@ewhauser/world-celld 0.1.0

package/dist/testing.js

@@ -0,0 +1,1808 @@
+import { i as parse, n as rpcParse, r as rpcStringify, t as compact } from "./util-BvWlkqgV.js";
+import { EventSchema, HookSchema, SPEC_VERSION_CURRENT, StepSchema, WorkflowRunSchema, isLegacySpecVersion, isTerminalStepStatus, isTerminalWorkflowRunStatus, requiresNewerWorld } from "@workflow/world";
+import http from "node:http";
+//#region src/testing/fake-cell.ts
+function applyListOptions(keys, options) {
+	let result = keys.toSorted();
+	if (options.prefix !== void 0) {
+		const prefix = options.prefix;
+		result = result.filter((k) => k.startsWith(prefix));
+	}
+	if (options.start !== void 0) {
+		const bound = options.start;
+		result = result.filter((k) => k >= bound);
+	}
+	if (options.startAfter !== void 0) {
+		const bound = options.startAfter;
+		result = result.filter((k) => k > bound);
+	}
+	if (options.end !== void 0) {
+		const bound = options.end;
+		result = result.filter((k) => k < bound);
+	}
+	if (options.reverse) result = result.toReversed();
+	if (options.limit !== void 0) result = result.slice(0, options.limit);
+	return result;
+}
+/**
+* Fake DurableObjectStorage over a Map. Transactions stage writes and commit
+* on success (discard on throw), with reads seeing staged state — the
+* semantics apply-event.ts relies on.
+*/
+var FakeStorage = class {
+	clock;
+	data = /* @__PURE__ */ new Map();
+	alarmAt = null;
+	mutationFailure;
+	constructor(clock = () => Date.now()) {
+		this.clock = clock;
+	}
+	async get(key) {
+		return this.data.get(key);
+	}
+	async put(key, value) {
+		this.maybeFailMutation({
+			operation: "put",
+			key,
+			value
+		});
+		this.data.set(key, structuredClone(value));
+	}
+	async delete(key) {
+		this.maybeFailMutation({
+			operation: "delete",
+			key
+		});
+		return this.data.delete(key);
+	}
+	async deleteAll() {
+		this.data.clear();
+	}
+	async list(options = {}) {
+		const keys = applyListOptions(Array.from(this.data.keys()), options);
+		return new Map(keys.map((k) => [k, this.data.get(k)]));
+	}
+	async transaction(cb) {
+		const txn = new FakeTransaction(this);
+		const result = await cb(txn);
+		txn.commit();
+		return result;
+	}
+	async getAlarm() {
+		return this.alarmAt;
+	}
+	async setAlarm(at) {
+		this.alarmAt = typeof at === "number" ? at : at.getTime();
+	}
+	async deleteAlarm() {
+		this.alarmAt = null;
+	}
+	now() {
+		return this.clock();
+	}
+	/** Inject one matching write failure, including writes inside transactions. */
+	failNextMutation(predicate, error = /* @__PURE__ */ new Error("injected fake storage mutation failure")) {
+		this.mutationFailure = {
+			predicate,
+			error
+		};
+	}
+	/** @internal Shared with FakeTransaction so failure injection survives a transaction fix. */
+	maybeFailMutation(mutation) {
+		if (!this.mutationFailure?.predicate(mutation)) return;
+		const { error } = this.mutationFailure;
+		this.mutationFailure = void 0;
+		throw error;
+	}
+};
+var FakeTransaction = class {
+	storage;
+	staged = /* @__PURE__ */ new Map();
+	deleted = /* @__PURE__ */ new Set();
+	stagedAlarm;
+	constructor(storage) {
+		this.storage = storage;
+	}
+	async get(key) {
+		if (this.deleted.has(key)) return void 0;
+		if (this.staged.has(key)) return this.staged.get(key);
+		return this.storage.data.get(key);
+	}
+	async put(key, value) {
+		this.storage.maybeFailMutation({
+			operation: "put",
+			key,
+			value
+		});
+		this.deleted.delete(key);
+		this.staged.set(key, structuredClone(value));
+	}
+	async delete(key) {
+		this.storage.maybeFailMutation({
+			operation: "delete",
+			key
+		});
+		const existed = !this.deleted.has(key) && this.staged.has(key) || this.storage.data.has(key);
+		this.staged.delete(key);
+		this.deleted.add(key);
+		return existed;
+	}
+	async list(options = {}) {
+		const merged = new Map(this.storage.data);
+		for (const key of this.deleted) merged.delete(key);
+		for (const [key, value] of this.staged) merged.set(key, value);
+		const keys = applyListOptions(Array.from(merged.keys()), options);
+		return new Map(keys.map((k) => [k, merged.get(k)]));
+	}
+	async getAlarm() {
+		return this.stagedAlarm === void 0 ? this.storage.alarmAt : this.stagedAlarm;
+	}
+	async setAlarm(at) {
+		this.stagedAlarm = typeof at === "number" ? at : at.getTime();
+	}
+	async deleteAlarm() {
+		this.stagedAlarm = null;
+	}
+	commit() {
+		for (const key of this.deleted) this.storage.data.delete(key);
+		for (const [key, value] of this.staged) this.storage.data.set(key, value);
+		if (this.stagedAlarm !== void 0) this.storage.alarmAt = this.stagedAlarm;
+	}
+};
+/** celld abandons an alarm after six counted handler failures. */
+const ALARM_FAILURE_LIMIT = 6;
+/**
+* A fake fleet: one namespace per binding, each lazily instantiating the real
+* cell class with a fake ctx. `fireDueAlarms()` drives alarm dispatch
+* deterministically (alarms never fire on their own), reproducing celld's
+* retry ladder including the six-failure abandonment.
+*/
+var FakeFleet = class {
+	classes;
+	cellEnv;
+	cells = /* @__PURE__ */ new Map();
+	now;
+	constructor(classes, cellEnv = {}, startTime = Date.now()) {
+		this.classes = classes;
+		this.cellEnv = cellEnv;
+		this.now = startTime;
+	}
+	namespace(bindingKey) {
+		return {
+			idFromName(name) {
+				return { toString: () => name };
+			},
+			get: (id) => this.cell(bindingKey, id.toString()).instance
+		};
+	}
+	cell(bindingKey, name) {
+		const key = `${bindingKey}\0${name}`;
+		let slot = this.cells.get(key);
+		if (!slot) {
+			const CellCtor = this.classes[bindingKey];
+			if (!CellCtor) throw new Error(`no cell class registered for binding: ${bindingKey}`);
+			const storage = new FakeStorage(() => this.now);
+			const pendingWaits = [];
+			slot = {
+				instance: new CellCtor({
+					storage,
+					id: {
+						toString: () => name,
+						name
+					},
+					waitUntil(promise) {
+						pendingWaits.push(promise);
+					},
+					async blockConcurrencyWhile(cb) {
+						return cb();
+					}
+				}, this.cellEnv),
+				storage,
+				pendingWaits,
+				alarmRetryCount: 0,
+				alarmAbandoned: false
+			};
+			this.cells.set(key, slot);
+		}
+		return slot;
+	}
+	advance(ms) {
+		this.now += ms;
+	}
+	/**
+	* Dispatch every alarm due at the virtual current time, awaiting waitUntil
+	* work. A throwing handler re-arms per celld's ladder (2s doubling) and
+	* abandons the alarm after the sixth counted failure — the cell keeps its
+	* state but has no timer.
+	*/
+	async fireDueAlarms() {
+		for (const slot of this.cells.values()) {
+			const due = slot.storage.alarmAt;
+			if (due === null || due > this.now || slot.alarmAbandoned) continue;
+			if (typeof slot.instance.alarm !== "function") continue;
+			slot.storage.alarmAt = null;
+			try {
+				await slot.instance.alarm({ retryCount: slot.alarmRetryCount });
+				slot.alarmRetryCount = 0;
+			} catch {
+				slot.alarmRetryCount += 1;
+				if (slot.alarmRetryCount >= ALARM_FAILURE_LIMIT) slot.alarmAbandoned = true;
+				else if (slot.storage.alarmAt === null) slot.storage.alarmAt = this.now + 2e3 * 2 ** (slot.alarmRetryCount - 1);
+			}
+			await this.drainWaits(slot);
+		}
+	}
+	async drainWaits(slot) {
+		while (slot.pendingWaits.length > 0) {
+			const batch = slot.pendingWaits.splice(0);
+			await Promise.allSettled(batch);
+		}
+	}
+	/** Await all waitUntil work across the fleet (delivery fetches, etc.). */
+	async settle() {
+		for (const slot of this.cells.values()) await this.drainWaits(slot);
+	}
+};
+//#endregion
+//#region src/worker/auth.ts
+/**
+* Bearer-token auth for the worker router.
+*
+* Fails closed: when the WORLD_SECRET var is not configured, every protected
+* route returns 503 instead of forwarding unauthenticated traffic (the
+* eve-ambient celld-worker pattern).
+*/
+/**
+* Constant-time string comparison via SHA-256 digests (digest-then-compare
+* is length-independent). crypto.subtle is global in both workerd and Node.
+*/
+async function timingSafeEqual(a, b) {
+	const enc = new TextEncoder();
+	const [da, db] = await Promise.all([crypto.subtle.digest("SHA-256", enc.encode(a)), crypto.subtle.digest("SHA-256", enc.encode(b))]);
+	const va = new Uint8Array(da);
+	const vb = new Uint8Array(db);
+	let diff = 0;
+	for (let i = 0; i < va.length; i++) diff |= va[i] ^ vb[i];
+	return diff === 0;
+}
+async function authenticate(request, secret) {
+	if (!secret) return {
+		ok: false,
+		response: Response.json({ error: {
+			name: "WorldNotConfigured",
+			message: "WORLD_SECRET is not configured"
+		} }, { status: 503 })
+	};
+	const header = request.headers.get("authorization") ?? "";
+	const token = header.startsWith("Bearer ") ? header.slice(7) : "";
+	if (!token || !await timingSafeEqual(token, secret)) return {
+		ok: false,
+		response: Response.json({ error: {
+			name: "Unauthorized",
+			message: "invalid or missing bearer token"
+		} }, { status: 401 })
+	};
+	return { ok: true };
+}
+//#endregion
+//#region src/worker/router.ts
+/**
+* Worker-level HTTP router: the fleet-facing RPC surface of the celld world.
+*
+* Routes:
+*   GET  /v1/health                              — liveness + spec version (unauthenticated)
+*   POST /v1/rpc/{binding}/{name}/{method}       — DO RPC (bearer auth)
+*
+* The RPC body is an rpc-codec-encoded JSON array of arguments; the response
+* body is the rpc-codec-encoded return value. Only whitelisted methods
+* dispatch — everything else (including fetch/alarm) is unreachable.
+*/
+const WORLD_NAME = "world-celld";
+const WORLD_VERSION = "0.1.0";
+const BINDINGS = {
+	runs: {
+		env: "WORKFLOW_DB",
+		methods: /* @__PURE__ */ new Set([
+			"applyEvent",
+			"getRun",
+			"getStep",
+			"getEvent",
+			"listEvents",
+			"listSteps",
+			"listHooks"
+		])
+	},
+	streams: {
+		env: "WORKFLOW_STREAMS",
+		methods: /* @__PURE__ */ new Set([
+			"writeChunk",
+			"closeStream",
+			"getChunks",
+			"getInfo",
+			"registerStream",
+			"listStreams"
+		])
+	},
+	index: {
+		env: "WORKFLOW_INDEX",
+		methods: /* @__PURE__ */ new Set([
+			"get",
+			"put",
+			"delete",
+			"list",
+			"reserveHookToken",
+			"finalizeHookIndexes",
+			"releaseHookToken",
+			"deleteHookIndexes"
+		])
+	},
+	queue: {
+		env: "WORKFLOW_QUEUE",
+		methods: /* @__PURE__ */ new Set([
+			"enqueue",
+			"stats",
+			"listDeadLetters",
+			"redriveDeadLetter",
+			"purgeDeadLetters",
+			"rearmAlarm"
+		])
+	}
+};
+/** Request body cap: oversize payloads get a clear 413 instead of an OOM. */
+const MAX_BODY_BYTES = 33554432;
+function errorResponse(status, name, message) {
+	return Response.json({ error: {
+		name,
+		message
+	} }, { status });
+}
+async function readBoundedBody(request) {
+	if (!request.body) return "";
+	const reader = request.body.getReader();
+	const decoder = new TextDecoder();
+	let total = 0;
+	let text = "";
+	try {
+		while (true) {
+			const { done, value } = await reader.read();
+			if (done) break;
+			total += value.byteLength;
+			if (total > MAX_BODY_BYTES) {
+				await reader.cancel("RPC body exceeds configured limit").catch(() => void 0);
+				return null;
+			}
+			text += decoder.decode(value, { stream: true });
+		}
+		return text + decoder.decode();
+	} finally {
+		reader.releaseLock();
+	}
+}
+function createRouter(env) {
+	return async (request) => {
+		const url = new URL(request.url);
+		const parts = url.pathname.split("/").filter(Boolean);
+		if (parts[0] !== "v1") return errorResponse(404, "NotFound", `unknown path: ${url.pathname}`);
+		if (parts[1] === "health" && parts.length === 2) return Response.json({
+			ok: true,
+			name: WORLD_NAME,
+			version: WORLD_VERSION,
+			specVersion: SPEC_VERSION_CURRENT
+		});
+		if (parts[1] !== "rpc") return errorResponse(404, "NotFound", `unknown path: ${url.pathname}`);
+		const auth = await authenticate(request, env.WORLD_SECRET);
+		if (!auth.ok) return auth.response;
+		if (request.method !== "POST" || parts.length !== 5) return errorResponse(404, "NotFound", "expected POST /v1/rpc/{binding}/{name}/{method}");
+		const [, , bindingKey, encodedName, method] = parts;
+		const binding = BINDINGS[bindingKey];
+		if (!binding) return errorResponse(404, "NotFound", `unknown binding: ${bindingKey}`);
+		if (!binding.methods.has(method)) return errorResponse(404, "NotFound", `unknown method: ${bindingKey}.${method}`);
+		if (Number(request.headers.get("content-length") ?? "0") > MAX_BODY_BYTES) return errorResponse(413, "PayloadTooLarge", `body exceeds ${MAX_BODY_BYTES} bytes`);
+		let args;
+		try {
+			const text = await readBoundedBody(request);
+			if (text === null) return errorResponse(413, "PayloadTooLarge", `body exceeds ${MAX_BODY_BYTES} bytes`);
+			const parsed = rpcParse(text);
+			if (!Array.isArray(parsed)) return errorResponse(400, "BadRequest", "body must be an argument array");
+			args = parsed;
+		} catch {
+			return errorResponse(400, "BadRequest", "malformed rpc body");
+		}
+		const name = decodeURIComponent(encodedName);
+		const namespace = env[binding.env];
+		if (!namespace) return errorResponse(500, "WorldMisconfigured", `missing binding: ${binding.env}`);
+		try {
+			const result = await namespace.get(namespace.idFromName(name))[method](...args);
+			return new Response(rpcStringify(result ?? null), {
+				status: 200,
+				headers: { "content-type": "application/json" }
+			});
+		} catch (error) {
+			const err = error;
+			return Response.json({ error: {
+				name: err?.name ?? "Error",
+				message: err?.message ?? String(error),
+				status: typeof err?.status === "number" ? err.status : void 0
+			} }, { status: 500 });
+		}
+	};
+}
+//#endregion
+//#region src/worker/do-base.ts
+/**
+* Durable Object base class — Node variant.
+*
+* The cell classes extend `DurableObject` so celld's JS RPC works on their
+* stubs. This module is what Node builds (tests, the `./testing` in-process
+* fleet) resolve; the worker build swaps it for do-base-workerd.ts, which
+* re-exports the real `cloudflare:workers` base (see tsdown.config.ts).
+* Behaviorally identical at this layer: the base only assigns ctx/env.
+*/
+var DurableObject = class {
+	ctx;
+	env;
+	constructor(ctx, env) {
+		this.ctx = ctx;
+		this.env = env;
+	}
+};
+//#endregion
+//#region src/worker/durable-objects/IndexDO.ts
+function sameOwner(left, right) {
+	return left.runId === right.runId && left.hookId === right.hookId;
+}
+function ownerFromHook(raw) {
+	const hook = parse(raw);
+	return {
+		runId: hook.runId,
+		hookId: hook.hookId
+	};
+}
+/**
+* Global index cell, replacing the Workers KV namespace world-cloudflare
+* uses for run listing and hook token/id lookup.
+*
+* A single cell (named `index`) serializes every read and write. Hook-token
+* reservation, publication, and release use storage transactions so
+* concurrent runs cannot both acquire the same token.
+*
+* The RPC surface matches the storage-layer KVNamespace interface bit-for-bit
+* (including MockKVNamespace's pagination contract: cursor = last returned
+* key, `list_complete` reflects whether further keys exist), so the vendored
+* storage.ts works against it unchanged.
+*/
+var IndexDO = class extends DurableObject {
+	async get(key) {
+		return await this.ctx.storage.get(key) ?? null;
+	}
+	async put(key, value) {
+		await this.ctx.storage.put(key, value);
+	}
+	async delete(key) {
+		await this.ctx.storage.delete(key);
+	}
+	async list(options) {
+		const prefix = options?.prefix ?? "";
+		const limit = options?.limit ?? 1e3;
+		const entries = await this.ctx.storage.list({
+			prefix,
+			...options?.reverse ? {
+				reverse: true,
+				end: options.cursor
+			} : { startAfter: options?.cursor },
+			limit: limit + 1
+		});
+		const names = Array.from(entries.keys());
+		const page = names.slice(0, limit);
+		const listComplete = names.length <= limit;
+		return {
+			keys: page.map((name) => ({ name })),
+			list_complete: listComplete,
+			cursor: listComplete ? void 0 : page.at(-1)
+		};
+	}
+	async reserveHookToken(token, owner) {
+		return this.ctx.storage.transaction(async (txn) => {
+			const indexedHook = await txn.get(`hook:${token}`);
+			if (indexedHook !== void 0) return {
+				claimed: false,
+				holder: ownerFromHook(indexedHook)
+			};
+			const claimKey = `hookclaim:${token}`;
+			const claim = await txn.get(claimKey);
+			if (claim !== void 0 && !sameOwner(claim.owner, owner)) return {
+				claimed: false,
+				holder: claim.owner
+			};
+			await txn.put(claimKey, {
+				owner,
+				reservedAt: Date.now()
+			});
+			return { claimed: true };
+		});
+	}
+	async finalizeHookIndexes(token, hookId, serializedHook, owner) {
+		await this.ctx.storage.transaction(async (txn) => {
+			const indexedHook = await txn.get(`hook:${token}`);
+			if (indexedHook !== void 0 && !sameOwner(ownerFromHook(indexedHook), owner)) throw new Error(`Hook token ${token} is owned by another hook`);
+			const claim = await txn.get(`hookclaim:${token}`);
+			if (claim !== void 0 && !sameOwner(claim.owner, owner)) throw new Error(`Hook token ${token} is reserved by another hook`);
+			await txn.put(`hook:${token}`, serializedHook);
+			await txn.put(`hookid:${hookId}`, serializedHook);
+			if (claim !== void 0) await txn.delete(`hookclaim:${token}`);
+		});
+	}
+	async releaseHookToken(token, owner) {
+		await this.ctx.storage.transaction(async (txn) => {
+			const key = `hookclaim:${token}`;
+			const claim = await txn.get(key);
+			if (claim !== void 0 && sameOwner(claim.owner, owner)) await txn.delete(key);
+		});
+	}
+	async deleteHookIndexes(token, hookId, owner) {
+		await this.ctx.storage.transaction(async (txn) => {
+			const tokenKey = `hook:${token}`;
+			const idKey = `hookid:${hookId}`;
+			const claimKey = `hookclaim:${token}`;
+			const [byToken, byId, claim] = await Promise.all([
+				txn.get(tokenKey),
+				txn.get(idKey),
+				txn.get(claimKey)
+			]);
+			if (byToken !== void 0 && sameOwner(ownerFromHook(byToken), owner)) await txn.delete(tokenKey);
+			if (byId !== void 0 && sameOwner(ownerFromHook(byId), owner)) await txn.delete(idKey);
+			if (claim !== void 0 && sameOwner(claim.owner, owner)) await txn.delete(claimKey);
+		});
+	}
+};
+//#endregion
+//#region src/worker/durable-objects/QueueDO.ts
+const PERMANENT_STATUSES = /* @__PURE__ */ new Set([
+	404,
+	409,
+	410,
+	422
+]);
+const DEFAULT_MAX_ATTEMPTS = 5;
+const DEFAULT_MAX_INFLIGHT = 5;
+const DEFAULT_DELIVERY_TIMEOUT_MS = 3e5;
+/** Grace period past the delivery timeout before a claim counts as lost. */
+const INFLIGHT_GRACE_MS = 3e4;
+/** Move overdue alarms to a new timestamp so celld observes a fresh edge. */
+const MIN_ALARM_DELAY_MS = 1;
+function pad(ms) {
+	return String(Math.max(0, Math.floor(ms))).padStart(13, "0");
+}
+function dueKey(atMs, messageId) {
+	return `due:${pad(atMs)}:${messageId}`;
+}
+function backoffSeconds(attempt) {
+	return Math.min(60, 2 ** attempt);
+}
+var QueueDO = class extends DurableObject {
+	#now() {
+		const clock = this.env?.clock;
+		return typeof clock === "function" ? clock() : Date.now();
+	}
+	#fetch() {
+		const impl = this.env?.fetch;
+		return typeof impl === "function" ? impl : fetch;
+	}
+	#intVar(name, fallback) {
+		const raw = this.env?.[name];
+		const parsed = raw ? Number.parseInt(raw, 10) : NaN;
+		return Number.isFinite(parsed) && parsed > 0 ? parsed : fallback;
+	}
+	async enqueue(request) {
+		const storage = this.ctx.storage;
+		const now = this.#now();
+		return await storage.transaction(async (txn) => {
+			const pinned = await txn.get("cfg");
+			if (!pinned) await txn.put("cfg", {
+				queueShards: request.config.queueShards,
+				pinnedAt: now
+			});
+			else if (pinned.queueShards !== request.config.queueShards) return {
+				ok: false,
+				code: "CONFIG_MISMATCH",
+				message: `queue cell shard-count mismatch: pinned ${pinned.queueShards}, got ${request.config.queueShards} — changing queueShards requires draining the fleet`
+			};
+			if (request.idempotencyKey) {
+				const existing = await txn.get(`key:${request.idempotencyKey}`);
+				if (existing) {
+					if (await txn.get(`msg:${existing}`)) {
+						await this.#scheduleNextAlarm(txn, now);
+						return {
+							ok: true,
+							messageId: existing,
+							deduped: true
+						};
+					}
+					await txn.delete(`key:${request.idempotencyKey}`);
+				}
+				await txn.put(`key:${request.idempotencyKey}`, request.messageId);
+			}
+			const row = {
+				messageId: request.messageId,
+				queueName: request.queueName,
+				pathname: request.pathname,
+				body: request.body,
+				targetBaseUrl: request.config.targetBaseUrl,
+				idempotencyKey: request.idempotencyKey,
+				attempt: 0,
+				enqueuedAt: now
+			};
+			const dueAt = now + Math.max(0, request.delaySeconds ?? 0) * 1e3;
+			await txn.put(`msg:${row.messageId}`, row);
+			await txn.put(dueKey(dueAt, row.messageId), row.messageId);
+			await this.#armAlarmAtMost(txn, dueAt, now);
+			return {
+				ok: true,
+				messageId: row.messageId,
+				deduped: false
+			};
+		});
+	}
+	async alarm() {
+		let claimed = [];
+		let failure = null;
+		const attempt = async () => {
+			try {
+				claimed = await this.#claimPhase();
+			} catch (error) {
+				failure = error;
+			}
+		};
+		if (typeof this.ctx.blockConcurrencyWhile === "function") await this.ctx.blockConcurrencyWhile(attempt);
+		else await attempt();
+		if (failure !== null) throw failure;
+		for (const row of claimed) this.ctx.waitUntil(this.#deliver(row));
+	}
+	/**
+	* Storage-only: recover lost inflight claims, claim due messages up to the
+	* inflight cap, and re-arm the alarm. Never throws for data conditions.
+	*/
+	async #claimPhase() {
+		const storage = this.ctx.storage;
+		const now = this.#now();
+		const maxInflight = this.#intVar("QUEUE_MAX_INFLIGHT", DEFAULT_MAX_INFLIGHT);
+		return await storage.transaction(async (txn) => {
+			const inflight = await txn.list({ prefix: "inflight:" });
+			let inflightCount = 0;
+			for (const [key, deadline] of inflight) if (deadline <= now) {
+				const messageId = key.slice(9);
+				await txn.delete(key);
+				if (await txn.get(`msg:${messageId}`)) await txn.put(dueKey(now, messageId), messageId);
+			} else inflightCount++;
+			const rows = [];
+			if (inflightCount < maxInflight) {
+				const due = await txn.list({
+					prefix: "due:",
+					end: `due:${pad(now + 1)}`,
+					limit: maxInflight - inflightCount
+				});
+				const timeoutMs = this.#intVar("QUEUE_DELIVERY_TIMEOUT_MS", DEFAULT_DELIVERY_TIMEOUT_MS);
+				for (const [key, messageId] of due) {
+					await txn.delete(key);
+					const row = await txn.get(`msg:${messageId}`);
+					if (!row) continue;
+					await txn.put(`inflight:${messageId}`, now + timeoutMs + INFLIGHT_GRACE_MS);
+					rows.push(row);
+				}
+			}
+			await this.#scheduleNextAlarm(txn, now);
+			return rows;
+		});
+	}
+	async #deliver(row) {
+		const storage = this.ctx.storage;
+		const timeoutMs = this.#intVar("QUEUE_DELIVERY_TIMEOUT_MS", DEFAULT_DELIVERY_TIMEOUT_MS);
+		const callbackSecret = this.env?.WORKFLOW_CALLBACK_SECRET;
+		const url = `${row.targetBaseUrl.replace(/\/$/, "")}/.well-known/workflow/v1/${row.pathname}`;
+		let response = null;
+		let transportError = null;
+		try {
+			response = await this.#fetch()(url, {
+				method: "POST",
+				headers: {
+					"content-type": "application/json",
+					"x-vqs-queue-name": row.queueName,
+					"x-vqs-message-id": row.messageId,
+					"x-vqs-message-attempt": String(row.attempt + 1),
+					...callbackSecret ? { "x-workflow-callback-secret": callbackSecret } : {}
+				},
+				body: row.body,
+				signal: AbortSignal.timeout(timeoutMs)
+			});
+		} catch (error) {
+			transportError = error;
+		}
+		const now = this.#now();
+		if (response?.ok) await this.#ack(row);
+		else if (response && response.status === 503) {
+			let timeoutSeconds;
+			try {
+				timeoutSeconds = (await response.json())?.timeoutSeconds;
+			} catch {
+				timeoutSeconds = void 0;
+			}
+			if (typeof timeoutSeconds === "number") await storage.transaction(async (txn) => {
+				await txn.delete(`inflight:${row.messageId}`);
+				await txn.put(dueKey(now + timeoutSeconds * 1e3, row.messageId), row.messageId);
+				await this.#scheduleNextAlarm(txn, now);
+			});
+			else await this.#retry(row, "HTTP 503");
+		} else if (response && PERMANENT_STATUSES.has(response.status)) await this.#ack(row);
+		else {
+			const reason = response ? `HTTP ${response.status}` : `transport error: ${String(transportError)}`;
+			await this.#retry(row, reason);
+		}
+	}
+	async #ack(row) {
+		await this.ctx.storage.transaction(async (txn) => {
+			await txn.delete(`msg:${row.messageId}`);
+			await txn.delete(`inflight:${row.messageId}`);
+			if (row.idempotencyKey) {
+				if (await txn.get(`key:${row.idempotencyKey}`) === row.messageId) await txn.delete(`key:${row.idempotencyKey}`);
+			}
+			await this.#scheduleNextAlarm(txn, this.#now());
+		});
+	}
+	async #retry(row, reason) {
+		const storage = this.ctx.storage;
+		const now = this.#now();
+		const maxAttempts = this.#intVar("QUEUE_MAX_ATTEMPTS", DEFAULT_MAX_ATTEMPTS);
+		const attempt = row.attempt + 1;
+		await storage.transaction(async (txn) => {
+			await txn.delete(`inflight:${row.messageId}`);
+			if (attempt >= maxAttempts) {
+				const dead = {
+					...row,
+					attempt,
+					lastError: reason,
+					failedAt: now
+				};
+				await txn.put(`dlq:${pad(now)}:${row.messageId}`, dead);
+				await txn.delete(`msg:${row.messageId}`);
+				if (row.idempotencyKey) {
+					if (await txn.get(`key:${row.idempotencyKey}`) === row.messageId) await txn.delete(`key:${row.idempotencyKey}`);
+				}
+				await this.#scheduleNextAlarm(txn, now);
+				return;
+			}
+			const updated = {
+				...row,
+				attempt,
+				lastError: reason
+			};
+			await txn.put(`msg:${row.messageId}`, updated);
+			await txn.put(dueKey(now + backoffSeconds(attempt) * 1e3, row.messageId), row.messageId);
+			await this.#scheduleNextAlarm(txn, now);
+		});
+	}
+	/** Arm the alarm no later than `atMs` (durable backoff never throws). */
+	async #armAlarmAtMost(storage, atMs, now) {
+		const current = await storage.getAlarm();
+		if (current !== null && current <= now) {
+			await storage.setAlarm(now + MIN_ALARM_DELAY_MS);
+			return;
+		}
+		const target = atMs <= now ? now + MIN_ALARM_DELAY_MS : atMs;
+		if (current === null || target < current) await storage.setAlarm(target);
+	}
+	/** Recompute the alarm from the earliest due entry / inflight deadline. */
+	async #rearm() {
+		await this.#scheduleNextAlarm(this.ctx.storage, this.#now());
+	}
+	/** Keep the alarm index consistent with message state in the same transaction. */
+	async #scheduleNextAlarm(storage, now) {
+		let next = null;
+		const due = await storage.list({
+			prefix: "due:",
+			limit: 1
+		});
+		for (const key of due.keys()) next = Number.parseInt(key.slice(4, 17), 10);
+		const inflight = await storage.list({ prefix: "inflight:" });
+		for (const deadline of inflight.values()) if (next === null || deadline < next) next = deadline;
+		if (next !== null) await storage.setAlarm(next <= now ? now + MIN_ALARM_DELAY_MS : next);
+		else await storage.deleteAlarm();
+	}
+	async stats() {
+		const storage = this.ctx.storage;
+		const [due, inflight, dlq, alarmAt] = await Promise.all([
+			storage.list({ prefix: "due:" }),
+			storage.list({ prefix: "inflight:" }),
+			storage.list({ prefix: "dlq:" }),
+			storage.getAlarm()
+		]);
+		return {
+			pending: due.size,
+			inflight: inflight.size,
+			deadLetters: dlq.size,
+			alarmAt
+		};
+	}
+	async listDeadLetters(params) {
+		const limit = params?.limit ?? 100;
+		const entries = await this.ctx.storage.list({
+			prefix: "dlq:",
+			startAfter: params?.cursor,
+			limit: limit + 1
+		});
+		const keys = Array.from(entries.keys());
+		const page = keys.slice(0, limit);
+		const hasMore = keys.length > limit;
+		return {
+			data: page.map((k) => entries.get(k)),
+			cursor: hasMore ? page.at(-1) : null,
+			hasMore
+		};
+	}
+	/** Move a dead letter back to the live queue (attempt count reset). */
+	async redriveDeadLetter(messageId) {
+		const storage = this.ctx.storage;
+		const now = this.#now();
+		return await storage.transaction(async (txn) => {
+			const dlq = await txn.list({ prefix: "dlq:" });
+			for (const [key, dead] of dlq) {
+				if (dead.messageId !== messageId) continue;
+				const { failedAt: _failedAt, ...rest } = dead;
+				const row = {
+					...rest,
+					attempt: 0,
+					lastError: void 0
+				};
+				if (row.idempotencyKey) {
+					const dedupKey = `key:${row.idempotencyKey}`;
+					const holder = await txn.get(dedupKey);
+					if (holder && holder !== row.messageId && await txn.get(`msg:${holder}`)) return { ok: false };
+					if (holder && holder !== row.messageId) await txn.delete(dedupKey);
+					await txn.put(dedupKey, row.messageId);
+				}
+				await txn.put(`msg:${row.messageId}`, row);
+				await txn.put(dueKey(now, row.messageId), row.messageId);
+				await txn.delete(key);
+				await this.#armAlarmAtMost(txn, now, now);
+				return { ok: true };
+			}
+			return { ok: false };
+		});
+	}
+	async purgeDeadLetters() {
+		return await this.ctx.storage.transaction(async (txn) => {
+			const dlq = await txn.list({ prefix: "dlq:" });
+			for (const key of dlq.keys()) await txn.delete(key);
+			return { purged: dlq.size };
+		});
+	}
+	/**
+	* Recovery hatch for celld's six-failure alarm abandonment: derive the due
+	* time again and arm it.
+	*/
+	async rearmAlarm() {
+		await this.#rearm();
+		return { alarmAt: await this.ctx.storage.getAlarm() };
+	}
+};
+//#endregion
+//#region src/worker/durable-objects/StreamDO.ts
+const META_KEY = "meta";
+const CHUNK_KEY_PREFIX = "chunk:";
+/** Registry keys used when this DO instance acts as a per-run stream index. */
+const STREAM_REGISTRY_PREFIX = "stream:";
+/**
+* Zero-pad chunk indexes so `storage.list({ prefix })` returns chunks in
+* write order. 12 digits comfortably exceeds any realistic chunk count.
+*/
+function chunkKey(index) {
+	return `${CHUNK_KEY_PREFIX}${index.toString().padStart(12, "0")}`;
+}
+/**
+* Durable Object backing workflow streams.
+*
+* Two roles, selected by the DO name:
+* - `stream:<name>`: chunk storage for a single stream. A monotonic
+*   per-stream counter (maintained transactionally inside the DO) assigns
+*   each chunk its index; one chunk per storage key.
+* - `run-streams:<runId>`: registry of stream names owned by a run,
+*   powering `listStreamsByRunId`.
+*/
+var StreamDO = class extends DurableObject {
+	async getMeta() {
+		return await this.ctx.storage.get(META_KEY) ?? {
+			count: 0,
+			closed: false
+		};
+	}
+	/**
+	* Append a chunk. The index is allocated inside the transaction, so
+	* concurrent writers can never collide or skip.
+	*/
+	async writeChunk(data) {
+		return await this.ctx.storage.transaction(async (txn) => {
+			const meta = await txn.get(META_KEY) ?? {
+				count: 0,
+				closed: false
+			};
+			if (meta.closed) throw new Error("Cannot write to a closed stream");
+			const index = meta.count;
+			await txn.put(chunkKey(index), data);
+			await txn.put(META_KEY, {
+				count: index + 1,
+				closed: false
+			});
+			return index;
+		});
+	}
+	/**
+	* Close the stream (idempotent). Readers observe `done: true` once all
+	* previously written chunks have been consumed.
+	*/
+	async closeStream() {
+		await this.ctx.storage.transaction(async (txn) => {
+			const meta = await txn.get(META_KEY) ?? {
+				count: 0,
+				closed: false
+			};
+			await txn.put(META_KEY, {
+				...meta,
+				closed: true
+			});
+		});
+	}
+	/**
+	* Read up to `limit` chunks starting at `startIndex` (0-based, inclusive).
+	*/
+	async getChunks(params) {
+		const meta = await this.getMeta();
+		const start = Math.max(0, params.startIndex);
+		const entries = await this.ctx.storage.list({
+			prefix: CHUNK_KEY_PREFIX,
+			start: chunkKey(start),
+			limit: params.limit
+		});
+		return {
+			chunks: Array.from(entries.values()),
+			done: meta.closed,
+			tailIndex: meta.count - 1
+		};
+	}
+	/**
+	* Lightweight stream metadata: last chunk index and completion flag.
+	*/
+	async getInfo() {
+		const meta = await this.getMeta();
+		return {
+			tailIndex: meta.count - 1,
+			done: meta.closed
+		};
+	}
+	/**
+	* Register a stream name against this per-run registry instance.
+	*/
+	async registerStream(name) {
+		await this.ctx.storage.put(`${STREAM_REGISTRY_PREFIX}${name}`, true);
+	}
+	/**
+	* List stream names registered against this per-run registry instance.
+	*/
+	async listStreams() {
+		const entries = await this.ctx.storage.list({ prefix: STREAM_REGISTRY_PREFIX });
+		return Array.from(entries.keys()).map((key) => key.slice(7));
+	}
+};
+//#endregion
+//#region src/apply-event.ts
+/** Storage key for the run entity. */
+const RUN_KEY = "run";
+/** Key prefixes for per-entity storage. */
+const EVENT_KEY_PREFIX = "event:";
+const STEP_KEY_PREFIX = "step:";
+const HOOK_KEY_PREFIX = "hook:";
+const STEP_CREATED_KEY_PREFIX = "stepcreated:";
+const HOOK_CREATED_KEY_PREFIX = "hookcreated:";
+/**
+* Marker recording that a hook_created event was committed for a hookId.
+* Mirrors postgres' `workflow_events_entity_creation_unique` partial index:
+* it outlives hook disposal so a replayed hook_created after dispose is
+* rejected as a duplicate instead of resurrecting the hook.
+*/
+const HOOK_EVENT_MARKER_PREFIX = "hookevent:";
+function failure(code, message, extra) {
+	return {
+		ok: false,
+		code,
+		message,
+		...extra
+	};
+}
+function readStringProp(value, key) {
+	if (value !== null && typeof value === "object") {
+		const prop = value[key];
+		if (typeof prop === "string") return prop;
+	}
+}
+/**
+* Map a failure eventData.error (which may be a string, an Error-shaped
+* object, or anything else) to the structured error stored on entities.
+* Matches upstream: string errors keep their text, errorCode is preserved.
+*/
+function toStructuredError(error, opts) {
+	return {
+		message: typeof error === "string" ? error : readStringProp(error, "message") ?? "Unknown error",
+		stack: opts?.stack ?? readStringProp(error, "stack"),
+		code: opts?.code ?? readStringProp(error, "code")
+	};
+}
+/**
+* Shared cursor pagination over a key prefix. Fetches `limit + 1` entries to
+* detect `hasMore` without ever skipping the boundary entry (the cursor is
+* derived from the last *returned* item, not the peeked one).
+*/
+async function listByPrefix(store, prefix, params, getId) {
+	const { limit, cursor, sortOrder = "asc" } = params;
+	const options = sortOrder === "desc" ? {
+		prefix,
+		reverse: true,
+		limit: limit + 1,
+		end: cursor ? `${prefix}${cursor}` : void 0
+	} : {
+		prefix,
+		limit: limit + 1,
+		startAfter: cursor ? `${prefix}${cursor}` : void 0
+	};
+	const entries = await store.list(options);
+	const values = Array.from(entries.values());
+	const hasMore = values.length > limit;
+	const data = values.slice(0, limit);
+	const last = data.at(-1);
+	return {
+		data,
+		cursor: hasMore && last !== void 0 ? getId(last) : null,
+		hasMore
+	};
+}
+function creationIndexKey(prefix, createdAt, id) {
+	return `${prefix}${createdAt.toISOString()}:${id}`;
+}
+/**
+* Cursor pagination over an explicit creation-time index. Entity ids are
+* values rather than key suffixes, so caller-supplied ids cannot disturb the
+* requested ordering.
+*/
+async function listByCreationTime(store, indexPrefix, entityPrefix, params) {
+	const { limit, cursor, sortOrder = "asc" } = params;
+	const entries = await store.list(sortOrder === "desc" ? {
+		prefix: indexPrefix,
+		reverse: true,
+		limit: limit + 1,
+		end: cursor ? `${indexPrefix}${cursor}` : void 0
+	} : {
+		prefix: indexPrefix,
+		limit: limit + 1,
+		startAfter: cursor ? `${indexPrefix}${cursor}` : void 0
+	});
+	const page = Array.from(entries.entries()).slice(0, limit);
+	const data = [];
+	for (const [, id] of page) {
+		const item = await store.get(`${entityPrefix}${id}`);
+		if (item !== void 0) data.push(item);
+	}
+	const hasMore = entries.size > limit;
+	const lastKey = page.at(-1)?.[0];
+	return {
+		data,
+		cursor: hasMore && lastKey ? lastKey.slice(indexPrefix.length) : null,
+		hasMore
+	};
+}
+/** Delete all hook entities for the run, returning the released tokens. */
+async function releaseAllHooks(store) {
+	const hooks = await store.list({ prefix: HOOK_KEY_PREFIX });
+	const released = [];
+	for (const hook of hooks.values()) {
+		await store.delete(`${HOOK_KEY_PREFIX}${hook.hookId}`);
+		await store.delete(creationIndexKey(HOOK_CREATED_KEY_PREFIX, hook.createdAt, hook.hookId));
+		released.push({
+			hookId: hook.hookId,
+			token: hook.token
+		});
+	}
+	return released;
+}
+async function applyEvent(store, ctx) {
+	const { runId, data, now } = ctx;
+	const specVersion = data.specVersion ?? SPEC_VERSION_CURRENT;
+	/** Build and validate the stored event BEFORE anything is persisted. */
+	const buildEvent = (record) => {
+		const withMeta = {
+			...record,
+			runId,
+			eventId: ctx.nextEventId(),
+			createdAt: now,
+			specVersion
+		};
+		if (record.eventType === "run_started") delete withMeta.eventData;
+		return EventSchema.parse(compact(withMeta));
+	};
+	const putEvent = async (event) => {
+		await store.put(`${EVENT_KEY_PREFIX}${event.eventId}`, event);
+	};
+	let currentRun;
+	const skipRunValidation = data.eventType === "run_created" || data.eventType === "step_completed" || data.eventType === "step_retrying";
+	if (!skipRunValidation) currentRun = await store.get(RUN_KEY);
+	let bootstrapped;
+	if (data.eventType === "run_started" && !currentRun && data.eventData) {
+		const { deploymentId, workflowName, input, executionContext } = data.eventData;
+		if (deploymentId && workflowName && input !== void 0) {
+			const createdRun = WorkflowRunSchema.parse(compact({
+				runId,
+				deploymentId,
+				workflowName,
+				specVersion,
+				executionContext,
+				input,
+				status: "pending",
+				output: void 0,
+				error: void 0,
+				startedAt: void 0,
+				completedAt: void 0,
+				createdAt: now,
+				updatedAt: now
+			}));
+			const runCreatedEvent = buildEvent({
+				eventType: "run_created",
+				eventData: {
+					deploymentId,
+					workflowName,
+					input,
+					executionContext
+				}
+			});
+			await store.put(RUN_KEY, createdRun);
+			await putEvent(runCreatedEvent);
+			currentRun = createdRun;
+			bootstrapped = {
+				workflowName,
+				createdAt: now
+			};
+		}
+	}
+	if (currentRun) {
+		if (requiresNewerWorld(currentRun.specVersion)) return failure("RUN_NOT_SUPPORTED", `Run "${runId}" requires a newer world (run specVersion ${currentRun.specVersion}, world ${SPEC_VERSION_CURRENT})`, { runSpecVersion: currentRun.specVersion });
+		if (isLegacySpecVersion(currentRun.specVersion)) return failure("LEGACY_RUN_NOT_SUPPORTED", `Run "${runId}" was created with a legacy spec version (${currentRun.specVersion ?? "undefined"}) not supported by this world`);
+	}
+	if (currentRun && isTerminalWorkflowRunStatus(currentRun.status)) {
+		if (data.eventType === "run_cancelled" && currentRun.status === "cancelled") {
+			const event = buildEvent({ ...data });
+			await putEvent(event);
+			return {
+				ok: true,
+				event,
+				run: currentRun,
+				releasedHooks: []
+			};
+		}
+		if (data.eventType === "run_started") return failure("RUN_EXPIRED", `Workflow run "${runId}" is already in terminal state "${currentRun.status}"`);
+		if (data.eventType === "run_completed" || data.eventType === "run_failed" || data.eventType === "run_cancelled") return failure("ENTITY_CONFLICT", `Cannot transition run from terminal state "${currentRun.status}"`);
+		if (data.eventType === "step_created" || data.eventType === "hook_created" || data.eventType === "wait_created") return failure("ENTITY_CONFLICT", `Cannot create new entities on run in terminal state "${currentRun.status}"`);
+	}
+	let validatedStep;
+	if (data.eventType === "step_started" || data.eventType === "step_completed" || data.eventType === "step_failed" || data.eventType === "step_retrying") {
+		validatedStep = await store.get(`${STEP_KEY_PREFIX}${data.correlationId}`);
+		if (!validatedStep) return failure("STEP_NOT_FOUND", `Step "${data.correlationId}" not found`);
+		if (isTerminalStepStatus(validatedStep.status)) return failure("ENTITY_CONFLICT", `Cannot modify step in terminal state "${validatedStep.status}"`);
+		if (currentRun && isTerminalWorkflowRunStatus(currentRun.status) && validatedStep.status !== "running") return failure("RUN_EXPIRED", `Cannot modify non-running step on run in terminal state "${currentRun.status}"`);
+	}
+	if ((data.eventType === "hook_disposed" || data.eventType === "hook_received") && data.correlationId) {
+		if (!await store.get(`hook:${data.correlationId}`)) return failure("HOOK_NOT_FOUND", `Hook "${data.correlationId}" not found`);
+	}
+	if (!skipRunValidation && data.eventType !== "run_started" && !currentRun) return failure("RUN_NOT_FOUND", `Workflow run "${runId}" not found`);
+	switch (data.eventType) {
+		case "run_created": {
+			const existing = await store.get(RUN_KEY);
+			if (existing) return {
+				ok: true,
+				run: existing,
+				releasedHooks: []
+			};
+			const run = WorkflowRunSchema.parse(compact({
+				runId,
+				deploymentId: data.eventData.deploymentId,
+				workflowName: data.eventData.workflowName,
+				specVersion,
+				executionContext: data.eventData.executionContext,
+				input: data.eventData.input,
+				status: "pending",
+				output: void 0,
+				error: void 0,
+				startedAt: void 0,
+				completedAt: void 0,
+				createdAt: now,
+				updatedAt: now
+			}));
+			const event = buildEvent({ ...data });
+			await store.put(RUN_KEY, run);
+			await putEvent(event);
+			return {
+				ok: true,
+				event,
+				run,
+				releasedHooks: [],
+				runCreated: {
+					workflowName: data.eventData.workflowName,
+					createdAt: now
+				}
+			};
+		}
+		case "run_started": {
+			if (!currentRun) return failure("RUN_NOT_FOUND", `Workflow run "${runId}" not found`);
+			if (currentRun.status === "running") return {
+				ok: true,
+				run: currentRun,
+				releasedHooks: []
+			};
+			const run = WorkflowRunSchema.parse(compact({
+				...currentRun,
+				status: "running",
+				output: void 0,
+				error: void 0,
+				completedAt: void 0,
+				startedAt: currentRun.startedAt ?? now,
+				updatedAt: now
+			}));
+			const event = buildEvent({ ...data });
+			await store.put(RUN_KEY, run);
+			await putEvent(event);
+			const allEvents = await listByPrefix(store, EVENT_KEY_PREFIX, {
+				limit: 1e3,
+				sortOrder: "asc"
+			}, (e) => e.eventId);
+			return {
+				ok: true,
+				event,
+				run,
+				releasedHooks: [],
+				runCreated: bootstrapped,
+				events: allEvents.data
+			};
+		}
+		case "run_completed": {
+			if (!currentRun) return failure("RUN_NOT_FOUND", `Workflow run "${runId}" not found`);
+			const run = WorkflowRunSchema.parse(compact({
+				...currentRun,
+				status: "completed",
+				output: data.eventData.output,
+				error: void 0,
+				completedAt: now,
+				updatedAt: now
+			}));
+			const event = buildEvent({ ...data });
+			await store.put(RUN_KEY, run);
+			await putEvent(event);
+			return {
+				ok: true,
+				event,
+				run,
+				releasedHooks: await releaseAllHooks(store)
+			};
+		}
+		case "run_failed": {
+			if (!currentRun) return failure("RUN_NOT_FOUND", `Workflow run "${runId}" not found`);
+			const run = WorkflowRunSchema.parse(compact({
+				...currentRun,
+				status: "failed",
+				output: void 0,
+				error: toStructuredError(data.eventData.error, { code: data.eventData.errorCode ?? readStringProp(data.eventData.error, "code") }),
+				completedAt: now,
+				updatedAt: now
+			}));
+			const event = buildEvent({ ...data });
+			await store.put(RUN_KEY, run);
+			await putEvent(event);
+			return {
+				ok: true,
+				event,
+				run,
+				releasedHooks: await releaseAllHooks(store)
+			};
+		}
+		case "run_cancelled": {
+			if (!currentRun) return failure("RUN_NOT_FOUND", `Workflow run "${runId}" not found`);
+			const run = WorkflowRunSchema.parse(compact({
+				...currentRun,
+				status: "cancelled",
+				output: void 0,
+				error: void 0,
+				completedAt: now,
+				updatedAt: now
+			}));
+			const event = buildEvent({ ...data });
+			await store.put(RUN_KEY, run);
+			await putEvent(event);
+			return {
+				ok: true,
+				event,
+				run,
+				releasedHooks: await releaseAllHooks(store)
+			};
+		}
+		case "step_created": {
+			const stepKey = `${STEP_KEY_PREFIX}${data.correlationId}`;
+			if (await store.get(stepKey)) return failure("ENTITY_CONFLICT", `Step "${data.correlationId}" already exists`);
+			const step = StepSchema.parse(compact({
+				runId,
+				stepId: data.correlationId,
+				stepName: data.eventData.stepName,
+				status: "pending",
+				input: data.eventData.input,
+				output: void 0,
+				error: void 0,
+				attempt: 0,
+				startedAt: void 0,
+				completedAt: void 0,
+				retryAfter: void 0,
+				createdAt: now,
+				updatedAt: now,
+				specVersion
+			}));
+			const event = buildEvent({ ...data });
+			await store.put(stepKey, step);
+			await store.put(creationIndexKey(STEP_CREATED_KEY_PREFIX, step.createdAt, step.stepId), step.stepId);
+			await putEvent(event);
+			return {
+				ok: true,
+				event,
+				step,
+				releasedHooks: []
+			};
+		}
+		case "step_started": {
+			const step = validatedStep;
+			if (!step) return failure("STEP_NOT_FOUND", `Step "${data.correlationId}" not found`);
+			if (step.retryAfter && step.retryAfter.getTime() > now.getTime()) return failure("TOO_EARLY", `Cannot start step "${data.correlationId}": retryAfter timestamp has not been reached yet`, { retryAfterSeconds: Math.ceil((step.retryAfter.getTime() - now.getTime()) / 1e3) });
+			const updated = StepSchema.parse(compact({
+				...step,
+				status: "running",
+				startedAt: step.startedAt ?? now,
+				attempt: step.attempt + 1,
+				retryAfter: void 0,
+				updatedAt: now
+			}));
+			const event = buildEvent({ ...data });
+			await store.put(`${STEP_KEY_PREFIX}${data.correlationId}`, updated);
+			await putEvent(event);
+			return {
+				ok: true,
+				event,
+				step: updated,
+				releasedHooks: []
+			};
+		}
+		case "step_completed": {
+			const step = validatedStep;
+			if (!step) return failure("STEP_NOT_FOUND", `Step "${data.correlationId}" not found`);
+			const updated = StepSchema.parse(compact({
+				...step,
+				status: "completed",
+				output: data.eventData.result,
+				completedAt: now,
+				updatedAt: now
+			}));
+			const event = buildEvent({ ...data });
+			await store.put(`${STEP_KEY_PREFIX}${data.correlationId}`, updated);
+			await putEvent(event);
+			return {
+				ok: true,
+				event,
+				step: updated,
+				releasedHooks: []
+			};
+		}
+		case "step_failed": {
+			const step = validatedStep;
+			if (!step) return failure("STEP_NOT_FOUND", `Step "${data.correlationId}" not found`);
+			const updated = StepSchema.parse(compact({
+				...step,
+				status: "failed",
+				error: toStructuredError(data.eventData.error, { stack: data.eventData.stack }),
+				completedAt: now,
+				updatedAt: now
+			}));
+			const event = buildEvent({ ...data });
+			await store.put(`${STEP_KEY_PREFIX}${data.correlationId}`, updated);
+			await putEvent(event);
+			return {
+				ok: true,
+				event,
+				step: updated,
+				releasedHooks: []
+			};
+		}
+		case "step_retrying": {
+			const step = validatedStep;
+			if (!step) return failure("STEP_NOT_FOUND", `Step "${data.correlationId}" not found`);
+			const updated = StepSchema.parse(compact({
+				...step,
+				status: "pending",
+				error: toStructuredError(data.eventData.error, { stack: data.eventData.stack }),
+				retryAfter: data.eventData.retryAfter ? new Date(data.eventData.retryAfter) : void 0,
+				updatedAt: now
+			}));
+			const event = buildEvent({ ...data });
+			await store.put(`${STEP_KEY_PREFIX}${data.correlationId}`, updated);
+			await putEvent(event);
+			return {
+				ok: true,
+				event,
+				step: updated,
+				releasedHooks: []
+			};
+		}
+		case "hook_created": {
+			const hookId = data.correlationId;
+			const token = data.eventData.token;
+			const holder = ctx.tokenHolder ?? null;
+			const markerKey = `${HOOK_EVENT_MARKER_PREFIX}${hookId}`;
+			const hookKey = `${HOOK_KEY_PREFIX}${hookId}`;
+			if (holder && (holder.runId !== runId || holder.hookId !== hookId)) {
+				const event = buildEvent({
+					eventType: "hook_conflict",
+					correlationId: hookId,
+					eventData: {
+						token,
+						conflictingRunId: holder.runId
+					}
+				});
+				await putEvent(event);
+				return {
+					ok: true,
+					event,
+					releasedHooks: []
+				};
+			}
+			if (await store.get(markerKey) !== void 0) {
+				const existingHook = await store.get(hookKey);
+				if (existingHook && !holder) return {
+					ok: true,
+					hook: existingHook,
+					hookToIndex: existingHook,
+					releasedHooks: []
+				};
+				return failure("ENTITY_CONFLICT", `Hook "${hookId}" already created`);
+			}
+			const hook = HookSchema.parse(compact({
+				runId,
+				hookId,
+				token,
+				metadata: data.eventData.metadata,
+				ownerId: "",
+				projectId: "",
+				environment: "",
+				createdAt: now,
+				specVersion,
+				isWebhook: data.eventData.isWebhook ?? false
+			}));
+			const event = buildEvent({ ...data });
+			await store.put(hookKey, hook);
+			await store.put(creationIndexKey(HOOK_CREATED_KEY_PREFIX, hook.createdAt, hook.hookId), hook.hookId);
+			await store.put(markerKey, event.eventId);
+			await putEvent(event);
+			return {
+				ok: true,
+				event,
+				hook,
+				hookToIndex: hook,
+				releasedHooks: []
+			};
+		}
+		case "hook_disposed": {
+			const hookKey = `${HOOK_KEY_PREFIX}${data.correlationId}`;
+			const hook = await store.get(hookKey);
+			if (!hook) return failure("HOOK_NOT_FOUND", `Hook "${data.correlationId}" not found`);
+			await store.delete(hookKey);
+			await store.delete(creationIndexKey(HOOK_CREATED_KEY_PREFIX, hook.createdAt, hook.hookId));
+			const event = buildEvent({ ...data });
+			await putEvent(event);
+			return {
+				ok: true,
+				event,
+				releasedHooks: [{
+					hookId: hook.hookId,
+					token: hook.token
+				}]
+			};
+		}
+		default: {
+			const event = buildEvent({ ...data });
+			await putEvent(event);
+			return {
+				ok: true,
+				event,
+				releasedHooks: []
+			};
+		}
+	}
+}
+//#endregion
+//#region src/worker/durable-objects/WorkflowRunDO.ts
+/**
+* Current schema version for DO storage.
+* Increment when making breaking changes to the storage layout.
+* Migrations run lazily on first request after deploy.
+*
+* v2: one storage key per event ('event:<eventId>'), step ('step:<stepId>')
+* and hook ('hook:<hookId>') instead of single aggregate values. This package
+* is pre-production, so the migration simply drops the legacy aggregates.
+*/
+const CURRENT_SCHEMA_VERSION = 3;
+/**
+* Idempotent migration functions keyed by target version. The schema version
+* is written only after the migration completes, so eviction safely retries
+* an interrupted migration.
+*/
+const MIGRATIONS = {
+	2: async (storage) => {
+		await storage.transaction(async (txn) => {
+			await txn.delete("events");
+			await txn.delete("steps");
+			await txn.delete("hooks");
+		});
+	},
+	3: async (storage) => {
+		await backfillCreationIndex(storage, STEP_KEY_PREFIX, STEP_CREATED_KEY_PREFIX, (step) => step.stepId);
+		await backfillCreationIndex(storage, HOOK_KEY_PREFIX, HOOK_CREATED_KEY_PREFIX, (hook) => hook.hookId);
+	}
+};
+async function backfillCreationIndex(storage, entityPrefix, indexPrefix, getId) {
+	let startAfter;
+	while (true) {
+		const entities = await storage.list({
+			prefix: entityPrefix,
+			startAfter,
+			limit: 100
+		});
+		if (entities.size === 0) return;
+		for (const [key, entity] of entities) {
+			const id = getId(entity);
+			await storage.put(`${indexPrefix}${entity.createdAt.toISOString()}:${id}`, id);
+			startAfter = key;
+		}
+		if (entities.size < 100) return;
+	}
+}
+/**
+* Ensure the DO storage schema is up to date.
+* Runs any pending migrations sequentially inside transactions,
+* persisting the version after each successful migration.
+* Safe to call on every request -- it's a no-op when already current.
+*/
+async function ensureSchemaUpToDate(storage) {
+	const stored = await storage.get("schema_version") ?? 1;
+	for (let v = stored + 1; v <= CURRENT_SCHEMA_VERSION; v++) {
+		const migration = MIGRATIONS[v];
+		if (migration) await migration(storage);
+		await storage.put("schema_version", v);
+	}
+}
+/**
+* Adapt DO storage (or a transaction) to the {@link EventStore} interface
+* shared with the test mocks. No casts: the methods line up structurally,
+* this just pins the subset we rely on.
+*/
+function storeFrom(storage) {
+	return {
+		get: (key) => storage.get(key),
+		put: (key, value) => storage.put(key, value),
+		delete: (key) => storage.delete(key),
+		list: (options) => storage.list(options)
+	};
+}
+/**
+* Durable Object for managing a single workflow run's state.
+*
+* All event-sourced writes go through {@link applyEvent} inside a single
+* storage transaction: guard checks, the event append, and the entity
+* mutation are atomic even if the DO is evicted mid-operation.
+*
+* Instances named `claim:<queueName>:<idempotencyKey>` are used purely as
+* queue-message dedup claims (see claimInflight/releaseInflight).
+*/
+var WorkflowRunDO = class extends DurableObject {
+	schemaReady = null;
+	/**
+	* Lazily ensure schema migrations have run.
+	* Memoized so it only runs once per DO instantiation.
+	*/
+	ensureSchema() {
+		if (!this.schemaReady) this.schemaReady = ensureSchemaUpToDate(this.ctx.storage);
+		return this.schemaReady;
+	}
+	/**
+	* Apply an event: validate, guard, append the event and mutate the entity
+	* in ONE storage transaction. Guard failures are returned as structured
+	* outcomes (not thrown) because typed errors do not survive the RPC
+	* boundary with their `name` intact.
+	*/
+	async applyEvent(request) {
+		await this.ensureSchema();
+		return await this.ctx.storage.transaction(async (txn) => {
+			let eventSequence = await txn.get("event_sequence") ?? 0;
+			const outcome = await applyEvent(storeFrom(txn), {
+				...request,
+				nextEventId: () => `wevt_z${String(++eventSequence).padStart(20, "0")}`,
+				now: /* @__PURE__ */ new Date()
+			});
+			if (outcome.ok) await txn.put("event_sequence", eventSequence);
+			return outcome;
+		});
+	}
+	/**
+	* Get the workflow run
+	*/
+	async getRun() {
+		await this.ensureSchema();
+		return await this.ctx.storage.get("run") ?? null;
+	}
+	/**
+	* Get a specific step
+	*/
+	async getStep(stepId) {
+		await this.ensureSchema();
+		return await this.ctx.storage.get(`step:${stepId}`) ?? null;
+	}
+	/**
+	* List steps with real limit/cursor pagination (cursor = last stepId).
+	*/
+	async listSteps(params) {
+		await this.ensureSchema();
+		return listByCreationTime(storeFrom(this.ctx.storage), STEP_CREATED_KEY_PREFIX, STEP_KEY_PREFIX, {
+			limit: params?.limit ?? 20,
+			cursor: params?.cursor,
+			sortOrder: params?.sortOrder ?? "asc"
+		});
+	}
+	/**
+	* Get a specific event
+	*/
+	async getEvent(eventId) {
+		await this.ensureSchema();
+		return await this.ctx.storage.get(`event:${eventId}`) ?? null;
+	}
+	/**
+	* List events with real limit/cursor pagination. Events are keyed by their
+	* monotonic ULID eventId, so storage order == event order.
+	*/
+	async listEvents(params) {
+		await this.ensureSchema();
+		return listByPrefix(storeFrom(this.ctx.storage), EVENT_KEY_PREFIX, {
+			limit: params?.limit ?? 100,
+			cursor: params?.cursor,
+			sortOrder: params?.sortOrder ?? "asc"
+		}, (event) => event.eventId);
+	}
+	/**
+	* List hooks with real limit/cursor pagination (cursor = last hookId).
+	*/
+	async listHooks(params) {
+		await this.ensureSchema();
+		return listByCreationTime(storeFrom(this.ctx.storage), HOOK_CREATED_KEY_PREFIX, HOOK_KEY_PREFIX, {
+			limit: params?.limit ?? 100,
+			cursor: params?.cursor,
+			sortOrder: params?.sortOrder ?? "asc"
+		});
+	}
+	/**
+	* Claim a queue-message dedup slot. Used on DO instances dedicated to a
+	* single idempotency key (`claim:<queueName>:<idempotencyKey>`).
+	*
+	* - Unclaimed -> claim and proceed.
+	* - Claimed by the SAME messageId -> redelivery of the same message
+	*   (previous attempt failed transiently) -> proceed.
+	* - Claimed by a DIFFERENT messageId -> concurrent duplicate -> reject,
+	*   unless the claim is stale (holder crashed / went to the DLQ without
+	*   releasing), in which case the claim is stolen.
+	*/
+	async claimInflight(params) {
+		await this.ensureSchema();
+		return await this.ctx.storage.transaction(async (txn) => {
+			const existing = await txn.get("claim");
+			const now = Date.now();
+			if (existing && existing.messageId !== params.messageId && now - existing.claimedAt < params.staleMs) return { claimed: false };
+			await txn.put("claim", {
+				messageId: params.messageId,
+				claimedAt: now
+			});
+			return { claimed: true };
+		});
+	}
+	/**
+	* Release a queue-message dedup claim after the message was fully handled.
+	*/
+	async releaseInflight() {
+		await this.ensureSchema();
+		await this.ctx.storage.delete("claim");
+	}
+};
+//#endregion
+//#region src/testing/http-harness.ts
+/**
+* Boots the real worker router over real cell classes (on FakeFleet state)
+* behind a node:http server — the full wire protocol without a celld binary.
+*/
+async function startHarness(options = {}) {
+	const fleet = new FakeFleet({
+		runs: WorkflowRunDO,
+		streams: StreamDO,
+		index: IndexDO,
+		queue: QueueDO,
+		...options.extraClasses
+	}, options.cellEnv ?? {});
+	const router = createRouter({
+		WORKFLOW_DB: fleet.namespace("runs"),
+		WORKFLOW_STREAMS: fleet.namespace("streams"),
+		WORKFLOW_INDEX: fleet.namespace("index"),
+		WORKFLOW_QUEUE: fleet.namespace("queue"),
+		WORLD_SECRET: options.secret
+	});
+	const server = http.createServer(async (req, res) => {
+		try {
+			const chunks = [];
+			for await (const chunk of req) chunks.push(chunk);
+			const body = Buffer.concat(chunks);
+			const request = new Request(`http://127.0.0.1${req.url ?? "/"}`, {
+				method: req.method,
+				headers: req.headers,
+				body: req.method === "GET" || req.method === "HEAD" || body.length === 0 ? null : body
+			});
+			const response = await router(request);
+			res.writeHead(response.status, Object.fromEntries(response.headers.entries()));
+			res.end(Buffer.from(await response.arrayBuffer()));
+		} catch (error) {
+			res.writeHead(500, { "content-type": "application/json" });
+			res.end(JSON.stringify({ error: {
+				name: "HarnessError",
+				message: String(error)
+			} }));
+		}
+	});
+	await new Promise((resolve) => server.listen(0, "127.0.0.1", resolve));
+	const { port } = server.address();
+	return {
+		url: `http://127.0.0.1:${port}`,
+		fleet,
+		close: () => new Promise((resolve, reject) => server.close((err) => err ? reject(err) : resolve()))
+	};
+}
+//#endregion
+//#region src/testing/index.ts
+/** Alarm-pump interval for the dev fleet (real time). */
+const PUMP_INTERVAL_MS = 25;
+async function startDevFleet(options = {}) {
+	const harness = await startHarness(options);
+	let pumping = false;
+	const pump = setInterval(async () => {
+		if (pumping) return;
+		pumping = true;
+		try {
+			harness.fleet.now = Date.now();
+			await harness.fleet.fireDueAlarms();
+		} catch (error) {
+			console.error("[world-celld dev fleet] alarm pump error:", error);
+		} finally {
+			pumping = false;
+		}
+	}, PUMP_INTERVAL_MS);
+	pump.unref?.();
+	return {
+		...harness,
+		async stop() {
+			clearInterval(pump);
+			await harness.close();
+		}
+	};
+}
+//#endregion
+export { FakeFleet, FakeStorage, startDevFleet, startHarness };
+
+//# sourceMappingURL=testing.js.map