED_FROM_HEADER.toLowerCase()];
+		const forkOffsetHeader = req.headers[STREAM_FORK_OFFSET_HEADER.toLowerCase()];
+		if (!contentType || contentType.trim() === `` || !/^[\w-]+\/[\w-]+/.test(contentType)) contentType = forkedFromHeader ? void 0 : `application/octet-stream`;
 		const ttlHeader = req.headers[STREAM_TTL_HEADER.toLowerCase()];
 		const expiresAtHeader = req.headers[STREAM_EXPIRES_AT_HEADER.toLowerCase()];
 		const closedHeader = req.headers[STREAM_CLOSED_HEADER.toLowerCase()];
 		const createClosed = closedHeader === `true`;
-		const forkedFromHeader = req.headers[STREAM_FORKED_FROM_HEADER.toLowerCase()];
-		const forkOffsetHeader = req.headers[STREAM_FORK_OFFSET_HEADER.toLowerCase()];
 		if (ttlHeader && expiresAtHeader) {
 			res.writeHead(400, { "content-type": `text/plain` });
 			res.end(`Cannot specify both Stream-TTL and Stream-Expires-At`);
@@ -2303,9 +3363,9 @@ var DurableStreamTestServer = class {
 			}
 		}
 		const body = await this.readBody(req);
-		const isNew = !this.store.has(path$2);
+		const isNew = !this.store.has(path$1);
 		try {
-			await Promise.resolve(this.store.create(path$2, {
+			await Promise.resolve(this.store.create(path$1, {
 				contentType,
 				ttlSeconds,
 				expiresAt: expiresAtHeader,
@@ -2339,18 +3399,20 @@ var DurableStreamTestServer = class {
 			}
 			throw err;
 		}
-		const stream = this.store.get(path$2);
+		const stream = this.store.get(path$1);
+		const resolvedContentType = stream.contentType ?? contentType ?? `application/octet-stream`;
 		if (isNew && this.options.onStreamCreated) await Promise.resolve(this.options.onStreamCreated({
 			type: `created`,
-			path: path$2,
-			contentType: stream.contentType ?? contentType,
+			path: path$1,
+			contentType: resolvedContentType,
 			timestamp: Date.now()
 		}));
+		if (isNew && body.length > 0) await this.notifyStreamAppend(path$1);
 		const headers = {
-			"content-type": stream.contentType ?? contentType,
+			"content-type": resolvedContentType,
 			[STREAM_OFFSET_HEADER]: stream.currentOffset
 		};
-		if (isNew) headers[`location`] = `${this._url}${path$2}`;
+		if (isNew) headers[`location`] = `${this._url}${path$1}`;
 		if (stream.closed) headers[STREAM_CLOSED_HEADER] = `true`;
 		res.writeHead(isNew ? 201 : 200, headers);
 		res.end();
@@ -2358,8 +3420,8 @@ var DurableStreamTestServer = class {
 	/**
 	* Handle HEAD - get metadata
 	*/
-	handleHead(path$2, res) {
-		const stream = this.store.get(path$2);
+	handleHead(path$1, res) {
+		const stream = this.store.get(path$1);
 		if (!stream) {
 			res.writeHead(404, { "content-type": `text/plain` });
 			res.end();
@@ -2379,15 +3441,15 @@ var DurableStreamTestServer = class {
 		if (stream.ttlSeconds !== void 0) headers[STREAM_TTL_HEADER] = String(stream.ttlSeconds);
 		if (stream.expiresAt) headers[STREAM_EXPIRES_AT_HEADER] = stream.expiresAt;
 		const closedSuffix = stream.closed ? `:c` : ``;
-		headers[`etag`] = `"${Buffer.from(path$2).toString(`base64`)}:-1:${stream.currentOffset}${closedSuffix}"`;
+		headers[`etag`] = `"${Buffer.from(path$1).toString(`base64`)}:-1:${stream.currentOffset}${closedSuffix}"`;
 		res.writeHead(200, headers);
 		res.end();
 	}
 	/**
 	* Handle GET - read data
 	*/
-	async handleRead(path$2, url, req, res) {
-		const stream = this.store.get(path$2);
+	async handleRead(path$1, url, req, res) {
+		const stream = this.store.get(path$1);
 		if (!stream) {
 			res.writeHead(404, { "content-type": `text/plain` });
 			res.end(`Stream not found`);
@@ -2433,7 +3495,7 @@ var DurableStreamTestServer = class {
 		}
 		if (live === `sse`) {
 			const sseOffset = offset === `now` ? stream.currentOffset : offset;
-			await this.handleSSE(path$2, stream, sseOffset, cursor, useBase64, res);
+			await this.handleSSE(path$1, stream, sseOffset, cursor, useBase64, res);
 			return;
 		}
 		const effectiveOffset = offset === `now` ? stream.currentOffset : offset;
@@ -2451,8 +3513,8 @@ var DurableStreamTestServer = class {
 			res.end(responseBody);
 			return;
 		}
-		let { messages, upToDate } = this.store.read(path$2, effectiveOffset);
-		this.store.touchAccess(path$2);
+		let { messages, upToDate } = this.store.read(path$1, effectiveOffset);
+		this.store.touchAccess(path$1);
 		const clientIsCaughtUp = effectiveOffset && effectiveOffset === stream.currentOffset || offset === `now`;
 		if (live === `long-poll` && clientIsCaughtUp && messages.length === 0) {
 			if (stream.closed) {
@@ -2464,8 +3526,8 @@ var DurableStreamTestServer = class {
 				res.end();
 				return;
 			}
-			const result = await this.store.waitForMessages(path$2, effectiveOffset ?? stream.currentOffset, this.options.longPollTimeout);
-			this.store.touchAccess(path$2);
+			const result = await this.store.waitForMessages(path$1, effectiveOffset ?? stream.currentOffset, this.options.longPollTimeout);
+			this.store.touchAccess(path$1);
 			if (result.streamClosed) {
 				const responseCursor = generateResponseCursor(cursor, this.options.cursorOptions);
 				res.writeHead(204, {
@@ -2479,7 +3541,7 @@ var DurableStreamTestServer = class {
 			}
 			if (result.timedOut) {
 				const responseCursor = generateResponseCursor(cursor, this.options.cursorOptions);
-				const currentStream$1 = this.store.get(path$2);
+				const currentStream$1 = this.store.get(path$1);
 				const timeoutHeaders = {
 					[STREAM_OFFSET_HEADER]: effectiveOffset ?? stream.currentOffset,
 					[STREAM_UP_TO_DATE_HEADER]: `true`,
@@ -2500,12 +3562,12 @@ var DurableStreamTestServer = class {
 		headers[STREAM_OFFSET_HEADER] = responseOffset;
 		if (live === `long-poll`) headers[STREAM_CURSOR_HEADER] = generateResponseCursor(cursor, this.options.cursorOptions);
 		if (upToDate) headers[STREAM_UP_TO_DATE_HEADER] = `true`;
-		const currentStream = this.store.get(path$2);
+		const currentStream = this.store.get(path$1);
 		const clientAtTail = responseOffset === currentStream?.currentOffset;
 		if (currentStream?.closed && clientAtTail && upToDate) headers[STREAM_CLOSED_HEADER] = `true`;
 		const startOffset = offset ?? `-1`;
 		const closedSuffix = currentStream?.closed && clientAtTail && upToDate ? `:c` : ``;
-		const etag = `"${Buffer.from(path$2).toString(`base64`)}:${startOffset}:${responseOffset}${closedSuffix}"`;
+		const etag = `"${Buffer.from(path$1).toString(`base64`)}:${startOffset}:${responseOffset}${closedSuffix}"`;
 		headers[`etag`] = etag;
 		const ifNoneMatch = req.headers[`if-none-match`];
 		if (ifNoneMatch && ifNoneMatch === etag) {
@@ -2513,7 +3575,7 @@ var DurableStreamTestServer = class {
 			res.end();
 			return;
 		}
-		const responseData = this.store.formatResponse(path$2, messages);
+		const responseData = this.store.formatResponse(path$1, messages);
 		let finalData = responseData;
 		if (this.options.compression && responseData.length >= COMPRESSION_THRESHOLD) {
 			const acceptEncoding = req.headers[`accept-encoding`];
@@ -2531,7 +3593,7 @@ var DurableStreamTestServer = class {
 	/**
 	* Handle SSE (Server-Sent Events) mode
 	*/
-	async handleSSE(path$2, stream, initialOffset, cursor, useBase64, res) {
+	async handleSSE(path$1, stream, initialOffset, cursor, useBase64, res) {
 		this.activeSSEResponses.add(res);
 		const sseHeaders = {
 			"content-type": `text/event-stream`,
@@ -2557,20 +3619,20 @@ var DurableStreamTestServer = class {
 		});
 		const isJsonStream = stream?.contentType?.includes(`application/json`);
 		while (isConnected && !this.isShuttingDown) {
-			const { messages, upToDate } = this.store.read(path$2, currentOffset);
-			this.store.touchAccess(path$2);
+			const { messages, upToDate } = this.store.read(path$1, currentOffset);
+			this.store.touchAccess(path$1);
 			for (const message of messages) {
 				let dataPayload;
 				if (useBase64) dataPayload = Buffer.from(message.data).toString(`base64`);
 				else if (isJsonStream) {
-					const jsonBytes = this.store.formatResponse(path$2, [message]);
+					const jsonBytes = this.store.formatResponse(path$1, [message]);
 					dataPayload = decoder.decode(jsonBytes);
 				} else dataPayload = decoder.decode(message.data);
 				res.write(`event: data\n`);
 				res.write(encodeSSEData(dataPayload));
 				currentOffset = message.offset;
 			}
-			const currentStream = this.store.get(path$2);
+			const currentStream = this.store.get(path$1);
 			const controlOffset = messages[messages.length - 1]?.offset ?? currentStream.currentOffset;
 			const streamIsClosed = currentStream?.closed ?? false;
 			const clientAtTail = controlOffset === currentStream.currentOffset;
@@ -2595,10 +3657,10 @@ var DurableStreamTestServer = class {
 					res.write(encodeSSEData(JSON.stringify(finalControlData)));
 					break;
 				}
-				const result = await this.store.waitForMessages(path$2, currentOffset, this.options.longPollTimeout);
-				this.store.touchAccess(path$2);
+				const result = await this.store.waitForMessages(path$1, currentOffset, this.options.longPollTimeout);
+				this.store.touchAccess(path$1);
 				if (this.isShuttingDown || !isConnected) break;
-				if (result.streamClosed) {
+				if (result.streamClosed && result.messages.length === 0) {
 					const finalControlData = {
 						[SSE_OFFSET_FIELD]: currentOffset,
 						[SSE_CLOSED_FIELD]: true
@@ -2609,7 +3671,7 @@ var DurableStreamTestServer = class {
 				}
 				if (result.timedOut) {
 					const keepAliveCursor = generateResponseCursor(cursor, this.options.cursorOptions);
-					const streamAfterWait = this.store.get(path$2);
+					const streamAfterWait = this.store.get(path$1);
 					if (streamAfterWait?.closed) {
 						const closedControlData = {
 							[SSE_OFFSET_FIELD]: currentOffset,
@@ -2634,7 +3696,7 @@ var DurableStreamTestServer = class {
 	/**
 	* Handle POST - append data
 	*/
-	async handleAppend(path$2, req, res) {
+	async handleAppend(path$1, req, res) {
 		const contentType = req.headers[`content-type`];
 		const seq = req.headers[STREAM_SEQ_HEADER.toLowerCase()];
 		const closedHeader = req.headers[STREAM_CLOSED_HEADER.toLowerCase()];
@@ -2684,7 +3746,7 @@ var DurableStreamTestServer = class {
 		const body = await this.readBody(req);
 		if (body.length === 0 && closeStream) {
 			if (hasAllProducerHeaders) {
-				const closeResult$1 = await this.store.closeStreamWithProducer(path$2, {
+				const closeResult$1 = await this.store.closeStreamWithProducer(path$1, {
 					producerId,
 					producerEpoch,
 					producerSeq
@@ -2727,7 +3789,7 @@ var DurableStreamTestServer = class {
 					return;
 				}
 				if (closeResult$1.producerResult?.status === `stream_closed`) {
-					const stream = this.store.get(path$2);
+					const stream = this.store.get(path$1);
 					res.writeHead(409, {
 						"content-type": `text/plain`,
 						[STREAM_CLOSED_HEADER]: `true`,
@@ -2745,7 +3807,7 @@ var DurableStreamTestServer = class {
 				res.end();
 				return;
 			}
-			const closeResult = this.store.closeStream(path$2);
+			const closeResult = this.store.closeStream(path$1);
 			if (!closeResult) {
 				res.writeHead(404, { "content-type": `text/plain` });
 				res.end(`Stream not found`);
@@ -2777,14 +3839,14 @@ var DurableStreamTestServer = class {
 			close: closeStream
 		};
 		let result;
-		if (producerId !== void 0) result = await this.store.appendWithProducer(path$2, body, appendOptions);
-		else result = await Promise.resolve(this.store.append(path$2, body, appendOptions));
-		this.store.touchAccess(path$2);
+		if (producerId !== void 0) result = await this.store.appendWithProducer(path$1, body, appendOptions);
+		else result = await Promise.resolve(this.store.append(path$1, body, appendOptions));
+		this.store.touchAccess(path$1);
 		if (result && typeof result === `object` && `message` in result) {
 			const { message: message$1, producerResult, streamClosed } = result;
 			if (streamClosed && !message$1) {
 				if (producerResult?.status === `duplicate`) {
-					const stream = this.store.get(path$2);
+					const stream = this.store.get(path$1);
 					res.writeHead(204, {
 						[STREAM_OFFSET_HEADER]: stream?.currentOffset ?? ``,
 						[STREAM_CLOSED_HEADER]: `true`,
@@ -2794,7 +3856,7 @@ var DurableStreamTestServer = class {
 					res.end();
 					return;
 				}
-				const closedStream = this.store.get(path$2);
+				const closedStream = this.store.get(path$1);
 				res.writeHead(409, {
 					"content-type": `text/plain`,
 					[STREAM_CLOSED_HEADER]: `true`,
@@ -2811,6 +3873,7 @@ var DurableStreamTestServer = class {
 				const statusCode = producerId !== void 0 ? 200 : 204;
 				res.writeHead(statusCode, responseHeaders$1);
 				res.end();
+				await this.notifyStreamAppend(path$1);
 				return;
 			}
 			switch (producerResult.status) {
@@ -2851,18 +3914,27 @@ var DurableStreamTestServer = class {
 		if (closeStream) responseHeaders[STREAM_CLOSED_HEADER] = `true`;
 		res.writeHead(204, responseHeaders);
 		res.end();
+		await this.notifyStreamAppend(path$1);
+	}
+	async notifyStreamAppend(path$1) {
+		if (!this.subscriptionManager) return;
+		try {
+			await this.subscriptionManager.onStreamAppend(path$1);
+		} catch (err) {
+			serverLog.error(`[server] subscription append hook failed:`, err);
+		}
 	}
 	/**
 	* Handle DELETE - delete stream
 	*/
-	async handleDelete(path$2, res) {
-		const existing = this.store.get(path$2);
+	async handleDelete(path$1, res) {
+		const existing = this.store.get(path$1);
 		if (existing?.softDeleted) {
 			res.writeHead(410, { "content-type": `text/plain` });
 			res.end(`Stream is gone`);
 			return;
 		}
-		const deleted = this.store.delete(path$2);
+		const deleted = this.store.delete(path$1);
 		if (!deleted) {
 			res.writeHead(404, { "content-type": `text/plain` });
 			res.end(`Stream not found`);
@@ -2870,9 +3942,10 @@ var DurableStreamTestServer = class {
 		}
 		if (this.options.onStreamDeleted) await Promise.resolve(this.options.onStreamDeleted({
 			type: `deleted`,
-			path: path$2,
+			path: path$1,
 			timestamp: Date.now()
 		}));
+		if (this.subscriptionManager) this.subscriptionManager.onStreamDeleted(path$1);
 		res.writeHead(204);
 		res.end();
 	}
@@ -3002,4 +4075,4 @@ function createRegistryHooks(store, serverUrl) {
 }
 
 //#endregion
-export { DEFAULT_CURSOR_EPOCH, DEFAULT_CURSOR_INTERVAL_SECONDS, DurableStreamTestServer, FileBackedStreamStore, StreamStore, calculateCursor, createRegistryHooks, decodeStreamPath, encodeStreamPath, generateResponseCursor, handleCursorCollision };
+export { DEFAULT_CURSOR_EPOCH, DEFAULT_CURSOR_INTERVAL_SECONDS, DurableStreamTestServer, FileBackedStreamStore, StreamStore, SubscriptionManager, SubscriptionRoutes, calculateCursor, createRegistryHooks, decodeStreamPath, encodeStreamPath, generateResponseCursor, globMatch, handleCursorCollision, validateWebhookUrl };