@ewhauser/world-celld 0.1.0

package/dist/worker.js

@@ -0,0 +1,1582 @@
+import { EventSchema, HookSchema, SPEC_VERSION_CURRENT, StepSchema, WorkflowRunSchema, isLegacySpecVersion, isTerminalStepStatus, isTerminalWorkflowRunStatus, requiresNewerWorld } from "@workflow/world";
+import { DurableObject } from "cloudflare:workers";
+//#region src/vendor/shared/serialization.ts
+/** Standard Date fields used across all worlds */
+const DATE_FIELDS = /* @__PURE__ */ new Set([
+	"createdAt",
+	"updatedAt",
+	"startedAt",
+	"completedAt",
+	"retryAfter"
+]);
+/**
+* JSON reviver that converts ISO date strings to Date objects.
+* Use with JSON.parse(json, dateReviver).
+*/
+function dateReviver(key, value) {
+	if (DATE_FIELDS.has(key) && typeof value === "string") {
+		const date = new Date(value);
+		return Number.isNaN(date.getTime()) ? value : date;
+	}
+	return value;
+}
+/**
+* Base64 helpers. Modified vs upstream: implemented over atob/btoa instead of
+* Buffer so this module is safe inside the celld worker bundle (workerd has
+* no Buffer global); atob/btoa are global in both workerd and Node >= 16.
+*/
+function b64encode(bytes) {
+	let bin = "";
+	const CHUNK = 32768;
+	for (let i = 0; i < bytes.length; i += CHUNK) bin += String.fromCharCode(...bytes.subarray(i, i + CHUNK));
+	return btoa(bin);
+}
+function b64decode(text) {
+	const bin = atob(text);
+	const out = new Uint8Array(bin.length);
+	for (let i = 0; i < bin.length; i++) out[i] = bin.charCodeAt(i);
+	return out;
+}
+/**
+* JSON reviver that decodes tagged Uint8Array objects and ISO date strings.
+* Supports both:
+* - New format: { __type: 'Uint8Array', data: '<base64>' }
+* - Legacy format: { __uint8array: true, data: [1, 2, 3] }
+*/
+function uint8ArrayReviver(key, value) {
+	if (value && typeof value === "object") {
+		const obj = value;
+		if (obj.__type === "Uint8Array" && typeof obj.data === "string") return b64decode(obj.data);
+		if (obj.__uint8array === true && Array.isArray(obj.data)) return new Uint8Array(obj.data);
+	}
+	return dateReviver(key, value);
+}
+/** Parse with Uint8Array and Date support. */
+function parse(text) {
+	return JSON.parse(text, uint8ArrayReviver);
+}
+//#endregion
+//#region src/codec.ts
+/**
+* RPC wire codec for the Node client <-> worker router HTTP boundary.
+*
+* Extends the shared tagged-JSON format (`{__type:'Uint8Array', data}` +
+* DATE_FIELDS revival) with explicitly tagged Dates: on Cloudflare the DO RPC
+* boundary is structured clone, which preserves EVERY Date — including ones
+* outside the well-known DATE_FIELDS (e.g. inside applyEvent outcomes and
+* user payloads). The HTTP hop must preserve them too, so Dates travel as
+* `{__type:'Date', iso}`.
+*
+* Runs on both sides of the wire, including inside the celld worker — so no
+* Node built-ins (Buffer): base64 goes through atob/btoa.
+*/
+function rpcReplacer(key, value) {
+	const original = this && typeof this === "object" ? this[key] : void 0;
+	if (original instanceof Date) return {
+		__type: "Date",
+		iso: original.toISOString()
+	};
+	if (value instanceof Uint8Array) return {
+		__type: "Uint8Array",
+		data: b64encode(value)
+	};
+	return value;
+}
+function rpcReviver(key, value) {
+	if (value && typeof value === "object") {
+		const obj = value;
+		if (obj.__type === "Date" && typeof obj.iso === "string") return new Date(obj.iso);
+		if (obj.__type === "Uint8Array" && typeof obj.data === "string") return b64decode(obj.data);
+	}
+	return dateReviver(key, value);
+}
+function rpcStringify(value) {
+	return JSON.stringify(value, rpcReplacer);
+}
+function rpcParse(text) {
+	return JSON.parse(text, rpcReviver);
+}
+//#endregion
+//#region src/worker/auth.ts
+/**
+* Bearer-token auth for the worker router.
+*
+* Fails closed: when the WORLD_SECRET var is not configured, every protected
+* route returns 503 instead of forwarding unauthenticated traffic (the
+* eve-ambient celld-worker pattern).
+*/
+/**
+* Constant-time string comparison via SHA-256 digests (digest-then-compare
+* is length-independent). crypto.subtle is global in both workerd and Node.
+*/
+async function timingSafeEqual(a, b) {
+	const enc = new TextEncoder();
+	const [da, db] = await Promise.all([crypto.subtle.digest("SHA-256", enc.encode(a)), crypto.subtle.digest("SHA-256", enc.encode(b))]);
+	const va = new Uint8Array(da);
+	const vb = new Uint8Array(db);
+	let diff = 0;
+	for (let i = 0; i < va.length; i++) diff |= va[i] ^ vb[i];
+	return diff === 0;
+}
+async function authenticate(request, secret) {
+	if (!secret) return {
+		ok: false,
+		response: Response.json({ error: {
+			name: "WorldNotConfigured",
+			message: "WORLD_SECRET is not configured"
+		} }, { status: 503 })
+	};
+	const header = request.headers.get("authorization") ?? "";
+	const token = header.startsWith("Bearer ") ? header.slice(7) : "";
+	if (!token || !await timingSafeEqual(token, secret)) return {
+		ok: false,
+		response: Response.json({ error: {
+			name: "Unauthorized",
+			message: "invalid or missing bearer token"
+		} }, { status: 401 })
+	};
+	return { ok: true };
+}
+//#endregion
+//#region src/worker/router.ts
+/**
+* Worker-level HTTP router: the fleet-facing RPC surface of the celld world.
+*
+* Routes:
+*   GET  /v1/health                              — liveness + spec version (unauthenticated)
+*   POST /v1/rpc/{binding}/{name}/{method}       — DO RPC (bearer auth)
+*
+* The RPC body is an rpc-codec-encoded JSON array of arguments; the response
+* body is the rpc-codec-encoded return value. Only whitelisted methods
+* dispatch — everything else (including fetch/alarm) is unreachable.
+*/
+const WORLD_NAME = "world-celld";
+const WORLD_VERSION = "0.1.0";
+const BINDINGS = {
+	runs: {
+		env: "WORKFLOW_DB",
+		methods: /* @__PURE__ */ new Set([
+			"applyEvent",
+			"getRun",
+			"getStep",
+			"getEvent",
+			"listEvents",
+			"listSteps",
+			"listHooks"
+		])
+	},
+	streams: {
+		env: "WORKFLOW_STREAMS",
+		methods: /* @__PURE__ */ new Set([
+			"writeChunk",
+			"closeStream",
+			"getChunks",
+			"getInfo",
+			"registerStream",
+			"listStreams"
+		])
+	},
+	index: {
+		env: "WORKFLOW_INDEX",
+		methods: /* @__PURE__ */ new Set([
+			"get",
+			"put",
+			"delete",
+			"list",
+			"reserveHookToken",
+			"finalizeHookIndexes",
+			"releaseHookToken",
+			"deleteHookIndexes"
+		])
+	},
+	queue: {
+		env: "WORKFLOW_QUEUE",
+		methods: /* @__PURE__ */ new Set([
+			"enqueue",
+			"stats",
+			"listDeadLetters",
+			"redriveDeadLetter",
+			"purgeDeadLetters",
+			"rearmAlarm"
+		])
+	}
+};
+/** Request body cap: oversize payloads get a clear 413 instead of an OOM. */
+const MAX_BODY_BYTES = 33554432;
+function errorResponse(status, name, message) {
+	return Response.json({ error: {
+		name,
+		message
+	} }, { status });
+}
+async function readBoundedBody(request) {
+	if (!request.body) return "";
+	const reader = request.body.getReader();
+	const decoder = new TextDecoder();
+	let total = 0;
+	let text = "";
+	try {
+		while (true) {
+			const { done, value } = await reader.read();
+			if (done) break;
+			total += value.byteLength;
+			if (total > MAX_BODY_BYTES) {
+				await reader.cancel("RPC body exceeds configured limit").catch(() => void 0);
+				return null;
+			}
+			text += decoder.decode(value, { stream: true });
+		}
+		return text + decoder.decode();
+	} finally {
+		reader.releaseLock();
+	}
+}
+function createRouter(env) {
+	return async (request) => {
+		const url = new URL(request.url);
+		const parts = url.pathname.split("/").filter(Boolean);
+		if (parts[0] !== "v1") return errorResponse(404, "NotFound", `unknown path: ${url.pathname}`);
+		if (parts[1] === "health" && parts.length === 2) return Response.json({
+			ok: true,
+			name: WORLD_NAME,
+			version: WORLD_VERSION,
+			specVersion: SPEC_VERSION_CURRENT
+		});
+		if (parts[1] !== "rpc") return errorResponse(404, "NotFound", `unknown path: ${url.pathname}`);
+		const auth = await authenticate(request, env.WORLD_SECRET);
+		if (!auth.ok) return auth.response;
+		if (request.method !== "POST" || parts.length !== 5) return errorResponse(404, "NotFound", "expected POST /v1/rpc/{binding}/{name}/{method}");
+		const [, , bindingKey, encodedName, method] = parts;
+		const binding = BINDINGS[bindingKey];
+		if (!binding) return errorResponse(404, "NotFound", `unknown binding: ${bindingKey}`);
+		if (!binding.methods.has(method)) return errorResponse(404, "NotFound", `unknown method: ${bindingKey}.${method}`);
+		if (Number(request.headers.get("content-length") ?? "0") > MAX_BODY_BYTES) return errorResponse(413, "PayloadTooLarge", `body exceeds ${MAX_BODY_BYTES} bytes`);
+		let args;
+		try {
+			const text = await readBoundedBody(request);
+			if (text === null) return errorResponse(413, "PayloadTooLarge", `body exceeds ${MAX_BODY_BYTES} bytes`);
+			const parsed = rpcParse(text);
+			if (!Array.isArray(parsed)) return errorResponse(400, "BadRequest", "body must be an argument array");
+			args = parsed;
+		} catch {
+			return errorResponse(400, "BadRequest", "malformed rpc body");
+		}
+		const name = decodeURIComponent(encodedName);
+		const namespace = env[binding.env];
+		if (!namespace) return errorResponse(500, "WorldMisconfigured", `missing binding: ${binding.env}`);
+		try {
+			const result = await namespace.get(namespace.idFromName(name))[method](...args);
+			return new Response(rpcStringify(result ?? null), {
+				status: 200,
+				headers: { "content-type": "application/json" }
+			});
+		} catch (error) {
+			const err = error;
+			return Response.json({ error: {
+				name: err?.name ?? "Error",
+				message: err?.message ?? String(error),
+				status: typeof err?.status === "number" ? err.status : void 0
+			} }, { status: 500 });
+		}
+	};
+}
+//#endregion
+//#region src/vendor/shared/util.ts
+function compact(obj) {
+	const value = {};
+	for (const key in obj) if (obj[key] !== null) value[key] = obj[key];
+	else value[key] = void 0;
+	return value;
+}
+//#endregion
+//#region src/worker/durable-objects/IndexDO.ts
+function sameOwner(left, right) {
+	return left.runId === right.runId && left.hookId === right.hookId;
+}
+function ownerFromHook(raw) {
+	const hook = parse(raw);
+	return {
+		runId: hook.runId,
+		hookId: hook.hookId
+	};
+}
+/**
+* Global index cell, replacing the Workers KV namespace world-cloudflare
+* uses for run listing and hook token/id lookup.
+*
+* A single cell (named `index`) serializes every read and write. Hook-token
+* reservation, publication, and release use storage transactions so
+* concurrent runs cannot both acquire the same token.
+*
+* The RPC surface matches the storage-layer KVNamespace interface bit-for-bit
+* (including MockKVNamespace's pagination contract: cursor = last returned
+* key, `list_complete` reflects whether further keys exist), so the vendored
+* storage.ts works against it unchanged.
+*/
+var IndexDO = class extends DurableObject {
+	async get(key) {
+		return await this.ctx.storage.get(key) ?? null;
+	}
+	async put(key, value) {
+		await this.ctx.storage.put(key, value);
+	}
+	async delete(key) {
+		await this.ctx.storage.delete(key);
+	}
+	async list(options) {
+		const prefix = options?.prefix ?? "";
+		const limit = options?.limit ?? 1e3;
+		const entries = await this.ctx.storage.list({
+			prefix,
+			...options?.reverse ? {
+				reverse: true,
+				end: options.cursor
+			} : { startAfter: options?.cursor },
+			limit: limit + 1
+		});
+		const names = Array.from(entries.keys());
+		const page = names.slice(0, limit);
+		const listComplete = names.length <= limit;
+		return {
+			keys: page.map((name) => ({ name })),
+			list_complete: listComplete,
+			cursor: listComplete ? void 0 : page.at(-1)
+		};
+	}
+	async reserveHookToken(token, owner) {
+		return this.ctx.storage.transaction(async (txn) => {
+			const indexedHook = await txn.get(`hook:${token}`);
+			if (indexedHook !== void 0) return {
+				claimed: false,
+				holder: ownerFromHook(indexedHook)
+			};
+			const claimKey = `hookclaim:${token}`;
+			const claim = await txn.get(claimKey);
+			if (claim !== void 0 && !sameOwner(claim.owner, owner)) return {
+				claimed: false,
+				holder: claim.owner
+			};
+			await txn.put(claimKey, {
+				owner,
+				reservedAt: Date.now()
+			});
+			return { claimed: true };
+		});
+	}
+	async finalizeHookIndexes(token, hookId, serializedHook, owner) {
+		await this.ctx.storage.transaction(async (txn) => {
+			const indexedHook = await txn.get(`hook:${token}`);
+			if (indexedHook !== void 0 && !sameOwner(ownerFromHook(indexedHook), owner)) throw new Error(`Hook token ${token} is owned by another hook`);
+			const claim = await txn.get(`hookclaim:${token}`);
+			if (claim !== void 0 && !sameOwner(claim.owner, owner)) throw new Error(`Hook token ${token} is reserved by another hook`);
+			await txn.put(`hook:${token}`, serializedHook);
+			await txn.put(`hookid:${hookId}`, serializedHook);
+			if (claim !== void 0) await txn.delete(`hookclaim:${token}`);
+		});
+	}
+	async releaseHookToken(token, owner) {
+		await this.ctx.storage.transaction(async (txn) => {
+			const key = `hookclaim:${token}`;
+			const claim = await txn.get(key);
+			if (claim !== void 0 && sameOwner(claim.owner, owner)) await txn.delete(key);
+		});
+	}
+	async deleteHookIndexes(token, hookId, owner) {
+		await this.ctx.storage.transaction(async (txn) => {
+			const tokenKey = `hook:${token}`;
+			const idKey = `hookid:${hookId}`;
+			const claimKey = `hookclaim:${token}`;
+			const [byToken, byId, claim] = await Promise.all([
+				txn.get(tokenKey),
+				txn.get(idKey),
+				txn.get(claimKey)
+			]);
+			if (byToken !== void 0 && sameOwner(ownerFromHook(byToken), owner)) await txn.delete(tokenKey);
+			if (byId !== void 0 && sameOwner(ownerFromHook(byId), owner)) await txn.delete(idKey);
+			if (claim !== void 0 && sameOwner(claim.owner, owner)) await txn.delete(claimKey);
+		});
+	}
+};
+//#endregion
+//#region src/worker/durable-objects/QueueDO.ts
+const PERMANENT_STATUSES = /* @__PURE__ */ new Set([
+	404,
+	409,
+	410,
+	422
+]);
+const DEFAULT_MAX_ATTEMPTS = 5;
+const DEFAULT_MAX_INFLIGHT = 5;
+const DEFAULT_DELIVERY_TIMEOUT_MS = 3e5;
+/** Grace period past the delivery timeout before a claim counts as lost. */
+const INFLIGHT_GRACE_MS = 3e4;
+/** Move overdue alarms to a new timestamp so celld observes a fresh edge. */
+const MIN_ALARM_DELAY_MS = 1;
+function pad(ms) {
+	return String(Math.max(0, Math.floor(ms))).padStart(13, "0");
+}
+function dueKey(atMs, messageId) {
+	return `due:${pad(atMs)}:${messageId}`;
+}
+function backoffSeconds(attempt) {
+	return Math.min(60, 2 ** attempt);
+}
+var QueueDO = class extends DurableObject {
+	#now() {
+		const clock = this.env?.clock;
+		return typeof clock === "function" ? clock() : Date.now();
+	}
+	#fetch() {
+		const impl = this.env?.fetch;
+		return typeof impl === "function" ? impl : fetch;
+	}
+	#intVar(name, fallback) {
+		const raw = this.env?.[name];
+		const parsed = raw ? Number.parseInt(raw, 10) : NaN;
+		return Number.isFinite(parsed) && parsed > 0 ? parsed : fallback;
+	}
+	async enqueue(request) {
+		const storage = this.ctx.storage;
+		const now = this.#now();
+		return await storage.transaction(async (txn) => {
+			const pinned = await txn.get("cfg");
+			if (!pinned) await txn.put("cfg", {
+				queueShards: request.config.queueShards,
+				pinnedAt: now
+			});
+			else if (pinned.queueShards !== request.config.queueShards) return {
+				ok: false,
+				code: "CONFIG_MISMATCH",
+				message: `queue cell shard-count mismatch: pinned ${pinned.queueShards}, got ${request.config.queueShards} — changing queueShards requires draining the fleet`
+			};
+			if (request.idempotencyKey) {
+				const existing = await txn.get(`key:${request.idempotencyKey}`);
+				if (existing) {
+					if (await txn.get(`msg:${existing}`)) {
+						await this.#scheduleNextAlarm(txn, now);
+						return {
+							ok: true,
+							messageId: existing,
+							deduped: true
+						};
+					}
+					await txn.delete(`key:${request.idempotencyKey}`);
+				}
+				await txn.put(`key:${request.idempotencyKey}`, request.messageId);
+			}
+			const row = {
+				messageId: request.messageId,
+				queueName: request.queueName,
+				pathname: request.pathname,
+				body: request.body,
+				targetBaseUrl: request.config.targetBaseUrl,
+				idempotencyKey: request.idempotencyKey,
+				attempt: 0,
+				enqueuedAt: now
+			};
+			const dueAt = now + Math.max(0, request.delaySeconds ?? 0) * 1e3;
+			await txn.put(`msg:${row.messageId}`, row);
+			await txn.put(dueKey(dueAt, row.messageId), row.messageId);
+			await this.#armAlarmAtMost(txn, dueAt, now);
+			return {
+				ok: true,
+				messageId: row.messageId,
+				deduped: false
+			};
+		});
+	}
+	async alarm() {
+		let claimed = [];
+		let failure = null;
+		const attempt = async () => {
+			try {
+				claimed = await this.#claimPhase();
+			} catch (error) {
+				failure = error;
+			}
+		};
+		if (typeof this.ctx.blockConcurrencyWhile === "function") await this.ctx.blockConcurrencyWhile(attempt);
+		else await attempt();
+		if (failure !== null) throw failure;
+		for (const row of claimed) this.ctx.waitUntil(this.#deliver(row));
+	}
+	/**
+	* Storage-only: recover lost inflight claims, claim due messages up to the
+	* inflight cap, and re-arm the alarm. Never throws for data conditions.
+	*/
+	async #claimPhase() {
+		const storage = this.ctx.storage;
+		const now = this.#now();
+		const maxInflight = this.#intVar("QUEUE_MAX_INFLIGHT", DEFAULT_MAX_INFLIGHT);
+		return await storage.transaction(async (txn) => {
+			const inflight = await txn.list({ prefix: "inflight:" });
+			let inflightCount = 0;
+			for (const [key, deadline] of inflight) if (deadline <= now) {
+				const messageId = key.slice(9);
+				await txn.delete(key);
+				if (await txn.get(`msg:${messageId}`)) await txn.put(dueKey(now, messageId), messageId);
+			} else inflightCount++;
+			const rows = [];
+			if (inflightCount < maxInflight) {
+				const due = await txn.list({
+					prefix: "due:",
+					end: `due:${pad(now + 1)}`,
+					limit: maxInflight - inflightCount
+				});
+				const timeoutMs = this.#intVar("QUEUE_DELIVERY_TIMEOUT_MS", DEFAULT_DELIVERY_TIMEOUT_MS);
+				for (const [key, messageId] of due) {
+					await txn.delete(key);
+					const row = await txn.get(`msg:${messageId}`);
+					if (!row) continue;
+					await txn.put(`inflight:${messageId}`, now + timeoutMs + INFLIGHT_GRACE_MS);
+					rows.push(row);
+				}
+			}
+			await this.#scheduleNextAlarm(txn, now);
+			return rows;
+		});
+	}
+	async #deliver(row) {
+		const storage = this.ctx.storage;
+		const timeoutMs = this.#intVar("QUEUE_DELIVERY_TIMEOUT_MS", DEFAULT_DELIVERY_TIMEOUT_MS);
+		const callbackSecret = this.env?.WORKFLOW_CALLBACK_SECRET;
+		const url = `${row.targetBaseUrl.replace(/\/$/, "")}/.well-known/workflow/v1/${row.pathname}`;
+		let response = null;
+		let transportError = null;
+		try {
+			response = await this.#fetch()(url, {
+				method: "POST",
+				headers: {
+					"content-type": "application/json",
+					"x-vqs-queue-name": row.queueName,
+					"x-vqs-message-id": row.messageId,
+					"x-vqs-message-attempt": String(row.attempt + 1),
+					...callbackSecret ? { "x-workflow-callback-secret": callbackSecret } : {}
+				},
+				body: row.body,
+				signal: AbortSignal.timeout(timeoutMs)
+			});
+		} catch (error) {
+			transportError = error;
+		}
+		const now = this.#now();
+		if (response?.ok) await this.#ack(row);
+		else if (response && response.status === 503) {
+			let timeoutSeconds;
+			try {
+				timeoutSeconds = (await response.json())?.timeoutSeconds;
+			} catch {
+				timeoutSeconds = void 0;
+			}
+			if (typeof timeoutSeconds === "number") await storage.transaction(async (txn) => {
+				await txn.delete(`inflight:${row.messageId}`);
+				await txn.put(dueKey(now + timeoutSeconds * 1e3, row.messageId), row.messageId);
+				await this.#scheduleNextAlarm(txn, now);
+			});
+			else await this.#retry(row, "HTTP 503");
+		} else if (response && PERMANENT_STATUSES.has(response.status)) await this.#ack(row);
+		else {
+			const reason = response ? `HTTP ${response.status}` : `transport error: ${String(transportError)}`;
+			await this.#retry(row, reason);
+		}
+	}
+	async #ack(row) {
+		await this.ctx.storage.transaction(async (txn) => {
+			await txn.delete(`msg:${row.messageId}`);
+			await txn.delete(`inflight:${row.messageId}`);
+			if (row.idempotencyKey) {
+				if (await txn.get(`key:${row.idempotencyKey}`) === row.messageId) await txn.delete(`key:${row.idempotencyKey}`);
+			}
+			await this.#scheduleNextAlarm(txn, this.#now());
+		});
+	}
+	async #retry(row, reason) {
+		const storage = this.ctx.storage;
+		const now = this.#now();
+		const maxAttempts = this.#intVar("QUEUE_MAX_ATTEMPTS", DEFAULT_MAX_ATTEMPTS);
+		const attempt = row.attempt + 1;
+		await storage.transaction(async (txn) => {
+			await txn.delete(`inflight:${row.messageId}`);
+			if (attempt >= maxAttempts) {
+				const dead = {
+					...row,
+					attempt,
+					lastError: reason,
+					failedAt: now
+				};
+				await txn.put(`dlq:${pad(now)}:${row.messageId}`, dead);
+				await txn.delete(`msg:${row.messageId}`);
+				if (row.idempotencyKey) {
+					if (await txn.get(`key:${row.idempotencyKey}`) === row.messageId) await txn.delete(`key:${row.idempotencyKey}`);
+				}
+				await this.#scheduleNextAlarm(txn, now);
+				return;
+			}
+			const updated = {
+				...row,
+				attempt,
+				lastError: reason
+			};
+			await txn.put(`msg:${row.messageId}`, updated);
+			await txn.put(dueKey(now + backoffSeconds(attempt) * 1e3, row.messageId), row.messageId);
+			await this.#scheduleNextAlarm(txn, now);
+		});
+	}
+	/** Arm the alarm no later than `atMs` (durable backoff never throws). */
+	async #armAlarmAtMost(storage, atMs, now) {
+		const current = await storage.getAlarm();
+		if (current !== null && current <= now) {
+			await storage.setAlarm(now + MIN_ALARM_DELAY_MS);
+			return;
+		}
+		const target = atMs <= now ? now + MIN_ALARM_DELAY_MS : atMs;
+		if (current === null || target < current) await storage.setAlarm(target);
+	}
+	/** Recompute the alarm from the earliest due entry / inflight deadline. */
+	async #rearm() {
+		await this.#scheduleNextAlarm(this.ctx.storage, this.#now());
+	}
+	/** Keep the alarm index consistent with message state in the same transaction. */
+	async #scheduleNextAlarm(storage, now) {
+		let next = null;
+		const due = await storage.list({
+			prefix: "due:",
+			limit: 1
+		});
+		for (const key of due.keys()) next = Number.parseInt(key.slice(4, 17), 10);
+		const inflight = await storage.list({ prefix: "inflight:" });
+		for (const deadline of inflight.values()) if (next === null || deadline < next) next = deadline;
+		if (next !== null) await storage.setAlarm(next <= now ? now + MIN_ALARM_DELAY_MS : next);
+		else await storage.deleteAlarm();
+	}
+	async stats() {
+		const storage = this.ctx.storage;
+		const [due, inflight, dlq, alarmAt] = await Promise.all([
+			storage.list({ prefix: "due:" }),
+			storage.list({ prefix: "inflight:" }),
+			storage.list({ prefix: "dlq:" }),
+			storage.getAlarm()
+		]);
+		return {
+			pending: due.size,
+			inflight: inflight.size,
+			deadLetters: dlq.size,
+			alarmAt
+		};
+	}
+	async listDeadLetters(params) {
+		const limit = params?.limit ?? 100;
+		const entries = await this.ctx.storage.list({
+			prefix: "dlq:",
+			startAfter: params?.cursor,
+			limit: limit + 1
+		});
+		const keys = Array.from(entries.keys());
+		const page = keys.slice(0, limit);
+		const hasMore = keys.length > limit;
+		return {
+			data: page.map((k) => entries.get(k)),
+			cursor: hasMore ? page.at(-1) : null,
+			hasMore
+		};
+	}
+	/** Move a dead letter back to the live queue (attempt count reset). */
+	async redriveDeadLetter(messageId) {
+		const storage = this.ctx.storage;
+		const now = this.#now();
+		return await storage.transaction(async (txn) => {
+			const dlq = await txn.list({ prefix: "dlq:" });
+			for (const [key, dead] of dlq) {
+				if (dead.messageId !== messageId) continue;
+				const { failedAt: _failedAt, ...rest } = dead;
+				const row = {
+					...rest,
+					attempt: 0,
+					lastError: void 0
+				};
+				if (row.idempotencyKey) {
+					const dedupKey = `key:${row.idempotencyKey}`;
+					const holder = await txn.get(dedupKey);
+					if (holder && holder !== row.messageId && await txn.get(`msg:${holder}`)) return { ok: false };
+					if (holder && holder !== row.messageId) await txn.delete(dedupKey);
+					await txn.put(dedupKey, row.messageId);
+				}
+				await txn.put(`msg:${row.messageId}`, row);
+				await txn.put(dueKey(now, row.messageId), row.messageId);
+				await txn.delete(key);
+				await this.#armAlarmAtMost(txn, now, now);
+				return { ok: true };
+			}
+			return { ok: false };
+		});
+	}
+	async purgeDeadLetters() {
+		return await this.ctx.storage.transaction(async (txn) => {
+			const dlq = await txn.list({ prefix: "dlq:" });
+			for (const key of dlq.keys()) await txn.delete(key);
+			return { purged: dlq.size };
+		});
+	}
+	/**
+	* Recovery hatch for celld's six-failure alarm abandonment: derive the due
+	* time again and arm it.
+	*/
+	async rearmAlarm() {
+		await this.#rearm();
+		return { alarmAt: await this.ctx.storage.getAlarm() };
+	}
+};
+//#endregion
+//#region src/worker/durable-objects/StreamDO.ts
+const META_KEY = "meta";
+const CHUNK_KEY_PREFIX = "chunk:";
+/** Registry keys used when this DO instance acts as a per-run stream index. */
+const STREAM_REGISTRY_PREFIX = "stream:";
+/**
+* Zero-pad chunk indexes so `storage.list({ prefix })` returns chunks in
+* write order. 12 digits comfortably exceeds any realistic chunk count.
+*/
+function chunkKey(index) {
+	return `${CHUNK_KEY_PREFIX}${index.toString().padStart(12, "0")}`;
+}
+/**
+* Durable Object backing workflow streams.
+*
+* Two roles, selected by the DO name:
+* - `stream:<name>`: chunk storage for a single stream. A monotonic
+*   per-stream counter (maintained transactionally inside the DO) assigns
+*   each chunk its index; one chunk per storage key.
+* - `run-streams:<runId>`: registry of stream names owned by a run,
+*   powering `listStreamsByRunId`.
+*/
+var StreamDO = class extends DurableObject {
+	async getMeta() {
+		return await this.ctx.storage.get(META_KEY) ?? {
+			count: 0,
+			closed: false
+		};
+	}
+	/**
+	* Append a chunk. The index is allocated inside the transaction, so
+	* concurrent writers can never collide or skip.
+	*/
+	async writeChunk(data) {
+		return await this.ctx.storage.transaction(async (txn) => {
+			const meta = await txn.get(META_KEY) ?? {
+				count: 0,
+				closed: false
+			};
+			if (meta.closed) throw new Error("Cannot write to a closed stream");
+			const index = meta.count;
+			await txn.put(chunkKey(index), data);
+			await txn.put(META_KEY, {
+				count: index + 1,
+				closed: false
+			});
+			return index;
+		});
+	}
+	/**
+	* Close the stream (idempotent). Readers observe `done: true` once all
+	* previously written chunks have been consumed.
+	*/
+	async closeStream() {
+		await this.ctx.storage.transaction(async (txn) => {
+			const meta = await txn.get(META_KEY) ?? {
+				count: 0,
+				closed: false
+			};
+			await txn.put(META_KEY, {
+				...meta,
+				closed: true
+			});
+		});
+	}
+	/**
+	* Read up to `limit` chunks starting at `startIndex` (0-based, inclusive).
+	*/
+	async getChunks(params) {
+		const meta = await this.getMeta();
+		const start = Math.max(0, params.startIndex);
+		const entries = await this.ctx.storage.list({
+			prefix: CHUNK_KEY_PREFIX,
+			start: chunkKey(start),
+			limit: params.limit
+		});
+		return {
+			chunks: Array.from(entries.values()),
+			done: meta.closed,
+			tailIndex: meta.count - 1
+		};
+	}
+	/**
+	* Lightweight stream metadata: last chunk index and completion flag.
+	*/
+	async getInfo() {
+		const meta = await this.getMeta();
+		return {
+			tailIndex: meta.count - 1,
+			done: meta.closed
+		};
+	}
+	/**
+	* Register a stream name against this per-run registry instance.
+	*/
+	async registerStream(name) {
+		await this.ctx.storage.put(`${STREAM_REGISTRY_PREFIX}${name}`, true);
+	}
+	/**
+	* List stream names registered against this per-run registry instance.
+	*/
+	async listStreams() {
+		const entries = await this.ctx.storage.list({ prefix: STREAM_REGISTRY_PREFIX });
+		return Array.from(entries.keys()).map((key) => key.slice(7));
+	}
+};
+//#endregion
+//#region src/apply-event.ts
+/** Storage key for the run entity. */
+const RUN_KEY = "run";
+/** Key prefixes for per-entity storage. */
+const EVENT_KEY_PREFIX = "event:";
+const STEP_KEY_PREFIX = "step:";
+const HOOK_KEY_PREFIX = "hook:";
+const STEP_CREATED_KEY_PREFIX = "stepcreated:";
+const HOOK_CREATED_KEY_PREFIX = "hookcreated:";
+/**
+* Marker recording that a hook_created event was committed for a hookId.
+* Mirrors postgres' `workflow_events_entity_creation_unique` partial index:
+* it outlives hook disposal so a replayed hook_created after dispose is
+* rejected as a duplicate instead of resurrecting the hook.
+*/
+const HOOK_EVENT_MARKER_PREFIX = "hookevent:";
+function failure(code, message, extra) {
+	return {
+		ok: false,
+		code,
+		message,
+		...extra
+	};
+}
+function readStringProp(value, key) {
+	if (value !== null && typeof value === "object") {
+		const prop = value[key];
+		if (typeof prop === "string") return prop;
+	}
+}
+/**
+* Map a failure eventData.error (which may be a string, an Error-shaped
+* object, or anything else) to the structured error stored on entities.
+* Matches upstream: string errors keep their text, errorCode is preserved.
+*/
+function toStructuredError(error, opts) {
+	return {
+		message: typeof error === "string" ? error : readStringProp(error, "message") ?? "Unknown error",
+		stack: opts?.stack ?? readStringProp(error, "stack"),
+		code: opts?.code ?? readStringProp(error, "code")
+	};
+}
+/**
+* Shared cursor pagination over a key prefix. Fetches `limit + 1` entries to
+* detect `hasMore` without ever skipping the boundary entry (the cursor is
+* derived from the last *returned* item, not the peeked one).
+*/
+async function listByPrefix(store, prefix, params, getId) {
+	const { limit, cursor, sortOrder = "asc" } = params;
+	const options = sortOrder === "desc" ? {
+		prefix,
+		reverse: true,
+		limit: limit + 1,
+		end: cursor ? `${prefix}${cursor}` : void 0
+	} : {
+		prefix,
+		limit: limit + 1,
+		startAfter: cursor ? `${prefix}${cursor}` : void 0
+	};
+	const entries = await store.list(options);
+	const values = Array.from(entries.values());
+	const hasMore = values.length > limit;
+	const data = values.slice(0, limit);
+	const last = data.at(-1);
+	return {
+		data,
+		cursor: hasMore && last !== void 0 ? getId(last) : null,
+		hasMore
+	};
+}
+function creationIndexKey(prefix, createdAt, id) {
+	return `${prefix}${createdAt.toISOString()}:${id}`;
+}
+/**
+* Cursor pagination over an explicit creation-time index. Entity ids are
+* values rather than key suffixes, so caller-supplied ids cannot disturb the
+* requested ordering.
+*/
+async function listByCreationTime(store, indexPrefix, entityPrefix, params) {
+	const { limit, cursor, sortOrder = "asc" } = params;
+	const entries = await store.list(sortOrder === "desc" ? {
+		prefix: indexPrefix,
+		reverse: true,
+		limit: limit + 1,
+		end: cursor ? `${indexPrefix}${cursor}` : void 0
+	} : {
+		prefix: indexPrefix,
+		limit: limit + 1,
+		startAfter: cursor ? `${indexPrefix}${cursor}` : void 0
+	});
+	const page = Array.from(entries.entries()).slice(0, limit);
+	const data = [];
+	for (const [, id] of page) {
+		const item = await store.get(`${entityPrefix}${id}`);
+		if (item !== void 0) data.push(item);
+	}
+	const hasMore = entries.size > limit;
+	const lastKey = page.at(-1)?.[0];
+	return {
+		data,
+		cursor: hasMore && lastKey ? lastKey.slice(indexPrefix.length) : null,
+		hasMore
+	};
+}
+/** Delete all hook entities for the run, returning the released tokens. */
+async function releaseAllHooks(store) {
+	const hooks = await store.list({ prefix: HOOK_KEY_PREFIX });
+	const released = [];
+	for (const hook of hooks.values()) {
+		await store.delete(`${HOOK_KEY_PREFIX}${hook.hookId}`);
+		await store.delete(creationIndexKey(HOOK_CREATED_KEY_PREFIX, hook.createdAt, hook.hookId));
+		released.push({
+			hookId: hook.hookId,
+			token: hook.token
+		});
+	}
+	return released;
+}
+async function applyEvent(store, ctx) {
+	const { runId, data, now } = ctx;
+	const specVersion = data.specVersion ?? SPEC_VERSION_CURRENT;
+	/** Build and validate the stored event BEFORE anything is persisted. */
+	const buildEvent = (record) => {
+		const withMeta = {
+			...record,
+			runId,
+			eventId: ctx.nextEventId(),
+			createdAt: now,
+			specVersion
+		};
+		if (record.eventType === "run_started") delete withMeta.eventData;
+		return EventSchema.parse(compact(withMeta));
+	};
+	const putEvent = async (event) => {
+		await store.put(`${EVENT_KEY_PREFIX}${event.eventId}`, event);
+	};
+	let currentRun;
+	const skipRunValidation = data.eventType === "run_created" || data.eventType === "step_completed" || data.eventType === "step_retrying";
+	if (!skipRunValidation) currentRun = await store.get(RUN_KEY);
+	let bootstrapped;
+	if (data.eventType === "run_started" && !currentRun && data.eventData) {
+		const { deploymentId, workflowName, input, executionContext } = data.eventData;
+		if (deploymentId && workflowName && input !== void 0) {
+			const createdRun = WorkflowRunSchema.parse(compact({
+				runId,
+				deploymentId,
+				workflowName,
+				specVersion,
+				executionContext,
+				input,
+				status: "pending",
+				output: void 0,
+				error: void 0,
+				startedAt: void 0,
+				completedAt: void 0,
+				createdAt: now,
+				updatedAt: now
+			}));
+			const runCreatedEvent = buildEvent({
+				eventType: "run_created",
+				eventData: {
+					deploymentId,
+					workflowName,
+					input,
+					executionContext
+				}
+			});
+			await store.put(RUN_KEY, createdRun);
+			await putEvent(runCreatedEvent);
+			currentRun = createdRun;
+			bootstrapped = {
+				workflowName,
+				createdAt: now
+			};
+		}
+	}
+	if (currentRun) {
+		if (requiresNewerWorld(currentRun.specVersion)) return failure("RUN_NOT_SUPPORTED", `Run "${runId}" requires a newer world (run specVersion ${currentRun.specVersion}, world ${SPEC_VERSION_CURRENT})`, { runSpecVersion: currentRun.specVersion });
+		if (isLegacySpecVersion(currentRun.specVersion)) return failure("LEGACY_RUN_NOT_SUPPORTED", `Run "${runId}" was created with a legacy spec version (${currentRun.specVersion ?? "undefined"}) not supported by this world`);
+	}
+	if (currentRun && isTerminalWorkflowRunStatus(currentRun.status)) {
+		if (data.eventType === "run_cancelled" && currentRun.status === "cancelled") {
+			const event = buildEvent({ ...data });
+			await putEvent(event);
+			return {
+				ok: true,
+				event,
+				run: currentRun,
+				releasedHooks: []
+			};
+		}
+		if (data.eventType === "run_started") return failure("RUN_EXPIRED", `Workflow run "${runId}" is already in terminal state "${currentRun.status}"`);
+		if (data.eventType === "run_completed" || data.eventType === "run_failed" || data.eventType === "run_cancelled") return failure("ENTITY_CONFLICT", `Cannot transition run from terminal state "${currentRun.status}"`);
+		if (data.eventType === "step_created" || data.eventType === "hook_created" || data.eventType === "wait_created") return failure("ENTITY_CONFLICT", `Cannot create new entities on run in terminal state "${currentRun.status}"`);
+	}
+	let validatedStep;
+	if (data.eventType === "step_started" || data.eventType === "step_completed" || data.eventType === "step_failed" || data.eventType === "step_retrying") {
+		validatedStep = await store.get(`${STEP_KEY_PREFIX}${data.correlationId}`);
+		if (!validatedStep) return failure("STEP_NOT_FOUND", `Step "${data.correlationId}" not found`);
+		if (isTerminalStepStatus(validatedStep.status)) return failure("ENTITY_CONFLICT", `Cannot modify step in terminal state "${validatedStep.status}"`);
+		if (currentRun && isTerminalWorkflowRunStatus(currentRun.status) && validatedStep.status !== "running") return failure("RUN_EXPIRED", `Cannot modify non-running step on run in terminal state "${currentRun.status}"`);
+	}
+	if ((data.eventType === "hook_disposed" || data.eventType === "hook_received") && data.correlationId) {
+		if (!await store.get(`hook:${data.correlationId}`)) return failure("HOOK_NOT_FOUND", `Hook "${data.correlationId}" not found`);
+	}
+	if (!skipRunValidation && data.eventType !== "run_started" && !currentRun) return failure("RUN_NOT_FOUND", `Workflow run "${runId}" not found`);
+	switch (data.eventType) {
+		case "run_created": {
+			const existing = await store.get(RUN_KEY);
+			if (existing) return {
+				ok: true,
+				run: existing,
+				releasedHooks: []
+			};
+			const run = WorkflowRunSchema.parse(compact({
+				runId,
+				deploymentId: data.eventData.deploymentId,
+				workflowName: data.eventData.workflowName,
+				specVersion,
+				executionContext: data.eventData.executionContext,
+				input: data.eventData.input,
+				status: "pending",
+				output: void 0,
+				error: void 0,
+				startedAt: void 0,
+				completedAt: void 0,
+				createdAt: now,
+				updatedAt: now
+			}));
+			const event = buildEvent({ ...data });
+			await store.put(RUN_KEY, run);
+			await putEvent(event);
+			return {
+				ok: true,
+				event,
+				run,
+				releasedHooks: [],
+				runCreated: {
+					workflowName: data.eventData.workflowName,
+					createdAt: now
+				}
+			};
+		}
+		case "run_started": {
+			if (!currentRun) return failure("RUN_NOT_FOUND", `Workflow run "${runId}" not found`);
+			if (currentRun.status === "running") return {
+				ok: true,
+				run: currentRun,
+				releasedHooks: []
+			};
+			const run = WorkflowRunSchema.parse(compact({
+				...currentRun,
+				status: "running",
+				output: void 0,
+				error: void 0,
+				completedAt: void 0,
+				startedAt: currentRun.startedAt ?? now,
+				updatedAt: now
+			}));
+			const event = buildEvent({ ...data });
+			await store.put(RUN_KEY, run);
+			await putEvent(event);
+			const allEvents = await listByPrefix(store, EVENT_KEY_PREFIX, {
+				limit: 1e3,
+				sortOrder: "asc"
+			}, (e) => e.eventId);
+			return {
+				ok: true,
+				event,
+				run,
+				releasedHooks: [],
+				runCreated: bootstrapped,
+				events: allEvents.data
+			};
+		}
+		case "run_completed": {
+			if (!currentRun) return failure("RUN_NOT_FOUND", `Workflow run "${runId}" not found`);
+			const run = WorkflowRunSchema.parse(compact({
+				...currentRun,
+				status: "completed",
+				output: data.eventData.output,
+				error: void 0,
+				completedAt: now,
+				updatedAt: now
+			}));
+			const event = buildEvent({ ...data });
+			await store.put(RUN_KEY, run);
+			await putEvent(event);
+			return {
+				ok: true,
+				event,
+				run,
+				releasedHooks: await releaseAllHooks(store)
+			};
+		}
+		case "run_failed": {
+			if (!currentRun) return failure("RUN_NOT_FOUND", `Workflow run "${runId}" not found`);
+			const run = WorkflowRunSchema.parse(compact({
+				...currentRun,
+				status: "failed",
+				output: void 0,
+				error: toStructuredError(data.eventData.error, { code: data.eventData.errorCode ?? readStringProp(data.eventData.error, "code") }),
+				completedAt: now,
+				updatedAt: now
+			}));
+			const event = buildEvent({ ...data });
+			await store.put(RUN_KEY, run);
+			await putEvent(event);
+			return {
+				ok: true,
+				event,
+				run,
+				releasedHooks: await releaseAllHooks(store)
+			};
+		}
+		case "run_cancelled": {
+			if (!currentRun) return failure("RUN_NOT_FOUND", `Workflow run "${runId}" not found`);
+			const run = WorkflowRunSchema.parse(compact({
+				...currentRun,
+				status: "cancelled",
+				output: void 0,
+				error: void 0,
+				completedAt: now,
+				updatedAt: now
+			}));
+			const event = buildEvent({ ...data });
+			await store.put(RUN_KEY, run);
+			await putEvent(event);
+			return {
+				ok: true,
+				event,
+				run,
+				releasedHooks: await releaseAllHooks(store)
+			};
+		}
+		case "step_created": {
+			const stepKey = `${STEP_KEY_PREFIX}${data.correlationId}`;
+			if (await store.get(stepKey)) return failure("ENTITY_CONFLICT", `Step "${data.correlationId}" already exists`);
+			const step = StepSchema.parse(compact({
+				runId,
+				stepId: data.correlationId,
+				stepName: data.eventData.stepName,
+				status: "pending",
+				input: data.eventData.input,
+				output: void 0,
+				error: void 0,
+				attempt: 0,
+				startedAt: void 0,
+				completedAt: void 0,
+				retryAfter: void 0,
+				createdAt: now,
+				updatedAt: now,
+				specVersion
+			}));
+			const event = buildEvent({ ...data });
+			await store.put(stepKey, step);
+			await store.put(creationIndexKey(STEP_CREATED_KEY_PREFIX, step.createdAt, step.stepId), step.stepId);
+			await putEvent(event);
+			return {
+				ok: true,
+				event,
+				step,
+				releasedHooks: []
+			};
+		}
+		case "step_started": {
+			const step = validatedStep;
+			if (!step) return failure("STEP_NOT_FOUND", `Step "${data.correlationId}" not found`);
+			if (step.retryAfter && step.retryAfter.getTime() > now.getTime()) return failure("TOO_EARLY", `Cannot start step "${data.correlationId}": retryAfter timestamp has not been reached yet`, { retryAfterSeconds: Math.ceil((step.retryAfter.getTime() - now.getTime()) / 1e3) });
+			const updated = StepSchema.parse(compact({
+				...step,
+				status: "running",
+				startedAt: step.startedAt ?? now,
+				attempt: step.attempt + 1,
+				retryAfter: void 0,
+				updatedAt: now
+			}));
+			const event = buildEvent({ ...data });
+			await store.put(`${STEP_KEY_PREFIX}${data.correlationId}`, updated);
+			await putEvent(event);
+			return {
+				ok: true,
+				event,
+				step: updated,
+				releasedHooks: []
+			};
+		}
+		case "step_completed": {
+			const step = validatedStep;
+			if (!step) return failure("STEP_NOT_FOUND", `Step "${data.correlationId}" not found`);
+			const updated = StepSchema.parse(compact({
+				...step,
+				status: "completed",
+				output: data.eventData.result,
+				completedAt: now,
+				updatedAt: now
+			}));
+			const event = buildEvent({ ...data });
+			await store.put(`${STEP_KEY_PREFIX}${data.correlationId}`, updated);
+			await putEvent(event);
+			return {
+				ok: true,
+				event,
+				step: updated,
+				releasedHooks: []
+			};
+		}
+		case "step_failed": {
+			const step = validatedStep;
+			if (!step) return failure("STEP_NOT_FOUND", `Step "${data.correlationId}" not found`);
+			const updated = StepSchema.parse(compact({
+				...step,
+				status: "failed",
+				error: toStructuredError(data.eventData.error, { stack: data.eventData.stack }),
+				completedAt: now,
+				updatedAt: now
+			}));
+			const event = buildEvent({ ...data });
+			await store.put(`${STEP_KEY_PREFIX}${data.correlationId}`, updated);
+			await putEvent(event);
+			return {
+				ok: true,
+				event,
+				step: updated,
+				releasedHooks: []
+			};
+		}
+		case "step_retrying": {
+			const step = validatedStep;
+			if (!step) return failure("STEP_NOT_FOUND", `Step "${data.correlationId}" not found`);
+			const updated = StepSchema.parse(compact({
+				...step,
+				status: "pending",
+				error: toStructuredError(data.eventData.error, { stack: data.eventData.stack }),
+				retryAfter: data.eventData.retryAfter ? new Date(data.eventData.retryAfter) : void 0,
+				updatedAt: now
+			}));
+			const event = buildEvent({ ...data });
+			await store.put(`${STEP_KEY_PREFIX}${data.correlationId}`, updated);
+			await putEvent(event);
+			return {
+				ok: true,
+				event,
+				step: updated,
+				releasedHooks: []
+			};
+		}
+		case "hook_created": {
+			const hookId = data.correlationId;
+			const token = data.eventData.token;
+			const holder = ctx.tokenHolder ?? null;
+			const markerKey = `${HOOK_EVENT_MARKER_PREFIX}${hookId}`;
+			const hookKey = `${HOOK_KEY_PREFIX}${hookId}`;
+			if (holder && (holder.runId !== runId || holder.hookId !== hookId)) {
+				const event = buildEvent({
+					eventType: "hook_conflict",
+					correlationId: hookId,
+					eventData: {
+						token,
+						conflictingRunId: holder.runId
+					}
+				});
+				await putEvent(event);
+				return {
+					ok: true,
+					event,
+					releasedHooks: []
+				};
+			}
+			if (await store.get(markerKey) !== void 0) {
+				const existingHook = await store.get(hookKey);
+				if (existingHook && !holder) return {
+					ok: true,
+					hook: existingHook,
+					hookToIndex: existingHook,
+					releasedHooks: []
+				};
+				return failure("ENTITY_CONFLICT", `Hook "${hookId}" already created`);
+			}
+			const hook = HookSchema.parse(compact({
+				runId,
+				hookId,
+				token,
+				metadata: data.eventData.metadata,
+				ownerId: "",
+				projectId: "",
+				environment: "",
+				createdAt: now,
+				specVersion,
+				isWebhook: data.eventData.isWebhook ?? false
+			}));
+			const event = buildEvent({ ...data });
+			await store.put(hookKey, hook);
+			await store.put(creationIndexKey(HOOK_CREATED_KEY_PREFIX, hook.createdAt, hook.hookId), hook.hookId);
+			await store.put(markerKey, event.eventId);
+			await putEvent(event);
+			return {
+				ok: true,
+				event,
+				hook,
+				hookToIndex: hook,
+				releasedHooks: []
+			};
+		}
+		case "hook_disposed": {
+			const hookKey = `${HOOK_KEY_PREFIX}${data.correlationId}`;
+			const hook = await store.get(hookKey);
+			if (!hook) return failure("HOOK_NOT_FOUND", `Hook "${data.correlationId}" not found`);
+			await store.delete(hookKey);
+			await store.delete(creationIndexKey(HOOK_CREATED_KEY_PREFIX, hook.createdAt, hook.hookId));
+			const event = buildEvent({ ...data });
+			await putEvent(event);
+			return {
+				ok: true,
+				event,
+				releasedHooks: [{
+					hookId: hook.hookId,
+					token: hook.token
+				}]
+			};
+		}
+		default: {
+			const event = buildEvent({ ...data });
+			await putEvent(event);
+			return {
+				ok: true,
+				event,
+				releasedHooks: []
+			};
+		}
+	}
+}
+//#endregion
+//#region src/worker/durable-objects/WorkflowRunDO.ts
+/**
+* Current schema version for DO storage.
+* Increment when making breaking changes to the storage layout.
+* Migrations run lazily on first request after deploy.
+*
+* v2: one storage key per event ('event:<eventId>'), step ('step:<stepId>')
+* and hook ('hook:<hookId>') instead of single aggregate values. This package
+* is pre-production, so the migration simply drops the legacy aggregates.
+*/
+const CURRENT_SCHEMA_VERSION = 3;
+/**
+* Idempotent migration functions keyed by target version. The schema version
+* is written only after the migration completes, so eviction safely retries
+* an interrupted migration.
+*/
+const MIGRATIONS = {
+	2: async (storage) => {
+		await storage.transaction(async (txn) => {
+			await txn.delete("events");
+			await txn.delete("steps");
+			await txn.delete("hooks");
+		});
+	},
+	3: async (storage) => {
+		await backfillCreationIndex(storage, STEP_KEY_PREFIX, STEP_CREATED_KEY_PREFIX, (step) => step.stepId);
+		await backfillCreationIndex(storage, HOOK_KEY_PREFIX, HOOK_CREATED_KEY_PREFIX, (hook) => hook.hookId);
+	}
+};
+async function backfillCreationIndex(storage, entityPrefix, indexPrefix, getId) {
+	let startAfter;
+	while (true) {
+		const entities = await storage.list({
+			prefix: entityPrefix,
+			startAfter,
+			limit: 100
+		});
+		if (entities.size === 0) return;
+		for (const [key, entity] of entities) {
+			const id = getId(entity);
+			await storage.put(`${indexPrefix}${entity.createdAt.toISOString()}:${id}`, id);
+			startAfter = key;
+		}
+		if (entities.size < 100) return;
+	}
+}
+/**
+* Ensure the DO storage schema is up to date.
+* Runs any pending migrations sequentially inside transactions,
+* persisting the version after each successful migration.
+* Safe to call on every request -- it's a no-op when already current.
+*/
+async function ensureSchemaUpToDate(storage) {
+	const stored = await storage.get("schema_version") ?? 1;
+	for (let v = stored + 1; v <= CURRENT_SCHEMA_VERSION; v++) {
+		const migration = MIGRATIONS[v];
+		if (migration) await migration(storage);
+		await storage.put("schema_version", v);
+	}
+}
+/**
+* Adapt DO storage (or a transaction) to the {@link EventStore} interface
+* shared with the test mocks. No casts: the methods line up structurally,
+* this just pins the subset we rely on.
+*/
+function storeFrom(storage) {
+	return {
+		get: (key) => storage.get(key),
+		put: (key, value) => storage.put(key, value),
+		delete: (key) => storage.delete(key),
+		list: (options) => storage.list(options)
+	};
+}
+/**
+* Durable Object for managing a single workflow run's state.
+*
+* All event-sourced writes go through {@link applyEvent} inside a single
+* storage transaction: guard checks, the event append, and the entity
+* mutation are atomic even if the DO is evicted mid-operation.
+*
+* Instances named `claim:<queueName>:<idempotencyKey>` are used purely as
+* queue-message dedup claims (see claimInflight/releaseInflight).
+*/
+var WorkflowRunDO = class extends DurableObject {
+	schemaReady = null;
+	/**
+	* Lazily ensure schema migrations have run.
+	* Memoized so it only runs once per DO instantiation.
+	*/
+	ensureSchema() {
+		if (!this.schemaReady) this.schemaReady = ensureSchemaUpToDate(this.ctx.storage);
+		return this.schemaReady;
+	}
+	/**
+	* Apply an event: validate, guard, append the event and mutate the entity
+	* in ONE storage transaction. Guard failures are returned as structured
+	* outcomes (not thrown) because typed errors do not survive the RPC
+	* boundary with their `name` intact.
+	*/
+	async applyEvent(request) {
+		await this.ensureSchema();
+		return await this.ctx.storage.transaction(async (txn) => {
+			let eventSequence = await txn.get("event_sequence") ?? 0;
+			const outcome = await applyEvent(storeFrom(txn), {
+				...request,
+				nextEventId: () => `wevt_z${String(++eventSequence).padStart(20, "0")}`,
+				now: /* @__PURE__ */ new Date()
+			});
+			if (outcome.ok) await txn.put("event_sequence", eventSequence);
+			return outcome;
+		});
+	}
+	/**
+	* Get the workflow run
+	*/
+	async getRun() {
+		await this.ensureSchema();
+		return await this.ctx.storage.get("run") ?? null;
+	}
+	/**
+	* Get a specific step
+	*/
+	async getStep(stepId) {
+		await this.ensureSchema();
+		return await this.ctx.storage.get(`step:${stepId}`) ?? null;
+	}
+	/**
+	* List steps with real limit/cursor pagination (cursor = last stepId).
+	*/
+	async listSteps(params) {
+		await this.ensureSchema();
+		return listByCreationTime(storeFrom(this.ctx.storage), STEP_CREATED_KEY_PREFIX, STEP_KEY_PREFIX, {
+			limit: params?.limit ?? 20,
+			cursor: params?.cursor,
+			sortOrder: params?.sortOrder ?? "asc"
+		});
+	}
+	/**
+	* Get a specific event
+	*/
+	async getEvent(eventId) {
+		await this.ensureSchema();
+		return await this.ctx.storage.get(`event:${eventId}`) ?? null;
+	}
+	/**
+	* List events with real limit/cursor pagination. Events are keyed by their
+	* monotonic ULID eventId, so storage order == event order.
+	*/
+	async listEvents(params) {
+		await this.ensureSchema();
+		return listByPrefix(storeFrom(this.ctx.storage), EVENT_KEY_PREFIX, {
+			limit: params?.limit ?? 100,
+			cursor: params?.cursor,
+			sortOrder: params?.sortOrder ?? "asc"
+		}, (event) => event.eventId);
+	}
+	/**
+	* List hooks with real limit/cursor pagination (cursor = last hookId).
+	*/
+	async listHooks(params) {
+		await this.ensureSchema();
+		return listByCreationTime(storeFrom(this.ctx.storage), HOOK_CREATED_KEY_PREFIX, HOOK_KEY_PREFIX, {
+			limit: params?.limit ?? 100,
+			cursor: params?.cursor,
+			sortOrder: params?.sortOrder ?? "asc"
+		});
+	}
+	/**
+	* Claim a queue-message dedup slot. Used on DO instances dedicated to a
+	* single idempotency key (`claim:<queueName>:<idempotencyKey>`).
+	*
+	* - Unclaimed -> claim and proceed.
+	* - Claimed by the SAME messageId -> redelivery of the same message
+	*   (previous attempt failed transiently) -> proceed.
+	* - Claimed by a DIFFERENT messageId -> concurrent duplicate -> reject,
+	*   unless the claim is stale (holder crashed / went to the DLQ without
+	*   releasing), in which case the claim is stolen.
+	*/
+	async claimInflight(params) {
+		await this.ensureSchema();
+		return await this.ctx.storage.transaction(async (txn) => {
+			const existing = await txn.get("claim");
+			const now = Date.now();
+			if (existing && existing.messageId !== params.messageId && now - existing.claimedAt < params.staleMs) return { claimed: false };
+			await txn.put("claim", {
+				messageId: params.messageId,
+				claimedAt: now
+			});
+			return { claimed: true };
+		});
+	}
+	/**
+	* Release a queue-message dedup claim after the message was fully handled.
+	*/
+	async releaseInflight() {
+		await this.ensureSchema();
+		await this.ctx.storage.delete("claim");
+	}
+};
+//#endregion
+//#region src/worker/worker.ts
+/**
+* celld worker entry: exports the Durable Object (cell) classes and the
+* default fetch router. This module (and everything it imports) must stay
+* free of Node built-ins — it runs inside celld's workerd runtime.
+*/
+var worker_default = { async fetch(request, env) {
+	return createRouter(env)(request);
+} };
+//#endregion
+export { IndexDO, QueueDO, StreamDO, WorkflowRunDO, createRouter, worker_default as default };
+
+//# sourceMappingURL=worker.js.map