@ewhauser/world-celld 0.1.1 → 0.3.0

package/dist/worker.js

@@ -1,4 +1,4 @@
-import { EventSchema, HookSchema, SPEC_VERSION_CURRENT, StepSchema, WorkflowRunSchema, isLegacySpecVersion, isTerminalStepStatus, isTerminalWorkflowRunStatus, requiresNewerWorld } from "@workflow/world";
+import { EventSchema, HookSchema, SPEC_VERSION_CURRENT, StepSchema, WaitSchema, WorkflowRunSchema, applyAttributeChanges, eventIdToSlot, getMaxEventsPerRun, isChildEntityCreationEvent, isTerminalStepStatus, isTerminalWorkflowRunStatus, slotToEventId, validateAttributeChanges } from "@workflow/world";
 import { DurableObject } from "cloudflare:workers";
 //#region src/vendor/shared/serialization.ts
 /** Standard Date fields used across all worlds */
@@ -162,7 +162,11 @@ const BINDINGS = {
 			"getEvent",
 			"listEvents",
 			"listSteps",
-			"listHooks"
+			"listHooks",
+			"getCleanupStatus",
+			"scheduleCleanup",
+			"cleanupNow",
+			"rearmCleanup"
 		])
 	},
 	streams: {
@@ -173,7 +177,10 @@ const BINDINGS = {
 			"getChunks",
 			"getInfo",
 			"registerStream",
-			"listStreams"
+			"listStreams",
+			"expireRegistry",
+			"finalizeRegistry",
+			"expireStream"
 		])
 	},
 	index: {
@@ -182,6 +189,8 @@ const BINDINGS = {
 			"get",
 			"put",
 			"delete",
+			"putOwned",
+			"expireRun",
 			"list",
 			"reserveHookToken",
 			"finalizeHookIndexes",
@@ -197,7 +206,8 @@ const BINDINGS = {
 			"listDeadLetters",
 			"redriveDeadLetter",
 			"purgeDeadLetters",
-			"rearmAlarm"
+			"rearmAlarm",
+			"expireRun"
 		])
 	}
 };
@@ -320,6 +330,14 @@ var IndexDO = class extends DurableObject {
 	async put(key, value) {
 		await this.ctx.storage.put(key, value);
 	}
+	/** Publish a derived index only while its owning run is not expired. */
+	async putOwned(runId, key, value) {
+		return await this.ctx.storage.transaction(async (txn) => {
+			if (await txn.get(`expired:${runId}`) !== void 0) return { stored: false };
+			await txn.put(key, value);
+			return { stored: true };
+		});
+	}
 	async delete(key) {
 		await this.ctx.storage.delete(key);
 	}
@@ -365,6 +383,11 @@ var IndexDO = class extends DurableObject {
 	}
 	async finalizeHookIndexes(token, hookId, serializedHook, owner) {
 		await this.ctx.storage.transaction(async (txn) => {
+			if (await txn.get(`expired:${owner.runId}`) !== void 0) {
+				const claim = await txn.get(`hookclaim:${token}`);
+				if (claim !== void 0 && sameOwner(claim.owner, owner)) await txn.delete(`hookclaim:${token}`);
+				return;
+			}
 			const indexedHook = await txn.get(`hook:${token}`);
 			if (indexedHook !== void 0 && !sameOwner(ownerFromHook(indexedHook), owner)) throw new Error(`Hook token ${token} is owned by another hook`);
 			const claim = await txn.get(`hookclaim:${token}`);
@@ -396,6 +419,42 @@ var IndexDO = class extends DurableObject {
 			if (claim !== void 0 && sameOwner(claim.owner, owner)) await txn.delete(claimKey);
 		});
 	}
+	/**
+	* Fence a run and remove all of its known derived indexes atomically.
+	* Once the fence exists, putOwned() and hook finalization cannot resurrect
+	* entries from a delayed request.
+	*/
+	async expireRun(request) {
+		return await this.ctx.storage.transaction(async (txn) => {
+			await txn.put(`expired:${request.runId}`, request.expiredAt);
+			let deleted = 0;
+			for (const key of new Set(request.keys)) if (await txn.delete(key)) deleted++;
+			for (const hook of request.hooks) {
+				const owner = {
+					runId: request.runId,
+					hookId: hook.hookId
+				};
+				const tokenKey = `hook:${hook.token}`;
+				const idKey = `hookid:${hook.hookId}`;
+				const claimKey = `hookclaim:${hook.token}`;
+				const [byToken, byId, claim] = await Promise.all([
+					txn.get(tokenKey),
+					txn.get(idKey),
+					txn.get(claimKey)
+				]);
+				if (byToken !== void 0 && sameOwner(ownerFromHook(byToken), owner)) {
+					if (await txn.delete(tokenKey)) deleted++;
+				}
+				if (byId !== void 0 && sameOwner(ownerFromHook(byId), owner)) {
+					if (await txn.delete(idKey)) deleted++;
+				}
+				if (claim !== void 0 && sameOwner(claim.owner, owner)) {
+					if (await txn.delete(claimKey)) deleted++;
+				}
+			}
+			return { deleted };
+		});
+	}
 };
 //#endregion
 //#region src/worker/durable-objects/QueueDO.ts
@@ -418,6 +477,12 @@ function pad(ms) {
 function dueKey(atMs, messageId) {
 	return `due:${pad(atMs)}:${messageId}`;
 }
+function runReferenceKey(runId, messageId) {
+	return `run:${runId}:${messageId}`;
+}
+function expiredRunKey(runId) {
+	return `expired-run:${runId}`;
+}
 function backoffSeconds(attempt) {
 	return Math.min(60, 2 ** attempt);
 }
@@ -439,6 +504,11 @@ var QueueDO = class extends DurableObject {
 		const storage = this.ctx.storage;
 		const now = this.#now();
 		return await storage.transaction(async (txn) => {
+			if (request.runId && await txn.get(expiredRunKey(request.runId)) !== void 0) return {
+				ok: false,
+				code: "RUN_EXPIRED",
+				message: `Workflow run "${request.runId}" has expired`
+			};
 			const pinned = await txn.get("cfg");
 			if (!pinned) await txn.put("cfg", {
 				queueShards: request.config.queueShards,
@@ -469,14 +539,21 @@ var QueueDO = class extends DurableObject {
 				queueName: request.queueName,
 				pathname: request.pathname,
 				body: request.body,
+				runId: request.runId,
 				targetBaseUrl: request.config.targetBaseUrl,
 				idempotencyKey: request.idempotencyKey,
 				attempt: 0,
 				enqueuedAt: now
 			};
 			const dueAt = now + Math.max(0, request.delaySeconds ?? 0) * 1e3;
+			const scheduleKey = dueKey(dueAt, row.messageId);
 			await txn.put(`msg:${row.messageId}`, row);
-			await txn.put(dueKey(dueAt, row.messageId), row.messageId);
+			await txn.put(scheduleKey, row.messageId);
+			if (row.runId) await txn.put(runReferenceKey(row.runId, row.messageId), {
+				messageId: row.messageId,
+				dueKey: scheduleKey,
+				idempotencyKey: row.idempotencyKey
+			});
 			await this.#armAlarmAtMost(txn, dueAt, now);
 			return {
 				ok: true,
@@ -514,7 +591,16 @@ var QueueDO = class extends DurableObject {
 			for (const [key, deadline] of inflight) if (deadline <= now) {
 				const messageId = key.slice(9);
 				await txn.delete(key);
-				if (await txn.get(`msg:${messageId}`)) await txn.put(dueKey(now, messageId), messageId);
+				const row = await txn.get(`msg:${messageId}`);
+				if (row) {
+					const scheduleKey = dueKey(now, messageId);
+					await txn.put(scheduleKey, messageId);
+					if (row.runId) await txn.put(runReferenceKey(row.runId, row.messageId), {
+						messageId: row.messageId,
+						dueKey: scheduleKey,
+						idempotencyKey: row.idempotencyKey
+					});
+				}
 			} else inflightCount++;
 			const rows = [];
 			if (inflightCount < maxInflight) {
@@ -569,8 +655,25 @@ var QueueDO = class extends DurableObject {
 				timeoutSeconds = void 0;
 			}
 			if (typeof timeoutSeconds === "number") await storage.transaction(async (txn) => {
+				if (row.runId && await txn.get(expiredRunKey(row.runId)) !== void 0) {
+					await txn.delete(`msg:${row.messageId}`);
+					await txn.delete(`inflight:${row.messageId}`);
+					await txn.delete(runReferenceKey(row.runId, row.messageId));
+					if (row.idempotencyKey) {
+						const dedupKey = `key:${row.idempotencyKey}`;
+						if (await txn.get(dedupKey) === row.messageId) await txn.delete(dedupKey);
+					}
+					await this.#scheduleNextAlarm(txn, now);
+					return;
+				}
 				await txn.delete(`inflight:${row.messageId}`);
-				await txn.put(dueKey(now + timeoutSeconds * 1e3, row.messageId), row.messageId);
+				const scheduleKey = dueKey(now + timeoutSeconds * 1e3, row.messageId);
+				await txn.put(scheduleKey, row.messageId);
+				if (row.runId) await txn.put(runReferenceKey(row.runId, row.messageId), {
+					messageId: row.messageId,
+					dueKey: scheduleKey,
+					idempotencyKey: row.idempotencyKey
+				});
 				await this.#scheduleNextAlarm(txn, now);
 			});
 			else await this.#retry(row, "HTTP 503");
@@ -587,6 +690,7 @@ var QueueDO = class extends DurableObject {
 			if (row.idempotencyKey) {
 				if (await txn.get(`key:${row.idempotencyKey}`) === row.messageId) await txn.delete(`key:${row.idempotencyKey}`);
 			}
+			if (row.runId) await txn.delete(runReferenceKey(row.runId, row.messageId));
 			await this.#scheduleNextAlarm(txn, this.#now());
 		});
 	}
@@ -596,6 +700,17 @@ var QueueDO = class extends DurableObject {
 		const maxAttempts = this.#intVar("QUEUE_MAX_ATTEMPTS", DEFAULT_MAX_ATTEMPTS);
 		const attempt = row.attempt + 1;
 		await storage.transaction(async (txn) => {
+			if (row.runId && await txn.get(expiredRunKey(row.runId)) !== void 0) {
+				await txn.delete(`msg:${row.messageId}`);
+				await txn.delete(`inflight:${row.messageId}`);
+				await txn.delete(runReferenceKey(row.runId, row.messageId));
+				if (row.idempotencyKey) {
+					const dedupKey = `key:${row.idempotencyKey}`;
+					if (await txn.get(dedupKey) === row.messageId) await txn.delete(dedupKey);
+				}
+				await this.#scheduleNextAlarm(txn, now);
+				return;
+			}
 			await txn.delete(`inflight:${row.messageId}`);
 			if (attempt >= maxAttempts) {
 				const dead = {
@@ -604,11 +719,17 @@ var QueueDO = class extends DurableObject {
 					lastError: reason,
 					failedAt: now
 				};
-				await txn.put(`dlq:${pad(now)}:${row.messageId}`, dead);
+				const deadKey = `dlq:${pad(now)}:${row.messageId}`;
+				await txn.put(deadKey, dead);
 				await txn.delete(`msg:${row.messageId}`);
 				if (row.idempotencyKey) {
 					if (await txn.get(`key:${row.idempotencyKey}`) === row.messageId) await txn.delete(`key:${row.idempotencyKey}`);
 				}
+				if (row.runId) await txn.put(runReferenceKey(row.runId, row.messageId), {
+					messageId: row.messageId,
+					dlqKey: deadKey,
+					idempotencyKey: row.idempotencyKey
+				});
 				await this.#scheduleNextAlarm(txn, now);
 				return;
 			}
@@ -617,8 +738,14 @@ var QueueDO = class extends DurableObject {
 				attempt,
 				lastError: reason
 			};
+			const scheduleKey = dueKey(now + backoffSeconds(attempt) * 1e3, row.messageId);
 			await txn.put(`msg:${row.messageId}`, updated);
-			await txn.put(dueKey(now + backoffSeconds(attempt) * 1e3, row.messageId), row.messageId);
+			await txn.put(scheduleKey, row.messageId);
+			if (row.runId) await txn.put(runReferenceKey(row.runId, row.messageId), {
+				messageId: row.messageId,
+				dueKey: scheduleKey,
+				idempotencyKey: row.idempotencyKey
+			});
 			await this.#scheduleNextAlarm(txn, now);
 		});
 	}
@@ -702,8 +829,14 @@ var QueueDO = class extends DurableObject {
 					await txn.put(dedupKey, row.messageId);
 				}
 				await txn.put(`msg:${row.messageId}`, row);
-				await txn.put(dueKey(now, row.messageId), row.messageId);
+				const scheduleKey = dueKey(now, row.messageId);
+				await txn.put(scheduleKey, row.messageId);
 				await txn.delete(key);
+				if (row.runId) await txn.put(runReferenceKey(row.runId, row.messageId), {
+					messageId: row.messageId,
+					dueKey: scheduleKey,
+					idempotencyKey: row.idempotencyKey
+				});
 				await this.#armAlarmAtMost(txn, now, now);
 				return { ok: true };
 			}
@@ -713,7 +846,11 @@ var QueueDO = class extends DurableObject {
 	async purgeDeadLetters() {
 		return await this.ctx.storage.transaction(async (txn) => {
 			const dlq = await txn.list({ prefix: "dlq:" });
-			for (const key of dlq.keys()) await txn.delete(key);
+			for (const [key, value] of dlq) {
+				await txn.delete(key);
+				const dead = value;
+				if (dead.runId) await txn.delete(runReferenceKey(dead.runId, dead.messageId));
+			}
 			return { purged: dlq.size };
 		});
 	}
@@ -725,6 +862,32 @@ var QueueDO = class extends DurableObject {
 		await this.#rearm();
 		return { alarmAt: await this.ctx.storage.getAlarm() };
 	}
+	/** Fence a run and purge every live, inflight, and dead-letter message it owns. */
+	async expireRun(runId, expiredAt) {
+		return { deleted: await this.ctx.storage.transaction(async (txn) => {
+			const existing = await txn.get(expiredRunKey(runId));
+			const references = await txn.list({ prefix: `run:${runId}:` });
+			let count = existing?.deleted ?? 0;
+			for (const [key, reference] of references) {
+				await txn.delete(`msg:${reference.messageId}`);
+				await txn.delete(`inflight:${reference.messageId}`);
+				if (reference.dueKey) await txn.delete(reference.dueKey);
+				if (reference.dlqKey) await txn.delete(reference.dlqKey);
+				if (reference.idempotencyKey) {
+					const dedupKey = `key:${reference.idempotencyKey}`;
+					if (await txn.get(dedupKey) === reference.messageId) await txn.delete(dedupKey);
+				}
+				await txn.delete(key);
+				count++;
+			}
+			await txn.put(expiredRunKey(runId), {
+				expiredAt,
+				deleted: count
+			});
+			await this.#scheduleNextAlarm(txn, this.#now());
+			return count;
+		}) };
+	}
 };
 //#endregion
 //#region src/worker/durable-objects/StreamDO.ts
@@ -732,6 +895,8 @@ const META_KEY = "meta";
 const CHUNK_KEY_PREFIX = "chunk:";
 /** Registry keys used when this DO instance acts as a per-run stream index. */
 const STREAM_REGISTRY_PREFIX = "stream:";
+const REGISTRY_OWNER_KEY = "registry:owner";
+const REGISTRY_EXPIRED_KEY = "registry:expired";
 /**
 * Zero-pad chunk indexes so `storage.list({ prefix })` returns chunks in
 * write order. 12 digits comfortably exceeds any realistic chunk count.
@@ -756,22 +921,28 @@ var StreamDO = class extends DurableObject {
 			closed: false
 		};
 	}
+	assertOwner(meta, runId) {
+		if (meta.expiredAt !== void 0) throw new Error(`Workflow run "${runId}" has expired`);
+		if (meta.ownerRunId !== void 0 && meta.ownerRunId !== runId) throw new Error(`Stream is owned by workflow run "${meta.ownerRunId}"`);
+	}
 	/**
 	* Append a chunk. The index is allocated inside the transaction, so
 	* concurrent writers can never collide or skip.
 	*/
-	async writeChunk(data) {
+	async writeChunk(runId, data) {
 		return await this.ctx.storage.transaction(async (txn) => {
 			const meta = await txn.get(META_KEY) ?? {
 				count: 0,
 				closed: false
 			};
+			this.assertOwner(meta, runId);
 			if (meta.closed) throw new Error("Cannot write to a closed stream");
 			const index = meta.count;
 			await txn.put(chunkKey(index), data);
 			await txn.put(META_KEY, {
 				count: index + 1,
-				closed: false
+				closed: false,
+				ownerRunId: runId
 			});
 			return index;
 		});
@@ -780,14 +951,16 @@ var StreamDO = class extends DurableObject {
 	* Close the stream (idempotent). Readers observe `done: true` once all
 	* previously written chunks have been consumed.
 	*/
-	async closeStream() {
+	async closeStream(runId) {
 		await this.ctx.storage.transaction(async (txn) => {
 			const meta = await txn.get(META_KEY) ?? {
 				count: 0,
 				closed: false
 			};
+			this.assertOwner(meta, runId);
 			await txn.put(META_KEY, {
 				...meta,
+				ownerRunId: runId,
 				closed: true
 			});
 		});
@@ -797,6 +970,7 @@ var StreamDO = class extends DurableObject {
 	*/
 	async getChunks(params) {
 		const meta = await this.getMeta();
+		if (meta.expiredAt !== void 0) throw new Error("Stream has expired");
 		const start = Math.max(0, params.startIndex);
 		const entries = await this.ctx.storage.list({
 			prefix: CHUNK_KEY_PREFIX,
@@ -814,6 +988,7 @@ var StreamDO = class extends DurableObject {
 	*/
 	async getInfo() {
 		const meta = await this.getMeta();
+		if (meta.expiredAt !== void 0) throw new Error("Stream has expired");
 		return {
 			tailIndex: meta.count - 1,
 			done: meta.closed
@@ -822,16 +997,66 @@ var StreamDO = class extends DurableObject {
 	/**
 	* Register a stream name against this per-run registry instance.
 	*/
-	async registerStream(name) {
-		await this.ctx.storage.put(`${STREAM_REGISTRY_PREFIX}${name}`, true);
+	async registerStream(runId, name) {
+		await this.ctx.storage.transaction(async (txn) => {
+			if (await txn.get(REGISTRY_EXPIRED_KEY) !== void 0) throw new Error(`Workflow run "${runId}" has expired`);
+			const owner = await txn.get(REGISTRY_OWNER_KEY);
+			if (owner !== void 0 && owner !== runId) throw new Error(`Stream registry is owned by workflow run "${owner}"`);
+			await txn.put(REGISTRY_OWNER_KEY, runId);
+			await txn.put(`${STREAM_REGISTRY_PREFIX}${name}`, true);
+		});
 	}
 	/**
 	* List stream names registered against this per-run registry instance.
 	*/
 	async listStreams() {
+		if (await this.ctx.storage.get(REGISTRY_EXPIRED_KEY) !== void 0) throw new Error("Workflow run streams have expired");
 		const entries = await this.ctx.storage.list({ prefix: STREAM_REGISTRY_PREFIX });
 		return Array.from(entries.keys()).map((key) => key.slice(7));
 	}
+	/** Fence a run's registry before any stream cells are removed. */
+	async expireRegistry(runId, expiredAt) {
+		return await this.ctx.storage.transaction(async (txn) => {
+			const owner = await txn.get(REGISTRY_OWNER_KEY);
+			if (owner !== void 0 && owner !== runId) throw new Error(`Stream registry is owned by workflow run "${owner}"`);
+			await txn.put(REGISTRY_OWNER_KEY, runId);
+			await txn.put(REGISTRY_EXPIRED_KEY, expiredAt);
+			const entries = await txn.list({ prefix: STREAM_REGISTRY_PREFIX });
+			return { streams: Array.from(entries.keys()).map((key) => key.slice(7)) };
+		});
+	}
+	/** Remove the registry payload after every referenced stream was fenced. */
+	async finalizeRegistry(runId) {
+		await this.ctx.storage.transaction(async (txn) => {
+			const owner = await txn.get(REGISTRY_OWNER_KEY);
+			const expiredAt = await txn.get(REGISTRY_EXPIRED_KEY);
+			if (owner !== runId || expiredAt === void 0) throw new Error(`Stream registry for workflow run "${runId}" is not expired`);
+			const entries = await txn.list({ prefix: STREAM_REGISTRY_PREFIX });
+			for (const key of entries.keys()) await txn.delete(key);
+		});
+	}
+	/** Delete stream payload while leaving a small ownership tombstone. */
+	async expireStream(runId, expiredAt) {
+		return await this.ctx.storage.transaction(async (txn) => {
+			const meta = await txn.get(META_KEY) ?? {
+				count: 0,
+				closed: false
+			};
+			if (meta.ownerRunId !== void 0 && meta.ownerRunId !== runId) throw new Error(`Stream is owned by workflow run "${meta.ownerRunId}"`);
+			const chunks = await txn.list({ prefix: CHUNK_KEY_PREFIX });
+			for (const key of chunks.keys()) await txn.delete(key);
+			await txn.put(META_KEY, {
+				count: 0,
+				closed: true,
+				ownerRunId: runId,
+				expiredAt
+			});
+			return {
+				deleted: true,
+				chunks: chunks.size
+			};
+		});
+	}
 };
 //#endregion
 //#region src/apply-event.ts
@@ -841,6 +1066,7 @@ const RUN_KEY = "run";
 const EVENT_KEY_PREFIX = "event:";
 const STEP_KEY_PREFIX = "step:";
 const HOOK_KEY_PREFIX = "hook:";
+const WAIT_KEY_PREFIX = "wait:";
 const STEP_CREATED_KEY_PREFIX = "stepcreated:";
 const HOOK_CREATED_KEY_PREFIX = "hookcreated:";
 /**
@@ -850,6 +1076,10 @@ const HOOK_CREATED_KEY_PREFIX = "hookcreated:";
 * rejected as a duplicate instead of resurrecting the hook.
 */
 const HOOK_EVENT_MARKER_PREFIX = "hookevent:";
+/** Workflow-authored attr_set correlation claims. */
+const ATTRIBUTE_EVENT_MARKER_PREFIX = "attrevent:";
+/** Durable lazy-hook resume claims, scoped by the containing run DO. */
+const HOOK_RESUME_CLAIM_PREFIX = "hookresume:";
 function failure(code, message, extra) {
 	return {
 		ok: false,
@@ -952,9 +1182,15 @@ async function releaseAllHooks(store) {
 	}
 	return released;
 }
+/** Delete all persisted waits once their owning run becomes terminal. */
+async function releaseAllWaits(store) {
+	const waits = await store.list({ prefix: WAIT_KEY_PREFIX });
+	for (const key of waits.keys()) await store.delete(key);
+}
 async function applyEvent(store, ctx) {
 	const { runId, data, now } = ctx;
 	const specVersion = data.specVersion ?? SPEC_VERSION_CURRENT;
+	if (specVersion !== SPEC_VERSION_CURRENT) return failure("RUN_NOT_SUPPORTED", `Run "${runId}" uses unsupported specVersion ${specVersion}; this world requires ${SPEC_VERSION_CURRENT}`, { runSpecVersion: specVersion });
 	/** Build and validate the stored event BEFORE anything is persisted. */
 	const buildEvent = (record) => {
 		const withMeta = {
@@ -962,9 +1198,16 @@ async function applyEvent(store, ctx) {
 			runId,
 			eventId: ctx.nextEventId(),
 			createdAt: now,
+			occurredAt: ctx.params?.occurredAt,
+			resumeId: ctx.params?.resumeId,
 			specVersion
 		};
+		if (record.eventType !== "hook_received") delete withMeta.resumeId;
 		if (record.eventType === "run_started") delete withMeta.eventData;
+		if (record.eventType === "step_started" && withMeta.eventData !== null && typeof withMeta.eventData === "object") {
+			const { input: _input, ...eventData } = withMeta.eventData;
+			withMeta.eventData = eventData;
+		}
 		return EventSchema.parse(compact(withMeta));
 	};
 	const putEvent = async (event) => {
@@ -975,14 +1218,21 @@ async function applyEvent(store, ctx) {
 	if (!skipRunValidation) currentRun = await store.get(RUN_KEY);
 	let bootstrapped;
 	if (data.eventType === "run_started" && !currentRun && data.eventData) {
-		const { deploymentId, workflowName, input, executionContext } = data.eventData;
+		const { deploymentId, workflowName, input, executionContext, attributes, allowReservedAttributes, encryptionPublicKey } = data.eventData;
 		if (deploymentId && workflowName && input !== void 0) {
+			const attributeChanges = Object.entries(attributes ?? {}).map(([key, value]) => ({
+				key,
+				value
+			}));
+			validateAttributeChanges(attributeChanges, { allowReservedAttributes });
 			const createdRun = WorkflowRunSchema.parse(compact({
 				runId,
 				deploymentId,
 				workflowName,
 				specVersion,
 				executionContext,
+				attributes,
+				encryptionPublicKey,
 				input,
 				status: "pending",
 				output: void 0,
@@ -998,7 +1248,10 @@ async function applyEvent(store, ctx) {
 					deploymentId,
 					workflowName,
 					input,
-					executionContext
+					executionContext,
+					attributes,
+					allowReservedAttributes,
+					encryptionPublicKey
 				}
 			});
 			await store.put(RUN_KEY, createdRun);
@@ -1010,10 +1263,7 @@ async function applyEvent(store, ctx) {
 			};
 		}
 	}
-	if (currentRun) {
-		if (requiresNewerWorld(currentRun.specVersion)) return failure("RUN_NOT_SUPPORTED", `Run "${runId}" requires a newer world (run specVersion ${currentRun.specVersion}, world ${SPEC_VERSION_CURRENT})`, { runSpecVersion: currentRun.specVersion });
-		if (isLegacySpecVersion(currentRun.specVersion)) return failure("LEGACY_RUN_NOT_SUPPORTED", `Run "${runId}" was created with a legacy spec version (${currentRun.specVersion ?? "undefined"}) not supported by this world`);
-	}
+	if (currentRun && currentRun.specVersion !== SPEC_VERSION_CURRENT) return failure("RUN_NOT_SUPPORTED", `Run "${runId}" uses unsupported specVersion ${currentRun.specVersion}; this world requires ${SPEC_VERSION_CURRENT}`, { runSpecVersion: currentRun.specVersion });
 	if (currentRun && isTerminalWorkflowRunStatus(currentRun.status)) {
 		if (data.eventType === "run_cancelled" && currentRun.status === "cancelled") {
 			const event = buildEvent({ ...data });
@@ -1027,14 +1277,32 @@ async function applyEvent(store, ctx) {
 		}
 		if (data.eventType === "run_started") return failure("RUN_EXPIRED", `Workflow run "${runId}" is already in terminal state "${currentRun.status}"`);
 		if (data.eventType === "run_completed" || data.eventType === "run_failed" || data.eventType === "run_cancelled") return failure("ENTITY_CONFLICT", `Cannot transition run from terminal state "${currentRun.status}"`);
-		if (data.eventType === "step_created" || data.eventType === "hook_created" || data.eventType === "wait_created") return failure("ENTITY_CONFLICT", `Cannot create new entities on run in terminal state "${currentRun.status}"`);
+		if (isChildEntityCreationEvent(data)) return failure("ENTITY_CONFLICT", `Cannot create new entities on run in terminal state "${currentRun.status}"`);
+		if (data.eventType === "attr_set") return failure("ENTITY_CONFLICT", `Cannot set attributes on run in terminal state "${currentRun.status}"`);
 	}
 	let validatedStep;
 	if (data.eventType === "step_started" || data.eventType === "step_completed" || data.eventType === "step_failed" || data.eventType === "step_retrying") {
+		const lazyStepStart = data.eventType === "step_started" && isChildEntityCreationEvent(data);
 		validatedStep = await store.get(`${STEP_KEY_PREFIX}${data.correlationId}`);
-		if (!validatedStep) return failure("STEP_NOT_FOUND", `Step "${data.correlationId}" not found`);
-		if (isTerminalStepStatus(validatedStep.status)) return failure("ENTITY_CONFLICT", `Cannot modify step in terminal state "${validatedStep.status}"`);
-		if (currentRun && isTerminalWorkflowRunStatus(currentRun.status) && validatedStep.status !== "running") return failure("RUN_EXPIRED", `Cannot modify non-running step on run in terminal state "${currentRun.status}"`);
+		if (!validatedStep) {
+			if (!lazyStepStart) return failure("STEP_NOT_FOUND", `Step "${data.correlationId}" not found`);
+		} else if (lazyStepStart) return failure("ENTITY_CONFLICT", `Step "${data.correlationId}" already exists`);
+		if (validatedStep && isTerminalStepStatus(validatedStep.status)) return failure("ENTITY_CONFLICT", `Cannot modify step in terminal state "${validatedStep.status}"`);
+		if (currentRun && isTerminalWorkflowRunStatus(currentRun.status) && validatedStep && validatedStep.status !== "running") return failure("RUN_EXPIRED", `Cannot modify non-running step on run in terminal state "${currentRun.status}"`);
+	}
+	if (data.eventType === "hook_received" && ctx.params?.resumeId) {
+		const claim = await store.get(`${HOOK_RESUME_CLAIM_PREFIX}${ctx.params.resumeId}`);
+		if (claim) {
+			if (claim.hookId !== data.correlationId) return failure("ENTITY_CONFLICT", `hook_received resumeId "${ctx.params.resumeId}" already recorded for a different hook`);
+			if (claim.payloadDigest && ctx.params.resumePayloadDigest && claim.payloadDigest !== ctx.params.resumePayloadDigest) return failure("ENTITY_CONFLICT", `hook_received resumeId "${ctx.params.resumeId}" already recorded with a different payload`);
+			const committed = await store.get(`${EVENT_KEY_PREFIX}${claim.eventId}`);
+			if (committed?.eventType === "hook_received" && committed.correlationId === claim.hookId && committed.resumeId === ctx.params.resumeId) return {
+				ok: true,
+				event: committed,
+				releasedHooks: []
+			};
+			if (committed) return failure("ENTITY_CONFLICT", `hook_received resumeId "${ctx.params.resumeId}" points to a different event`);
+		}
 	}
 	if ((data.eventType === "hook_disposed" || data.eventType === "hook_received") && data.correlationId) {
 		if (!await store.get(`hook:${data.correlationId}`)) return failure("HOOK_NOT_FOUND", `Hook "${data.correlationId}" not found`);
@@ -1048,12 +1316,19 @@ async function applyEvent(store, ctx) {
 				run: existing,
 				releasedHooks: []
 			};
+			const attributeChanges = Object.entries(data.eventData.attributes ?? {}).map(([key, value]) => ({
+				key,
+				value
+			}));
+			validateAttributeChanges(attributeChanges, { allowReservedAttributes: data.eventData.allowReservedAttributes });
 			const run = WorkflowRunSchema.parse(compact({
 				runId,
 				deploymentId: data.eventData.deploymentId,
 				workflowName: data.eventData.workflowName,
 				specVersion,
 				executionContext: data.eventData.executionContext,
+				attributes: data.eventData.attributes,
+				encryptionPublicKey: data.eventData.encryptionPublicKey,
 				input: data.eventData.input,
 				status: "pending",
 				output: void 0,
@@ -1079,11 +1354,25 @@ async function applyEvent(store, ctx) {
 		}
 		case "run_started": {
 			if (!currentRun) return failure("RUN_NOT_FOUND", `Workflow run "${runId}" not found`);
-			if (currentRun.status === "running") return {
-				ok: true,
-				run: currentRun,
-				releasedHooks: []
-			};
+			if (currentRun.status === "running") {
+				const result = {
+					ok: true,
+					run: currentRun,
+					releasedHooks: [],
+					maxEvents: getMaxEventsPerRun()
+				};
+				if (ctx.params?.skipPreload) return result;
+				const allEvents = await listByPrefix(store, EVENT_KEY_PREFIX, {
+					limit: getMaxEventsPerRun(),
+					sortOrder: "asc"
+				}, (event) => event.eventId);
+				return {
+					...result,
+					events: allEvents.data,
+					cursor: allEvents.cursor,
+					hasMore: allEvents.hasMore
+				};
+			}
 			const run = WorkflowRunSchema.parse(compact({
 				...currentRun,
 				status: "running",
@@ -1096,17 +1385,24 @@ async function applyEvent(store, ctx) {
 			const event = buildEvent({ ...data });
 			await store.put(RUN_KEY, run);
 			await putEvent(event);
-			const allEvents = await listByPrefix(store, EVENT_KEY_PREFIX, {
-				limit: 1e3,
-				sortOrder: "asc"
-			}, (e) => e.eventId);
-			return {
+			const result = {
 				ok: true,
 				event,
 				run,
 				releasedHooks: [],
 				runCreated: bootstrapped,
-				events: allEvents.data
+				maxEvents: getMaxEventsPerRun()
+			};
+			if (ctx.params?.skipPreload) return result;
+			const allEvents = await listByPrefix(store, EVENT_KEY_PREFIX, {
+				limit: getMaxEventsPerRun(),
+				sortOrder: "asc"
+			}, (e) => e.eventId);
+			return {
+				...result,
+				events: allEvents.data,
+				cursor: allEvents.cursor,
+				hasMore: allEvents.hasMore
 			};
 		}
 		case "run_completed": {
@@ -1122,11 +1418,13 @@ async function applyEvent(store, ctx) {
 			const event = buildEvent({ ...data });
 			await store.put(RUN_KEY, run);
 			await putEvent(event);
+			const releasedHooks = await releaseAllHooks(store);
+			await releaseAllWaits(store);
 			return {
 				ok: true,
 				event,
 				run,
-				releasedHooks: await releaseAllHooks(store)
+				releasedHooks
 			};
 		}
 		case "run_failed": {
@@ -1142,11 +1440,13 @@ async function applyEvent(store, ctx) {
 			const event = buildEvent({ ...data });
 			await store.put(RUN_KEY, run);
 			await putEvent(event);
+			const releasedHooks = await releaseAllHooks(store);
+			await releaseAllWaits(store);
 			return {
 				ok: true,
 				event,
 				run,
-				releasedHooks: await releaseAllHooks(store)
+				releasedHooks
 			};
 		}
 		case "run_cancelled": {
@@ -1162,11 +1462,37 @@ async function applyEvent(store, ctx) {
 			const event = buildEvent({ ...data });
 			await store.put(RUN_KEY, run);
 			await putEvent(event);
+			const releasedHooks = await releaseAllHooks(store);
+			await releaseAllWaits(store);
 			return {
 				ok: true,
 				event,
 				run,
-				releasedHooks: await releaseAllHooks(store)
+				releasedHooks
+			};
+		}
+		case "attr_set": {
+			if (!currentRun) return failure("RUN_NOT_FOUND", `Workflow run "${runId}" not found`);
+			validateAttributeChanges(data.eventData.changes, {
+				existingKeys: Object.keys(currentRun.attributes),
+				allowReservedAttributes: data.eventData.allowReservedAttributes
+			});
+			const markerKey = data.correlationId && data.eventData.writer.type === "workflow" ? `${ATTRIBUTE_EVENT_MARKER_PREFIX}${data.correlationId}` : void 0;
+			if (markerKey && await store.get(markerKey) !== void 0) return failure("ENTITY_CONFLICT", `Attribute event "${data.correlationId}" already exists`);
+			const run = WorkflowRunSchema.parse(compact({
+				...currentRun,
+				attributes: applyAttributeChanges(currentRun.attributes, data.eventData.changes),
+				updatedAt: now
+			}));
+			const event = buildEvent({ ...data });
+			await store.put(RUN_KEY, run);
+			if (markerKey) await store.put(markerKey, event.eventId);
+			await putEvent(event);
+			return {
+				ok: true,
+				event,
+				run,
+				releasedHooks: []
 			};
 		}
 		case "step_created": {
@@ -1200,7 +1526,34 @@ async function applyEvent(store, ctx) {
 			};
 		}
 		case "step_started": {
-			const step = validatedStep;
+			let step = validatedStep;
+			let stepCreated = false;
+			if (!step && data.eventData?.input !== void 0 && data.eventData.stepName) {
+				step = StepSchema.parse(compact({
+					runId,
+					stepId: data.correlationId,
+					stepName: data.eventData.stepName,
+					status: "pending",
+					input: data.eventData.input,
+					attempt: 0,
+					createdAt: now,
+					updatedAt: now,
+					specVersion
+				}));
+				const createdEvent = buildEvent({
+					eventType: "step_created",
+					correlationId: data.correlationId,
+					eventData: {
+						stepName: data.eventData.stepName,
+						workflowName: data.eventData.workflowName,
+						input: data.eventData.input
+					}
+				});
+				await store.put(`${STEP_KEY_PREFIX}${data.correlationId}`, step);
+				await store.put(creationIndexKey(STEP_CREATED_KEY_PREFIX, step.createdAt, step.stepId), step.stepId);
+				await putEvent(createdEvent);
+				stepCreated = true;
+			}
 			if (!step) return failure("STEP_NOT_FOUND", `Step "${data.correlationId}" not found`);
 			if (step.retryAfter && step.retryAfter.getTime() > now.getTime()) return failure("TOO_EARLY", `Cannot start step "${data.correlationId}": retryAfter timestamp has not been reached yet`, { retryAfterSeconds: Math.ceil((step.retryAfter.getTime() - now.getTime()) / 1e3) });
 			const updated = StepSchema.parse(compact({
@@ -1218,7 +1571,8 @@ async function applyEvent(store, ctx) {
 				ok: true,
 				event,
 				step: updated,
-				releasedHooks: []
+				releasedHooks: [],
+				...stepCreated ? { stepCreated: true } : {}
 			};
 		}
 		case "step_completed": {
@@ -1247,7 +1601,7 @@ async function applyEvent(store, ctx) {
 			const updated = StepSchema.parse(compact({
 				...step,
 				status: "failed",
-				error: toStructuredError(data.eventData.error, { stack: data.eventData.stack }),
+				error: toStructuredError(data.eventData.error),
 				completedAt: now,
 				updatedAt: now
 			}));
@@ -1267,7 +1621,7 @@ async function applyEvent(store, ctx) {
 			const updated = StepSchema.parse(compact({
 				...step,
 				status: "pending",
-				error: toStructuredError(data.eventData.error, { stack: data.eventData.stack }),
+				error: toStructuredError(data.eventData.error),
 				retryAfter: data.eventData.retryAfter ? new Date(data.eventData.retryAfter) : void 0,
 				updatedAt: now
 			}));
@@ -1323,7 +1677,9 @@ async function applyEvent(store, ctx) {
 				environment: "",
 				createdAt: now,
 				specVersion,
-				isWebhook: data.eventData.isWebhook ?? false
+				isWebhook: data.eventData.isWebhook ?? false,
+				isSystem: data.eventData.isSystem,
+				tokenRetentionUntil: data.eventData.tokenRetentionUntil
 			}));
 			const event = buildEvent({ ...data });
 			await store.put(hookKey, hook);
@@ -1355,9 +1711,58 @@ async function applyEvent(store, ctx) {
 				}]
 			};
 		}
+		case "wait_created": {
+			const waitKey = `${WAIT_KEY_PREFIX}${data.correlationId}`;
+			if (await store.get(waitKey) !== void 0) return failure("ENTITY_CONFLICT", `Wait "${data.correlationId}" already exists`);
+			const wait = WaitSchema.parse({
+				waitId: `${runId}-${data.correlationId}`,
+				runId,
+				status: "waiting",
+				resumeAt: data.eventData.resumeAt,
+				createdAt: now,
+				updatedAt: now,
+				specVersion
+			});
+			const event = buildEvent({ ...data });
+			await store.put(waitKey, wait);
+			await putEvent(event);
+			return {
+				ok: true,
+				event,
+				wait,
+				releasedHooks: []
+			};
+		}
+		case "wait_completed": {
+			const waitKey = `${WAIT_KEY_PREFIX}${data.correlationId}`;
+			const existing = await store.get(waitKey);
+			if (!existing) return failure("WAIT_NOT_FOUND", `Wait "${data.correlationId}" not found`);
+			if (existing.status === "completed") return failure("ENTITY_CONFLICT", `Wait "${data.correlationId}" already completed`);
+			const event = buildEvent({ ...data });
+			const wait = WaitSchema.parse({
+				...existing,
+				status: "completed",
+				resumeAt: data.eventData?.resumeAt ?? existing.resumeAt,
+				completedAt: now,
+				updatedAt: now
+			});
+			await store.put(waitKey, wait);
+			await putEvent(event);
+			return {
+				ok: true,
+				event,
+				wait,
+				releasedHooks: []
+			};
+		}
 		default: {
 			const event = buildEvent({ ...data });
 			await putEvent(event);
+			if (data.eventType === "hook_received" && ctx.params?.resumeId) await store.put(`${HOOK_RESUME_CLAIM_PREFIX}${ctx.params.resumeId}`, {
+				hookId: data.correlationId,
+				eventId: event.eventId,
+				...ctx.params.resumePayloadDigest ? { payloadDigest: ctx.params.resumePayloadDigest } : {}
+			});
 			return {
 				ok: true,
 				event,
@@ -1366,67 +1771,95 @@ async function applyEvent(store, ctx) {
 		}
 	}
 }
-//#endregion
-//#region src/worker/durable-objects/WorkflowRunDO.ts
-/**
-* Current schema version for DO storage.
-* Increment when making breaking changes to the storage layout.
-* Migrations run lazily on first request after deploy.
-*
-* v2: one storage key per event ('event:<eventId>'), step ('step:<stepId>')
-* and hook ('hook:<hookId>') instead of single aggregate values. This package
-* is pre-production, so the migration simply drops the legacy aggregates.
-*/
-const CURRENT_SCHEMA_VERSION = 3;
 /**
-* Idempotent migration functions keyed by target version. The schema version
-* is written only after the migration completes, so eviction safely retries
-* an interrupted migration.
+* Complete Workflow 5's event-page response after an atomic apply. A celld
+* run is a single serialized writer, so the committed sequence is dense; a
+* stale eventCount therefore needs only the slots between the requested
+* position and the event this call committed.
 */
-const MIGRATIONS = {
-	2: async (storage) => {
-		await storage.transaction(async (txn) => {
-			await txn.delete("events");
-			await txn.delete("steps");
-			await txn.delete("hooks");
-		});
-	},
-	3: async (storage) => {
-		await backfillCreationIndex(storage, STEP_KEY_PREFIX, STEP_CREATED_KEY_PREFIX, (step) => step.stepId);
-		await backfillCreationIndex(storage, HOOK_KEY_PREFIX, HOOK_CREATED_KEY_PREFIX, (hook) => hook.hookId);
-	}
-};
-async function backfillCreationIndex(storage, entityPrefix, indexPrefix, getId) {
-	let startAfter;
-	while (true) {
-		const entities = await storage.list({
-			prefix: entityPrefix,
-			startAfter,
-			limit: 100
-		});
-		if (entities.size === 0) return;
-		for (const [key, entity] of entities) {
-			const id = getId(entity);
-			await storage.put(`${indexPrefix}${entity.createdAt.toISOString()}:${id}`, id);
-			startAfter = key;
-		}
-		if (entities.size < 100) return;
+async function finalizeEventPage(store, outcome, params) {
+	if (!outcome.ok) return outcome;
+	const result = outcome.run && outcome.maxEvents === void 0 ? {
+		...outcome,
+		maxEvents: getMaxEventsPerRun()
+	} : outcome;
+	if (!result.event) return result;
+	if (typeof params?.sinceCursor === "string") {
+		const page = await listByPrefix(store, EVENT_KEY_PREFIX, {
+			limit: 100,
+			cursor: params.sinceCursor,
+			sortOrder: "asc"
+		}, (event) => event.eventId);
+		return {
+			...result,
+			events: page.data,
+			cursor: page.cursor,
+			hasMore: page.hasMore
+		};
 	}
+	if (params?.eventCount === void 0) return result;
+	const committedSlot = eventIdToSlot(result.event.eventId);
+	if (committedSlot === null || committedSlot <= params.eventCount + 1) return result;
+	const skippedCount = committedSlot - params.eventCount - 1;
+	const events = (await listByPrefix(store, EVENT_KEY_PREFIX, {
+		limit: skippedCount,
+		cursor: params.eventCount > 0 ? slotToEventId(params.eventCount) : void 0,
+		sortOrder: "asc"
+	}, (event) => event.eventId)).data.filter((event) => event.eventId < result.event.eventId);
+	return {
+		...result,
+		events,
+		cursor: null,
+		hasMore: events.length < skippedCount
+	};
 }
-/**
-* Ensure the DO storage schema is up to date.
-* Runs any pending migrations sequentially inside transactions,
-* persisting the version after each successful migration.
-* Safe to call on every request -- it's a no-op when already current.
-*/
-async function ensureSchemaUpToDate(storage) {
-	const stored = await storage.get("schema_version") ?? 1;
-	for (let v = stored + 1; v <= CURRENT_SCHEMA_VERSION; v++) {
-		const migration = MIGRATIONS[v];
-		if (migration) await migration(storage);
-		await storage.put("schema_version", v);
-	}
+//#endregion
+//#region src/retention.ts
+const CLEANUP_RECORD_KEY = "retention:cleanup";
+const TOMBSTONE_KEY = "retention:tombstone";
+const INDEX_MARKER_PREFIX = "retention:index:";
+const HOOK_MARKER_PREFIX = "retention:hook:";
+function sortableTimestamp(date) {
+	return date.getTime().toString().padStart(13, "0");
+}
+function workflowRunIndexKey(run) {
+	return `run:${run.workflowName}:${sortableTimestamp(run.createdAt)}:${run.runId}`;
+}
+function globalRunIndexKey(run) {
+	return `runall:${sortableTimestamp(run.createdAt)}:${run.runId}`;
+}
+function correlationIndexKey(correlationId, createdAt, eventId, runId) {
+	return `correlation:${encodeURIComponent(correlationId)}:${sortableTimestamp(createdAt)}:${eventId}:${runId}`;
 }
+function indexMarkerKey(indexKey) {
+	return `${INDEX_MARKER_PREFIX}${encodeURIComponent(indexKey)}`;
+}
+function hookMarkerKey(reference) {
+	return `${HOOK_MARKER_PREFIX}${encodeURIComponent(reference.hookId)}:${encodeURIComponent(reference.token)}`;
+}
+function cleanupTombstone(record, now) {
+	return {
+		version: 1,
+		runId: record.runId,
+		terminalStatus: record.terminalStatus,
+		completedAt: record.completedAt,
+		expiredAt: record.dueAt,
+		tombstonedAt: now
+	};
+}
+function expiredRead(tombstone) {
+	return {
+		ok: false,
+		code: "RUN_EXPIRED",
+		message: `Workflow run "${tombstone.runId}" expired at ${tombstone.expiredAt.toISOString()}`,
+		tombstone
+	};
+}
+//#endregion
+//#region src/worker/durable-objects/WorkflowRunDO.ts
+const PAYLOAD_DELETE_BATCH = 256;
+const STREAM_DELETE_CONCURRENCY = 16;
+const CLEANUP_RETRY_MAX_MS = 36e5;
 /**
 * Adapt DO storage (or a transaction) to the {@link EventStore} interface
 * shared with the test mocks. No casts: the methods line up structurally,
@@ -1451,105 +1884,335 @@ function storeFrom(storage) {
 * queue-message dedup claims (see claimInflight/releaseInflight).
 */
 var WorkflowRunDO = class extends DurableObject {
-	schemaReady = null;
-	/**
-	* Lazily ensure schema migrations have run.
-	* Memoized so it only runs once per DO instantiation.
-	*/
-	ensureSchema() {
-		if (!this.schemaReady) this.schemaReady = ensureSchemaUpToDate(this.ctx.storage);
-		return this.schemaReady;
+	now() {
+		const clock = this.env?.clock;
+		return typeof clock === "function" ? clock() : Date.now();
 	}
-	/**
-	* Apply an event: validate, guard, append the event and mutate the entity
-	* in ONE storage transaction. Guard failures are returned as structured
-	* outcomes (not thrown) because typed errors do not survive the RPC
-	* boundary with their `name` intact.
-	*/
+	async expiredTombstone(storage, now = this.now()) {
+		const tombstone = await storage.get(TOMBSTONE_KEY);
+		if (tombstone) return tombstone;
+		const cleanup = await storage.get(CLEANUP_RECORD_KEY);
+		if (!cleanup || cleanup.phase === "retained" && cleanup.dueAt.getTime() > now) return null;
+		return cleanupTombstone(cleanup, cleanup.tombstonedAt ?? cleanup.dueAt);
+	}
+	async read(reader) {
+		const tombstone = await this.expiredTombstone(this.ctx.storage);
+		if (tombstone) return expiredRead(tombstone);
+		return {
+			ok: true,
+			value: await reader()
+		};
+	}
+	/** Apply an event and capture all retention metadata in the same transaction. */
 	async applyEvent(request) {
-		await this.ensureSchema();
 		return await this.ctx.storage.transaction(async (txn) => {
+			const now = new Date(this.now());
+			const tombstone = await this.expiredTombstone(txn, now.getTime());
+			if (tombstone) return {
+				ok: false,
+				code: "RUN_EXPIRED",
+				message: `Workflow run "${request.runId}" expired at ${tombstone.expiredAt.toISOString()}`
+			};
 			let eventSequence = await txn.get("event_sequence") ?? 0;
 			const outcome = await applyEvent(storeFrom(txn), {
 				...request,
-				nextEventId: () => `wevt_z${String(++eventSequence).padStart(20, "0")}`,
-				now: /* @__PURE__ */ new Date()
+				nextEventId: () => slotToEventId(++eventSequence),
+				now
 			});
-			if (outcome.ok) await txn.put("event_sequence", eventSequence);
-			return outcome;
+			if (!outcome.ok) return outcome;
+			await txn.put("event_sequence", eventSequence);
+			if (outcome.event?.correlationId) {
+				const key = correlationIndexKey(outcome.event.correlationId, outcome.event.createdAt, outcome.event.eventId, request.runId);
+				await txn.put(indexMarkerKey(key), key);
+			}
+			if (outcome.hookToIndex) {
+				const reference = {
+					hookId: outcome.hookToIndex.hookId,
+					token: outcome.hookToIndex.token
+				};
+				await txn.put(hookMarkerKey(reference), reference);
+			}
+			for (const reference of outcome.releasedHooks) await txn.put(hookMarkerKey(reference), reference);
+			const retentionMs = request.cleanup?.retentionMs ?? 0;
+			if (retentionMs > 0 && outcome.run && isTerminalWorkflowRunStatus(outcome.run.status) && !await txn.get("retention:cleanup")) {
+				const terminalRun = outcome.run;
+				const dueAt = new Date(terminalRun.completedAt.getTime() + retentionMs);
+				const run = WorkflowRunSchema.parse({
+					...terminalRun,
+					expiredAt: dueAt
+				});
+				const cleanup = {
+					version: 1,
+					runId: run.runId,
+					workflowName: run.workflowName,
+					createdAt: run.createdAt,
+					completedAt: run.completedAt,
+					terminalStatus: run.status,
+					dueAt,
+					queueShards: request.cleanup?.queueShards ?? 1,
+					phase: "retained",
+					attempts: 0,
+					deletedPayloadKeys: 0,
+					deletedStreams: 0,
+					deletedQueueMessages: 0
+				};
+				await txn.put("run", run);
+				await txn.put(CLEANUP_RECORD_KEY, cleanup);
+				await txn.setAlarm(dueAt);
+				outcome.run = run;
+			}
+			return finalizeEventPage(storeFrom(txn), outcome, request.params);
 		});
 	}
-	/**
-	* Get the workflow run
-	*/
 	async getRun() {
-		await this.ensureSchema();
-		return await this.ctx.storage.get("run") ?? null;
+		return this.read(async () => await this.ctx.storage.get("run") ?? null);
 	}
-	/**
-	* Get a specific step
-	*/
 	async getStep(stepId) {
-		await this.ensureSchema();
-		return await this.ctx.storage.get(`step:${stepId}`) ?? null;
+		return this.read(async () => await this.ctx.storage.get(`step:${stepId}`) ?? null);
 	}
-	/**
-	* List steps with real limit/cursor pagination (cursor = last stepId).
-	*/
 	async listSteps(params) {
-		await this.ensureSchema();
-		return listByCreationTime(storeFrom(this.ctx.storage), STEP_CREATED_KEY_PREFIX, STEP_KEY_PREFIX, {
+		return this.read(() => listByCreationTime(storeFrom(this.ctx.storage), STEP_CREATED_KEY_PREFIX, STEP_KEY_PREFIX, {
 			limit: params?.limit ?? 20,
 			cursor: params?.cursor,
 			sortOrder: params?.sortOrder ?? "asc"
-		});
+		}));
 	}
-	/**
-	* Get a specific event
-	*/
 	async getEvent(eventId) {
-		await this.ensureSchema();
-		return await this.ctx.storage.get(`event:${eventId}`) ?? null;
+		return this.read(async () => await this.ctx.storage.get(`event:${eventId}`) ?? null);
 	}
-	/**
-	* List events with real limit/cursor pagination. Events are keyed by their
-	* monotonic ULID eventId, so storage order == event order.
-	*/
 	async listEvents(params) {
-		await this.ensureSchema();
-		return listByPrefix(storeFrom(this.ctx.storage), EVENT_KEY_PREFIX, {
+		return this.read(() => listByPrefix(storeFrom(this.ctx.storage), EVENT_KEY_PREFIX, {
 			limit: params?.limit ?? 100,
 			cursor: params?.cursor,
 			sortOrder: params?.sortOrder ?? "asc"
-		}, (event) => event.eventId);
+		}, (event) => event.eventId));
 	}
-	/**
-	* List hooks with real limit/cursor pagination (cursor = last hookId).
-	*/
 	async listHooks(params) {
-		await this.ensureSchema();
-		return listByCreationTime(storeFrom(this.ctx.storage), HOOK_CREATED_KEY_PREFIX, HOOK_KEY_PREFIX, {
+		return this.read(() => listByCreationTime(storeFrom(this.ctx.storage), HOOK_CREATED_KEY_PREFIX, HOOK_KEY_PREFIX, {
 			limit: params?.limit ?? 100,
 			cursor: params?.cursor,
 			sortOrder: params?.sortOrder ?? "asc"
+		}));
+	}
+	async getCleanupStatus() {
+		return await this.ctx.storage.get("retention:cleanup") ?? null;
+	}
+	/** Explicitly schedule an existing terminal run, used for opt-in backfills. */
+	async scheduleCleanup(request) {
+		if (request.retentionMs <= 0) return this.getCleanupStatus();
+		return await this.ctx.storage.transaction(async (txn) => {
+			const existing = await txn.get(CLEANUP_RECORD_KEY);
+			if (existing) return existing;
+			if (await txn.get("retention:tombstone")) return null;
+			const current = await txn.get("run");
+			if (!current || !isTerminalWorkflowRunStatus(current.status)) return null;
+			const terminalRun = current;
+			const dueAt = new Date(terminalRun.completedAt.getTime() + request.retentionMs);
+			const run = WorkflowRunSchema.parse({
+				...terminalRun,
+				expiredAt: dueAt
+			});
+			const cleanup = {
+				version: 1,
+				runId: run.runId,
+				workflowName: run.workflowName,
+				createdAt: run.createdAt,
+				completedAt: run.completedAt,
+				terminalStatus: run.status,
+				dueAt,
+				queueShards: request.queueShards,
+				phase: "retained",
+				attempts: 0,
+				deletedPayloadKeys: 0,
+				deletedStreams: 0,
+				deletedQueueMessages: 0
+			};
+			await txn.put("run", run);
+			await txn.put(CLEANUP_RECORD_KEY, cleanup);
+			await txn.setAlarm(dueAt.getTime() <= this.now() ? this.now() + 1 : dueAt);
+			return cleanup;
+		});
+	}
+	async cleanupNow(request) {
+		if (!await this.ctx.storage.get("retention:cleanup")) await this.scheduleCleanup({
+			...request,
+			retentionMs: Math.max(1, request.retentionMs)
+		});
+		await this.ctx.storage.transaction(async (txn) => {
+			const cleanup = await txn.get(CLEANUP_RECORD_KEY);
+			if (!cleanup || cleanup.phase === "tombstoned") return;
+			const dueAt = new Date(this.now());
+			const run = await txn.get("run");
+			if (run) await txn.put("run", WorkflowRunSchema.parse({
+				...run,
+				expiredAt: dueAt
+			}));
+			await txn.put(CLEANUP_RECORD_KEY, {
+				...cleanup,
+				dueAt
+			});
+			await txn.setAlarm(this.now() + 1);
+		});
+		try {
+			await this.executeCleanup();
+		} catch (error) {
+			await this.recordCleanupFailure(error);
+		}
+		return this.getCleanupStatus();
+	}
+	async rearmCleanup() {
+		const cleanup = await this.ctx.storage.get(CLEANUP_RECORD_KEY);
+		if (!cleanup) return null;
+		if (cleanup.phase === "tombstoned") await this.ctx.storage.deleteAlarm();
+		else await this.ctx.storage.setAlarm(Math.max(this.now() + 1, cleanup.dueAt.getTime()));
+		return cleanup;
+	}
+	async alarm() {
+		try {
+			await this.executeCleanup();
+		} catch (error) {
+			await this.recordCleanupFailure(error);
+		}
+	}
+	namespace(name) {
+		const namespace = this.env?.[name];
+		if (!namespace || typeof namespace === "function") throw new Error(`world-celld retention missing binding ${name}`);
+		return namespace;
+	}
+	async setCleanupPhase(expected, next, updates = {}) {
+		await this.ctx.storage.transaction(async (txn) => {
+			const cleanup = await txn.get(CLEANUP_RECORD_KEY);
+			if (!cleanup || cleanup.phase !== expected) return;
+			await txn.put(CLEANUP_RECORD_KEY, {
+				...cleanup,
+				...updates,
+				phase: next,
+				attempts: 0,
+				lastError: void 0
+			});
+		});
+	}
+	async executeCleanup() {
+		for (;;) {
+			const cleanup = await this.ctx.storage.get(CLEANUP_RECORD_KEY);
+			if (!cleanup) {
+				await this.ctx.storage.deleteAlarm();
+				return;
+			}
+			if (cleanup.phase === "tombstoned") {
+				await this.ctx.storage.deleteAlarm();
+				return;
+			}
+			if (cleanup.phase === "retained") {
+				if (cleanup.dueAt.getTime() > this.now()) {
+					await this.ctx.storage.setAlarm(cleanup.dueAt);
+					return;
+				}
+				await this.setCleanupPhase("retained", "index");
+				continue;
+			}
+			if (cleanup.phase === "index") {
+				const [indexMarkers, hookMarkers] = await Promise.all([this.ctx.storage.list({ prefix: INDEX_MARKER_PREFIX }), this.ctx.storage.list({ prefix: HOOK_MARKER_PREFIX })]);
+				const indexNamespace = this.namespace("WORKFLOW_INDEX");
+				await indexNamespace.get(indexNamespace.idFromName("index")).expireRun({
+					runId: cleanup.runId,
+					keys: [
+						workflowRunIndexKey(cleanup),
+						globalRunIndexKey(cleanup),
+						...indexMarkers.values()
+					],
+					hooks: Array.from(hookMarkers.values()),
+					expiredAt: cleanup.dueAt.getTime()
+				});
+				await this.setCleanupPhase("index", "streams");
+				continue;
+			}
+			if (cleanup.phase === "streams") {
+				const streamsNamespace = this.namespace("WORKFLOW_STREAMS");
+				const registry = streamsNamespace.get(streamsNamespace.idFromName(`run-streams:${cleanup.runId}`));
+				const { streams } = await registry.expireRegistry(cleanup.runId, cleanup.dueAt.getTime());
+				let deletedStreams = streams.length === 0 ? cleanup.deletedStreams : 0;
+				for (let offset = 0; offset < streams.length; offset += STREAM_DELETE_CONCURRENCY) {
+					const batch = streams.slice(offset, offset + STREAM_DELETE_CONCURRENCY);
+					const results = await Promise.all(batch.map((name) => {
+						return streamsNamespace.get(streamsNamespace.idFromName(`stream:${name}`)).expireStream(cleanup.runId, cleanup.dueAt.getTime());
+					}));
+					deletedStreams += results.filter((result) => result.deleted).length;
+				}
+				await this.ctx.storage.transaction(async (txn) => {
+					const current = await txn.get(CLEANUP_RECORD_KEY);
+					if (current?.phase === "streams") await txn.put(CLEANUP_RECORD_KEY, {
+						...current,
+						deletedStreams
+					});
+				});
+				await registry.finalizeRegistry(cleanup.runId);
+				await this.setCleanupPhase("streams", "queues");
+				continue;
+			}
+			if (cleanup.phase === "queues") {
+				const queues = this.namespace("WORKFLOW_QUEUE");
+				let deletedQueueMessages = 0;
+				for (let shard = 0; shard < cleanup.queueShards; shard++) {
+					const result = await queues.get(queues.idFromName(`q:${shard}`)).expireRun(cleanup.runId, cleanup.dueAt.getTime());
+					deletedQueueMessages += result.deleted;
+				}
+				await this.setCleanupPhase("queues", "payload", { deletedQueueMessages });
+				continue;
+			}
+			if (cleanup.phase === "payload") {
+				if (!await this.deletePayloadBatch()) return;
+			}
+		}
+	}
+	async deletePayloadBatch() {
+		return await this.ctx.storage.transaction(async (txn) => {
+			const cleanup = await txn.get(CLEANUP_RECORD_KEY);
+			if (!cleanup || cleanup.phase !== "payload") return true;
+			const entries = await txn.list({ limit: 259 });
+			const keys = Array.from(entries.keys()).filter((key) => key !== "retention:cleanup" && key !== "retention:tombstone").slice(0, PAYLOAD_DELETE_BATCH);
+			const now = new Date(this.now());
+			await txn.put(TOMBSTONE_KEY, cleanupTombstone(cleanup, now));
+			for (const key of keys) await txn.delete(key);
+			if (keys.length > 0) {
+				await txn.put(CLEANUP_RECORD_KEY, {
+					...cleanup,
+					deletedPayloadKeys: cleanup.deletedPayloadKeys + keys.length,
+					lastError: void 0
+				});
+				await txn.setAlarm(this.now() + 1);
+				return false;
+			}
+			await txn.put(CLEANUP_RECORD_KEY, {
+				...cleanup,
+				phase: "tombstoned",
+				attempts: 0,
+				lastError: void 0,
+				tombstonedAt: now
+			});
+			await txn.deleteAlarm();
+			return true;
+		});
+	}
+	async recordCleanupFailure(error) {
+		await this.ctx.storage.transaction(async (txn) => {
+			const cleanup = await txn.get(CLEANUP_RECORD_KEY);
+			if (!cleanup || cleanup.phase === "tombstoned") return;
+			const attempts = cleanup.attempts + 1;
+			const delay = Math.min(CLEANUP_RETRY_MAX_MS, 1e3 * 2 ** Math.min(attempts - 1, 12));
+			await txn.put(CLEANUP_RECORD_KEY, {
+				...cleanup,
+				attempts,
+				lastError: error instanceof Error ? error.message : String(error),
+				lastAttemptAt: new Date(this.now())
+			});
+			await txn.setAlarm(this.now() + delay);
 		});
 	}
-	/**
-	* Claim a queue-message dedup slot. Used on DO instances dedicated to a
-	* single idempotency key (`claim:<queueName>:<idempotencyKey>`).
-	*
-	* - Unclaimed -> claim and proceed.
-	* - Claimed by the SAME messageId -> redelivery of the same message
-	*   (previous attempt failed transiently) -> proceed.
-	* - Claimed by a DIFFERENT messageId -> concurrent duplicate -> reject,
-	*   unless the claim is stale (holder crashed / went to the DLQ without
-	*   releasing), in which case the claim is stolen.
-	*/
 	async claimInflight(params) {
-		await this.ensureSchema();
 		return await this.ctx.storage.transaction(async (txn) => {
 			const existing = await txn.get("claim");
-			const now = Date.now();
+			const now = this.now();
 			if (existing && existing.messageId !== params.messageId && now - existing.claimedAt < params.staleMs) return { claimed: false };
 			await txn.put("claim", {
 				messageId: params.messageId,
@@ -1558,11 +2221,7 @@ var WorkflowRunDO = class extends DurableObject {
 			return { claimed: true };
 		});
 	}
-	/**
-	* Release a queue-message dedup claim after the message was fully handled.
-	*/
 	async releaseInflight() {
-		await this.ensureSchema();
 		await this.ctx.storage.delete("claim");
 	}
 };