@ewhauser/world-celld 0.7.0 → 0.8.1

package/dist/testing.js

@@ -1,4 +1,4 @@
-import { A as isRecord$1, B as STREAM_BATCH_CONTENT_TYPE, G as encodeStreamReadResult, I as MAX_STREAM_LONG_POLL_MS, L as MAX_STREAM_READ_BYTES, N as MAX_STREAM_BATCH_BYTES, O as isNonNegativeSafeInteger, P as MAX_STREAM_CHUNK_BYTES, T as MAX_RUN_INDEX_PUBLICATION_LIFETIME_MS, U as decodeStreamWriteBatch, V as STREAM_CHUNK_LIMIT_HEADER, X as validateStreamReadRequest, Y as normalizeStreamError, Z as validateStreamWriteChunks, _ as createWorkflowIndex, b as HOOK_CLAIM_LEASE_MS, c as queuePayloadObjectKey, d as validateNativeQueueSendOptions, f as compact, h as parse, i as QUEUE_PAYLOAD_REGISTRY_PREFIX, k as isPositiveSafeInteger, l as queuePayloadRegistryKey, m as rpcStringify, n as listRunsPage, o as queueClaimName, p as rpcParse, q as encodeStreamWriteResult, r as NATIVE_QUEUE_MAX_MESSAGE_BYTES, s as queueOrphanName, t as MAX_RUN_LIST_LIMIT, u as validateNativeQueueEnvelope, v as runIndexMetadata, x as LIFECYCLE_COMPACTION_RETRY_MS } from "./run-list-B__jKuE7.js";
+import { $ as validateStreamReadRequest, B as MAX_STREAM_READ_BYTES, C as HOOK_CLAIM_LEASE_MS, I as MAX_STREAM_BATCH_BYTES, J as encodeStreamReadResult, K as decodeStreamWriteBatch, L as MAX_STREAM_CHUNK_BYTES, M as isPositiveSafeInteger, N as isRecord$1, O as MAX_RUN_INDEX_PUBLICATION_LIFETIME_MS, Q as normalizeStreamError, U as STREAM_BATCH_CONTENT_TYPE, W as STREAM_CHUNK_LIMIT_HEADER, X as encodeStreamWriteResult, _ as rpcStringify, a as QUEUE_PUBLICATION_LEASE_MS, b as createWorkflowIndex, d as queuePayloadObjectKey, et as validateStreamWriteChunks, f as queuePayloadRegistryKey, g as rpcParse, h as compact, i as QUEUE_PAYLOAD_REGISTRY_PREFIX, j as isNonNegativeSafeInteger, l as queueClaimName, m as validateNativeQueueSendOptions, n as listRunsPage, o as QUEUE_RESERVATION_GRACE_MS, p as validateNativeQueueEnvelope, r as NATIVE_QUEUE_MAX_MESSAGE_BYTES, s as isInlineRunBody, t as MAX_RUN_LIST_LIMIT, u as queueOrphanName, v as parse, w as LIFECYCLE_COMPACTION_RETRY_MS, x as runIndexMetadata, z as MAX_STREAM_LONG_POLL_MS } from "./run-list-DGsdv6Jf.js";
 import { CreateEventSchema, EventSchema, HookSchema, SPEC_VERSION_CURRENT, StepSchema, WaitSchema, WorkflowRunSchema, applyAttributeChanges, eventIdToSlot, getMaxEventsPerRun, isChildEntityCreationEvent, isTerminalStepStatus, isTerminalWorkflowRunStatus, slotToEventId, validateAttributeChanges } from "@workflow/world";
 import http from "node:http";
 //#region src/testing/fake-cell.ts
@@ -373,6 +373,10 @@ var FakeFleet = class {
 			}
 		}, this.cellEnv);
 	}
+	/** Whether a cell has been activated, without activating it. */
+	hasCell(bindingKey, name) {
+		return this.cells.has(`${bindingKey}\0${name}`);
+	}
 	cell(bindingKey, name) {
 		const key = `${bindingKey}\0${name}`;
 		let slot = this.cells.get(key);
@@ -542,8 +546,8 @@ function readStringProp(value, key) {
 	}
 }
 /**
-* Map a failure eventData.error (which may be a string, an Error-shaped
-* object, or anything else) to the structured error stored on entities.
+* Map a run failure eventData.error (which may be a string, an Error-shaped
+* object, or anything else) to the structured error stored on runs.
 * Matches upstream: string errors keep their text, errorCode is preserved.
 */
 function toStructuredError(error, opts) {
@@ -1019,14 +1023,17 @@ async function applyEvent(store, ctx) {
 			}
 			if (!step) return failure("STEP_NOT_FOUND", `Step "${data.correlationId}" not found`);
 			if (step.retryAfter && step.retryAfter.getTime() > now.getTime()) return failure("TOO_EARLY", `Cannot start step "${data.correlationId}": retryAfter timestamp has not been reached yet`, { retryAfterSeconds: Math.ceil((step.retryAfter.getTime() - now.getTime()) / 1e3) });
-			const updated = StepSchema.parse(compact({
-				...step,
-				status: "running",
-				startedAt: step.startedAt ?? now,
-				attempt: step.attempt + 1,
-				retryAfter: void 0,
-				updatedAt: now
-			}));
+			const updated = StepSchema.parse({
+				...compact({
+					...step,
+					status: "running",
+					startedAt: step.startedAt ?? now,
+					attempt: step.attempt + 1,
+					retryAfter: void 0,
+					updatedAt: now
+				}),
+				error: step.error
+			});
 			const event = buildEvent({ ...data });
 			await store.put(`${STEP_KEY_PREFIX}${data.correlationId}`, updated);
 			await putEvent(event);
@@ -1041,13 +1048,16 @@ async function applyEvent(store, ctx) {
 		case "step_completed": {
 			const step = validatedStep;
 			if (!step) return failure("STEP_NOT_FOUND", `Step "${data.correlationId}" not found`);
-			const updated = StepSchema.parse(compact({
-				...step,
-				status: "completed",
-				output: data.eventData.result,
-				completedAt: now,
-				updatedAt: now
-			}));
+			const updated = StepSchema.parse({
+				...compact({
+					...step,
+					status: "completed",
+					output: data.eventData.result,
+					completedAt: now,
+					updatedAt: now
+				}),
+				error: step.error
+			});
 			const event = buildEvent({ ...data });
 			await store.put(`${STEP_KEY_PREFIX}${data.correlationId}`, updated);
 			await putEvent(event);
@@ -1061,13 +1071,13 @@ async function applyEvent(store, ctx) {
 		case "step_failed": {
 			const step = validatedStep;
 			if (!step) return failure("STEP_NOT_FOUND", `Step "${data.correlationId}" not found`);
-			const updated = StepSchema.parse(compact({
+			const updated = StepSchema.parse({
 				...step,
 				status: "failed",
-				error: toStructuredError(data.eventData.error),
+				error: data.eventData.error,
 				completedAt: now,
 				updatedAt: now
-			}));
+			});
 			const event = buildEvent({ ...data });
 			await store.put(`${STEP_KEY_PREFIX}${data.correlationId}`, updated);
 			await putEvent(event);
@@ -1081,13 +1091,13 @@ async function applyEvent(store, ctx) {
 		case "step_retrying": {
 			const step = validatedStep;
 			if (!step) return failure("STEP_NOT_FOUND", `Step "${data.correlationId}" not found`);
-			const updated = StepSchema.parse(compact({
+			const updated = StepSchema.parse({
 				...step,
 				status: "pending",
-				error: toStructuredError(data.eventData.error),
+				error: data.eventData.error,
 				retryAfter: data.eventData.retryAfter ? new Date(data.eventData.retryAfter) : void 0,
 				updatedAt: now
-			}));
+			});
 			const event = buildEvent({ ...data });
 			await store.put(`${STEP_KEY_PREFIX}${data.correlationId}`, updated);
 			await putEvent(event);
@@ -1123,7 +1133,7 @@ async function applyEvent(store, ctx) {
 			}
 			if (await store.get(markerKey) !== void 0) {
 				const existingHook = await store.get(hookKey);
-				if (existingHook && !holder) return {
+				if (existingHook && !holder && existingHook.token === token) return {
 					ok: true,
 					hook: existingHook,
 					hookToIndex: existingHook,
@@ -1350,6 +1360,60 @@ async function authenticate(request, secret) {
 	return { ok: true };
 }
 //#endregion
+//#region src/worker/queue-claims.ts
+function cellQueueClaim(cell) {
+	return {
+		claim: (messageId, staleMs) => cell.claimInflight({
+			messageId,
+			staleMs
+		}),
+		hold: (params) => cell.holdInflight(params),
+		release: (messageId) => cell.releaseInflight(messageId),
+		abandonReservation: (messageId) => cell.abandonQueueMessageReservation(messageId),
+		confirmPublication: (messageId, expiresAt) => cell.confirmQueueMessagePublication({
+			messageId,
+			expiresAt
+		}),
+		complete: (messageId) => cell.completeQueueMessage(messageId)
+	};
+}
+function runQueueClaim(run, claimName) {
+	return {
+		claim: async (messageId, staleMs) => {
+			const result = await run.claimRunQueueMessage({
+				claimName,
+				messageId,
+				staleMs
+			});
+			return result.expired ? {
+				expired: true,
+				claimed: false
+			} : result;
+		},
+		hold: (params) => run.holdRunQueueMessage({
+			claimName,
+			...params
+		}),
+		release: (messageId) => run.releaseRunQueueMessage({
+			claimName,
+			messageId
+		}),
+		abandonReservation: (messageId) => run.abandonRunQueueMessageReservation({
+			claimName,
+			messageId
+		}),
+		confirmPublication: (messageId, expiresAt) => run.confirmRunQueueMessagePublication({
+			claimName,
+			messageId,
+			expiresAt
+		}),
+		complete: (messageId) => run.completeRunQueueMessage({
+			claimName,
+			messageId
+		})
+	};
+}
+//#endregion
 //#region src/worker/index-validation.ts
 function invalid(message) {
 	const error = /* @__PURE__ */ new Error(`invalid index RPC arguments: ${message}`);
@@ -1598,6 +1662,18 @@ const INDEX_OPERATIONS = /* @__PURE__ */ new Set([
 */
 const WORLD_NAME = "world-celld";
 const WORLD_VERSION = "0.1.0";
+/**
+* Per-isolate record of runs whose Queue idempotency claims stay in claim
+* cells (created before run-scoped claims) or live in the run cell. A run's
+* scope never changes, so the cache only saves the run-cell question.
+*/
+const runClaimScopes = /* @__PURE__ */ new Map();
+const MAX_REMEMBERED_RUN_CLAIM_SCOPES = 4096;
+function rememberRunClaimScope(runId, scope) {
+	if (runClaimScopes.has(runId)) return;
+	if (runClaimScopes.size >= MAX_REMEMBERED_RUN_CLAIM_SCOPES) runClaimScopes.delete(runClaimScopes.keys().next().value);
+	runClaimScopes.set(runId, scope);
+}
 function workflowIndex(env) {
 	return createWorkflowIndex({
 		runCatalog: env.WORKFLOW_RUN_CATALOG,
@@ -1652,7 +1728,8 @@ const BINDINGS = {
 			"scheduleCleanup",
 			"cleanupNow",
 			"rearmCleanup",
-			"resolveHookTokenClaim"
+			"resolveHookTokenClaim",
+			"resolveExpiredHookClaim"
 		])
 	},
 	streams: {
@@ -1679,7 +1756,6 @@ const BINDINGS = {
 /** Request body cap: oversize payloads get a clear 413 instead of an OOM. */
 const MAX_BODY_BYTES = 33554432;
 const MAX_STREAM_WRITE_BODY_BYTES = MAX_STREAM_BATCH_BYTES + 2048 + 1024;
-const QUEUE_ORPHAN_GRACE_MS = 432e6;
 function errorResponse(status, name, message) {
 	return Response.json({ error: {
 		name,
@@ -1832,34 +1908,82 @@ function createRouter(env) {
 				} catch (error) {
 					return errorResponse(400, "BadRequest", error.message);
 				}
+				let enqueueClaim;
 				try {
 					const namespace = env.WORKFLOW_DB;
 					const payloadStore = env.WORKFLOW_QUEUE_PAYLOADS;
-					const payloadKey = envelope.runId ? queuePayloadObjectKey(envelope.runId, envelope.messageId) : void 0;
-					const brokerEnvelope = payloadKey ? {
+					const inlineRunBody = envelope.runId !== void 0 && isInlineRunBody(envelope.body);
+					const payloadKey = envelope.runId && !inlineRunBody ? queuePayloadObjectKey(envelope.runId, envelope.messageId) : void 0;
+					let brokerEnvelope = payloadKey ? {
 						...envelope,
 						payloadKey,
 						body: void 0
 					} : envelope;
-					const encoded = JSON.stringify(brokerEnvelope);
-					if (new TextEncoder().encode(encoded).byteLength > 128e3) return errorResponse(413, "PayloadTooLarge", `native queue envelope exceeds ${NATIVE_QUEUE_MAX_MESSAGE_BYTES} bytes`);
+					const sized = JSON.stringify({
+						...brokerEnvelope,
+						claimScope: "run"
+					});
+					if (new TextEncoder().encode(sized).byteLength > 128e3) return errorResponse(413, "PayloadTooLarge", `native queue envelope exceeds ${NATIVE_QUEUE_MAX_MESSAGE_BYTES} bytes`);
 					const now = Date.now();
-					const reservationExpiresAt = Math.max(now, envelope.notBefore ?? now) + QUEUE_ORPHAN_GRACE_MS;
-					let claim;
+					const reservationExpiresAt = Math.max(now, envelope.notBefore ?? now) + QUEUE_RESERVATION_GRACE_MS;
+					const run = envelope.runId ? namespace.get(namespace.idFromName(envelope.runId)) : void 0;
+					let admission;
 					if (envelope.idempotencyKey) {
-						claim = namespace.get(namespace.idFromName(queueClaimName(envelope.queueName, envelope.idempotencyKey)));
-						const reservation = await claim.reserveQueueMessage({
-							messageId: envelope.messageId,
-							expiresAt: reservationExpiresAt
-						});
-						if (!reservation.admitted) return new Response(rpcStringify({ messageId: reservation.messageId }), {
-							status: 200,
-							headers: { "content-type": "application/json" }
-						});
+						const claimName = queueClaimName(envelope.queueName, envelope.idempotencyKey);
+						let scope = run && envelope.runId ? runClaimScopes.get(envelope.runId) : "cell";
+						let reservation;
+						if (run && envelope.runId && scope !== "cell") {
+							enqueueClaim = runQueueClaim(run, claimName);
+							const reserved = await run.reserveRunQueueMessage({
+								claimName,
+								messageId: envelope.messageId,
+								expiresAt: now + QUEUE_PUBLICATION_LEASE_MS,
+								publicationPending: true
+							});
+							if (!reserved.ok) return errorResponse(410, "RunExpiredError", reserved.message);
+							scope = reserved.scope;
+							rememberRunClaimScope(envelope.runId, reserved.scope);
+							if (reserved.scope === "run") {
+								reservation = reserved;
+								brokerEnvelope = {
+									...brokerEnvelope,
+									claimScope: "run"
+								};
+							}
+						} else if (inlineRunBody && run) {
+							admission = run.getQueueAdmission();
+							admission.catch(() => void 0);
+						}
+						if (!reservation) {
+							const cell = namespace.get(namespace.idFromName(claimName));
+							enqueueClaim = cellQueueClaim(cell);
+							reservation = await cell.reserveQueueMessage({
+								messageId: envelope.messageId,
+								expiresAt: now + QUEUE_PUBLICATION_LEASE_MS,
+								publicationPending: true
+							});
+						}
+						if (!reservation.admitted) {
+							if (reservation.publicationPending) return errorResponse(503, "QueuePublicationPending", "the reserved Queue message has not been confirmed by the broker; retry publication");
+							return new Response(rpcStringify({ messageId: reservation.messageId }), {
+								status: 200,
+								headers: { "content-type": "application/json" }
+							});
+						}
+					} else if (inlineRunBody && run) admission = run.getQueueAdmission();
+					const encoded = JSON.stringify(brokerEnvelope);
+					if (admission) {
+						const admitted = await admission;
+						if (!admitted.ok) {
+							await enqueueClaim?.complete(envelope.messageId);
+							return errorResponse(410, "RunExpiredError", admitted.message);
+						}
 					}
-					if (envelope.runId && payloadKey) {
-						if (!payloadStore) return errorResponse(500, "WorldMisconfigured", "missing binding: WORKFLOW_QUEUE_PAYLOADS");
-						const run = namespace.get(namespace.idFromName(envelope.runId));
+					if (run && envelope.runId && payloadKey) {
+						if (!payloadStore) {
+							await enqueueClaim?.abandonReservation(envelope.messageId);
+							return errorResponse(500, "WorldMisconfigured", "missing binding: WORKFLOW_QUEUE_PAYLOADS");
+						}
 						const orphanExpiresAt = reservationExpiresAt;
 						const registered = await run.registerQueuePayload({
 							messageId: envelope.messageId,
@@ -1867,7 +1991,7 @@ function createRouter(env) {
 							orphanExpiresAt
 						});
 						if (!registered.ok) {
-							await claim?.completeQueueMessage(envelope.messageId);
+							await enqueueClaim?.complete(envelope.messageId);
 							return errorResponse(410, "RunExpiredError", registered.message);
 						}
 						const orphan = namespace.get(namespace.idFromName(queueOrphanName(envelope.messageId)));
@@ -1880,30 +2004,18 @@ function createRouter(env) {
 							});
 						} catch (error) {
 							await run.unregisterQueuePayload(envelope.messageId);
-							await claim?.completeQueueMessage(envelope.messageId);
-							throw error;
-						}
-						try {
-							await payloadStore.write(payloadKey, envelope.body, {
-								runId: envelope.runId,
-								messageId: envelope.messageId
-							});
-						} catch (error) {
-							await claim?.completeQueueMessage(envelope.messageId);
-							throw error;
-						}
-						let finalized;
-						try {
-							finalized = await run.finalizeQueuePayload(envelope.messageId);
-						} catch (error) {
-							await claim?.completeQueueMessage(envelope.messageId);
 							throw error;
 						}
+						await payloadStore.write(payloadKey, envelope.body, {
+							runId: envelope.runId,
+							messageId: envelope.messageId
+						});
+						const finalized = await run.finalizeQueuePayload(envelope.messageId);
 						if (!finalized.ok) {
 							await payloadStore.delete(payloadKey);
 							await run.unregisterQueuePayload(envelope.messageId);
 							await orphan.cancelQueuePayloadOrphan(envelope.messageId);
-							await claim?.completeQueueMessage(envelope.messageId);
+							await enqueueClaim?.complete(envelope.messageId);
 							return errorResponse(410, "RunExpiredError", finalized.message);
 						}
 					}
@@ -1911,11 +2023,17 @@ function createRouter(env) {
 						contentType: "text",
 						...options
 					});
+					await enqueueClaim?.confirmPublication(envelope.messageId, reservationExpiresAt);
 					return new Response(rpcStringify({ messageId: envelope.messageId }), {
 						status: 200,
 						headers: { "content-type": "application/json" }
 					});
 				} catch (error) {
+					try {
+						await enqueueClaim?.abandonReservation(envelope.messageId);
+					} catch (cleanupError) {
+						console.error("world-celld could not abandon a failed Queue reservation", cleanupError);
+					}
 					const err = error;
 					return errorResponse(500, err.name ?? "Error", err.message ?? String(error));
 				}
@@ -2148,6 +2266,16 @@ async function runIsActive(env, runId) {
 	if (!namespace) throw new Error("world-celld hook index missing WORKFLOW_DB binding");
 	return await namespace.get(namespace.idFromName(runId)).getLifecycleStatus() === "active";
 }
+/** Resolve a stale shard reservation in its authoritative event writer. */
+async function resolveExpiredHookClaim(env, owner, claimId, token) {
+	const namespace = env.WORKFLOW_DB;
+	if (!namespace) throw new Error("world-celld hook index missing WORKFLOW_DB binding");
+	return await namespace.get(namespace.idFromName(owner.runId)).resolveExpiredHookClaim({
+		hookId: owner.hookId,
+		claimId,
+		token
+	});
+}
 //#endregion
 //#region src/worker/durable-objects/HookIdDO.ts
 const MAX_RELEASE_BATCH$1 = 64;
@@ -2176,52 +2304,69 @@ var HookIdDO = class extends DurableObject {
 		return await runIsActive(this.env, owner.runId) ? raw : null;
 	}
 	async reserve(hookId, owner, proposedClaimId) {
-		return await this.ctx.storage.transaction(async (txn) => {
-			const record = recordKey$1(hookId);
-			const claim = claimKey$1(hookId);
-			const values = await txn.get([record, claim]);
-			const indexed = values.get(record);
-			if (indexed !== void 0) return {
-				claimed: false,
-				holder: ownerFromSerializedHook(indexed)
-			};
-			let existing = values.get(claim);
-			const now = this.now();
-			if (existing && existing.expiresAt <= now) {
-				await txn.delete([claim, existing.deadlineKey]);
-				existing = void 0;
-			}
-			if (existing !== void 0 && !sameOwner(existing.owner, owner)) return {
-				claimed: false,
-				holder: existing.owner
-			};
-			if (existing === void 0 || existing.claimId !== proposedClaimId) {
-				if (existing) await txn.delete(existing.deadlineKey);
-				const expiresAt = now + HOOK_CLAIM_LEASE_MS;
-				const deadlineKey = claimDeadlineKey$1(hookId, expiresAt);
-				await txn.put(claim, {
-					owner,
-					claimId: proposedClaimId,
-					reservedAt: now,
-					expiresAt,
-					deadlineKey
-				});
-				await txn.put(deadlineKey, {
-					hookId,
-					claimId: proposedClaimId,
-					expiresAt
-				});
-				await this.armAtMost(txn, expiresAt);
+		for (;;) {
+			const observed = await this.ctx.storage.get(claimKey$1(hookId));
+			const expired = observed && observed.expiresAt <= this.now() ? observed : void 0;
+			const committed = expired ? await resolveExpiredHookClaim(this.env, expired.owner, expired.claimId) : void 0;
+			const result = await this.ctx.storage.transaction(async (txn) => {
+				const record = recordKey$1(hookId);
+				const claim = claimKey$1(hookId);
+				const values = await txn.get([record, claim]);
+				const indexed = values.get(record);
+				if (indexed !== void 0) return {
+					claimed: false,
+					holder: ownerFromSerializedHook(indexed)
+				};
+				let existing = values.get(claim);
+				const now = this.now();
+				if (existing && existing.expiresAt <= now) {
+					if (existing.claimId !== expired?.claimId || existing.expiresAt !== expired.expiresAt) return null;
+					if (committed) {
+						await this.renewClaim(txn, hookId, existing, now);
+						return sameOwner(existing.owner, owner) ? {
+							claimed: true,
+							claimId: existing.claimId
+						} : {
+							claimed: false,
+							holder: existing.owner
+						};
+					}
+					await txn.delete([claim, existing.deadlineKey]);
+					existing = void 0;
+				}
+				if (existing !== void 0 && !sameOwner(existing.owner, owner)) return {
+					claimed: false,
+					holder: existing.owner
+				};
+				if (existing === void 0 || existing.claimId !== proposedClaimId) {
+					if (existing) await txn.delete(existing.deadlineKey);
+					const expiresAt = now + HOOK_CLAIM_LEASE_MS;
+					const deadlineKey = claimDeadlineKey$1(hookId, expiresAt);
+					await txn.put(claim, {
+						owner,
+						claimId: proposedClaimId,
+						reservedAt: now,
+						expiresAt,
+						deadlineKey
+					});
+					await txn.put(deadlineKey, {
+						hookId,
+						claimId: proposedClaimId,
+						expiresAt
+					});
+					await this.armAtMost(txn, expiresAt);
+					return {
+						claimed: true,
+						claimId: proposedClaimId
+					};
+				}
 				return {
 					claimed: true,
-					claimId: proposedClaimId
+					claimId: existing.claimId
 				};
-			}
-			return {
-				claimed: true,
-				claimId: existing.claimId
-			};
-		});
+			});
+			if (result) return result;
+		}
 	}
 	async publish(hookId, serializedHook, owner, claimId) {
 		if (!await runIsActive(this.env, owner.runId)) {
@@ -2238,10 +2383,7 @@ var HookIdDO = class extends DurableObject {
 			const indexed = values.get(record);
 			if (indexed !== void 0 && !sameOwner(ownerFromSerializedHook(indexed), owner)) throw new Error(`Hook id ${hookId} is owned by another hook`);
 			const existingClaim = values.get(claim);
-			if (existingClaim && existingClaim.expiresAt <= this.now()) {
-				await txn.delete([claim, existingClaim.deadlineKey]);
-				return { stored: false };
-			}
+			if (existingClaim && existingClaim.expiresAt <= this.now()) throw new Error(`Hook id ${hookId} reservation expired`);
 			if (existingClaim !== void 0 && (!sameOwner(existingClaim.owner, owner) || existingClaim.claimId !== claimId)) throw new Error(`Hook id ${hookId} is reserved by another hook`);
 			if (indexed === void 0 && existingClaim === void 0) throw new Error(`Hook id ${hookId} has no active reservation`);
 			await txn.put(record, serializedHook);
@@ -2291,21 +2433,51 @@ var HookIdDO = class extends DurableObject {
 		const current = await storage.getAlarm();
 		if (current === null || at < current) await storage.setAlarm(at);
 	}
+	async renewClaim(txn, hookId, claim, now) {
+		const expiresAt = now + HOOK_CLAIM_LEASE_MS;
+		const deadlineKey = claimDeadlineKey$1(hookId, expiresAt);
+		await txn.delete(claim.deadlineKey);
+		await txn.put(claimKey$1(hookId), {
+			...claim,
+			expiresAt,
+			deadlineKey
+		});
+		await txn.put(deadlineKey, {
+			hookId,
+			claimId: claim.claimId,
+			expiresAt
+		});
+		await this.armAtMost(txn, expiresAt);
+	}
 	async compactClaims() {
 		const now = this.now();
+		const due = await this.ctx.storage.list({
+			prefix: CLAIM_DEADLINE_PREFIX$1,
+			end: `${CLAIM_DEADLINE_PREFIX$1}${pad$2(now + 1)}`,
+			limit: 129
+		});
+		const page = Array.from(due).slice(0, 128);
+		const observed = await this.ctx.storage.get(page.map(([, item]) => claimKey$1(item.hookId)));
+		const committed = /* @__PURE__ */ new Map();
+		await Promise.all(page.map(async ([, item]) => {
+			const claim = observed.get(claimKey$1(item.hookId));
+			if (!claim || claim.claimId !== item.claimId || claim.expiresAt > now) return;
+			const hook = await resolveExpiredHookClaim(this.env, claim.owner, claim.claimId);
+			committed.set(claimKey$1(item.hookId), hook !== null);
+		}));
 		await this.ctx.storage.transaction(async (txn) => {
-			const due = await txn.list({
-				prefix: CLAIM_DEADLINE_PREFIX$1,
-				end: `${CLAIM_DEADLINE_PREFIX$1}${pad$2(now + 1)}`,
-				limit: 129
-			});
-			const page = Array.from(due).slice(0, 128);
 			const claims = await txn.get(page.map(([, item]) => claimKey$1(item.hookId)));
-			const deletes = page.flatMap(([deadline, item]) => {
+			const deletes = [];
+			for (const [deadline, item] of page) {
 				const key = claimKey$1(item.hookId);
 				const claim = claims.get(key);
-				return claim?.claimId === item.claimId && claim.expiresAt <= now ? [deadline, key] : [deadline];
-			});
+				const snapshot = observed.get(key);
+				if (claim?.claimId !== item.claimId || claim.expiresAt > now) deletes.push(deadline);
+				else if (claim.claimId === snapshot?.claimId && claim.expiresAt === snapshot.expiresAt) {
+					if (committed.get(key)) await this.renewClaim(txn, item.hookId, claim, now);
+					else deletes.push(deadline, key);
+				}
+			}
 			for (let offset = 0; offset < deletes.length; offset += 128) await txn.delete(deletes.slice(offset, offset + 128));
 			if (due.size > 128) {
 				await txn.setAlarm(now + 1);
@@ -2348,51 +2520,68 @@ var HookTokenDO = class extends DurableObject {
 		return await runIsActive(this.env, owner.runId) ? raw : null;
 	}
 	async reserve(token, owner, proposedClaimId) {
-		return await this.ctx.storage.transaction(async (txn) => {
-			const record = recordKey(token);
-			const claim = claimKey(token);
-			const values = await txn.get([record, claim]);
-			const indexed = values.get(record);
-			if (indexed !== void 0) return {
-				claimed: false,
-				holder: ownerFromSerializedHook(indexed)
-			};
-			let existing = values.get(claim);
-			const now = this.now();
-			if (existing && existing.expiresAt <= now) {
-				await txn.delete([claim, existing.deadlineKey]);
-				existing = void 0;
-			}
-			if (existing !== void 0 && !sameOwner(existing.owner, owner)) return {
-				claimed: false,
-				holder: existing.owner
-			};
-			if (existing === void 0) {
-				const expiresAt = now + HOOK_CLAIM_LEASE_MS;
-				const deadlineKey = claimDeadlineKey(token, expiresAt);
-				await txn.put(claim, {
-					owner,
-					claimId: proposedClaimId,
-					reservedAt: now,
-					expiresAt,
-					deadlineKey
-				});
-				await txn.put(deadlineKey, {
-					token,
-					claimId: proposedClaimId,
-					expiresAt
-				});
-				await this.armAtMost(txn, expiresAt);
+		for (;;) {
+			const observed = await this.ctx.storage.get(claimKey(token));
+			const expired = observed && observed.expiresAt <= this.now() ? observed : void 0;
+			const committed = expired ? await resolveExpiredHookClaim(this.env, expired.owner, expired.claimId, token) : void 0;
+			const result = await this.ctx.storage.transaction(async (txn) => {
+				const record = recordKey(token);
+				const claim = claimKey(token);
+				const values = await txn.get([record, claim]);
+				const indexed = values.get(record);
+				if (indexed !== void 0) return {
+					claimed: false,
+					holder: ownerFromSerializedHook(indexed)
+				};
+				let existing = values.get(claim);
+				const now = this.now();
+				if (existing && existing.expiresAt <= now) {
+					if (existing.claimId !== expired?.claimId || existing.expiresAt !== expired.expiresAt) return null;
+					if (committed) {
+						await this.renewClaim(txn, token, existing, now);
+						return sameOwner(existing.owner, owner) ? {
+							claimed: true,
+							claimId: existing.claimId
+						} : {
+							claimed: false,
+							holder: existing.owner
+						};
+					}
+					await txn.delete([claim, existing.deadlineKey]);
+					existing = void 0;
+				}
+				if (existing !== void 0 && !sameOwner(existing.owner, owner)) return {
+					claimed: false,
+					holder: existing.owner
+				};
+				if (existing === void 0) {
+					const expiresAt = now + HOOK_CLAIM_LEASE_MS;
+					const deadlineKey = claimDeadlineKey(token, expiresAt);
+					await txn.put(claim, {
+						owner,
+						claimId: proposedClaimId,
+						reservedAt: now,
+						expiresAt,
+						deadlineKey
+					});
+					await txn.put(deadlineKey, {
+						token,
+						claimId: proposedClaimId,
+						expiresAt
+					});
+					await this.armAtMost(txn, expiresAt);
+					return {
+						claimed: true,
+						claimId: proposedClaimId
+					};
+				}
 				return {
 					claimed: true,
-					claimId: proposedClaimId
+					claimId: existing.claimId
 				};
-			}
-			return {
-				claimed: true,
-				claimId: existing.claimId
-			};
-		});
+			});
+			if (result) return result;
+		}
 	}
 	async finalize(token, serializedHook, owner, claimId) {
 		if (!await runIsActive(this.env, owner.runId)) {
@@ -2409,10 +2598,7 @@ var HookTokenDO = class extends DurableObject {
 			const indexed = values.get(record);
 			if (indexed !== void 0 && !sameOwner(ownerFromSerializedHook(indexed), owner)) throw new Error(`Hook token ${token} is owned by another hook`);
 			const existingClaim = values.get(claim);
-			if (existingClaim && existingClaim.expiresAt <= this.now()) {
-				await txn.delete([claim, existingClaim.deadlineKey]);
-				return { stored: false };
-			}
+			if (existingClaim && existingClaim.expiresAt <= this.now()) throw new Error(`Hook token ${token} reservation expired`);
 			if (existingClaim !== void 0 && (!sameOwner(existingClaim.owner, owner) || existingClaim.claimId !== claimId)) throw new Error(`Hook token ${token} is reserved by another hook`);
 			if (indexed === void 0 && existingClaim === void 0) throw new Error(`Hook token ${token} has no active reservation`);
 			await txn.put(record, serializedHook);
@@ -2462,21 +2648,51 @@ var HookTokenDO = class extends DurableObject {
 		const current = await storage.getAlarm();
 		if (current === null || at < current) await storage.setAlarm(at);
 	}
+	async renewClaim(txn, token, claim, now) {
+		const expiresAt = now + HOOK_CLAIM_LEASE_MS;
+		const deadlineKey = claimDeadlineKey(token, expiresAt);
+		await txn.delete(claim.deadlineKey);
+		await txn.put(claimKey(token), {
+			...claim,
+			expiresAt,
+			deadlineKey
+		});
+		await txn.put(deadlineKey, {
+			token,
+			claimId: claim.claimId,
+			expiresAt
+		});
+		await this.armAtMost(txn, expiresAt);
+	}
 	async compactClaims() {
 		const now = this.now();
+		const due = await this.ctx.storage.list({
+			prefix: CLAIM_DEADLINE_PREFIX,
+			end: `${CLAIM_DEADLINE_PREFIX}${pad$1(now + 1)}`,
+			limit: 129
+		});
+		const page = Array.from(due).slice(0, 128);
+		const observed = await this.ctx.storage.get(page.map(([, item]) => claimKey(item.token)));
+		const committed = /* @__PURE__ */ new Map();
+		await Promise.all(page.map(async ([, item]) => {
+			const claim = observed.get(claimKey(item.token));
+			if (!claim || claim.claimId !== item.claimId || claim.expiresAt > now) return;
+			const hook = await resolveExpiredHookClaim(this.env, claim.owner, claim.claimId, item.token);
+			committed.set(claimKey(item.token), hook !== null);
+		}));
 		await this.ctx.storage.transaction(async (txn) => {
-			const due = await txn.list({
-				prefix: CLAIM_DEADLINE_PREFIX,
-				end: `${CLAIM_DEADLINE_PREFIX}${pad$1(now + 1)}`,
-				limit: 129
-			});
-			const page = Array.from(due).slice(0, 128);
 			const claims = await txn.get(page.map(([, item]) => claimKey(item.token)));
-			const deletes = page.flatMap(([deadline, item]) => {
+			const deletes = [];
+			for (const [deadline, item] of page) {
 				const key = claimKey(item.token);
 				const claim = claims.get(key);
-				return claim?.claimId === item.claimId && claim.expiresAt <= now ? [deadline, key] : [deadline];
-			});
+				const snapshot = observed.get(key);
+				if (claim?.claimId !== item.claimId || claim.expiresAt > now) deletes.push(deadline);
+				else if (claim.claimId === snapshot?.claimId && claim.expiresAt === snapshot.expiresAt) {
+					if (committed.get(key)) await this.renewClaim(txn, item.token, claim, now);
+					else deletes.push(deadline, key);
+				}
+			}
 			for (let offset = 0; offset < deletes.length; offset += 128) await txn.delete(deletes.slice(offset, offset + 128));
 			if (due.size > 128) {
 				await txn.setAlarm(now + 1);
@@ -2655,6 +2871,13 @@ const DELETE_BATCH_KEYS = 128;
 const DEFAULT_EXPIRE_BYTE_LIMIT = 16777216;
 const MAX_EXPIRE_BYTE_LIMIT = DEFAULT_EXPIRE_BYTE_LIMIT;
 const MAX_STREAM_INDEX = 2147483647;
+const SEGMENT_LAYOUT = 2;
+const SEGMENT_KEY_PREFIX = "seg:";
+const SEGMENT_SIZE_KEY_PREFIX = "segsize:";
+/** Payload bytes per segment row, well below the 2 MiB per-value storage limit. */
+const MAX_SEGMENT_BYTES = 1048576;
+/** Layout of a stream's first write. Existing streams keep the layout they started with. */
+const NEW_STREAM_LAYOUT = SEGMENT_LAYOUT;
 /** One storage get or put call accepts at most 128 keys. */
 const STORAGE_BATCH_KEYS = 128;
 function boundedLimit(value, fallback, maximum) {
@@ -2675,7 +2898,7 @@ function validateMeta(meta) {
 		"closed",
 		"errored",
 		"expired"
-	].includes(candidate.state) || candidate.ownerRunId !== void 0 && typeof candidate.ownerRunId !== "string" || candidate.payloadDeleted !== void 0 && typeof candidate.payloadDeleted !== "boolean") throw new Error("Invalid persisted stream metadata");
+	].includes(candidate.state) || candidate.ownerRunId !== void 0 && typeof candidate.ownerRunId !== "string" || candidate.payloadDeleted !== void 0 && typeof candidate.payloadDeleted !== "boolean" || candidate.layout !== void 0 && candidate.layout !== SEGMENT_LAYOUT) throw new Error("Invalid persisted stream metadata");
 	const error = candidate.error;
 	if (error !== void 0 && (!error || typeof error !== "object" || typeof error.name !== "string" || typeof error.message !== "string") || candidate.state === "errored" !== (error !== void 0)) throw new Error("Invalid persisted stream error metadata");
 	return candidate;
@@ -2687,6 +2910,80 @@ function chunkKey(index) {
 function chunkSizeKey(index) {
 	return `${CHUNK_SIZE_KEY_PREFIX}${index.toString().padStart(12, "0")}`;
 }
+function segmentKey(start) {
+	return `${SEGMENT_KEY_PREFIX}${start.toString().padStart(12, "0")}`;
+}
+function segmentSizeKey(start) {
+	return `${SEGMENT_SIZE_KEY_PREFIX}${start.toString().padStart(12, "0")}`;
+}
+function startFromSegmentKey(key, prefix) {
+	const suffix = key.slice(prefix.length);
+	const start = Number(suffix);
+	if (!key.startsWith(prefix) || !/^\d{12}$/.test(suffix) || !Number.isSafeInteger(start) || start > MAX_STREAM_INDEX) throw new Error(`Invalid persisted stream segment key "${key}"`);
+	return start;
+}
+function validateSegmentSize(value, start) {
+	const size = value;
+	if (!size || !Number.isSafeInteger(size.count) || size.count < 1 || !Number.isSafeInteger(size.bytes) || size.bytes < 0) throw new Error(`Invalid persisted stream segment size at index ${start}`);
+	return size;
+}
+/** Pack chunks as `[u32 count][u32 length]*count` followed by the payloads. */
+function encodeSegment(chunks) {
+	const payloadBytes = chunks.reduce((total, chunk) => total + chunk.byteLength, 0);
+	const header = 4 + 4 * chunks.length;
+	const encoded = new Uint8Array(header + payloadBytes);
+	const view = new DataView(encoded.buffer);
+	view.setUint32(0, chunks.length);
+	let offset = header;
+	for (let index = 0; index < chunks.length; index++) {
+		view.setUint32(4 + 4 * index, chunks[index].byteLength);
+		encoded.set(chunks[index], offset);
+		offset += chunks[index].byteLength;
+	}
+	return encoded;
+}
+function decodeSegment(value, start, size) {
+	if (!(value instanceof Uint8Array) || value.byteLength < 4) throw new Error(`Invalid persisted stream segment at index ${start}`);
+	const view = new DataView(value.buffer, value.byteOffset, value.byteLength);
+	const count = view.getUint32(0);
+	const header = 4 + 4 * count;
+	if (count !== size.count || header + size.bytes !== value.byteLength) throw new Error(`Invalid persisted stream segment at index ${start}`);
+	const chunks = [];
+	let offset = header;
+	for (let index = 0; index < count; index++) {
+		const length = view.getUint32(4 + 4 * index);
+		if (offset + length > value.byteLength) throw new Error(`Invalid persisted stream segment at index ${start}`);
+		chunks.push(value.subarray(offset, offset + length));
+		offset += length;
+	}
+	if (offset !== value.byteLength) throw new Error(`Invalid persisted stream segment at index ${start}`);
+	return chunks;
+}
+/** Group one write's chunks into segments of at most MAX_SEGMENT_BYTES payload bytes. */
+function packSegments(startIndex, chunks) {
+	const segments = [];
+	let current = [];
+	let bytes = 0;
+	let start = startIndex;
+	for (const chunk of chunks) {
+		if (current.length > 0 && bytes + chunk.byteLength > MAX_SEGMENT_BYTES) {
+			segments.push({
+				start,
+				chunks: current
+			});
+			start += current.length;
+			current = [];
+			bytes = 0;
+		}
+		current.push(chunk);
+		bytes += chunk.byteLength;
+	}
+	if (current.length > 0) segments.push({
+		start,
+		chunks: current
+	});
+	return segments;
+}
 function indexFromChunkSizeKey(key) {
 	const suffix = key.slice(11);
 	const index = Number(suffix);
@@ -2703,6 +3000,9 @@ function validateChunkSize(size, index) {
 	if (typeof size !== "number" || !Number.isSafeInteger(size) || size < 0 || size > 1048576) throw new Error(`Invalid persisted stream chunk size at index ${index}`);
 	return size;
 }
+async function deleteInBatches(txn, keys) {
+	for (let offset = 0; offset < keys.length; offset += DELETE_BATCH_KEYS) await txn.delete(keys.slice(offset, offset + DELETE_BATCH_KEYS));
+}
 function compactChunk(chunk) {
 	return chunk.byteOffset === 0 && chunk.byteLength === chunk.buffer.byteLength ? chunk : new Uint8Array(chunk);
 }
@@ -2799,29 +3099,8 @@ var StreamDO = class extends DurableObject {
 		const meta = await this.getMeta();
 		this.assertOwner(meta, request.runId);
 		const available = meta.state === "expired" ? 0 : Math.max(0, Math.min(request.maxChunks, meta.count - request.startIndex));
-		const chunks = [];
-		if (available > 0) {
-			const indexes = Array.from({ length: available }, (_, offset) => request.startIndex + offset);
-			const sizeKeys = indexes.map(chunkSizeKey);
-			const storedSizes = await this.getMany(sizeKeys);
-			const selectedIndexes = [];
-			const selectedSizes = [];
-			let bytes = 0;
-			for (const index of indexes) {
-				const size = validateChunkSize(storedSizes.get(chunkSizeKey(index)), index);
-				if (bytes + size > request.maxBytes) break;
-				selectedIndexes.push(index);
-				selectedSizes.push(size);
-				bytes += size;
-			}
-			const payloadKeys = selectedIndexes.map(chunkKey);
-			const storedChunks = await this.getMany(payloadKeys);
-			for (let offset = 0; offset < payloadKeys.length; offset++) {
-				const chunk = storedChunks.get(payloadKeys[offset]);
-				if (!(chunk instanceof Uint8Array) || chunk.byteLength !== selectedSizes[offset]) throw new Error(`Invalid persisted stream chunk at index ${selectedIndexes[offset]}`);
-				chunks.push(chunk);
-			}
-		}
+		let chunks = [];
+		if (available > 0) chunks = meta.layout === SEGMENT_LAYOUT ? await this.readSegmentRows(request.startIndex, available, request.maxBytes) : await this.readChunkRows(request.startIndex, available, request.maxBytes);
 		return {
 			startIndex: request.startIndex,
 			tailIndex: meta.count - 1,
@@ -2831,10 +3110,100 @@ var StreamDO = class extends DurableObject {
 			error: meta.error
 		};
 	}
+	async readChunkRows(startIndex, available, maxBytes) {
+		const indexes = Array.from({ length: available }, (_, offset) => startIndex + offset);
+		const sizeKeys = indexes.map(chunkSizeKey);
+		const storedSizes = await this.getMany(sizeKeys);
+		const selectedIndexes = [];
+		const selectedSizes = [];
+		let bytes = 0;
+		for (const index of indexes) {
+			const size = validateChunkSize(storedSizes.get(chunkSizeKey(index)), index);
+			if (bytes + size > maxBytes) break;
+			selectedIndexes.push(index);
+			selectedSizes.push(size);
+			bytes += size;
+		}
+		const payloadKeys = selectedIndexes.map(chunkKey);
+		const storedChunks = await this.getMany(payloadKeys);
+		const chunks = [];
+		for (let offset = 0; offset < payloadKeys.length; offset++) {
+			const chunk = storedChunks.get(payloadKeys[offset]);
+			if (!(chunk instanceof Uint8Array) || chunk.byteLength !== selectedSizes[offset]) throw new Error(`Invalid persisted stream chunk at index ${selectedIndexes[offset]}`);
+			chunks.push(chunk);
+		}
+		return chunks;
+	}
+	/**
+	* Plan from the small segment size rows, then load only the segments that
+	* cover the requested range. A read that starts on a segment boundary (the
+	* common sequential case) needs one list and one multi-get.
+	*/
+	async readSegmentRows(startIndex, available, maxBytes) {
+		const endIndex = startIndex + available;
+		const listed = await this.ctx.storage.list({
+			prefix: SEGMENT_SIZE_KEY_PREFIX,
+			start: segmentSizeKey(startIndex),
+			end: segmentSizeKey(endIndex),
+			limit: available
+		});
+		const planned = [];
+		for (const [key, value] of listed) {
+			const start = startFromSegmentKey(key, SEGMENT_SIZE_KEY_PREFIX);
+			planned.push({
+				start,
+				size: validateSegmentSize(value, start)
+			});
+		}
+		if (planned[0]?.start !== startIndex) {
+			const entry = (await this.ctx.storage.list({
+				prefix: SEGMENT_SIZE_KEY_PREFIX,
+				end: segmentSizeKey(startIndex + 1),
+				reverse: true,
+				limit: 1
+			})).entries().next().value;
+			if (!entry) throw new Error(`Missing persisted stream segment at index ${startIndex}`);
+			const start = startFromSegmentKey(entry[0], SEGMENT_SIZE_KEY_PREFIX);
+			planned.unshift({
+				start,
+				size: validateSegmentSize(entry[1], start)
+			});
+		}
+		let covered = startIndex;
+		for (let index = 0; index < planned.length; index++) {
+			const { start, size } = planned[index];
+			if (start > covered) throw new Error(`Missing persisted stream segment at index ${covered}`);
+			if (index > 0 && start !== covered) throw new Error(`Overlapping persisted stream segment at index ${start}`);
+			if (start + size.count <= covered) throw new Error(`Missing persisted stream segment at index ${covered}`);
+			covered = start + size.count;
+		}
+		if (covered < endIndex) throw new Error(`Missing persisted stream segment at index ${covered}`);
+		const selected = [];
+		let plannedBytes = 0;
+		for (const segment of planned) {
+			if (selected.length > 0 && plannedBytes >= maxBytes) break;
+			selected.push(segment);
+			plannedBytes += segment.size.bytes;
+		}
+		const values = await this.getMany(selected.map(({ start }) => segmentKey(start)));
+		const chunks = [];
+		let bytes = 0;
+		let expected = startIndex;
+		for (const { start, size } of selected) {
+			if (start > expected) throw new Error(`Missing persisted stream segment at index ${expected}`);
+			const segment = decodeSegment(values.get(segmentKey(start)), start, size);
+			for (let offset = expected - start; offset < segment.length; offset++) {
+				if (expected >= endIndex || bytes + segment[offset].byteLength > maxBytes) return chunks;
+				chunks.push(segment[offset]);
+				bytes += segment[offset].byteLength;
+				expected++;
+			}
+		}
+		return chunks;
+	}
 	/** Append one bounded binary batch with contiguous indexes. */
 	async writeChunks(runId, chunks) {
 		validateStreamWriteChunks(chunks);
-		const storedChunks = chunks.map(compactChunk);
 		return await this.runMutation(async () => {
 			const committed = await this.ctx.storage.transaction(async (txn) => {
 				const stored = await txn.get(META_KEY);
@@ -2842,16 +3211,28 @@ var StreamDO = class extends DurableObject {
 				this.assertWritable(meta, runId);
 				const startIndex = meta.count;
 				if (startIndex + chunks.length > MAX_STREAM_INDEX) throw new Error("Stream offset limit exceeded");
+				const layout = stored === void 0 ? NEW_STREAM_LAYOUT : meta.layout;
 				const nextMeta = {
 					count: startIndex + chunks.length,
 					state: "open",
-					ownerRunId: runId
+					ownerRunId: runId,
+					...layout === void 0 ? {} : { layout }
 				};
 				const entries = [[META_KEY, nextMeta]];
-				for (let offset = 0; offset < storedChunks.length; offset++) {
-					const index = startIndex + offset;
-					entries.push([chunkKey(index), storedChunks[offset]]);
-					entries.push([chunkSizeKey(index), storedChunks[offset].byteLength]);
+				if (layout === SEGMENT_LAYOUT) for (const segment of packSegments(startIndex, chunks)) {
+					entries.push([segmentKey(segment.start), encodeSegment(segment.chunks)]);
+					entries.push([segmentSizeKey(segment.start), {
+						count: segment.chunks.length,
+						bytes: segment.chunks.reduce((total, chunk) => total + chunk.byteLength, 0)
+					}]);
+				}
+				else {
+					const storedChunks = chunks.map(compactChunk);
+					for (let offset = 0; offset < storedChunks.length; offset++) {
+						const index = startIndex + offset;
+						entries.push([chunkKey(index), storedChunks[offset]]);
+						entries.push([chunkSizeKey(index), storedChunks[offset].byteLength]);
+					}
 				}
 				for (let offset = 0; offset < entries.length; offset += STORAGE_BATCH_KEYS) await txn.put(Object.fromEntries(entries.slice(offset, offset + STORAGE_BATCH_KEYS)));
 				return {
@@ -2987,6 +3368,102 @@ var StreamDO = class extends DurableObject {
 			};
 		});
 	}
+	/** Delete one page of per-chunk rows, listing size rows to avoid loading payloads. */
+	async expireChunkPage(txn, limit, byteLimit) {
+		const candidates = await txn.list({
+			prefix: CHUNK_SIZE_KEY_PREFIX,
+			limit: limit + 1
+		});
+		const page = [];
+		let bytes = 0;
+		for (const [key, storedSize] of Array.from(candidates).slice(0, limit)) {
+			const index = indexFromChunkSizeKey(key);
+			const size = validateChunkSize(storedSize, index);
+			if (page.length > 0 && bytes + size > byteLimit) break;
+			page.push({
+				index,
+				size
+			});
+			bytes += size;
+		}
+		let payloadFallback = false;
+		if (candidates.size === 0) {
+			const first = (await txn.list({
+				prefix: CHUNK_KEY_PREFIX,
+				limit: 1
+			})).entries().next().value;
+			if (first) {
+				const [key, payload] = first;
+				page.push({
+					index: indexFromChunkKey(key),
+					size: payload instanceof Uint8Array ? payload.byteLength : 0
+				});
+				bytes = page[0].size;
+				payloadFallback = true;
+			}
+		}
+		await deleteInBatches(txn, page.flatMap(({ index }) => [chunkKey(index), chunkSizeKey(index)]));
+		let done = candidates.size === page.length;
+		if (payloadFallback) done = (await txn.list({
+			prefix: CHUNK_KEY_PREFIX,
+			limit: 1
+		})).size === 0;
+		else if (done && candidates.size > 0) done = (await txn.list({
+			prefix: CHUNK_KEY_PREFIX,
+			limit: 1
+		})).size === 0;
+		return {
+			chunks: page.length,
+			bytes,
+			done
+		};
+	}
+	/**
+	* Delete one page of segment rows, listing segment size rows to avoid
+	* loading payloads. One segment always makes progress, even when it holds
+	* more chunks or bytes than the page allows.
+	*/
+	async expireSegmentPage(txn, limit, byteLimit) {
+		const candidates = await txn.list({
+			prefix: SEGMENT_SIZE_KEY_PREFIX,
+			limit: limit + 1
+		});
+		const page = [];
+		let chunks = 0;
+		let bytes = 0;
+		for (const [key, value] of candidates) {
+			const start = startFromSegmentKey(key, SEGMENT_SIZE_KEY_PREFIX);
+			const size = validateSegmentSize(value, start);
+			if (page.length > 0 && (chunks + size.count > limit || bytes + size.bytes > byteLimit)) break;
+			page.push(start);
+			chunks += size.count;
+			bytes += size.bytes;
+		}
+		let orphan = false;
+		if (candidates.size === 0) {
+			const first = (await txn.list({
+				prefix: SEGMENT_KEY_PREFIX,
+				limit: 1
+			})).entries().next().value;
+			if (first) {
+				page.push(startFromSegmentKey(first[0], SEGMENT_KEY_PREFIX));
+				bytes = first[1] instanceof Uint8Array ? first[1].byteLength : 0;
+				chunks = 1;
+				orphan = true;
+			}
+		}
+		await deleteInBatches(txn, page.flatMap((start) => [segmentKey(start), segmentSizeKey(start)]));
+		let done = !orphan && candidates.size === page.length;
+		if (orphan || done) done = (await txn.list({
+			prefix: SEGMENT_KEY_PREFIX,
+			limit: 1
+		})).size === 0;
+		return {
+			chunks,
+			bytes,
+			done
+		};
+	}
 	/**
 	* Fence the stream and delete one bounded page. Listing size keys avoids
 	* loading payloads, and the transaction makes a crash retry resume safely.
@@ -3000,50 +3477,8 @@ var StreamDO = class extends DurableObject {
 				const meta = stored === void 0 ? emptyMeta() : validateMeta(stored);
 				this.assertOwner(meta, runId);
 				const firstFence = meta.state !== "expired";
-				const candidates = await txn.list({
-					prefix: CHUNK_SIZE_KEY_PREFIX,
-					limit: limit + 1
-				});
-				const page = [];
-				let bytes = 0;
-				for (const [key, storedSize] of Array.from(candidates).slice(0, limit)) {
-					const index = indexFromChunkSizeKey(key);
-					const size = validateChunkSize(storedSize, index);
-					if (page.length > 0 && bytes + size > byteLimit) break;
-					page.push({
-						index,
-						size
-					});
-					bytes += size;
-				}
-				let payloadFallback = false;
-				if (candidates.size === 0) {
-					const first = (await txn.list({
-						prefix: CHUNK_KEY_PREFIX,
-						limit: 1
-					})).entries().next().value;
-					if (first) {
-						const [key, payload] = first;
-						page.push({
-							index: indexFromChunkKey(key),
-							size: payload instanceof Uint8Array ? payload.byteLength : 0
-						});
-						bytes = page[0].size;
-						payloadFallback = true;
-					}
-				}
-				const keys = page.flatMap(({ index }) => [chunkKey(index), chunkSizeKey(index)]);
-				for (let offset = 0; offset < keys.length; offset += DELETE_BATCH_KEYS) await txn.delete(keys.slice(offset, offset + DELETE_BATCH_KEYS));
-				let done = candidates.size === page.length;
-				if (payloadFallback) done = (await txn.list({
-					prefix: CHUNK_KEY_PREFIX,
-					limit: 1
-				})).size === 0;
-				else if (done && candidates.size > 0) done = (await txn.list({
-					prefix: CHUNK_KEY_PREFIX,
-					limit: 1
-				})).size === 0;
-				if (done && page.length === 0 && meta.state === "expired" && meta.payloadDeleted) return {
+				const { chunks, bytes, done } = meta.layout === SEGMENT_LAYOUT ? await this.expireSegmentPage(txn, limit, byteLimit) : await this.expireChunkPage(txn, limit, byteLimit);
+				if (done && chunks === 0 && meta.state === "expired" && meta.payloadDeleted) return {
 					meta,
 					result: {
 						deleted: false,
@@ -3067,7 +3502,7 @@ var StreamDO = class extends DurableObject {
 					meta: nextMeta,
 					result: {
 						deleted: firstFence,
-						chunks: page.length,
+						chunks,
 						bytes,
 						done
 					}
@@ -3152,6 +3587,14 @@ const CLEANUP_RETRY_MAX_MS = 36e5;
 const MAX_DATE_MS = 864e13;
 const QUEUE_ORPHAN_KEY = "queue-orphan";
 const QUEUE_RESERVATION_KEY = "queue-reservation";
+/** Run-scoped Queue idempotency state, one key per claim name, in the run's own cell. */
+const RUN_QUEUE_CLAIM_PREFIX = "queue-claim:";
+/**
+* Present when every idempotency claim of this run lives in the run's own
+* cell. Written only when the run is created, so a run keeps one claim scope
+* for its whole life and claims made before the marker existed stay valid.
+*/
+const RUN_QUEUE_CLAIM_SCOPE_KEY = "queue-claim-scope";
 function validateCleanupRequest(request, allowDisabled) {
 	if (!isRecord$1(request)) throw new Error("world-celld retention request must be an object");
 	if (!(allowDisabled ? isNonNegativeSafeInteger(request.retentionMs) : isPositiveSafeInteger(request.retentionMs))) throw new Error(`world-celld retentionMs must be a ${allowDisabled ? "non-negative" : "positive"} safe integer`);
@@ -3205,6 +3648,12 @@ async function putStorageEntries(storage, entries) {
 	const all = Array.from(entries);
 	for (let offset = 0; offset < all.length; offset += STORAGE_BATCH_SIZE) await storage.put(Object.fromEntries(all.slice(offset, offset + STORAGE_BATCH_SIZE)));
 }
+function runQueueClaimKey(claimName) {
+	return `${RUN_QUEUE_CLAIM_PREFIX}${claimName}`;
+}
+function validRunQueueClaimName(claimName) {
+	return typeof claimName === "string" && claimName.startsWith("claim:");
+}
 /**
 * Durable Object for managing a single workflow run's state.
 *
@@ -3285,6 +3734,7 @@ var WorkflowRunDO = class extends DurableObject {
 			});
 			if (!outcome.ok) return outcome;
 			if (eventSequence !== storedSequence) await txn.put(EVENT_SEQUENCE_KEY, eventSequence);
+			if (outcome.runCreated) await txn.put(RUN_QUEUE_CLAIM_SCOPE_KEY, "run");
 			await putStorageEntries(txn, (outcome.hookToIndex ? [{
 				hookId: outcome.hookToIndex.hookId,
 				token: outcome.hookToIndex.token
@@ -3338,6 +3788,28 @@ var WorkflowRunDO = class extends DurableObject {
 	async getRun() {
 		return this.readKey("run");
 	}
+	/** Fence both supported event-claim forms before an expired shard claim is released. */
+	async resolveExpiredHookClaim(request) {
+		if (typeof request?.hookId !== "string" || request.hookId.length === 0 || typeof request.claimId !== "string" || request.claimId.length === 0 || request.token !== void 0 && typeof request.token !== "string") throw new TypeError("world-celld expired hook claim resolution is invalid");
+		return await this.ctx.storage.transaction(async (txn) => {
+			const { tombstone } = await this.retentionState(txn);
+			if (tombstone) return null;
+			const run = await txn.get("run");
+			if (run && isTerminalWorkflowRunStatus(run.status)) return null;
+			const hook = await txn.get(`${HOOK_KEY_PREFIX}${request.hookId}`);
+			if (hook && (request.token === void 0 || hook.token === request.token)) return hook;
+			const cancellation = {
+				hookId: request.hookId,
+				token: request.token,
+				canceledAt: this.now()
+			};
+			await txn.put({
+				[hookClaimCancellationKey(`${request.claimId}:${request.claimId}`)]: cancellation,
+				[hookClaimCancellationKey(`-:${request.claimId}`)]: cancellation
+			});
+			return null;
+		});
+	}
 	/** Single authoritative lifecycle answer used after derivative compaction. */
 	async getLifecycleStatus() {
 		return await this.ctx.storage.transaction(async (txn) => {
@@ -3951,6 +4423,189 @@ var WorkflowRunDO = class extends DurableObject {
 			await txn.setAlarm(this.now() + delay);
 		});
 	}
+	/**
+	* Read-only admission for a run-bearing Queue message whose body travels
+	* inline in the broker envelope. It answers what payload registration does
+	* for offloaded bodies, without writing anything.
+	*/
+	async getQueueAdmission() {
+		const { tombstone } = await this.retentionState(this.ctx.storage);
+		return tombstone ? {
+			ok: false,
+			message: `Workflow run "${tombstone.runId}" expired at ${tombstone.expiredAt.toISOString()}`
+		} : { ok: true };
+	}
+	/**
+	* Enqueue-side admission and idempotency reservation in one transaction,
+	* for a run-scoped claim. Replaces a separate claim cell's reservation plus
+	* the run expiry check.
+	*/
+	async reserveRunQueueMessage(params) {
+		if (!validRunQueueClaimName(params?.claimName) || typeof params.messageId !== "string" || params.messageId.length === 0 || !isNonNegativeSafeInteger(params.expiresAt) || params.publicationPending !== void 0 && typeof params.publicationPending !== "boolean") throw new TypeError("world-celld run queue reservation is invalid");
+		return await this.ctx.storage.transaction(async (txn) => {
+			const key = runQueueClaimKey(params.claimName);
+			const values = await txn.get([
+				TOMBSTONE_KEY,
+				CLEANUP_RECORD_KEY,
+				RUN_QUEUE_CLAIM_SCOPE_KEY,
+				key
+			]);
+			const tombstone = this.tombstoneFrom(values);
+			if (tombstone) return {
+				ok: false,
+				message: `Workflow run "${tombstone.runId}" expired at ${tombstone.expiredAt.toISOString()}`
+			};
+			if (values.get("queue-claim-scope") !== "run") return {
+				ok: true,
+				scope: "cell"
+			};
+			const state = values.get(key) ?? {};
+			const existing = state.reservation;
+			if (existing && existing.expiresAt > this.now() && (existing.messageId !== params.messageId || params.publicationPending)) return {
+				ok: true,
+				scope: "run",
+				admitted: false,
+				messageId: existing.messageId,
+				...existing.publicationPending ? { publicationPending: true } : {}
+			};
+			await txn.put(key, {
+				...state,
+				reservation: {
+					messageId: params.messageId,
+					expiresAt: Math.max(existing?.expiresAt ?? 0, params.expiresAt),
+					...params.publicationPending ? { publicationPending: true } : {}
+				}
+			});
+			return {
+				ok: true,
+				scope: "run",
+				admitted: true,
+				messageId: params.messageId
+			};
+		});
+	}
+	async confirmRunQueueMessagePublication(params) {
+		if (!validRunQueueClaimName(params?.claimName) || typeof params.messageId !== "string" || params.messageId.length === 0 || !isNonNegativeSafeInteger(params.expiresAt)) throw new TypeError("world-celld run queue publication confirmation is invalid");
+		await this.ctx.storage.transaction(async (txn) => {
+			const key = runQueueClaimKey(params.claimName);
+			const state = await txn.get(key);
+			if (state?.reservation?.messageId !== params.messageId) return;
+			await txn.put(key, {
+				...state,
+				reservation: {
+					messageId: params.messageId,
+					expiresAt: Math.max(state.reservation.expiresAt, params.expiresAt)
+				}
+			});
+		});
+	}
+	/** Delivery-side run expiry check and in-flight claim in one transaction. */
+	async claimRunQueueMessage(params) {
+		if (!validRunQueueClaimName(params?.claimName) || typeof params.messageId !== "string" || params.messageId.length === 0 || !isPositiveSafeInteger(params.staleMs)) throw new TypeError("world-celld run queue claim is invalid");
+		return await this.ctx.storage.transaction(async (txn) => {
+			const key = runQueueClaimKey(params.claimName);
+			const values = await txn.get([
+				TOMBSTONE_KEY,
+				CLEANUP_RECORD_KEY,
+				key
+			]);
+			if (this.tombstoneFrom(values)) return { expired: true };
+			let state = values.get(key) ?? {};
+			const now = this.now();
+			if (state.reservation?.publicationPending && state.reservation.messageId === params.messageId) {
+				state = {
+					...state,
+					reservation: {
+						messageId: params.messageId,
+						expiresAt: Math.max(state.reservation.expiresAt, now + QUEUE_RESERVATION_GRACE_MS)
+					}
+				};
+				await txn.put(key, state);
+			}
+			const existing = state.claim;
+			if (existing && existing.expiresAt > now) {
+				if (existing.messageId !== params.messageId) return {
+					expired: false,
+					claimed: false
+				};
+				if (existing.retryAt === void 0 || existing.retryAt > now) return {
+					expired: false,
+					claimed: false,
+					retryAt: existing.retryAt ?? existing.expiresAt
+				};
+			}
+			await txn.put(key, {
+				...state,
+				claim: {
+					messageId: params.messageId,
+					expiresAt: now + params.staleMs
+				}
+			});
+			return {
+				expired: false,
+				claimed: true
+			};
+		});
+	}
+	async holdRunQueueMessage(params) {
+		if (!validRunQueueClaimName(params?.claimName) || typeof params.messageId !== "string" || params.messageId.length === 0 || !isNonNegativeSafeInteger(params.retryAt) || !isNonNegativeSafeInteger(params.expiresAt) || params.reservationExpiresAt !== void 0 && !isNonNegativeSafeInteger(params.reservationExpiresAt)) throw new TypeError("world-celld run queue claim hold is invalid");
+		return await this.ctx.storage.transaction(async (txn) => {
+			const key = runQueueClaimKey(params.claimName);
+			const state = await txn.get(key) ?? {};
+			const existing = state.claim;
+			if (!existing || existing.messageId !== params.messageId) return { held: false };
+			const next = {
+				...state,
+				claim: {
+					...existing,
+					retryAt: params.retryAt,
+					expiresAt: Math.max(existing.expiresAt, params.expiresAt)
+				}
+			};
+			if (state.reservation?.messageId === params.messageId && params.reservationExpiresAt !== void 0 && params.reservationExpiresAt > state.reservation.expiresAt) next.reservation = {
+				...state.reservation,
+				expiresAt: params.reservationExpiresAt
+			};
+			await txn.put(key, next);
+			return { held: true };
+		});
+	}
+	async releaseRunQueueMessage(params) {
+		if (!validRunQueueClaimName(params?.claimName) || typeof params.messageId !== "string") throw new TypeError("world-celld run queue claim release is invalid");
+		await this.ctx.storage.transaction(async (txn) => {
+			const key = runQueueClaimKey(params.claimName);
+			const state = await txn.get(key);
+			if (state?.claim?.messageId !== params.messageId) return;
+			const { claim: _released, ...rest } = state;
+			if (rest.reservation) await txn.put(key, rest);
+			else await txn.delete(key);
+		});
+	}
+	async completeRunQueueMessage(params) {
+		if (!validRunQueueClaimName(params?.claimName) || typeof params.messageId !== "string") throw new TypeError("world-celld run queue completion is invalid");
+		await this.ctx.storage.transaction(async (txn) => {
+			const key = runQueueClaimKey(params.claimName);
+			const state = await txn.get(key);
+			if (!state) return;
+			const next = {};
+			if (state.reservation && state.reservation.messageId !== params.messageId) next.reservation = state.reservation;
+			if (state.claim && state.claim.messageId !== params.messageId) next.claim = state.claim;
+			if (next.reservation || next.claim) await txn.put(key, next);
+			else await txn.delete(key);
+		});
+	}
+	/** Failed enqueue cleanup must preserve delivery already accepted by the broker. */
+	async abandonRunQueueMessageReservation(params) {
+		if (!validRunQueueClaimName(params?.claimName) || typeof params.messageId !== "string" || params.messageId.length === 0) throw new TypeError("world-celld run queue reservation abandonment is invalid");
+		await this.ctx.storage.transaction(async (txn) => {
+			const key = runQueueClaimKey(params.claimName);
+			const state = await txn.get(key);
+			if (state?.reservation?.messageId !== params.messageId) return;
+			const { reservation: _abandoned, ...rest } = state;
+			if (rest.claim) await txn.put(key, rest);
+			else await txn.delete(key);
+		});
+	}
 	async registerQueuePayload(registration) {
 		if (!registration || typeof registration.messageId !== "string" || registration.messageId.length === 0 || typeof registration.key !== "string" || registration.key.length === 0 || !isNonNegativeSafeInteger(registration.orphanExpiresAt)) throw new TypeError("world-celld queue payload registration is invalid");
 		return await this.ctx.storage.transaction(async (txn) => {
@@ -4007,22 +4662,24 @@ var WorkflowRunDO = class extends DurableObject {
 		});
 	}
 	async reserveQueueMessage(params) {
-		if (typeof params?.messageId !== "string" || params.messageId.length === 0 || !isNonNegativeSafeInteger(params.expiresAt)) throw new TypeError("world-celld queue message reservation is invalid");
+		if (typeof params?.messageId !== "string" || params.messageId.length === 0 || !isNonNegativeSafeInteger(params.expiresAt) || params.publicationPending !== void 0 && typeof params.publicationPending !== "boolean") throw new TypeError("world-celld queue message reservation is invalid");
 		return await this.ctx.storage.transaction(async (txn) => {
 			const values = await txn.get([QUEUE_RESERVATION_KEY, "claim"]);
 			const existing = values.get(QUEUE_RESERVATION_KEY);
 			const claim = values.get("claim");
 			const now = this.now();
-			if (existing && existing.expiresAt > now && existing.messageId !== params.messageId) {
+			if (existing && existing.expiresAt > now && (existing.messageId !== params.messageId || params.publicationPending)) {
 				await txn.setAlarm(Math.min(existing.expiresAt, claim?.expiresAt ?? existing.expiresAt));
 				return {
 					admitted: false,
-					messageId: existing.messageId
+					messageId: existing.messageId,
+					...existing.publicationPending ? { publicationPending: true } : {}
 				};
 			}
 			const reservation = {
 				messageId: params.messageId,
-				expiresAt: Math.max(existing?.expiresAt ?? 0, params.expiresAt)
+				expiresAt: Math.max(existing?.expiresAt ?? 0, params.expiresAt),
+				...params.publicationPending ? { publicationPending: true } : {}
 			};
 			await txn.put(QUEUE_RESERVATION_KEY, reservation);
 			await txn.setAlarm(Math.min(reservation.expiresAt, claim?.expiresAt ?? reservation.expiresAt));
@@ -4032,6 +4689,20 @@ var WorkflowRunDO = class extends DurableObject {
 			};
 		});
 	}
+	async confirmQueueMessagePublication(params) {
+		if (typeof params?.messageId !== "string" || params.messageId.length === 0 || !isNonNegativeSafeInteger(params.expiresAt)) throw new TypeError("world-celld queue publication confirmation is invalid");
+		await this.ctx.storage.transaction(async (txn) => {
+			const values = await txn.get([QUEUE_RESERVATION_KEY, "claim"]);
+			const existing = values.get(QUEUE_RESERVATION_KEY);
+			if (existing?.messageId !== params.messageId) return;
+			const reservation = {
+				messageId: params.messageId,
+				expiresAt: Math.max(existing.expiresAt, params.expiresAt)
+			};
+			await txn.put(QUEUE_RESERVATION_KEY, reservation);
+			await txn.setAlarm(Math.min(reservation.expiresAt, values.get("claim")?.expiresAt ?? reservation.expiresAt));
+		});
+	}
 	async completeQueueMessage(messageId) {
 		if (typeof messageId !== "string" || messageId.length === 0) throw new TypeError("world-celld queue messageId must be a non-empty string");
 		await this.ctx.storage.transaction(async (txn) => {
@@ -4051,13 +4722,32 @@ var WorkflowRunDO = class extends DurableObject {
 			else await txn.deleteAlarm();
 		});
 	}
+	/** Abandon the enqueue reservation without releasing an active delivery claim. */
+	async abandonQueueMessageReservation(messageId) {
+		if (typeof messageId !== "string" || messageId.length === 0) throw new TypeError("world-celld queue reservation messageId must be a non-empty string");
+		await this.ctx.storage.transaction(async (txn) => {
+			const values = await txn.get([QUEUE_RESERVATION_KEY, "claim"]);
+			if (values.get(QUEUE_RESERVATION_KEY)?.messageId !== messageId) return;
+			await txn.delete(QUEUE_RESERVATION_KEY);
+			const claim = values.get("claim");
+			if (claim) await txn.setAlarm(claim.expiresAt);
+			else await txn.deleteAlarm();
+		});
+	}
 	async claimInflight(params) {
 		if (typeof params?.messageId !== "string" || params.messageId.length === 0 || !isPositiveSafeInteger(params.staleMs)) throw new TypeError("world-celld queue claim is invalid");
 		return await this.ctx.storage.transaction(async (txn) => {
 			const values = await txn.get(["claim", QUEUE_RESERVATION_KEY]);
 			const existing = values.get("claim");
-			const reservation = values.get(QUEUE_RESERVATION_KEY);
+			let reservation = values.get(QUEUE_RESERVATION_KEY);
 			const now = this.now();
+			if (reservation?.publicationPending && reservation.messageId === params.messageId) {
+				reservation = {
+					messageId: params.messageId,
+					expiresAt: Math.max(reservation.expiresAt, now + QUEUE_RESERVATION_GRACE_MS)
+				};
+				await txn.put(QUEUE_RESERVATION_KEY, reservation);
+			}
 			if (existing && existing.expiresAt > now) {
 				if (existing.messageId !== params.messageId) return { claimed: false };
 				if (existing.retryAt === void 0 || existing.retryAt > now) return {