@ewhauser/world-celld 0.4.1 → 0.6.0

package/dist/worker.js

@@ -1,6 +1,181 @@
-import { CreateEventSchema, EventSchema, HookSchema, QueuePayloadSchema, SPEC_VERSION_CURRENT, StepSchema, WaitSchema, WorkflowRunSchema, applyAttributeChanges, eventIdToSlot, getMaxEventsPerRun, isChildEntityCreationEvent, isTerminalStepStatus, isTerminalWorkflowRunStatus, slotToEventId, validateAttributeChanges } from "@workflow/world";
-import { DurableObject } from "cloudflare:workers";
-import { WorkflowWorldError } from "@workflow/errors";
+import { _ as isRecord$1, a as queueOrphanName, c as validateNativeQueueEnvelope, d as HOOK_CLAIM_LEASE_MS, f as LIFECYCLE_COMPACTION_RETRY_MS, g as isPositiveSafeInteger, h as isNonNegativeSafeInteger, i as queueClaimName, l as validateNativeQueueSendOptions, m as QUEUE_CLAIM_STALE_MS, n as QUEUE_PAYLOAD_REGISTRY_PREFIX, o as queuePayloadObjectKey, p as MAX_RUN_INDEX_PUBLICATION_LIFETIME_MS, s as queuePayloadRegistryKey, t as NATIVE_QUEUE_MAX_MESSAGE_BYTES, v as queueDelayDeadline, y as strictIntegerSetting } from "./queue-protocol-Ds44uuND.js";
+import { DurableObject, WorkerEntrypoint } from "cloudflare:workers";
+import { CreateEventSchema, EventSchema, HookSchema, SPEC_VERSION_CURRENT, StepSchema, WaitSchema, WorkflowRunSchema, applyAttributeChanges, eventIdToSlot, getMaxEventsPerRun, isChildEntityCreationEvent, isTerminalStepStatus, isTerminalWorkflowRunStatus, slotToEventId, validateAttributeChanges } from "@workflow/world";
+//#region src/worker/auth.ts
+/**
+* Bearer-token auth for the worker router.
+*
+* Fails closed: when the WORLD_SECRET var is not configured, every protected
+* route returns 503 instead of forwarding unauthenticated traffic (the
+* eve-ambient celld-worker pattern).
+*/
+/**
+* Constant-time string comparison via SHA-256 digests (digest-then-compare
+* is length-independent). crypto.subtle is global in both workerd and Node.
+*/
+async function timingSafeEqual(a, b) {
+	const enc = new TextEncoder();
+	const [da, db] = await Promise.all([crypto.subtle.digest("SHA-256", enc.encode(a)), crypto.subtle.digest("SHA-256", enc.encode(b))]);
+	const va = new Uint8Array(da);
+	const vb = new Uint8Array(db);
+	let diff = 0;
+	for (let i = 0; i < va.length; i++) diff |= va[i] ^ vb[i];
+	return diff === 0;
+}
+async function authenticate(request, secret) {
+	if (!secret) return {
+		ok: false,
+		response: Response.json({ error: {
+			name: "WorldNotConfigured",
+			message: "WORLD_SECRET is not configured"
+		} }, { status: 503 })
+	};
+	const header = request.headers.get("authorization") ?? "";
+	const token = header.startsWith("Bearer ") ? header.slice(7) : "";
+	if (!token || !await timingSafeEqual(token, secret)) return {
+		ok: false,
+		response: Response.json({ error: {
+			name: "Unauthorized",
+			message: "invalid or missing bearer token"
+		} }, { status: 401 })
+	};
+	return { ok: true };
+}
+//#endregion
+//#region src/worker/queue-delivery.ts
+/** Internal delivery contract. No Request/Response objects cross the RPC boundary. */
+const MAX_QUEUE_DELIVERY_RESPONSE_BYTES = 65536;
+const QUEUE_ORPHAN_GRACE_MS$1 = 432e6;
+const PERMANENT_QUEUE_STATUSES = /* @__PURE__ */ new Set([
+	404,
+	409,
+	410,
+	422
+]);
+async function readResponseText(response) {
+	if (!response.body) return "";
+	const reader = response.body.getReader();
+	const decoder = new TextDecoder();
+	let total = 0;
+	let text = "";
+	try {
+		for (;;) {
+			const { done, value } = await reader.read();
+			if (done) break;
+			total += value.byteLength;
+			if (total > MAX_QUEUE_DELIVERY_RESPONSE_BYTES) {
+				await reader.cancel("queue delivery response is too large").catch(() => void 0);
+				throw new Error("workflow queue handler response exceeds configured limit");
+			}
+			text += decoder.decode(value, { stream: true });
+		}
+		return text + decoder.decode();
+	} finally {
+		reader.releaseLock();
+	}
+}
+/** Validate at the service boundary; callers cannot bypass auth via RPC. */
+async function deliverQueueMessage(env, secret, input, attempt) {
+	if (!env.WORLD_SECRET) throw new Error("WORLD_SECRET is not configured");
+	if (typeof secret !== "string" || !secret || !await timingSafeEqual(secret, env.WORLD_SECRET)) throw new Error("Unauthorized Queue delivery");
+	const envelope = validateNativeQueueEnvelope(input);
+	if (!Number.isSafeInteger(attempt) || attempt < 1) throw new TypeError("queue delivery attempt must be a positive safe integer");
+	if (!env.WORKFLOW_DB) throw new Error("missing binding: WORKFLOW_DB");
+	const namespace = env.WORKFLOW_DB;
+	const payloadStore = env.WORKFLOW_QUEUE_PAYLOADS;
+	const runStub = (name) => namespace.get(namespace.idFromName(name));
+	let claim;
+	let claimed = false;
+	async function releaseClaim() {
+		if (claimed) await claim.releaseInflight(envelope.messageId);
+	}
+	async function unregisterPayload() {
+		if (envelope.runId) {
+			await runStub(envelope.runId).unregisterQueuePayload(envelope.messageId);
+			await runStub(queueOrphanName(envelope.messageId)).cancelQueuePayloadOrphan(envelope.messageId);
+		}
+	}
+	try {
+		if (envelope.idempotencyKey) {
+			claim = runStub(queueClaimName(envelope.queueName, envelope.idempotencyKey));
+			const result = await claim.claimInflight({
+				messageId: envelope.messageId,
+				staleMs: QUEUE_CLAIM_STALE_MS
+			});
+			if (!result.claimed) {
+				const now = Date.now();
+				if (result.retryAt !== void 0 && result.retryAt > now) return {
+					kind: "suspend",
+					timeoutSeconds: Math.max(1, Math.ceil((result.retryAt - now) / 1e3))
+				};
+				return { kind: "complete" };
+			}
+			claimed = true;
+		}
+		let body = envelope.body;
+		if (envelope.payloadKey) {
+			if (!payloadStore) throw new Error("missing binding: WORKFLOW_QUEUE_PAYLOADS");
+			body = await payloadStore.read(envelope.payloadKey) ?? void 0;
+			if (body === void 0) {
+				await unregisterPayload();
+				await claim?.completeQueueMessage(envelope.messageId);
+				return { kind: "complete" };
+			}
+		}
+		const headers = {
+			"content-type": "application/json",
+			"x-vqs-queue-name": envelope.queueName,
+			"x-vqs-message-id": envelope.messageId,
+			"x-vqs-message-attempt": String(attempt)
+		};
+		if (env.WORKFLOW_CALLBACK_SECRET) headers["x-workflow-callback-secret"] = env.WORKFLOW_CALLBACK_SECRET;
+		const callback = await fetch(`${envelope.targetBaseUrl.replace(/\/$/, "")}/.well-known/workflow/v1/flow`, {
+			method: "POST",
+			headers,
+			body,
+			signal: AbortSignal.timeout(3e5)
+		});
+		if (callback.ok || PERMANENT_QUEUE_STATUSES.has(callback.status)) {
+			await callback.body?.cancel().catch(() => void 0);
+			if (envelope.payloadKey) {
+				await payloadStore.delete(envelope.payloadKey);
+				await unregisterPayload();
+			}
+			await claim?.completeQueueMessage(envelope.messageId);
+			return { kind: "complete" };
+		}
+		if (callback.status === 503) {
+			const responseBody = await readResponseText(callback);
+			const timeoutSeconds = JSON.parse(responseBody).timeoutSeconds;
+			const notBefore = queueDelayDeadline(Date.now(), timeoutSeconds, 1, QUEUE_CLAIM_STALE_MS);
+			if (notBefore === null) throw new Error("workflow queue suspension deadline is invalid");
+			if (envelope.payloadKey && envelope.runId) await runStub(queueOrphanName(envelope.messageId)).scheduleQueuePayloadOrphan({
+				messageId: envelope.messageId,
+				runId: envelope.runId,
+				key: envelope.payloadKey,
+				expiresAt: notBefore + QUEUE_ORPHAN_GRACE_MS$1
+			});
+			if (claim) await claim.holdInflight({
+				messageId: envelope.messageId,
+				retryAt: notBefore,
+				expiresAt: notBefore + QUEUE_CLAIM_STALE_MS,
+				reservationExpiresAt: notBefore + QUEUE_ORPHAN_GRACE_MS$1
+			});
+			return {
+				kind: "suspend",
+				timeoutSeconds
+			};
+		}
+		await callback.body?.cancel().catch(() => void 0);
+		await releaseClaim();
+		claimed = false;
+		return { kind: "retry" };
+	} catch (error) {
+		await releaseClaim();
+		throw error;
+	}
+}
+//#endregion
 //#region src/vendor/shared/serialization.ts
 /** Standard Date fields used across all worlds */
 const DATE_FIELDS = /* @__PURE__ */ new Set([
@@ -100,13 +275,13 @@ const HOOK_CLAIM_CANCELLATION_PREFIX = "hookclaimcancelled:";
 const ATTRIBUTE_EVENT_MARKER_PREFIX = "attrevent:";
 /** Durable lazy-hook resume claims, scoped by the containing run DO. */
 const HOOK_RESUME_CLAIM_PREFIX = "hookresume:";
-const STORAGE_BATCH_SIZE$2 = 128;
+const STORAGE_BATCH_SIZE$1 = 128;
 const MAX_ENTITY_PAGE_SIZE = 1e3;
-async function getMany$1(store, keys) {
+async function getMany(store, keys) {
 	if (store.getMany) {
 		const result = /* @__PURE__ */ new Map();
-		for (let offset = 0; offset < keys.length; offset += STORAGE_BATCH_SIZE$2) {
-			const page = await store.getMany(keys.slice(offset, offset + STORAGE_BATCH_SIZE$2));
+		for (let offset = 0; offset < keys.length; offset += STORAGE_BATCH_SIZE$1) {
+			const page = await store.getMany(keys.slice(offset, offset + STORAGE_BATCH_SIZE$1));
 			for (const entry of page) result.set(...entry);
 		}
 		return result;
@@ -114,15 +289,15 @@ async function getMany$1(store, keys) {
 	const values = await Promise.all(keys.map((key) => store.get(key)));
 	return new Map(keys.flatMap((key, index) => values[index] === void 0 ? [] : [[key, values[index]]]));
 }
-async function deleteMany$1(store, keys) {
+async function deleteMany(store, keys) {
 	if (store.deleteMany) {
 		let deleted = 0;
-		for (let offset = 0; offset < keys.length; offset += STORAGE_BATCH_SIZE$2) deleted += await store.deleteMany(keys.slice(offset, offset + STORAGE_BATCH_SIZE$2));
+		for (let offset = 0; offset < keys.length; offset += STORAGE_BATCH_SIZE$1) deleted += await store.deleteMany(keys.slice(offset, offset + STORAGE_BATCH_SIZE$1));
 		return deleted;
 	}
 	return (await Promise.all(keys.map((key) => store.delete(key)))).filter(Boolean).length;
 }
-function isRecord$1(value) {
+function isRecord(value) {
 	return value !== null && typeof value === "object" && !Array.isArray(value);
 }
 /**
@@ -131,12 +306,12 @@ function isRecord$1(value) {
 * events cannot allocate a sequence or touch hook/entity storage.
 */
 function parseApplyEventRequest(value) {
-	if (!isRecord$1(value)) throw new TypeError("applyEvent request must be an object");
+	if (!isRecord(value)) throw new TypeError("applyEvent request must be an object");
 	if (typeof value.runId !== "string" || value.runId.length === 0) throw new TypeError("applyEvent runId must be a non-empty string");
-	const data = CreateEventSchema.parse(isRecord$1(value.data) ? compact(value.data) : value.data);
+	const data = CreateEventSchema.parse(isRecord(value.data) ? compact(value.data) : value.data);
 	const params = value.params;
 	if (params !== void 0) {
-		if (!isRecord$1(params)) throw new TypeError("applyEvent params must be an object");
+		if (!isRecord(params)) throw new TypeError("applyEvent params must be an object");
 		if (params.occurredAt !== void 0 && (!(params.occurredAt instanceof Date) || Number.isNaN(params.occurredAt.getTime()))) throw new TypeError("applyEvent params.occurredAt must be a valid Date");
 		for (const key of [
 			"resumeId",
@@ -149,7 +324,7 @@ function parseApplyEventRequest(value) {
 	let tokenHolder;
 	if (value.tokenHolder === null) tokenHolder = null;
 	else if (value.tokenHolder !== void 0) {
-		if (!isRecord$1(value.tokenHolder) || typeof value.tokenHolder.runId !== "string" || value.tokenHolder.runId.length === 0 || typeof value.tokenHolder.hookId !== "string" || value.tokenHolder.hookId.length === 0) throw new TypeError("applyEvent tokenHolder must contain non-empty runId and hookId strings");
+		if (!isRecord(value.tokenHolder) || typeof value.tokenHolder.runId !== "string" || value.tokenHolder.runId.length === 0 || typeof value.tokenHolder.hookId !== "string" || value.tokenHolder.hookId.length === 0) throw new TypeError("applyEvent tokenHolder must contain non-empty runId and hookId strings");
 		tokenHolder = {
 			runId: value.tokenHolder.runId,
 			hookId: value.tokenHolder.hookId
@@ -246,7 +421,7 @@ async function listByCreationTime(store, indexPrefix, entityPrefix, params) {
 	});
 	const page = Array.from(entries.entries()).slice(0, limit);
 	const entityKeys = page.map(([, id]) => `${entityPrefix}${id}`);
-	const entities = await getMany$1(store, entityKeys);
+	const entities = await getMany(store, entityKeys);
 	const data = entityKeys.flatMap((key) => {
 		const item = entities.get(key);
 		return item === void 0 ? [] : [item];
@@ -273,14 +448,14 @@ async function releaseAllHooks(store) {
 			token: hook.token
 		});
 	}
-	await deleteMany$1(store, keys);
+	await deleteMany(store, keys);
 	return released;
 }
 /** Delete all persisted waits once their owning run becomes terminal. */
 async function releaseAllWaits(store) {
 	if (store.deferTerminalCleanup) return;
 	const waits = await store.list({ prefix: WAIT_KEY_PREFIX });
-	await deleteMany$1(store, Array.from(waits.keys()));
+	await deleteMany(store, Array.from(waits.keys()));
 }
 async function applyEvent(store, ctx) {
 	const { runId, data, now } = ctx;
@@ -1308,91 +1483,6 @@ function normalizeStreamError(error) {
 	return normalized;
 }
 //#endregion
-//#region src/worker/auth.ts
-/**
-* Bearer-token auth for the worker router.
-*
-* Fails closed: when the WORLD_SECRET var is not configured, every protected
-* route returns 503 instead of forwarding unauthenticated traffic (the
-* eve-ambient celld-worker pattern).
-*/
-/**
-* Constant-time string comparison via SHA-256 digests (digest-then-compare
-* is length-independent). crypto.subtle is global in both workerd and Node.
-*/
-async function timingSafeEqual(a, b) {
-	const enc = new TextEncoder();
-	const [da, db] = await Promise.all([crypto.subtle.digest("SHA-256", enc.encode(a)), crypto.subtle.digest("SHA-256", enc.encode(b))]);
-	const va = new Uint8Array(da);
-	const vb = new Uint8Array(db);
-	let diff = 0;
-	for (let i = 0; i < va.length; i++) diff |= va[i] ^ vb[i];
-	return diff === 0;
-}
-async function authenticate(request, secret) {
-	if (!secret) return {
-		ok: false,
-		response: Response.json({ error: {
-			name: "WorldNotConfigured",
-			message: "WORLD_SECRET is not configured"
-		} }, { status: 503 })
-	};
-	const header = request.headers.get("authorization") ?? "";
-	const token = header.startsWith("Bearer ") ? header.slice(7) : "";
-	if (!token || !await timingSafeEqual(token, secret)) return {
-		ok: false,
-		response: Response.json({ error: {
-			name: "Unauthorized",
-			message: "invalid or missing bearer token"
-		} }, { status: 401 })
-	};
-	return { ok: true };
-}
-const MAX_QUEUE_DELAY_SECONDS = Math.floor(9999999999999 / 1e3);
-function isRecord(value) {
-	return value !== null && typeof value === "object" && !Array.isArray(value);
-}
-function isNonNegativeSafeInteger(value) {
-	return Number.isSafeInteger(value) && value >= 0;
-}
-function isPositiveSafeInteger(value) {
-	return Number.isSafeInteger(value) && value > 0;
-}
-function boundedIntegerOption(name, value, fallback, minimum, maximum = Number.MAX_SAFE_INTEGER) {
-	if (value === void 0) return fallback;
-	if (!Number.isSafeInteger(value) || value < minimum || value > maximum) throw new Error(`${name} must be an integer between ${minimum} and ${maximum}`);
-	return value;
-}
-/**
-* Parse a deployment/runtime integer setting without accepting whitespace,
-* exponents, fractions, or numeric prefixes such as `5junk`.
-*/
-function strictIntegerSetting(name, raw, fallback, minimum, maximum = Number.MAX_SAFE_INTEGER) {
-	if (raw === void 0) return fallback;
-	const value = typeof raw === "number" ? raw : /^\d+$/.test(raw) ? Number(raw) : NaN;
-	if (!Number.isSafeInteger(value) || value < minimum || value > maximum) throw new Error(`${name} must be an integer between ${minimum} and ${maximum}`);
-	return value;
-}
-function isValidQueueDelaySeconds(value, minimum = 0) {
-	return Number.isSafeInteger(value) && value >= minimum && value <= MAX_QUEUE_DELAY_SECONDS;
-}
-function queueDelayDeadline(now, delaySeconds, minimum = 0, requiredHeadroomMs = 0) {
-	if (!isNonNegativeSafeInteger(now) || !isValidQueueDelaySeconds(delaySeconds, minimum)) return null;
-	return checkedQueueTimestampAdd(now, delaySeconds * 1e3, requiredHeadroomMs);
-}
-/**
-* Add an offset to a queue timestamp while preserving its 13-digit key order.
-* Optional headroom reserves space for a later persisted derivative deadline.
-*/
-function checkedQueueTimestampAdd(timestampMs, offsetMs, requiredHeadroomMs = 0) {
-	if (!isNonNegativeSafeInteger(timestampMs) || !isNonNegativeSafeInteger(offsetMs) || !isNonNegativeSafeInteger(requiredHeadroomMs)) return null;
-	const timestamp = timestampMs;
-	const offset = offsetMs;
-	if (timestamp > 9999999999999 || offset > 9999999999999 - timestamp) return null;
-	const result = timestamp + offset;
-	return requiredHeadroomMs <= 9999999999999 - result ? result : null;
-}
-//#endregion
 //#region src/worker/index-validation.ts
 function invalid(message) {
 	const error = /* @__PURE__ */ new Error(`invalid index RPC arguments: ${message}`);
@@ -1420,14 +1510,14 @@ function positiveSafeInteger(value, name) {
 	return parsed;
 }
 function owner(value, name = "owner") {
-	if (!isRecord(value)) invalid(`${name} must be an object`);
+	if (!isRecord$1(value)) invalid(`${name} must be an object`);
 	return {
 		runId: nonEmptyString(value.runId, `${name}.runId`),
 		hookId: nonEmptyString(value.hookId, `${name}.hookId`)
 	};
 }
 function reservation(value) {
-	if (!isRecord(value)) invalid("reservation must be an object");
+	if (!isRecord$1(value)) invalid("reservation must be an object");
 	const parsed = { claimId: nonEmptyString(value.claimId, "reservation.claimId") };
 	if (value.tokenClaimId !== void 0) parsed.tokenClaimId = nonEmptyString(value.tokenClaimId, "reservation.tokenClaimId");
 	if (value.hookIdClaimId !== void 0) parsed.hookIdClaimId = nonEmptyString(value.hookIdClaimId, "reservation.hookIdClaimId");
@@ -1436,7 +1526,7 @@ function reservation(value) {
 function hooks(value) {
 	if (!Array.isArray(value)) invalid("hooks must be an array");
 	return value.map((entry, index) => {
-		if (!isRecord(entry)) invalid(`hooks[${index}] must be an object`);
+		if (!isRecord$1(entry)) invalid(`hooks[${index}] must be an object`);
 		return {
 			hookId: nonEmptyString(entry.hookId, `hooks[${index}].hookId`),
 			token: nonEmptyString(entry.token, `hooks[${index}].token`)
@@ -1448,14 +1538,14 @@ function exactProperties(value, allowed, name) {
 	if (unexpected !== void 0) invalid(`${name}.${unexpected} is not allowed`);
 }
 function releaseRequest(value) {
-	if (!isRecord(value)) invalid("release request must be an object");
+	if (!isRecord$1(value)) invalid("release request must be an object");
 	return {
 		runId: nonEmptyString(value.runId, "request.runId"),
 		hooks: hooks(value.hooks)
 	};
 }
 function expireRequest(value) {
-	if (!isRecord(value)) invalid("expiry request must be an object");
+	if (!isRecord$1(value)) invalid("expiry request must be an object");
 	exactProperties(value, [
 		"runId",
 		"hooks",
@@ -1469,7 +1559,7 @@ function expireRequest(value) {
 }
 function listOptions(value) {
 	if (value === void 0 || value === null) return void 0;
-	if (!isRecord(value)) invalid("list options must be an object");
+	if (!isRecord$1(value)) invalid("list options must be an object");
 	const parsed = {};
 	for (const name of [
 		"prefix",
@@ -1502,7 +1592,7 @@ function runCommit(args) {
 	} catch {
 		invalid("serializedMetadata must be valid JSON");
 	}
-	if (!isRecord(metadata) || metadata.runId !== run.runId || metadata.status !== run.status || metadata.createdAt !== run.createdAt.toISOString()) invalid("serializedMetadata must match the committed run");
+	if (!isRecord$1(metadata) || metadata.runId !== run.runId || metadata.status !== run.status || metadata.createdAt !== run.createdAt.toISOString()) invalid("serializedMetadata must match the committed run");
 	return {
 		operation: "runs.commit",
 		args: [
@@ -1651,24 +1741,12 @@ const BINDINGS = {
 	"hook-ids": {
 		env: "WORKFLOW_HOOK_IDS",
 		methods: /* @__PURE__ */ new Set(["get"])
-	},
-	queue: {
-		env: "WORKFLOW_QUEUE",
-		methods: /* @__PURE__ */ new Set([
-			"enqueue",
-			"stats",
-			"listDeadLetters",
-			"redriveDeadLetter",
-			"purgeDeadLetters",
-			"rearmAlarm",
-			"expireRun",
-			"acknowledgeExpireRun"
-		])
 	}
 };
 /** Request body cap: oversize payloads get a clear 413 instead of an OOM. */
 const MAX_BODY_BYTES = 33554432;
 const MAX_STREAM_WRITE_BODY_BYTES = 8389632;
+const QUEUE_ORPHAN_GRACE_MS = 432e6;
 function errorResponse(status, name, message) {
 	return Response.json({ error: {
 		name,
@@ -1752,6 +1830,25 @@ async function readBoundedBytes(request, maxBytes) {
 	}
 	return body;
 }
+async function parseRpcArguments(request) {
+	if (request.method !== "POST") return errorResponse(405, "MethodNotAllowed", "expected POST");
+	if (!hasContentType(request, "application/json")) return errorResponse(415, "UnsupportedMediaType", "expected application/json");
+	let contentLength;
+	try {
+		contentLength = declaredContentLength(request);
+	} catch (error) {
+		return errorResponse(400, "BadRequest", error.message);
+	}
+	if (contentLength !== null && contentLength > MAX_BODY_BYTES) return errorResponse(413, "PayloadTooLarge", `body exceeds ${MAX_BODY_BYTES} bytes`);
+	try {
+		const text = await readBoundedBody(request);
+		if (text === null) return errorResponse(413, "PayloadTooLarge", `body exceeds ${MAX_BODY_BYTES} bytes`);
+		const parsed = rpcParse(text);
+		return Array.isArray(parsed) ? parsed : errorResponse(400, "BadRequest", "body must be an argument array");
+	} catch {
+		return errorResponse(400, "BadRequest", "malformed rpc body");
+	}
+}
 function parseBoundedInteger(url, name, minimum, maximum) {
 	const raw = url.searchParams.get(name);
 	const value = raw !== null && /^\d+$/.test(raw) ? Number(raw) : NaN;
@@ -1784,6 +1881,111 @@ function createRouter(env) {
 		}
 		const auth = await authenticate(request, env.WORLD_SECRET);
 		if (!auth.ok) return auth.response;
+		if (parts[1] === "queue" && parts.length === 3) {
+			const parsed = await parseRpcArguments(request);
+			if (parsed instanceof Response) return parsed;
+			if (parts[2] === "send") {
+				if (parsed.length < 1 || parsed.length > 2) return errorResponse(400, "BadRequest", "queue send expects an envelope and options");
+				if (!env.WORKFLOW_QUEUE) return errorResponse(500, "WorldMisconfigured", "missing binding: WORKFLOW_QUEUE");
+				let envelope;
+				let options;
+				try {
+					envelope = validateNativeQueueEnvelope(parsed[0]);
+					options = validateNativeQueueSendOptions(parsed[1]);
+					if (envelope.body === void 0 || envelope.payloadKey !== void 0) throw new TypeError("queue send requires an inline body");
+				} catch (error) {
+					return errorResponse(400, "BadRequest", error.message);
+				}
+				try {
+					const namespace = env.WORKFLOW_DB;
+					const payloadStore = env.WORKFLOW_QUEUE_PAYLOADS;
+					const payloadKey = envelope.runId ? queuePayloadObjectKey(envelope.runId, envelope.messageId) : void 0;
+					const brokerEnvelope = payloadKey ? {
+						...envelope,
+						payloadKey,
+						body: void 0
+					} : envelope;
+					const encoded = JSON.stringify(brokerEnvelope);
+					if (new TextEncoder().encode(encoded).byteLength > 128e3) return errorResponse(413, "PayloadTooLarge", `native queue envelope exceeds ${NATIVE_QUEUE_MAX_MESSAGE_BYTES} bytes`);
+					const now = Date.now();
+					const reservationExpiresAt = Math.max(now, envelope.notBefore ?? now) + QUEUE_ORPHAN_GRACE_MS;
+					let claim;
+					if (envelope.idempotencyKey) {
+						claim = namespace.get(namespace.idFromName(queueClaimName(envelope.queueName, envelope.idempotencyKey)));
+						const reservation = await claim.reserveQueueMessage({
+							messageId: envelope.messageId,
+							expiresAt: reservationExpiresAt
+						});
+						if (!reservation.admitted) return new Response(rpcStringify({ messageId: reservation.messageId }), {
+							status: 200,
+							headers: { "content-type": "application/json" }
+						});
+					}
+					if (envelope.runId && payloadKey) {
+						if (!payloadStore) return errorResponse(500, "WorldMisconfigured", "missing binding: WORKFLOW_QUEUE_PAYLOADS");
+						const run = namespace.get(namespace.idFromName(envelope.runId));
+						const orphanExpiresAt = reservationExpiresAt;
+						const registered = await run.registerQueuePayload({
+							messageId: envelope.messageId,
+							key: payloadKey,
+							orphanExpiresAt
+						});
+						if (!registered.ok) {
+							await claim?.completeQueueMessage(envelope.messageId);
+							return errorResponse(410, "RunExpiredError", registered.message);
+						}
+						const orphan = namespace.get(namespace.idFromName(queueOrphanName(envelope.messageId)));
+						try {
+							await orphan.scheduleQueuePayloadOrphan({
+								messageId: envelope.messageId,
+								runId: envelope.runId,
+								key: payloadKey,
+								expiresAt: orphanExpiresAt
+							});
+						} catch (error) {
+							await run.unregisterQueuePayload(envelope.messageId);
+							await claim?.completeQueueMessage(envelope.messageId);
+							throw error;
+						}
+						try {
+							await payloadStore.write(payloadKey, envelope.body, {
+								runId: envelope.runId,
+								messageId: envelope.messageId
+							});
+						} catch (error) {
+							await claim?.completeQueueMessage(envelope.messageId);
+							throw error;
+						}
+						let finalized;
+						try {
+							finalized = await run.finalizeQueuePayload(envelope.messageId);
+						} catch (error) {
+							await claim?.completeQueueMessage(envelope.messageId);
+							throw error;
+						}
+						if (!finalized.ok) {
+							await payloadStore.delete(payloadKey);
+							await run.unregisterQueuePayload(envelope.messageId);
+							await orphan.cancelQueuePayloadOrphan(envelope.messageId);
+							await claim?.completeQueueMessage(envelope.messageId);
+							return errorResponse(410, "RunExpiredError", finalized.message);
+						}
+					}
+					await env.WORKFLOW_QUEUE.send(encoded, {
+						contentType: "text",
+						...options
+					});
+					return new Response(rpcStringify({ messageId: envelope.messageId }), {
+						status: 200,
+						headers: { "content-type": "application/json" }
+					});
+				} catch (error) {
+					const err = error;
+					return errorResponse(500, err.name ?? "Error", err.message ?? String(error));
+				}
+			}
+			return errorResponse(404, "NotFound", `unknown queue operation: ${parts[2]}`);
+		}
 		if (parts[1] === "index" && parts.length === 4) {
 			if (request.method !== "POST") return errorResponse(405, "MethodNotAllowed", "expected POST");
 			if (!hasContentType(request, "application/json")) return errorResponse(415, "UnsupportedMediaType", "expected application/json");
@@ -2010,7 +2212,7 @@ function catalogCandidate(name, value) {
 		const parsed = JSON.parse(value);
 		return {
 			runId,
-			invalid: !isRecord(parsed) || parsed.runId !== runId
+			invalid: !isRecord$1(parsed) || parsed.runId !== runId
 		};
 	} catch {
 		return {
@@ -2038,7 +2240,6 @@ async function runRetentionSweep(scheduledTime, env) {
 		preserved: 0
 	};
 	const batchSize = strictIntegerSetting("world-celld: WORKFLOW_RETENTION_BATCH_SIZE", env.WORKFLOW_RETENTION_BATCH_SIZE, 128, 1, MAX_RETENTION_SWEEP_BATCH_SIZE);
-	const queueShards = strictIntegerSetting("world-celld: WORKFLOW_RETENTION_QUEUE_SHARDS", env.WORKFLOW_RETENTION_QUEUE_SHARDS, 1, 1);
 	const cutoff = scheduledTime - retentionMs;
 	const runNamespace = requireNamespace("WORKFLOW_DB", env.WORKFLOW_DB);
 	const catalogNamespace = requireNamespace("WORKFLOW_RUN_CATALOG", env.WORKFLOW_RUN_CATALOG);
@@ -2075,7 +2276,6 @@ async function runRetentionSweep(scheduledTime, env) {
 			};
 			const outcome = await runNamespace.get(runNamespace.idFromName(runId)).enforceRetention({
 				retentionMs,
-				queueShards,
 				scheduledTime
 			});
 			if (outcome.state === "missing" || outcome.state === "not-due") {
@@ -2100,6 +2300,24 @@ async function runRetentionSweep(scheduledTime, env) {
 	return result;
 }
 //#endregion
+//#region src/worker/queue-payload-store.ts
+function createQueuePayloadStore(binding) {
+	return {
+		async write(key, value, metadata) {
+			await binding.put(key, value, { customMetadata: metadata });
+		},
+		async read(key) {
+			return (await binding.get(key))?.text() ?? null;
+		},
+		async delete(keys) {
+			await binding.delete(keys);
+		}
+	};
+}
+async function deleteQueuePayloadObjects(binding, keys) {
+	await binding.delete(keys);
+}
+//#endregion
 //#region src/worker/durable-objects/hook-index-shared.ts
 function sameOwner(left, right) {
 	return left.runId === right.runId && left.hookId === right.hookId;
@@ -2120,32 +2338,10 @@ async function runIsActive(env, runId) {
 	return await namespace.get(namespace.idFromName(runId)).getLifecycleStatus() === "active";
 }
 //#endregion
-//#region src/lifecycle.ts
-/**
-* Hard protocol bounds used by lifecycle leases and derivative-fence cleanup.
-*
-* These are not retention TTLs. They bound how long a request which was
-* admitted before expiry may still mutate a derivative Durable Object:
-*
-* - fleet calls have at most three 5-minute attempts plus bounded retry delay;
-* - one queue delivery owns its lease for at most 5 minutes plus 30 seconds;
-* - hook admission spans reserve retries, one authoritative apply, and
-*   finalize retries before the exact claim must be reacquired.
-*/
-const MAX_FLEET_RPC_TIMEOUT_MS = 3e5;
-const MAX_RUN_INDEX_PUBLICATION_LIFETIME_MS = 1200900;
-const MAX_QUEUE_DELIVERY_TIMEOUT_MS = 3e5;
-const QUEUE_INFLIGHT_GRACE_MS = 3e4;
-const MAX_QUEUE_INFLIGHT_LEASE_MS = 33e4;
-const MAX_QUEUE_DERIVED_DEADLINE_HEADROOM_MS = 330001;
-const QUEUE_FENCE_GRACE_MS = Math.max(MAX_FLEET_RPC_TIMEOUT_MS, MAX_QUEUE_INFLIGHT_LEASE_MS);
-const HOOK_CLAIM_LEASE_MS = 2101800;
-const LIFECYCLE_COMPACTION_RETRY_MS = 1e3;
-//#endregion
 //#region src/worker/durable-objects/HookIdDO.ts
 const MAX_RELEASE_BATCH$1 = 64;
 const CLAIM_DEADLINE_PREFIX$1 = "claim-deadline:";
-function pad$3(ms) {
+function pad$2(ms) {
 	return String(Math.max(0, Math.floor(ms))).padStart(13, "0");
 }
 function recordKey$1(hookId) {
@@ -2155,7 +2351,7 @@ function claimKey$1(hookId) {
 	return indexKey("claim", hookId);
 }
 function claimDeadlineKey$1(hookId, expiresAt) {
-	return `${CLAIM_DEADLINE_PREFIX$1}${pad$3(expiresAt)}:${encodeURIComponent(hookId)}`;
+	return `${CLAIM_DEADLINE_PREFIX$1}${pad$2(expiresAt)}:${encodeURIComponent(hookId)}`;
 }
 /** Hook-ID ownership and lookup shard; every hook ID has one transaction domain. */
 var HookIdDO = class extends DurableObject {
@@ -2289,7 +2485,7 @@ var HookIdDO = class extends DurableObject {
 		await this.ctx.storage.transaction(async (txn) => {
 			const due = await txn.list({
 				prefix: CLAIM_DEADLINE_PREFIX$1,
-				end: `${CLAIM_DEADLINE_PREFIX$1}${pad$3(now + 1)}`,
+				end: `${CLAIM_DEADLINE_PREFIX$1}${pad$2(now + 1)}`,
 				limit: 129
 			});
 			const page = Array.from(due).slice(0, 128);
@@ -2317,7 +2513,7 @@ var HookIdDO = class extends DurableObject {
 //#region src/worker/durable-objects/HookTokenDO.ts
 const MAX_RELEASE_BATCH = 64;
 const CLAIM_DEADLINE_PREFIX = "claim-deadline:";
-function pad$2(ms) {
+function pad$1(ms) {
 	return String(Math.max(0, Math.floor(ms))).padStart(13, "0");
 }
 function recordKey(token) {
@@ -2327,7 +2523,7 @@ function claimKey(token) {
 	return indexKey("claim", token);
 }
 function claimDeadlineKey(token, expiresAt) {
-	return `${CLAIM_DEADLINE_PREFIX}${pad$2(expiresAt)}:${encodeURIComponent(token)}`;
+	return `${CLAIM_DEADLINE_PREFIX}${pad$1(expiresAt)}:${encodeURIComponent(token)}`;
 }
 /** Token-ownership shard. A token hashes to exactly one shard and transaction domain. */
 var HookTokenDO = class extends DurableObject {
@@ -2460,7 +2656,7 @@ var HookTokenDO = class extends DurableObject {
 		await this.ctx.storage.transaction(async (txn) => {
 			const due = await txn.list({
 				prefix: CLAIM_DEADLINE_PREFIX,
-				end: `${CLAIM_DEADLINE_PREFIX}${pad$2(now + 1)}`,
+				end: `${CLAIM_DEADLINE_PREFIX}${pad$1(now + 1)}`,
 				limit: 129
 			});
 			const page = Array.from(due).slice(0, 128);
@@ -2485,705 +2681,6 @@ var HookTokenDO = class extends DurableObject {
 	}
 };
 //#endregion
-//#region src/worker/durable-objects/QueueDO.ts
-const PERMANENT_STATUSES = /* @__PURE__ */ new Set([
-	404,
-	409,
-	410,
-	422
-]);
-const DEFAULT_MAX_ATTEMPTS = 5;
-const DEFAULT_MAX_INFLIGHT = 5;
-const DEFAULT_DELIVERY_TIMEOUT_MS = 3e5;
-/** Move overdue alarms to a new timestamp so celld observes a fresh edge. */
-const MIN_ALARM_DELAY_MS = 1;
-/** Bound expiry recovery so one alarm cannot monopolize the cell. */
-const EXPIRED_INFLIGHT_BATCH = 128;
-const STORAGE_BATCH_SIZE$1 = 128;
-const EXPIRE_RUN_REFERENCE_BATCH = 64;
-const PURGE_DEAD_LETTER_BATCH = 128;
-const MAX_DEAD_LETTER_LIST_SIZE = 1e3;
-const INFLIGHT_DEADLINE_PREFIX = "inflight-deadline:";
-const EXPIRED_RUN_GC_PREFIX = "expired-run-gc:";
-function pad$1(ms) {
-	if (!isNonNegativeSafeInteger(ms) || ms > 9999999999999) throw new Error("queue timestamp must be a non-negative 13-digit integer");
-	return String(ms).padStart(13, "0");
-}
-function dueKey(atMs, messageId) {
-	return `due:${pad$1(atMs)}:${messageId}`;
-}
-function inflightKey(deadlineMs, messageId) {
-	return `${INFLIGHT_DEADLINE_PREFIX}${pad$1(deadlineMs)}:${messageId}`;
-}
-function deadlineFromInflightKey(key) {
-	return Number.parseInt(key.slice(18, 31), 10);
-}
-function inclusiveTimestampEnd(prefix, now) {
-	return now >= 9999999999999 ? `${prefix.slice(0, -1)};` : `${prefix}${pad$1(now + 1)}`;
-}
-function runReferenceKey(runId, messageId) {
-	return `run:${runId}:${messageId}`;
-}
-function expiredRunKey(runId) {
-	return `expired-run:${runId}`;
-}
-function expiredRunGcKey(runId, compactAt) {
-	return `${EXPIRED_RUN_GC_PREFIX}${pad$1(compactAt)}:${encodeURIComponent(runId)}`;
-}
-function validateEnqueueRequest(request) {
-	if (!isRecord(request)) throw new Error("world-celld queue enqueue request must be an object");
-	for (const field of [
-		"messageId",
-		"queueName",
-		"body"
-	]) if (typeof request[field] !== "string" || request[field].length === 0) throw new Error(`world-celld queue enqueue ${field} must be a non-empty string`);
-	if (request.pathname !== "flow") throw new Error("world-celld queue enqueue pathname must be flow");
-	if (!isRecord(request.config) || typeof request.config.targetBaseUrl !== "string" || request.config.targetBaseUrl.length === 0) throw new Error("world-celld queue enqueue config is invalid");
-	if (!isPositiveSafeInteger(request.config.queueShards)) throw new Error("world-celld queue enqueue queueShards must be a positive safe integer");
-	if (request.delaySeconds !== void 0 && !isValidQueueDelaySeconds(request.delaySeconds)) throw new Error("world-celld queue enqueue delaySeconds is out of range");
-	if (request.runId !== void 0 && (typeof request.runId !== "string" || request.runId.length === 0)) throw new Error("world-celld queue enqueue runId must be a non-empty string");
-	if (request.idempotencyKey !== void 0 && (typeof request.idempotencyKey !== "string" || request.idempotencyKey.length === 0)) throw new Error("world-celld queue enqueue idempotencyKey must be a non-empty string");
-	let body;
-	try {
-		body = parse(request.body);
-	} catch {
-		throw new WorkflowWorldError("world-celld queue enqueue body must be valid tagged JSON", { status: 422 });
-	}
-	const payload = QueuePayloadSchema.safeParse(body);
-	if (!payload.success) throw new WorkflowWorldError("world-celld queue enqueue body is an invalid queue payload", { status: 422 });
-	const payloadRunId = "runId" in payload.data && typeof payload.data.runId === "string" ? payload.data.runId : void 0;
-	if (request.runId !== payloadRunId) throw new WorkflowWorldError("world-celld queue enqueue runId does not match body", { status: 422 });
-}
-async function getMany(storage, keys) {
-	const result = /* @__PURE__ */ new Map();
-	for (let offset = 0; offset < keys.length; offset += STORAGE_BATCH_SIZE$1) {
-		const page = await storage.get(keys.slice(offset, offset + STORAGE_BATCH_SIZE$1));
-		for (const [key, value] of page) result.set(key, value);
-	}
-	return result;
-}
-async function putMany(storage, entries) {
-	const all = Array.from(entries);
-	for (let offset = 0; offset < all.length; offset += STORAGE_BATCH_SIZE$1) await storage.put(Object.fromEntries(all.slice(offset, offset + STORAGE_BATCH_SIZE$1)));
-}
-async function deleteMany(storage, keys) {
-	let deleted = 0;
-	const unique = Array.from(new Set(keys));
-	for (let offset = 0; offset < unique.length; offset += STORAGE_BATCH_SIZE$1) deleted += await storage.delete(unique.slice(offset, offset + STORAGE_BATCH_SIZE$1));
-	return deleted;
-}
-function backoffSeconds(attempt) {
-	return Math.min(60, 2 ** attempt);
-}
-async function cancelUnusedResponseBody(response) {
-	try {
-		await response.body?.cancel();
-	} catch {}
-}
-const MAX_QUEUE_INFLIGHT = 128;
-var QueueDO = class extends DurableObject {
-	#now() {
-		const clock = this.env?.clock;
-		return typeof clock === "function" ? clock() : Date.now();
-	}
-	#fetch() {
-		const impl = this.env?.fetch;
-		return typeof impl === "function" ? impl : fetch;
-	}
-	#intVar(name, fallback) {
-		const raw = this.env?.[name];
-		return strictIntegerSetting(name, raw, fallback, 1);
-	}
-	#maxAttempts() {
-		return this.#intVar("QUEUE_MAX_ATTEMPTS", DEFAULT_MAX_ATTEMPTS);
-	}
-	#maxInflight() {
-		const configured = this.#intVar("QUEUE_MAX_INFLIGHT", DEFAULT_MAX_INFLIGHT);
-		if (configured > MAX_QUEUE_INFLIGHT) throw new Error(`QUEUE_MAX_INFLIGHT must be at most ${MAX_QUEUE_INFLIGHT}`);
-		return configured;
-	}
-	#deliveryTimeoutMs() {
-		const configured = this.#intVar("QUEUE_DELIVERY_TIMEOUT_MS", DEFAULT_DELIVERY_TIMEOUT_MS);
-		if (configured > 3e5) throw new Error(`QUEUE_DELIVERY_TIMEOUT_MS must be at most ${MAX_QUEUE_DELIVERY_TIMEOUT_MS}`);
-		return configured;
-	}
-	#validateRuntimeConfig() {
-		this.#maxAttempts();
-		this.#maxInflight();
-		this.#deliveryTimeoutMs();
-	}
-	async #authoritativeRunExpired(runId) {
-		const namespace = this.env?.WORKFLOW_DB;
-		if (!namespace) throw new Error("world-celld queue missing WORKFLOW_DB binding");
-		return await namespace.get(namespace.idFromName(runId)).getLifecycleStatus() === "expired";
-	}
-	async #withRunMutation(runId, onExpired, onAllowed) {
-		const expired = await this.#authoritativeRunExpired(runId);
-		return await this.ctx.storage.transaction(async (txn) => {
-			if (await txn.get(expiredRunKey(runId)) || expired) return await onExpired(txn);
-			return await onAllowed(txn);
-		});
-	}
-	async enqueue(request) {
-		this.#validateRuntimeConfig();
-		validateEnqueueRequest(request);
-		const storage = this.ctx.storage;
-		const now = this.#now();
-		const dueAt = queueDelayDeadline(now, request.delaySeconds ?? 0, 0, MAX_QUEUE_DERIVED_DEADLINE_HEADROOM_MS);
-		if (dueAt === null) throw new Error("world-celld queue enqueue delaySeconds lacks required delivery headroom");
-		const persist = async (txn) => {
-			const pinned = await txn.get("cfg");
-			if (!pinned) await txn.put("cfg", {
-				queueShards: request.config.queueShards,
-				pinnedAt: now
-			});
-			else if (pinned.queueShards !== request.config.queueShards) return {
-				ok: false,
-				code: "CONFIG_MISMATCH",
-				message: `queue cell shard-count mismatch: pinned ${pinned.queueShards}, got ${request.config.queueShards} — changing queueShards requires draining the fleet`
-			};
-			if (request.idempotencyKey) {
-				const existing = await txn.get(`key:${request.idempotencyKey}`);
-				if (existing) {
-					if (await txn.get(`msg:${existing}`)) {
-						await this.#scheduleNextAlarm(txn, now);
-						return {
-							ok: true,
-							messageId: existing,
-							deduped: true
-						};
-					}
-					await txn.delete(`key:${request.idempotencyKey}`);
-				}
-				await txn.put(`key:${request.idempotencyKey}`, request.messageId);
-			}
-			const row = {
-				messageId: request.messageId,
-				queueName: request.queueName,
-				pathname: request.pathname,
-				body: request.body,
-				runId: request.runId,
-				targetBaseUrl: request.config.targetBaseUrl,
-				idempotencyKey: request.idempotencyKey,
-				attempt: 0,
-				enqueuedAt: now
-			};
-			const scheduleKey = dueKey(dueAt, row.messageId);
-			await txn.put(`msg:${row.messageId}`, row);
-			await txn.put(scheduleKey, row.messageId);
-			if (row.runId) await txn.put(runReferenceKey(row.runId, row.messageId), {
-				messageId: row.messageId,
-				dueKey: scheduleKey,
-				idempotencyKey: row.idempotencyKey
-			});
-			await this.#armAlarmAtMost(txn, dueAt, now);
-			return {
-				ok: true,
-				messageId: row.messageId,
-				deduped: false
-			};
-		};
-		return request.runId ? await this.#withRunMutation(request.runId, async () => ({
-			ok: false,
-			code: "RUN_EXPIRED",
-			message: `Workflow run "${request.runId}" has expired`
-		}), persist) : await storage.transaction(persist);
-	}
-	async alarm() {
-		this.#validateRuntimeConfig();
-		let claimed = [];
-		let failure = null;
-		const attempt = async () => {
-			try {
-				claimed = await this.#claimPhase();
-			} catch (error) {
-				failure = error;
-			}
-		};
-		if (typeof this.ctx.blockConcurrencyWhile === "function") await this.ctx.blockConcurrencyWhile(attempt);
-		else await attempt();
-		if (failure !== null) {
-			const retryAt = checkedQueueTimestampAdd(this.#now(), LIFECYCLE_COMPACTION_RETRY_MS);
-			if (retryAt === null) await this.ctx.storage.deleteAlarm();
-			else await this.ctx.storage.setAlarm(retryAt);
-			throw failure;
-		}
-		for (const claim of claimed) this.ctx.waitUntil(this.#deliver(claim));
-	}
-	/**
-	* Storage-only: recover lost inflight claims, claim due messages up to the
-	* inflight cap, and re-arm the alarm. Never throws for data conditions.
-	*/
-	async #claimPhase() {
-		const storage = this.ctx.storage;
-		const now = this.#now();
-		const maxInflight = this.#maxInflight();
-		return await storage.transaction(async (txn) => {
-			if (await this.#compactExpiredRunFences(txn, now)) {
-				const nextAt = checkedQueueTimestampAdd(now, MIN_ALARM_DELAY_MS);
-				if (nextAt === null) await txn.deleteAlarm();
-				else await txn.setAlarm(nextAt);
-				return [];
-			}
-			const expiredPage = await txn.list({
-				prefix: INFLIGHT_DEADLINE_PREFIX,
-				end: inclusiveTimestampEnd(INFLIGHT_DEADLINE_PREFIX, now),
-				limit: 129
-			});
-			const expired = Array.from(expiredPage.entries()).slice(0, EXPIRED_INFLIGHT_BATCH);
-			const expiredRows = await getMany(txn, expired.map(([, messageId]) => `msg:${messageId}`));
-			await deleteMany(txn, expired.map(([key]) => key));
-			const recoveryWrites = [];
-			for (const [, messageId] of expired) {
-				const row = expiredRows.get(`msg:${messageId}`);
-				if (row) {
-					const recoveryAt = checkedQueueTimestampAdd(now, 0, MAX_QUEUE_DERIVED_DEADLINE_HEADROOM_MS);
-					if (recoveryAt === null) {
-						await this.#deadLetter(txn, row, row.attempt, "inflight recovery exceeded the queue timestamp horizon", now);
-						continue;
-					}
-					const scheduleKey = dueKey(recoveryAt, messageId);
-					recoveryWrites.push([scheduleKey, messageId]);
-					if (row.runId) recoveryWrites.push([runReferenceKey(row.runId, row.messageId), {
-						messageId: row.messageId,
-						dueKey: scheduleKey,
-						idempotencyKey: row.idempotencyKey
-					}]);
-				}
-			}
-			await putMany(txn, recoveryWrites);
-			if (expiredPage.size > EXPIRED_INFLIGHT_BATCH) {
-				const nextAt = checkedQueueTimestampAdd(now, MIN_ALARM_DELAY_MS);
-				if (nextAt === null) await txn.deleteAlarm();
-				else await txn.setAlarm(nextAt);
-				return [];
-			}
-			const inflightCount = (await txn.list({
-				prefix: INFLIGHT_DEADLINE_PREFIX,
-				limit: maxInflight
-			})).size;
-			const rows = [];
-			if (inflightCount < maxInflight) {
-				const due = await txn.list({
-					prefix: "due:",
-					end: inclusiveTimestampEnd("due:", now),
-					limit: maxInflight - inflightCount
-				});
-				const timeoutMs = this.#deliveryTimeoutMs();
-				const dueRows = await getMany(txn, Array.from(due.values(), (messageId) => `msg:${messageId}`));
-				await deleteMany(txn, Array.from(due.keys()));
-				const claimWrites = [];
-				for (const [, messageId] of due) {
-					const row = dueRows.get(`msg:${messageId}`);
-					if (!row) continue;
-					const claimDeadline = checkedQueueTimestampAdd(now, timeoutMs + QUEUE_INFLIGHT_GRACE_MS);
-					if (claimDeadline === null) {
-						await this.#deadLetter(txn, row, row.attempt, "delivery lease exceeded the queue timestamp horizon", now);
-						continue;
-					}
-					const claimKey = inflightKey(claimDeadline, messageId);
-					claimWrites.push([claimKey, messageId]);
-					if (row.runId) claimWrites.push([runReferenceKey(row.runId, row.messageId), {
-						messageId: row.messageId,
-						inflightKey: claimKey,
-						idempotencyKey: row.idempotencyKey
-					}]);
-					rows.push({
-						row,
-						inflightKey: claimKey
-					});
-				}
-				await putMany(txn, claimWrites);
-			}
-			await this.#scheduleNextAlarm(txn, now);
-			return rows;
-		});
-	}
-	async #deliver({ row, inflightKey: claimKey }) {
-		const storage = this.ctx.storage;
-		const timeoutMs = this.#deliveryTimeoutMs();
-		const callbackSecret = this.env?.WORKFLOW_CALLBACK_SECRET;
-		const url = `${row.targetBaseUrl.replace(/\/$/, "")}/.well-known/workflow/v1/${row.pathname}`;
-		if (row.runId && await this.#authoritativeRunExpired(row.runId)) {
-			await storage.transaction((txn) => this.#dropExpiredMessage(txn, row, claimKey, this.#now()));
-			return;
-		}
-		let response = null;
-		let transportError = null;
-		try {
-			response = await this.#fetch()(url, {
-				method: "POST",
-				headers: {
-					"content-type": "application/json",
-					"x-vqs-queue-name": row.queueName,
-					"x-vqs-message-id": row.messageId,
-					"x-vqs-message-attempt": String(row.attempt + 1),
-					...callbackSecret ? { "x-workflow-callback-secret": callbackSecret } : {}
-				},
-				body: row.body,
-				signal: AbortSignal.timeout(timeoutMs)
-			});
-		} catch (error) {
-			transportError = error;
-		}
-		const now = this.#now();
-		if (response?.ok) {
-			await cancelUnusedResponseBody(response);
-			await this.#ack(row, claimKey);
-		} else if (response && response.status === 503) {
-			let timeoutSeconds;
-			try {
-				timeoutSeconds = (await response.json())?.timeoutSeconds;
-			} catch {
-				timeoutSeconds = void 0;
-			}
-			const redeliveryAt = queueDelayDeadline(now, timeoutSeconds, 1, MAX_QUEUE_DERIVED_DEADLINE_HEADROOM_MS);
-			if (redeliveryAt !== null) {
-				const reschedule = async (txn) => {
-					if (!await txn.delete(claimKey)) return;
-					const scheduleKey = dueKey(redeliveryAt, row.messageId);
-					await txn.put(scheduleKey, row.messageId);
-					if (row.runId) await txn.put(runReferenceKey(row.runId, row.messageId), {
-						messageId: row.messageId,
-						dueKey: scheduleKey,
-						idempotencyKey: row.idempotencyKey
-					});
-					await this.#scheduleNextAlarm(txn, now);
-				};
-				if (row.runId) await this.#withRunMutation(row.runId, (txn) => this.#dropExpiredMessage(txn, row, claimKey, now), reschedule);
-				else await storage.transaction(reschedule);
-			} else await this.#retry(row, claimKey, "HTTP 503");
-		} else if (response && PERMANENT_STATUSES.has(response.status)) {
-			await cancelUnusedResponseBody(response);
-			await this.#ack(row, claimKey);
-		} else {
-			const reason = response ? `HTTP ${response.status}` : `transport error: ${String(transportError)}`;
-			if (response) await cancelUnusedResponseBody(response);
-			await this.#retry(row, claimKey, reason);
-		}
-	}
-	async #ack(row, claimKey) {
-		await this.ctx.storage.transaction(async (txn) => {
-			if (!await txn.delete(claimKey)) return;
-			await txn.delete(`msg:${row.messageId}`);
-			if (row.idempotencyKey) {
-				if (await txn.get(`key:${row.idempotencyKey}`) === row.messageId) await txn.delete(`key:${row.idempotencyKey}`);
-			}
-			if (row.runId) await txn.delete(runReferenceKey(row.runId, row.messageId));
-			await this.#scheduleNextAlarm(txn, this.#now());
-		});
-	}
-	async #dropExpiredMessage(txn, row, claimKey, now) {
-		if (!await txn.delete(claimKey)) return;
-		await txn.delete(`msg:${row.messageId}`);
-		if (row.runId) await txn.delete(runReferenceKey(row.runId, row.messageId));
-		if (row.idempotencyKey) {
-			const dedupKey = `key:${row.idempotencyKey}`;
-			if (await txn.get(dedupKey) === row.messageId) await txn.delete(dedupKey);
-		}
-		await this.#scheduleNextAlarm(txn, now);
-	}
-	async #retry(row, claimKey, reason) {
-		const storage = this.ctx.storage;
-		const now = this.#now();
-		const maxAttempts = this.#maxAttempts();
-		const attempt = row.attempt + 1;
-		const retryAt = checkedQueueTimestampAdd(now, backoffSeconds(attempt) * 1e3, MAX_QUEUE_DERIVED_DEADLINE_HEADROOM_MS);
-		const persistRetry = async (txn) => {
-			if (!await txn.delete(claimKey)) return;
-			if (attempt >= maxAttempts || retryAt === null) {
-				await this.#deadLetter(txn, row, attempt, retryAt === null ? `${reason}; retry exceeded the queue timestamp horizon` : reason, now);
-				await this.#scheduleNextAlarm(txn, now);
-				return;
-			}
-			const updated = {
-				...row,
-				attempt,
-				lastError: reason
-			};
-			const scheduleKey = dueKey(retryAt, row.messageId);
-			await txn.put(`msg:${row.messageId}`, updated);
-			await txn.put(scheduleKey, row.messageId);
-			if (row.runId) await txn.put(runReferenceKey(row.runId, row.messageId), {
-				messageId: row.messageId,
-				dueKey: scheduleKey,
-				idempotencyKey: row.idempotencyKey
-			});
-			await this.#scheduleNextAlarm(txn, now);
-		};
-		if (row.runId) await this.#withRunMutation(row.runId, (txn) => this.#dropExpiredMessage(txn, row, claimKey, now), persistRetry);
-		else await storage.transaction(persistRetry);
-	}
-	async #deadLetter(txn, row, attempt, reason, now) {
-		const failedAt = checkedQueueTimestampAdd(now, 0);
-		await txn.delete(`msg:${row.messageId}`);
-		if (row.idempotencyKey) {
-			if (await txn.get(`key:${row.idempotencyKey}`) === row.messageId) await txn.delete(`key:${row.idempotencyKey}`);
-		}
-		if (failedAt === null) {
-			if (row.runId) await txn.delete(runReferenceKey(row.runId, row.messageId));
-			return;
-		}
-		const dead = {
-			...row,
-			attempt,
-			lastError: reason,
-			failedAt
-		};
-		const deadKey = `dlq:${pad$1(failedAt)}:${row.messageId}`;
-		await txn.put(deadKey, dead);
-		if (row.runId) await txn.put(runReferenceKey(row.runId, row.messageId), {
-			messageId: row.messageId,
-			dlqKey: deadKey,
-			idempotencyKey: row.idempotencyKey
-		});
-	}
-	/** Return true when another due compaction page must run immediately. */
-	async #compactExpiredRunFences(txn, now) {
-		const due = await txn.list({
-			prefix: EXPIRED_RUN_GC_PREFIX,
-			end: inclusiveTimestampEnd(EXPIRED_RUN_GC_PREFIX, now),
-			limit: 129
-		});
-		const page = Array.from(due).slice(0, 128);
-		if (page.length === 0) return false;
-		const markerKeys = page.map(([, item]) => expiredRunKey(item.runId));
-		const markers = await getMany(txn, markerKeys);
-		const deletes = [];
-		for (let index = 0; index < page.length; index++) {
-			const [gcKey, item] = page[index];
-			const markerKey = markerKeys[index];
-			const marker = markers.get(markerKey);
-			deletes.push(gcKey);
-			if (marker?.compactAt !== item.compactAt) continue;
-			deletes.push(markerKey);
-		}
-		await deleteMany(txn, deletes);
-		return due.size > 128;
-	}
-	/** Arm the alarm no later than `atMs` (durable backoff never throws). */
-	async #armAlarmAtMost(storage, atMs, now) {
-		const current = await storage.getAlarm();
-		const immediate = checkedQueueTimestampAdd(now, MIN_ALARM_DELAY_MS);
-		if (current !== null && current <= now) {
-			if (immediate === null) await storage.deleteAlarm();
-			else await storage.setAlarm(immediate);
-			return;
-		}
-		const target = atMs <= now ? immediate : atMs;
-		if (target === null) {
-			await storage.deleteAlarm();
-			return;
-		}
-		if (current === null || target < current) await storage.setAlarm(target);
-	}
-	/** Recompute the alarm from the earliest due entry / inflight deadline. */
-	async #rearm() {
-		await this.#scheduleNextAlarm(this.ctx.storage, this.#now());
-	}
-	/** Keep the alarm index consistent with message state in the same transaction. */
-	async #scheduleNextAlarm(storage, now) {
-		let next = null;
-		const due = await storage.list({
-			prefix: "due:",
-			limit: 1
-		});
-		for (const key of due.keys()) next = Number.parseInt(key.slice(4, 17), 10);
-		const inflight = await storage.list({
-			prefix: INFLIGHT_DEADLINE_PREFIX,
-			limit: 1
-		});
-		for (const key of inflight.keys()) {
-			const deadline = deadlineFromInflightKey(key);
-			if (next === null || deadline < next) next = deadline;
-		}
-		const expiryGc = await storage.list({
-			prefix: EXPIRED_RUN_GC_PREFIX,
-			limit: 1
-		});
-		for (const item of expiryGc.values()) if (next === null || item.compactAt < next) next = item.compactAt;
-		if (next !== null) {
-			const target = next <= now ? checkedQueueTimestampAdd(now, MIN_ALARM_DELAY_MS) : next;
-			if (target === null) await storage.deleteAlarm();
-			else await storage.setAlarm(target);
-		} else await storage.deleteAlarm();
-	}
-	async stats() {
-		const storage = this.ctx.storage;
-		const [due, inflight, dlq, alarmAt] = await Promise.all([
-			storage.list({ prefix: "due:" }),
-			storage.list({ prefix: INFLIGHT_DEADLINE_PREFIX }),
-			storage.list({ prefix: "dlq:" }),
-			storage.getAlarm()
-		]);
-		return {
-			pending: due.size,
-			inflight: inflight.size,
-			deadLetters: dlq.size,
-			alarmAt
-		};
-	}
-	async listDeadLetters(params) {
-		if (params !== void 0 && !isRecord(params)) throw new Error("world-celld queue dead-letter list options must be an object");
-		const limit = boundedIntegerOption("world-celld queue dead-letter limit", params?.limit, 100, 1, MAX_DEAD_LETTER_LIST_SIZE);
-		if (params?.cursor !== void 0 && typeof params.cursor !== "string") throw new Error("world-celld queue dead-letter cursor must be a string");
-		const entries = await this.ctx.storage.list({
-			prefix: "dlq:",
-			startAfter: params?.cursor,
-			limit: limit + 1
-		});
-		const keys = Array.from(entries.keys());
-		const page = keys.slice(0, limit);
-		const hasMore = keys.length > limit;
-		return {
-			data: page.map((k) => entries.get(k)),
-			cursor: hasMore ? page.at(-1) : null,
-			hasMore
-		};
-	}
-	/** Move a dead letter back to the live queue (attempt count reset). */
-	async redriveDeadLetter(messageId) {
-		if (typeof messageId !== "string" || messageId.length === 0) throw new Error("world-celld queue redrive messageId must be a non-empty string");
-		const storage = this.ctx.storage;
-		const now = this.#now();
-		if (checkedQueueTimestampAdd(now, 0, 330001) === null) return { ok: false };
-		const found = Array.from(await storage.list({ prefix: "dlq:" })).find(([, dead]) => dead.messageId === messageId);
-		if (!found) return { ok: false };
-		const [deadKey, candidate] = found;
-		const redrive = async (txn) => {
-			const dead = await txn.get(deadKey);
-			if (!dead || dead.messageId !== messageId) return { ok: false };
-			const { failedAt: _failedAt, ...rest } = dead;
-			const row = {
-				...rest,
-				attempt: 0,
-				lastError: void 0
-			};
-			if (row.idempotencyKey) {
-				const dedupKey = `key:${row.idempotencyKey}`;
-				const holder = await txn.get(dedupKey);
-				if (holder && holder !== row.messageId && await txn.get(`msg:${holder}`)) return { ok: false };
-				if (holder && holder !== row.messageId) await txn.delete(dedupKey);
-				await txn.put(dedupKey, row.messageId);
-			}
-			await txn.put(`msg:${row.messageId}`, row);
-			const scheduleKey = dueKey(now, row.messageId);
-			await txn.put(scheduleKey, row.messageId);
-			await txn.delete(deadKey);
-			if (row.runId) await txn.put(runReferenceKey(row.runId, row.messageId), {
-				messageId: row.messageId,
-				dueKey: scheduleKey,
-				idempotencyKey: row.idempotencyKey
-			});
-			await this.#armAlarmAtMost(txn, now, now);
-			return { ok: true };
-		};
-		const rejectExpired = async (txn) => {
-			if ((await txn.get(deadKey))?.messageId === messageId) await txn.delete([deadKey, runReferenceKey(candidate.runId, messageId)]);
-			return { ok: false };
-		};
-		return candidate.runId ? await this.#withRunMutation(candidate.runId, rejectExpired, redrive) : await storage.transaction(redrive);
-	}
-	async purgeDeadLetters() {
-		return await this.ctx.storage.transaction(async (txn) => {
-			const entries = await txn.list({
-				prefix: "dlq:",
-				limit: 129
-			});
-			const page = Array.from(entries).slice(0, PURGE_DEAD_LETTER_BATCH);
-			await deleteMany(txn, page.flatMap(([key, dead]) => [key, ...dead.runId ? [runReferenceKey(dead.runId, dead.messageId)] : []]));
-			return {
-				purged: page.length,
-				hasMore: entries.size > PURGE_DEAD_LETTER_BATCH
-			};
-		});
-	}
-	/**
-	* Recovery hatch for celld's six-failure alarm abandonment: derive the due
-	* time again and arm it.
-	*/
-	async rearmAlarm() {
-		await this.#rearm();
-		return { alarmAt: await this.ctx.storage.getAlarm() };
-	}
-	/** Fence a run and purge every live, inflight, and dead-letter message it owns. */
-	async expireRun(runId, expiredAt, options) {
-		if (typeof runId !== "string" || runId.length === 0) throw new Error("world-celld queue expiry runId must be a non-empty string");
-		if (!isNonNegativeSafeInteger(expiredAt)) throw new Error("world-celld queue expiry expiredAt must be a non-negative safe integer");
-		if (options !== void 0 && !isRecord(options)) throw new Error("world-celld queue expiry options must be an object");
-		const storage = this.ctx.storage;
-		const limit = boundedIntegerOption("world-celld queue expiry limit", options?.limit, EXPIRE_RUN_REFERENCE_BATCH, 1, EXPIRE_RUN_REFERENCE_BATCH);
-		return await storage.transaction(async (txn) => {
-			const existing = await txn.get(expiredRunKey(runId));
-			const references = await txn.list({
-				prefix: `run:${runId}:`,
-				limit: limit + 1
-			});
-			const page = Array.from(references).slice(0, limit);
-			const dedupHolders = await getMany(txn, page.flatMap(([, reference]) => reference.idempotencyKey ? [`key:${reference.idempotencyKey}`] : []));
-			const keys = [];
-			let count = existing?.deleted ?? 0;
-			for (const [key, reference] of page) {
-				keys.push(`msg:${reference.messageId}`, key);
-				if (reference.inflightKey) keys.push(reference.inflightKey);
-				if (reference.dueKey) keys.push(reference.dueKey);
-				if (reference.dlqKey) keys.push(reference.dlqKey);
-				if (reference.idempotencyKey) {
-					const dedupKey = `key:${reference.idempotencyKey}`;
-					if (dedupHolders.get(dedupKey) === reference.messageId) keys.push(dedupKey);
-				}
-				count++;
-			}
-			await deleteMany(txn, keys);
-			const done = references.size <= limit;
-			const markerExpiredAt = existing?.expiredAt ?? expiredAt;
-			await txn.put(expiredRunKey(runId), {
-				expiredAt: markerExpiredAt,
-				deleted: count,
-				compactAt: existing?.compactAt ?? null
-			});
-			await this.#scheduleNextAlarm(txn, this.#now());
-			return done ? {
-				deleted: count,
-				done: true,
-				receipt: {
-					expiredAt: markerExpiredAt,
-					deleted: count
-				}
-			} : {
-				deleted: count,
-				done: false
-			};
-		});
-	}
-	/** Acknowledge a final cleanup receipt before making its marker compactable. */
-	async acknowledgeExpireRun(runId, receipt) {
-		if (typeof runId !== "string" || runId.length === 0) throw new Error("world-celld queue expiry runId must be a non-empty string");
-		if (!isRecord(receipt) || !isNonNegativeSafeInteger(receipt.expiredAt) || !isNonNegativeSafeInteger(receipt.deleted)) throw new Error("world-celld queue expiry receipt is invalid");
-		return await this.ctx.storage.transaction(async (txn) => {
-			const key = expiredRunKey(runId);
-			const marker = await txn.get(key);
-			if (!marker) return { acknowledged: true };
-			if (marker.expiredAt !== receipt.expiredAt || marker.deleted !== receipt.deleted) return { acknowledged: false };
-			if (marker.compactAt === null) {
-				const compactAt = checkedQueueTimestampAdd(this.#now(), QUEUE_FENCE_GRACE_MS);
-				if (compactAt !== null) {
-					await txn.put(key, {
-						...marker,
-						compactAt
-					});
-					await txn.put(expiredRunGcKey(runId, compactAt), {
-						runId,
-						compactAt
-					});
-				}
-			}
-			await this.#scheduleNextAlarm(txn, this.#now());
-			return { acknowledged: true };
-		});
-	}
-};
-//#endregion
 //#region src/worker/durable-objects/RunCatalogDO.ts
 const MAX_INDEX_LIST_SIZE = 1001;
 const EXPIRY_GC_PREFIX = "expiry-gc:";
@@ -3761,15 +3258,14 @@ const TERMINAL_WAIT_PAGE_SIZE = STORAGE_BATCH_SIZE;
 const STREAMS_PER_CLEANUP_PAGE = 16;
 const STREAM_CHUNKS_PER_CLEANUP_PAGE = STORAGE_BATCH_SIZE;
 const STREAM_BYTES_PER_CLEANUP_PAGE = 16777216;
-const QUEUE_REFERENCES_PER_CLEANUP_PAGE = 64;
+const QUEUE_PAYLOADS_PER_CLEANUP_PAGE = STORAGE_BATCH_SIZE;
 const CLEANUP_RETRY_MAX_MS = 36e5;
-const CLEANUP_PROGRESS_KEY = "retention:progress";
-const RUN_QUEUE_SHARDS_KEY = "retention:queue-shards";
 const MAX_DATE_MS = 864e13;
+const QUEUE_ORPHAN_KEY = "queue-orphan";
+const QUEUE_RESERVATION_KEY = "queue-reservation";
 function validateCleanupRequest(request, allowDisabled) {
-	if (!isRecord(request)) throw new Error("world-celld retention request must be an object");
+	if (!isRecord$1(request)) throw new Error("world-celld retention request must be an object");
 	if (!(allowDisabled ? isNonNegativeSafeInteger(request.retentionMs) : isPositiveSafeInteger(request.retentionMs))) throw new Error(`world-celld retentionMs must be a ${allowDisabled ? "non-negative" : "positive"} safe integer`);
-	if (!isPositiveSafeInteger(request.queueShards)) throw new Error("world-celld retention queueShards must be a positive safe integer");
 	return request;
 }
 function retentionDeadline(baseMs, retentionMs, runId) {
@@ -3777,7 +3273,7 @@ function retentionDeadline(baseMs, retentionMs, runId) {
 	if (!Number.isSafeInteger(dueAtMs) || dueAtMs > MAX_DATE_MS) throw new Error(`world-celld retention deadline is out of range for ${runId}`);
 	return dueAtMs;
 }
-function cleanupRecord(run, dueAt, queueShards, reason) {
+function cleanupRecord(run, dueAt, reason) {
 	const terminal = isTerminalWorkflowRunStatus(run.status) ? run : void 0;
 	return {
 		version: 1,
@@ -3789,13 +3285,12 @@ function cleanupRecord(run, dueAt, queueShards, reason) {
 		terminalStatus: terminal?.status,
 		reason,
 		dueAt,
-		queueShards,
 		phase: "retained",
 		generation: 0,
 		attempts: 0,
 		deletedPayloadKeys: 0,
 		deletedStreams: 0,
-		deletedQueueMessages: 0
+		deletedQueuePayloads: 0
 	};
 }
 /**
@@ -3828,8 +3323,8 @@ async function putStorageEntries(storage, entries) {
 * storage transaction: guard checks, the event append, and the entity
 * mutation are atomic even if the DO is evicted mid-operation.
 *
-* Instances named `claim:<queueName>:<idempotencyKey>` are used purely as
-* queue-message dedup claims (see claimInflight/releaseInflight).
+* Instances named `claim:<queueName>:<idempotencyKey>` reserve one message ID
+* at publication time and serialize its deliveries until completion.
 */
 var WorkflowRunDO = class extends DurableObject {
 	now() {
@@ -3896,7 +3391,6 @@ var WorkflowRunDO = class extends DurableObject {
 				now
 			});
 			if (!outcome.ok) return outcome;
-			if (outcome.runCreated && request.cleanup) await txn.put(RUN_QUEUE_SHARDS_KEY, request.cleanup.queueShards);
 			await txn.put("event_sequence", eventSequence);
 			await putStorageEntries(txn, (outcome.hookToIndex ? [{
 				hookId: outcome.hookToIndex.hookId,
@@ -3910,7 +3404,7 @@ var WorkflowRunDO = class extends DurableObject {
 					...terminalRun,
 					expiredAt: dueAt
 				});
-				const cleanup = cleanupRecord(run, dueAt, request.cleanup?.queueShards ?? 1, "terminal-retention");
+				const cleanup = cleanupRecord(run, dueAt, "terminal-retention");
 				await txn.put("run", run);
 				await txn.put(CLEANUP_RECORD_KEY, cleanup);
 				await txn.setAlarm(dueAt);
@@ -4020,7 +3514,7 @@ var WorkflowRunDO = class extends DurableObject {
 				...terminalRun,
 				expiredAt: dueAt
 			});
-			const cleanup = cleanupRecord(run, dueAt, request.queueShards, "manual");
+			const cleanup = cleanupRecord(run, dueAt, "manual");
 			await txn.put("run", run);
 			await txn.put(CLEANUP_RECORD_KEY, cleanup);
 			await txn.setAlarm(values.get("terminal:cleanup") || dueAt.getTime() <= this.now() ? this.now() + 1 : dueAt);
@@ -4041,7 +3535,6 @@ var WorkflowRunDO = class extends DurableObject {
 			const values = await txn.get([
 				CLEANUP_RECORD_KEY,
 				TOMBSTONE_KEY,
-				RUN_QUEUE_SHARDS_KEY,
 				"run"
 			]);
 			const tombstone = values.get(TOMBSTONE_KEY);
@@ -4060,12 +3553,9 @@ var WorkflowRunDO = class extends DurableObject {
 				cleanup: null
 			};
 			const dueAt = new Date(dueAtMs);
-			const existing = values.get(CLEANUP_RECORD_KEY);
-			const storedQueueShards = values.get(RUN_QUEUE_SHARDS_KEY);
-			const queueShards = Number.isSafeInteger(storedQueueShards) && storedQueueShards > 0 ? storedQueueShards : request.queueShards;
-			let cleanup = existing;
+			let cleanup = values.get(CLEANUP_RECORD_KEY);
 			if (!cleanup) {
-				cleanup = cleanupRecord(run, dueAt, queueShards, "maximum-age");
+				cleanup = cleanupRecord(run, dueAt, "maximum-age");
 				await txn.put("run", WorkflowRunSchema.parse({
 					...run,
 					expiredAt: dueAt
@@ -4168,9 +3658,69 @@ var WorkflowRunDO = class extends DurableObject {
 		});
 	}
 	async executeScheduledCleanupPage() {
-		const values = await this.ctx.storage.get([CLEANUP_RECORD_KEY, TERMINAL_CLEANUP_KEY]);
+		const values = await this.ctx.storage.get([
+			CLEANUP_RECORD_KEY,
+			TERMINAL_CLEANUP_KEY,
+			"claim",
+			QUEUE_RESERVATION_KEY,
+			QUEUE_ORPHAN_KEY,
+			"run"
+		]);
 		const cleanup = values.get(CLEANUP_RECORD_KEY);
 		const terminalCleanup = values.get(TERMINAL_CLEANUP_KEY);
+		const claim = values.get("claim");
+		const reservation = values.get(QUEUE_RESERVATION_KEY);
+		if (values.get(QUEUE_ORPHAN_KEY)) {
+			const leased = await this.ctx.storage.transaction(async (txn) => {
+				const current = await txn.get(QUEUE_ORPHAN_KEY);
+				if (!current) return null;
+				if (current.expiresAt > this.now()) {
+					await txn.setAlarm(current.expiresAt);
+					return null;
+				}
+				if (current.deleting) return current;
+				const next = {
+					...current,
+					generation: current.generation + 1,
+					deleting: true
+				};
+				await txn.put(QUEUE_ORPHAN_KEY, next);
+				return next;
+			});
+			if (!leased) return;
+			const bucket = this.env?.WORKFLOW_QUEUE_PAYLOADS;
+			const runs = this.env?.WORKFLOW_DB;
+			if (!bucket || !runs) throw new Error("world-celld queue orphan cleanup is missing required bindings");
+			await deleteQueuePayloadObjects(bucket, leased.key);
+			await runs.get(runs.idFromName(leased.runId)).unregisterQueuePayload(leased.messageId);
+			await this.ctx.storage.transaction(async (txn) => {
+				const current = await txn.get(QUEUE_ORPHAN_KEY);
+				if (current?.messageId !== leased.messageId || current.generation !== leased.generation || !current.deleting) return;
+				await txn.delete(QUEUE_ORPHAN_KEY);
+				await txn.deleteAlarm();
+			});
+			return;
+		}
+		if (claim || reservation) {
+			await this.ctx.storage.transaction(async (txn) => {
+				const current = await txn.get(["claim", QUEUE_RESERVATION_KEY]);
+				let nextClaim = current.get("claim");
+				let nextReservation = current.get(QUEUE_RESERVATION_KEY);
+				const now = this.now();
+				if (nextClaim && nextClaim.expiresAt <= now) {
+					await txn.delete("claim");
+					nextClaim = void 0;
+				}
+				if (nextReservation && nextReservation.expiresAt <= now) {
+					await txn.delete(QUEUE_RESERVATION_KEY);
+					nextReservation = void 0;
+				}
+				const nextAlarm = Math.min(nextClaim?.expiresAt ?? Number.POSITIVE_INFINITY, nextReservation?.expiresAt ?? Number.POSITIVE_INFINITY);
+				if (Number.isFinite(nextAlarm)) await txn.setAlarm(nextAlarm);
+				else await txn.deleteAlarm();
+			});
+			return;
+		}
 		if (cleanup && cleanup.phase !== "tombstoned" && cleanup.dueAt.getTime() <= this.now()) {
 			try {
 				await this.executeCleanup(cleanup);
@@ -4369,85 +3919,27 @@ var WorkflowRunDO = class extends DurableObject {
 		});
 	}
 	async deleteQueuePage(cleanup) {
-		const queues = this.namespace("WORKFLOW_QUEUE");
-		const progress = await this.ctx.storage.get(CLEANUP_PROGRESS_KEY) ?? {
-			queueShard: 0,
-			queueShardDeleted: 0
-		};
-		if (progress.pendingAck) {
-			const { queueShard, receipt } = progress.pendingAck;
-			if (!(await queues.get(queues.idFromName(`q:${queueShard}`)).acknowledgeExpireRun(cleanup.runId, receipt)).acknowledged) throw new Error(`queue shard ${queueShard} rejected expiry receipt for ${cleanup.runId}`);
-			await this.ctx.storage.transaction(async (txn) => {
-				const current = await txn.get(CLEANUP_RECORD_KEY);
-				if (current?.phase !== "queues" || current.generation !== cleanup.generation) return;
-				const persisted = await txn.get(CLEANUP_PROGRESS_KEY);
-				if (persisted?.pendingAck?.queueShard !== queueShard || persisted.pendingAck.receipt.expiredAt !== receipt.expiredAt || persisted.pendingAck.receipt.deleted !== receipt.deleted) return;
-				await txn.put(CLEANUP_RECORD_KEY, {
-					...current,
-					generation: current.generation + 1,
-					attempts: 0,
-					lastError: void 0
-				});
-				await txn.put(CLEANUP_PROGRESS_KEY, {
-					queueShard: queueShard + 1,
-					queueShardDeleted: 0
-				});
-				await txn.setAlarm(this.now() + 1);
-			});
-			return;
-		}
-		if (progress.queueShard < cleanup.queueShards) {
-			const requestedShard = progress.queueShard;
-			const result = await queues.get(queues.idFromName(`q:${requestedShard}`)).expireRun(cleanup.runId, cleanup.dueAt.getTime(), { limit: QUEUE_REFERENCES_PER_CLEANUP_PAGE });
-			await this.ctx.storage.transaction(async (txn) => {
-				const current = await txn.get(CLEANUP_RECORD_KEY);
-				if (current?.phase !== "queues" || current.generation !== cleanup.generation) return;
-				const persisted = await txn.get(CLEANUP_PROGRESS_KEY) ?? {
-					queueShard: 0,
-					queueShardDeleted: 0
-				};
-				if (persisted.queueShard !== requestedShard || persisted.pendingAck) return;
-				if (result.deleted < persisted.queueShardDeleted) throw new Error(`queue shard ${requestedShard} regressed expiry receipt for ${cleanup.runId}`);
-				const delta = result.deleted - persisted.queueShardDeleted;
-				const next = result.done ? {
-					queueShard: requestedShard,
-					queueShardDeleted: result.deleted,
-					pendingAck: {
-						queueShard: requestedShard,
-						receipt: result.receipt
-					}
-				} : {
-					queueShard: requestedShard,
-					queueShardDeleted: result.deleted
-				};
-				await txn.put(CLEANUP_RECORD_KEY, {
-					...current,
-					deletedQueueMessages: current.deletedQueueMessages + delta,
-					generation: current.generation + 1,
-					attempts: 0,
-					lastError: void 0
-				});
-				await txn.put(CLEANUP_PROGRESS_KEY, next);
-				await txn.setAlarm(this.now() + 1);
-			});
-			return;
-		}
+		const entries = await this.ctx.storage.list({
+			prefix: QUEUE_PAYLOAD_REGISTRY_PREFIX,
+			limit: 129
+		});
+		const page = Array.from(entries).slice(0, QUEUE_PAYLOADS_PER_CLEANUP_PAGE);
+		const bucket = this.env?.WORKFLOW_QUEUE_PAYLOADS;
+		if (!bucket) throw new Error("world-celld retention missing binding WORKFLOW_QUEUE_PAYLOADS");
+		if (page.length > 0) await deleteQueuePayloadObjects(bucket, page.map(([, registration]) => registration.key));
 		await this.ctx.storage.transaction(async (txn) => {
 			const current = await txn.get(CLEANUP_RECORD_KEY);
 			if (current?.phase !== "queues" || current.generation !== cleanup.generation) return;
-			const persisted = await txn.get(CLEANUP_PROGRESS_KEY) ?? {
-				queueShard: 0,
-				queueShardDeleted: 0
-			};
-			if (persisted.queueShard >= current.queueShards && !persisted.pendingAck) {
-				await txn.put(CLEANUP_RECORD_KEY, {
-					...current,
-					phase: "payload",
-					generation: current.generation + 1
-				});
-				await txn.delete(CLEANUP_PROGRESS_KEY);
-				await txn.setAlarm(this.now() + 1);
-			}
+			if (page.length > 0) await txn.delete(page.map(([key]) => key));
+			await txn.put(CLEANUP_RECORD_KEY, {
+				...current,
+				deletedQueuePayloads: current.deletedQueuePayloads + page.length,
+				phase: entries.size <= QUEUE_PAYLOADS_PER_CLEANUP_PAGE ? "payload" : "queues",
+				generation: current.generation + 1,
+				attempts: 0,
+				lastError: void 0
+			});
+			await txn.setAlarm(this.now() + 1);
 		});
 	}
 	async deletePayloadBatch() {
@@ -4518,20 +4010,163 @@ var WorkflowRunDO = class extends DurableObject {
 			await txn.setAlarm(this.now() + delay);
 		});
 	}
+	async registerQueuePayload(registration) {
+		if (!registration || typeof registration.messageId !== "string" || registration.messageId.length === 0 || typeof registration.key !== "string" || registration.key.length === 0 || !isNonNegativeSafeInteger(registration.orphanExpiresAt)) throw new TypeError("world-celld queue payload registration is invalid");
+		return await this.ctx.storage.transaction(async (txn) => {
+			const { tombstone } = await this.retentionState(txn);
+			if (tombstone) return {
+				ok: false,
+				message: `Workflow run "${tombstone.runId}" expired at ${tombstone.expiredAt.toISOString()}`
+			};
+			await txn.put(queuePayloadRegistryKey(registration.messageId), registration);
+			return { ok: true };
+		});
+	}
+	async finalizeQueuePayload(messageId) {
+		if (typeof messageId !== "string" || messageId.length === 0) throw new TypeError("world-celld queue payload messageId must be a non-empty string");
+		return await this.ctx.storage.transaction(async (txn) => {
+			const { tombstone } = await this.retentionState(txn);
+			if (tombstone) return {
+				ok: false,
+				message: `Workflow run "${tombstone.runId}" expired at ${tombstone.expiredAt.toISOString()}`
+			};
+			return await txn.get(queuePayloadRegistryKey(messageId)) ? { ok: true } : {
+				ok: false,
+				message: "workflow queue payload registration was removed before publication"
+			};
+		});
+	}
+	async unregisterQueuePayload(messageId) {
+		if (typeof messageId !== "string" || messageId.length === 0) throw new TypeError("world-celld queue payload messageId must be a non-empty string");
+		await this.ctx.storage.delete(queuePayloadRegistryKey(messageId));
+	}
+	async scheduleQueuePayloadOrphan(orphan) {
+		if (!orphan || typeof orphan.messageId !== "string" || orphan.messageId.length === 0 || typeof orphan.runId !== "string" || orphan.runId.length === 0 || typeof orphan.key !== "string" || orphan.key.length === 0 || !isNonNegativeSafeInteger(orphan.expiresAt)) throw new TypeError("world-celld queue payload orphan is invalid");
+		await this.ctx.storage.transaction(async (txn) => {
+			const existing = await txn.get(QUEUE_ORPHAN_KEY);
+			if (existing && existing.messageId !== orphan.messageId) throw new Error("world-celld queue payload orphan identity mismatch");
+			if (existing?.deleting) throw new Error("world-celld queue payload orphan deletion is in progress");
+			const next = {
+				...orphan,
+				expiresAt: Math.max(existing?.expiresAt ?? 0, orphan.expiresAt),
+				generation: (existing?.generation ?? 0) + 1,
+				deleting: false
+			};
+			await txn.put(QUEUE_ORPHAN_KEY, next);
+			await txn.setAlarm(next.expiresAt);
+		});
+	}
+	async cancelQueuePayloadOrphan(messageId) {
+		if (typeof messageId !== "string" || messageId.length === 0) throw new TypeError("world-celld queue payload orphan messageId must be a non-empty string");
+		await this.ctx.storage.transaction(async (txn) => {
+			const existing = await txn.get(QUEUE_ORPHAN_KEY);
+			if (!existing || existing.messageId !== messageId) return;
+			await txn.delete(QUEUE_ORPHAN_KEY);
+			await txn.deleteAlarm();
+		});
+	}
+	async reserveQueueMessage(params) {
+		if (typeof params?.messageId !== "string" || params.messageId.length === 0 || !isNonNegativeSafeInteger(params.expiresAt)) throw new TypeError("world-celld queue message reservation is invalid");
+		return await this.ctx.storage.transaction(async (txn) => {
+			const values = await txn.get([QUEUE_RESERVATION_KEY, "claim"]);
+			const existing = values.get(QUEUE_RESERVATION_KEY);
+			const claim = values.get("claim");
+			const now = this.now();
+			if (existing && existing.expiresAt > now && existing.messageId !== params.messageId) {
+				await txn.setAlarm(Math.min(existing.expiresAt, claim?.expiresAt ?? existing.expiresAt));
+				return {
+					admitted: false,
+					messageId: existing.messageId
+				};
+			}
+			const reservation = {
+				messageId: params.messageId,
+				expiresAt: Math.max(existing?.expiresAt ?? 0, params.expiresAt)
+			};
+			await txn.put(QUEUE_RESERVATION_KEY, reservation);
+			await txn.setAlarm(Math.min(reservation.expiresAt, claim?.expiresAt ?? reservation.expiresAt));
+			return {
+				admitted: true,
+				messageId: params.messageId
+			};
+		});
+	}
+	async completeQueueMessage(messageId) {
+		if (typeof messageId !== "string" || messageId.length === 0) throw new TypeError("world-celld queue messageId must be a non-empty string");
+		await this.ctx.storage.transaction(async (txn) => {
+			const values = await txn.get([QUEUE_RESERVATION_KEY, "claim"]);
+			let reservation = values.get(QUEUE_RESERVATION_KEY);
+			let claim = values.get("claim");
+			if (reservation?.messageId === messageId) {
+				await txn.delete(QUEUE_RESERVATION_KEY);
+				reservation = void 0;
+			}
+			if (claim?.messageId === messageId) {
+				await txn.delete("claim");
+				claim = void 0;
+			}
+			const nextAlarm = Math.min(reservation?.expiresAt ?? Number.POSITIVE_INFINITY, claim?.expiresAt ?? Number.POSITIVE_INFINITY);
+			if (Number.isFinite(nextAlarm)) await txn.setAlarm(nextAlarm);
+			else await txn.deleteAlarm();
+		});
+	}
 	async claimInflight(params) {
+		if (typeof params?.messageId !== "string" || params.messageId.length === 0 || !isPositiveSafeInteger(params.staleMs)) throw new TypeError("world-celld queue claim is invalid");
 		return await this.ctx.storage.transaction(async (txn) => {
-			const existing = await txn.get("claim");
+			const values = await txn.get(["claim", QUEUE_RESERVATION_KEY]);
+			const existing = values.get("claim");
+			const reservation = values.get(QUEUE_RESERVATION_KEY);
 			const now = this.now();
-			if (existing && existing.messageId !== params.messageId && now - existing.claimedAt < params.staleMs) return { claimed: false };
+			if (existing && existing.expiresAt > now) {
+				if (existing.messageId !== params.messageId) return { claimed: false };
+				if (existing.retryAt === void 0 || existing.retryAt > now) return {
+					claimed: false,
+					retryAt: existing.retryAt ?? existing.expiresAt
+				};
+			}
+			const expiresAt = now + params.staleMs;
 			await txn.put("claim", {
 				messageId: params.messageId,
-				claimedAt: now
+				expiresAt
 			});
+			await txn.setAlarm(Math.min(expiresAt, reservation?.expiresAt ?? expiresAt));
 			return { claimed: true };
 		});
 	}
-	async releaseInflight() {
-		await this.ctx.storage.delete("claim");
+	async holdInflight(params) {
+		if (typeof params?.messageId !== "string" || params.messageId.length === 0 || !isNonNegativeSafeInteger(params.retryAt) || !isNonNegativeSafeInteger(params.expiresAt) || params.reservationExpiresAt !== void 0 && !isNonNegativeSafeInteger(params.reservationExpiresAt)) throw new TypeError("world-celld queue claim hold is invalid");
+		return await this.ctx.storage.transaction(async (txn) => {
+			const values = await txn.get(["claim", QUEUE_RESERVATION_KEY]);
+			const existing = values.get("claim");
+			let reservation = values.get(QUEUE_RESERVATION_KEY);
+			if (!existing || existing.messageId !== params.messageId) return { held: false };
+			const expiresAt = Math.max(existing.expiresAt, params.expiresAt);
+			await txn.put("claim", {
+				...existing,
+				retryAt: params.retryAt,
+				expiresAt
+			});
+			if (reservation?.messageId === params.messageId && params.reservationExpiresAt !== void 0 && params.reservationExpiresAt > reservation.expiresAt) {
+				reservation = {
+					...reservation,
+					expiresAt: params.reservationExpiresAt
+				};
+				await txn.put(QUEUE_RESERVATION_KEY, reservation);
+			}
+			await txn.setAlarm(Math.min(expiresAt, reservation?.expiresAt ?? expiresAt));
+			return { held: true };
+		});
+	}
+	async releaseInflight(messageId) {
+		await this.ctx.storage.transaction(async (txn) => {
+			const values = await txn.get(["claim", QUEUE_RESERVATION_KEY]);
+			const existing = values.get("claim");
+			const reservation = values.get(QUEUE_RESERVATION_KEY);
+			if (!existing || messageId !== void 0 && existing.messageId !== messageId) return;
+			await txn.delete("claim");
+			if (reservation) await txn.setAlarm(reservation.expiresAt);
+			else await txn.deleteAlarm();
+		});
 	}
 };
 //#endregion
@@ -4550,11 +4185,23 @@ async function scheduled(controller, env) {
 }
 var worker_default = {
 	async fetch(request, env) {
-		return createRouter(env)(request);
+		return createRouter({
+			...env,
+			WORKFLOW_QUEUE_PAYLOADS: env.WORKFLOW_QUEUE_PAYLOADS ? createQueuePayloadStore(env.WORKFLOW_QUEUE_PAYLOADS) : void 0
+		})(request);
 	},
 	scheduled
 };
+/** Only the companion consumer binds this internal delivery entrypoint. */
+var QueueDeliveryRpc = class extends WorkerEntrypoint {
+	deliver(secret, envelope, attempt) {
+		return deliverQueueMessage({
+			...this.env,
+			WORKFLOW_QUEUE_PAYLOADS: this.env.WORKFLOW_QUEUE_PAYLOADS ? createQueuePayloadStore(this.env.WORKFLOW_QUEUE_PAYLOADS) : void 0
+		}, secret, envelope, attempt);
+	}
+};
 //#endregion
-export { HookIdDO, HookTokenDO, QueueDO, RunCatalogDO, StreamDO, WorkflowRunDO, createRouter, worker_default as default };
+export { HookIdDO, HookTokenDO, QueueDeliveryRpc, RunCatalogDO, StreamDO, WorkflowRunDO, createRouter, worker_default as default };
 
 //# sourceMappingURL=worker.js.map