@hasna/events 0.1.14 → 0.1.15

package/dist/cli/index.js

@@ -2,8 +2,8 @@
 // @bun
 
 // src/cli/index.ts
-import { readFileSync } from "fs";
-import { dirname, join as join2 } from "path";
+import { readFileSync as readFileSync2 } from "fs";
+import { dirname, join as join5 } from "path";
 import { fileURLToPath } from "url";
 
 // src/index.ts
@@ -433,21 +433,27 @@ function now() {
 function truncate(value, max = 4096) {
   return value.length > max ? `${value.slice(0, max)}...` : value;
 }
-function buildWebhookRequest(event, channel) {
+function buildWebhookRequest(event, channel, options = {}) {
   if (!channel.webhook)
     throw new Error(`Channel ${channel.id} has no webhook config`);
+  for (const name of Object.keys(channel.webhook.headers ?? {})) {
+    if (/^x-hasna-/i.test(name)) {
+      throw new Error(`Webhook header ${name} is reserved for signed delivery metadata`);
+    }
+  }
   const body = JSON.stringify(event);
-  const timestamp = event.time;
+  const timestamp = options.timestamp ?? new Date().toISOString();
   const headers = {
     "Content-Type": "application/json",
     "User-Agent": "@hasna/events",
     "X-Hasna-Event-Id": event.id,
     "X-Hasna-Event-Type": event.type,
-    "X-Hasna-Timestamp": timestamp,
-    ...channel.webhook.headers
+    ...channel.webhook.headers,
+    "X-Hasna-Timestamp": timestamp
   };
-  if (channel.webhook.secret) {
-    headers["X-Hasna-Signature"] = signPayload(channel.webhook.secret, timestamp, body);
+  const secret = options.secret ?? channel.webhook.secret;
+  if (secret) {
+    headers["X-Hasna-Signature"] = signPayload(secret, timestamp, body);
   }
   return { body, headers };
 }
@@ -455,7 +461,21 @@ async function dispatchWebhook(event, channel, options = {}) {
   if (!channel.webhook)
     throw new Error(`Channel ${channel.id} has no webhook config`);
   const startedAt = now();
-  const { body, headers } = buildWebhookRequest(event, channel);
+  let secret = channel.webhook.secret;
+  if (channel.webhook.secretRef) {
+    if (!options.secretResolver) {
+      return failedAttempt(startedAt, "Webhook secret reference has no runtime resolver");
+    }
+    try {
+      secret = await options.secretResolver(channel.webhook.secretRef);
+    } catch {
+      return failedAttempt(startedAt, "Webhook secret reference could not be resolved");
+    }
+    if (!secret)
+      return failedAttempt(startedAt, "Webhook secret reference could not be resolved");
+  }
+  const timestamp = (options.now?.() ?? new Date).toISOString();
+  const { body, headers } = buildWebhookRequest(event, channel, { secret, timestamp });
   const controller = new AbortController;
   const timeout = setTimeout(() => controller.abort(), channel.webhook.timeoutMs ?? 15000);
   try {
@@ -487,6 +507,15 @@ async function dispatchWebhook(event, channel, options = {}) {
     clearTimeout(timeout);
   }
 }
+function failedAttempt(startedAt, error) {
+  return {
+    attempt: 1,
+    status: "failed",
+    startedAt,
+    completedAt: now(),
+    error
+  };
+}
 async function dispatchCommand(event, channel) {
   if (!channel.command)
     throw new Error(`Channel ${channel.id} has no command config`);
@@ -622,6 +651,48 @@ class EventTypeCatalog {
 }
 var defaultEventTypeCatalog = new EventTypeCatalog;
 
+// src/redaction.ts
+function redactPaths(event, paths, replacement = "[REDACTED]") {
+  if (paths.length === 0)
+    return event;
+  const copy = structuredClone(event);
+  for (const path of paths) {
+    setPath(copy, path, replacement);
+  }
+  return copy;
+}
+function redactSensitiveKeys(event, replacement = "[REDACTED]") {
+  return redactValue(event, replacement);
+}
+function shouldRedactKey(key) {
+  return /secret|token|password|api[_-]?key|authorization/i.test(key);
+}
+function redactValue(value, replacement) {
+  if (Array.isArray(value))
+    return value.map((item) => redactValue(item, replacement));
+  if (!value || typeof value !== "object")
+    return value;
+  return Object.fromEntries(Object.entries(value).map(([key, item]) => [
+    key,
+    shouldRedactKey(key) ? replacement : redactValue(item, replacement)
+  ]));
+}
+function setPath(input, path, replacement) {
+  const parts = path.split(".");
+  let cursor = input;
+  for (const part of parts.slice(0, -1)) {
+    const next = cursor[part];
+    if (!next || typeof next !== "object")
+      return;
+    cursor = next;
+  }
+  const last = parts.at(-1);
+  if (last && last in cursor)
+    cursor[last] = replacement;
+}
+// src/app-event.ts
+var APP_EVENT_V1_MAX_DATA_BYTES = 32 * 1024;
+
 // src/index.ts
 function createEvent(input) {
   return {
@@ -648,7 +719,11 @@ class EventsClient {
   constructor(options = {}) {
     this.store = options.store ?? new JsonEventsStore(options.dataDir);
     this.redactors = options.redactors ?? [];
-    this.transportOptions = { fetchImpl: options.fetchImpl };
+    this.transportOptions = {
+      fetchImpl: options.fetchImpl,
+      secretResolver: options.secretResolver,
+      now: options.now
+    };
     this.catalog = options.catalog ?? defaultEventTypeCatalog;
     this.validateCatalogTypes = options.validateCatalogTypes ?? false;
   }
@@ -826,15 +901,6 @@ class EventsClient {
     return createDeliveryResult(event, channel, attempts);
   }
 }
-function redactPaths(event, paths, replacement = "[REDACTED]") {
-  if (paths.length === 0)
-    return event;
-  const copy = structuredClone(event);
-  for (const path of paths) {
-    setPath(copy, path, replacement);
-  }
-  return copy;
-}
 function sanitizeChannelForOutput(channel) {
   const copy = structuredClone(channel);
   if (copy.webhook?.secret)
@@ -847,35 +913,6 @@ function sanitizeChannelForOutput(channel) {
 function sanitizeChannelsForOutput(channels) {
   return channels.map(sanitizeChannelForOutput);
 }
-function redactSensitiveKeys(event, replacement = "[REDACTED]") {
-  return redactValue(event, replacement);
-}
-function shouldRedactKey(key) {
-  return /secret|token|password|api[_-]?key|authorization/i.test(key);
-}
-function redactValue(value, replacement) {
-  if (Array.isArray(value))
-    return value.map((item) => redactValue(item, replacement));
-  if (!value || typeof value !== "object")
-    return value;
-  return Object.fromEntries(Object.entries(value).map(([key, item]) => [
-    key,
-    shouldRedactKey(key) ? replacement : redactValue(item, replacement)
-  ]));
-}
-function setPath(input, path, replacement) {
-  const parts = path.split(".");
-  let cursor = input;
-  for (const part of parts.slice(0, -1)) {
-    const next = cursor[part];
-    if (!next || typeof next !== "object")
-      return;
-    cursor = next;
-  }
-  const last = parts.at(-1);
-  if (last && last in cursor)
-    cursor[last] = replacement;
-}
 function queryClientEvents(events, options) {
   let rows = events;
   if (options.eventId)
@@ -903,6 +940,1119 @@ function normalizeRetryPolicy(policy) {
   };
 }
 
+// src/durable.ts
+import { Database } from "bun:sqlite";
+import { createHash, randomUUID as randomUUID3 } from "crypto";
+import {
+  chmodSync,
+  closeSync,
+  existsSync as existsSync2,
+  fsyncSync,
+  mkdirSync,
+  openSync,
+  readdirSync,
+  readFileSync,
+  unlinkSync
+} from "fs";
+import { join as join2 } from "path";
+var DURABLE_SCHEMA_VERSION = 1;
+var MAX_RETRY_ATTEMPTS = 1000;
+var MAX_RETRY_DELAY_MS = 365 * 24 * 60 * 60 * 1000;
+var MAX_RETRY_MULTIPLIER = 100;
+var SCHEMA_V1_TABLE_SQL = {
+  channels: `CREATE TABLE channels (
+    id TEXT PRIMARY KEY,
+    enabled INTEGER NOT NULL,
+    config_json TEXT NOT NULL,
+    created_at TEXT NOT NULL,
+    updated_at TEXT NOT NULL
+  )`,
+  events: `CREATE TABLE events (
+    id TEXT PRIMARY KEY,
+    dedupe_key TEXT,
+    source TEXT NOT NULL,
+    type TEXT NOT NULL,
+    time TEXT NOT NULL,
+    envelope_json TEXT NOT NULL,
+    created_at TEXT NOT NULL
+  )`,
+  outbox: `CREATE TABLE outbox (
+    id TEXT PRIMARY KEY,
+    event_id TEXT NOT NULL REFERENCES events(id),
+    channel_id TEXT NOT NULL,
+    event_json TEXT NOT NULL,
+    channel_json TEXT NOT NULL,
+    status TEXT NOT NULL CHECK (status IN ('pending', 'leased', 'delivered', 'dead')),
+    attempt_count INTEGER NOT NULL DEFAULT 0,
+    available_at INTEGER NOT NULL,
+    lease_owner TEXT,
+    lease_expires_at INTEGER,
+    attempts_json TEXT NOT NULL DEFAULT '[]',
+    created_at TEXT NOT NULL,
+    updated_at TEXT NOT NULL,
+    UNIQUE(event_id, channel_id)
+  )`,
+  deliveries: `CREATE TABLE deliveries (
+    id TEXT PRIMARY KEY,
+    event_id TEXT NOT NULL REFERENCES events(id),
+    channel_id TEXT NOT NULL,
+    result_json TEXT NOT NULL,
+    created_at TEXT NOT NULL
+  )`
+};
+var SCHEMA_V1_INDEX_SQL = {
+  events_dedupe_key_unique: `CREATE UNIQUE INDEX events_dedupe_key_unique
+    ON events(dedupe_key) WHERE dedupe_key IS NOT NULL`,
+  events_source_type_idx: "CREATE INDEX events_source_type_idx ON events(source, type)",
+  outbox_due_idx: "CREATE INDEX outbox_due_idx ON outbox(status, available_at, lease_expires_at)"
+};
+var SCHEMA_V1_COLUMNS = {
+  channels: [
+    { name: "id", type: "TEXT", notnull: 0, defaultValue: null, pk: 1 },
+    { name: "enabled", type: "INTEGER", notnull: 1, defaultValue: null, pk: 0 },
+    { name: "config_json", type: "TEXT", notnull: 1, defaultValue: null, pk: 0 },
+    { name: "created_at", type: "TEXT", notnull: 1, defaultValue: null, pk: 0 },
+    { name: "updated_at", type: "TEXT", notnull: 1, defaultValue: null, pk: 0 }
+  ],
+  events: [
+    { name: "id", type: "TEXT", notnull: 0, defaultValue: null, pk: 1 },
+    { name: "dedupe_key", type: "TEXT", notnull: 0, defaultValue: null, pk: 0 },
+    { name: "source", type: "TEXT", notnull: 1, defaultValue: null, pk: 0 },
+    { name: "type", type: "TEXT", notnull: 1, defaultValue: null, pk: 0 },
+    { name: "time", type: "TEXT", notnull: 1, defaultValue: null, pk: 0 },
+    { name: "envelope_json", type: "TEXT", notnull: 1, defaultValue: null, pk: 0 },
+    { name: "created_at", type: "TEXT", notnull: 1, defaultValue: null, pk: 0 }
+  ],
+  outbox: [
+    { name: "id", type: "TEXT", notnull: 0, defaultValue: null, pk: 1 },
+    { name: "event_id", type: "TEXT", notnull: 1, defaultValue: null, pk: 0 },
+    { name: "channel_id", type: "TEXT", notnull: 1, defaultValue: null, pk: 0 },
+    { name: "event_json", type: "TEXT", notnull: 1, defaultValue: null, pk: 0 },
+    { name: "channel_json", type: "TEXT", notnull: 1, defaultValue: null, pk: 0 },
+    { name: "status", type: "TEXT", notnull: 1, defaultValue: null, pk: 0 },
+    { name: "attempt_count", type: "INTEGER", notnull: 1, defaultValue: "0", pk: 0 },
+    { name: "available_at", type: "INTEGER", notnull: 1, defaultValue: null, pk: 0 },
+    { name: "lease_owner", type: "TEXT", notnull: 0, defaultValue: null, pk: 0 },
+    { name: "lease_expires_at", type: "INTEGER", notnull: 0, defaultValue: null, pk: 0 },
+    { name: "attempts_json", type: "TEXT", notnull: 1, defaultValue: "'[]'", pk: 0 },
+    { name: "created_at", type: "TEXT", notnull: 1, defaultValue: null, pk: 0 },
+    { name: "updated_at", type: "TEXT", notnull: 1, defaultValue: null, pk: 0 }
+  ],
+  deliveries: [
+    { name: "id", type: "TEXT", notnull: 0, defaultValue: null, pk: 1 },
+    { name: "event_id", type: "TEXT", notnull: 1, defaultValue: null, pk: 0 },
+    { name: "channel_id", type: "TEXT", notnull: 1, defaultValue: null, pk: 0 },
+    { name: "result_json", type: "TEXT", notnull: 1, defaultValue: null, pk: 0 },
+    { name: "created_at", type: "TEXT", notnull: 1, defaultValue: null, pk: 0 }
+  ]
+};
+var EVENT_FOREIGN_KEY = {
+  table: "events",
+  from: "event_id",
+  to: "id",
+  onUpdate: "NO ACTION",
+  onDelete: "NO ACTION",
+  match: "NONE"
+};
+var SCHEMA_V1_FOREIGN_KEYS = {
+  channels: [],
+  events: [],
+  outbox: [EVENT_FOREIGN_KEY],
+  deliveries: [EVENT_FOREIGN_KEY]
+};
+var SCHEMA_V1_INDEXES = {
+  channels: [
+    { name: "sqlite_autoindex_channels_1", unique: 1, origin: "pk", partial: 0, columns: ["id"] }
+  ],
+  events: [
+    { name: "events_dedupe_key_unique", unique: 1, origin: "c", partial: 1, columns: ["dedupe_key"] },
+    { name: "events_source_type_idx", unique: 0, origin: "c", partial: 0, columns: ["source", "type"] },
+    { name: "sqlite_autoindex_events_1", unique: 1, origin: "pk", partial: 0, columns: ["id"] }
+  ],
+  outbox: [
+    { name: "outbox_due_idx", unique: 0, origin: "c", partial: 0, columns: ["status", "available_at", "lease_expires_at"] },
+    { name: "sqlite_autoindex_outbox_1", unique: 1, origin: "pk", partial: 0, columns: ["id"] },
+    { name: "sqlite_autoindex_outbox_2", unique: 1, origin: "u", partial: 0, columns: ["event_id", "channel_id"] }
+  ],
+  deliveries: [
+    { name: "sqlite_autoindex_deliveries_1", unique: 1, origin: "pk", partial: 0, columns: ["id"] }
+  ]
+};
+function defaultWebhookSecretResolver(reference) {
+  if (!reference.startsWith("env:"))
+    throw new Error("Unsupported webhook secret reference scheme");
+  const name = reference.slice("env:".length);
+  if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(name))
+    throw new Error("Invalid webhook secret environment reference");
+  return process.env[name];
+}
+
+class DurableEventsBroker {
+  dataDir;
+  databasePath;
+  db;
+  now;
+  transportOptions;
+  constructor(options) {
+    if (!options.dataDir)
+      throw new Error("DurableEventsBroker requires dataDir");
+    this.dataDir = options.dataDir;
+    this.databasePath = join2(options.dataDir, options.databaseName ?? "events.sqlite");
+    this.now = options.now ?? (() => new Date);
+    this.transportOptions = {
+      fetchImpl: options.fetchImpl,
+      secretResolver: options.secretResolver ?? defaultWebhookSecretResolver,
+      now: this.now
+    };
+    mkdirSync(this.dataDir, { recursive: true, mode: 448 });
+    chmodSync(this.dataDir, 448);
+    this.db = new Database(this.databasePath, { create: true, strict: true });
+    try {
+      this.db.exec("PRAGMA busy_timeout = 5000;");
+      this.ensureSchema();
+      this.db.exec("PRAGMA journal_mode = WAL;");
+      this.db.exec("PRAGMA synchronous = FULL;");
+      this.db.exec("PRAGMA foreign_keys = ON;");
+      this.secureDatabaseFiles();
+    } catch (error) {
+      this.db.close();
+      throw error;
+    }
+  }
+  close() {
+    this.db.close();
+  }
+  addChannel(input) {
+    if (input.transport !== "webhook") {
+      throw new Error("Durable SQLite channels support only webhook transport");
+    }
+    if (input.webhook?.secret !== undefined) {
+      throw new Error("Durable SQLite channels reject inline webhook secrets; use webhook.secretRef");
+    }
+    if (input.transport === "webhook" && !input.webhook?.secretRef) {
+      throw new Error("Durable SQLite webhook channels require webhook.secretRef");
+    }
+    if (input.webhook?.secretRef && !/^[A-Za-z][A-Za-z0-9+.-]*:\S+$/.test(input.webhook.secretRef)) {
+      throw new Error("Durable SQLite webhook secretRef must be a runtime reference");
+    }
+    if (input.webhook)
+      validateDurableWebhookConfig(input.webhook);
+    if (input.retry !== undefined)
+      validateRetryPolicy(input.retry);
+    const timestamp = this.now().toISOString();
+    const existing = this.db.query("SELECT config_json FROM channels WHERE id = ?").get(input.id);
+    const existingChannel = existing ? parseJson(existing.config_json) : undefined;
+    const channel = {
+      ...input,
+      createdAt: existingChannel?.createdAt ?? input.createdAt ?? timestamp,
+      updatedAt: timestamp
+    };
+    this.immediate(() => {
+      this.db.query(`
+        INSERT INTO channels (id, enabled, config_json, created_at, updated_at)
+        VALUES (?, ?, ?, ?, ?)
+        ON CONFLICT(id) DO UPDATE SET
+          enabled = excluded.enabled,
+          config_json = excluded.config_json,
+          updated_at = excluded.updated_at
+      `).run(channel.id, channel.enabled ? 1 : 0, JSON.stringify(channel), channel.createdAt, channel.updatedAt);
+    });
+    this.secureDatabaseFiles();
+    return channel;
+  }
+  listChannels() {
+    const rows = this.db.query("SELECT config_json FROM channels ORDER BY id").all();
+    return rows.map((row) => parseJson(row.config_json));
+  }
+  enqueue(input, options = {}) {
+    const event = redactSensitiveKeys(createEvent({ ...input, time: input.time ?? this.now() }));
+    const result = this.immediate(() => {
+      if (options.dedupe !== false) {
+        const existing = this.findEvent(event.id, event.dedupeKey);
+        if (existing) {
+          const storedEvent = parseJson(existing.envelope_json);
+          return {
+            event: storedEvent,
+            deduped: true,
+            queued: this.queueMatchingChannels(storedEvent)
+          };
+        }
+      }
+      this.db.query(`
+        INSERT INTO events (id, dedupe_key, source, type, time, envelope_json, created_at)
+        VALUES (?, ?, ?, ?, ?, ?, ?)
+      `).run(event.id, event.dedupeKey ?? null, event.source, event.type, event.time, JSON.stringify(event), this.now().toISOString());
+      const queued = this.queueMatchingChannels(event);
+      return { event, deduped: false, queued };
+    });
+    this.secureDatabaseFiles();
+    return result;
+  }
+  async drain(options = {}) {
+    const workerId = options.workerId ?? randomUUID3();
+    const limit = normalizePositiveInteger(options.limit, 100, "limit");
+    const leaseMs = normalizePositiveInteger(options.leaseMs, 60000, "leaseMs");
+    const attemptedIds = new Set;
+    const summary = {
+      workerId,
+      claimed: 0,
+      delivered: 0,
+      retried: 0,
+      dead: 0,
+      lost: 0,
+      deliveries: []
+    };
+    while (summary.claimed < limit) {
+      const [job] = this.claim({ workerId, limit: 1, leaseMs, excludeIds: [...attemptedIds] });
+      if (!job)
+        break;
+      attemptedIds.add(job.id);
+      summary.claimed += 1;
+      let attempt;
+      try {
+        attempt = await dispatchChannel(job.event, job.channel, this.transportOptions);
+      } catch {
+        const timestamp = this.now().toISOString();
+        attempt = {
+          attempt: job.attempt,
+          status: "failed",
+          startedAt: timestamp,
+          completedAt: timestamp,
+          error: "Webhook delivery failed"
+        };
+      }
+      attempt.attempt = job.attempt;
+      attempt = sanitizeDurableAttempt(attempt);
+      const settled = this.settle(job, attempt);
+      if (settled.status === "delivered")
+        summary.delivered += 1;
+      if (settled.status === "retry")
+        summary.retried += 1;
+      if (settled.status === "dead")
+        summary.dead += 1;
+      if (settled.status === "lost")
+        summary.lost += 1;
+      if (settled.delivery)
+        summary.deliveries.push(settled.delivery);
+    }
+    this.secureDatabaseFiles();
+    return summary;
+  }
+  importSpool(options = {}) {
+    const inboxDir = join2(this.dataDir, "spool", "inbox");
+    if (!existsSync2(inboxDir))
+      return { scanned: 0, imported: 0, deduped: 0, queued: 0 };
+    const limit = normalizePositiveInteger(options.limit, 100, "limit");
+    const names = readdirSync(inboxDir).filter((name) => /^[a-f0-9]{64}\.json$/.test(name)).sort().slice(0, limit);
+    const result = { scanned: names.length, imported: 0, deduped: 0, queued: 0 };
+    for (const name of names) {
+      const path = join2(inboxDir, name);
+      let event;
+      try {
+        event = parseSpoolEnvelope(readFileSync(path, "utf8"));
+      } catch (error) {
+        if (isNodeError(error, "ENOENT"))
+          continue;
+        throw error;
+      }
+      if (spoolFileName(event) !== name)
+        throw new Error("Durable event spool filename does not match its identity");
+      const enqueued = this.enqueue(event);
+      if (enqueued.deduped)
+        result.deduped += 1;
+      else
+        result.imported += 1;
+      result.queued += enqueued.queued;
+      try {
+        unlinkSync(path);
+      } catch (error) {
+        if (!isNodeError(error, "ENOENT"))
+          throw error;
+      }
+    }
+    if (names.length > 0)
+      syncDirectory(inboxDir);
+    this.secureDatabaseFiles();
+    return result;
+  }
+  retryDead(options = {}) {
+    const limit = normalizePositiveInteger(options.limit, 100, "limit");
+    return this.immediate(() => {
+      const conditions = ["status = 'dead'"];
+      const bindings = [];
+      if (options.eventId) {
+        conditions.push("event_id = ?");
+        bindings.push(options.eventId);
+      }
+      if (options.channelId) {
+        conditions.push("channel_id = ?");
+        bindings.push(options.channelId);
+      }
+      const rows = this.db.query(`
+        SELECT id FROM outbox
+        WHERE ${conditions.join(" AND ")}
+        ORDER BY updated_at, id
+        LIMIT ?
+      `).all(...bindings, limit);
+      let requeued = 0;
+      for (const row of rows) {
+        const updated = this.db.query(`
+          UPDATE outbox
+          SET status = 'pending', attempt_count = 0, attempts_json = '[]',
+              available_at = ?, lease_owner = NULL, lease_expires_at = NULL,
+              updated_at = ?
+          WHERE id = ? AND status = 'dead'
+        `).run(this.now().getTime(), this.now().toISOString(), row.id);
+        requeued += Number(updated.changes);
+      }
+      return { matched: rows.length, requeued };
+    });
+  }
+  status() {
+    const channels = this.count("SELECT COUNT(*) AS count FROM channels");
+    const enabledChannels = this.count("SELECT COUNT(*) AS count FROM channels WHERE enabled = 1");
+    const events = this.count("SELECT COUNT(*) AS count FROM events");
+    const statusRows = this.db.query("SELECT status, COUNT(*) AS count FROM outbox GROUP BY status").all();
+    const statuses = Object.fromEntries(statusRows.map((row) => [row.status, Number(row.count)]));
+    return {
+      service: "events",
+      storage: "local-sqlite",
+      schemaVersion: DURABLE_SCHEMA_VERSION,
+      databasePath: this.databasePath,
+      counts: {
+        channels,
+        enabledChannels,
+        events,
+        pending: statuses.pending ?? 0,
+        leased: statuses.leased ?? 0,
+        delivered: statuses.delivered ?? 0,
+        dead: statuses.dead ?? 0
+      },
+      safety: {
+        statusOmitsEventPayloads: true,
+        databasePersistsEventEnvelopes: true,
+        includesResolvedSecrets: false,
+        inlineWebhookSecretsAllowed: false
+      }
+    };
+  }
+  nextWakeAt() {
+    const row = this.db.query(`
+      SELECT MIN(
+        CASE WHEN o.status = 'leased' THEN o.lease_expires_at ELSE o.available_at END
+      ) AS next_at
+      FROM outbox o
+      JOIN channels c ON c.id = o.channel_id AND c.enabled = 1
+      WHERE o.status IN ('pending', 'leased')
+    `).get();
+    return row?.next_at === null || row?.next_at === undefined ? undefined : Number(row.next_at);
+  }
+  claim(options) {
+    return this.immediate(() => {
+      const nowMs = this.now().getTime();
+      const excludeIds = options.excludeIds ?? [];
+      const exclusion = excludeIds.length > 0 ? ` AND o.id NOT IN (${excludeIds.map(() => "?").join(", ")})` : "";
+      const rows = this.db.query(`
+        SELECT o.id, o.event_json, c.config_json AS channel_json,
+               o.attempt_count, o.attempts_json
+        FROM outbox o
+        JOIN channels c ON c.id = o.channel_id AND c.enabled = 1
+        WHERE ((o.status = 'pending' AND o.available_at <= ?)
+           OR (o.status = 'leased' AND o.lease_expires_at <= ?))
+          ${exclusion}
+        ORDER BY o.available_at, o.created_at, o.id
+        LIMIT ?
+      `).all(nowMs, nowMs, ...excludeIds, options.limit);
+      const jobs = [];
+      for (const row of rows) {
+        const nextAttempt = Number(row.attempt_count) + 1;
+        const channel = parseJson(row.channel_json);
+        const transportTimeoutMs = channel.webhook?.timeoutMs ?? channel.command?.timeoutMs ?? 15000;
+        const leaseMs = Math.max(options.leaseMs, transportTimeoutMs + 5000);
+        const update = this.db.query(`
+          UPDATE outbox
+          SET status = 'leased', attempt_count = ?, lease_owner = ?,
+              lease_expires_at = ?, updated_at = ?
+          WHERE id = ?
+            AND ((status = 'pending' AND available_at <= ?)
+              OR (status = 'leased' AND lease_expires_at <= ?))
+        `).run(nextAttempt, options.workerId, nowMs + leaseMs, this.now().toISOString(), row.id, nowMs, nowMs);
+        if (Number(update.changes) !== 1)
+          continue;
+        jobs.push({
+          id: row.id,
+          event: parseJson(row.event_json),
+          channel,
+          attempt: nextAttempt,
+          workerId: options.workerId
+        });
+      }
+      return jobs;
+    });
+  }
+  settle(job, attempt) {
+    return this.immediate(() => {
+      const row = this.db.query(`
+        SELECT attempts_json FROM outbox
+        WHERE id = ? AND status = 'leased' AND lease_owner = ?
+      `).get(job.id, job.workerId);
+      if (!row)
+        return { status: "lost" };
+      const attempts = parseJson(row.attempts_json);
+      attempts.push(attempt);
+      if (attempt.status === "success") {
+        const delivery2 = createDeliveryResult(job.event, job.channel, attempts);
+        this.completeOutbox(job, "delivered", attempts, delivery2);
+        return { status: "delivered", delivery: delivery2 };
+      }
+      const retry = normalizeRetryPolicy2(job.channel.retry);
+      if (job.attempt < retry.maxAttempts) {
+        const backoffMs = retryBackoffMs(retry, job.attempt);
+        attempt.nextBackoffMs = backoffMs;
+        this.db.query(`
+          UPDATE outbox
+          SET status = 'pending', available_at = ?, attempts_json = ?,
+              lease_owner = NULL, lease_expires_at = NULL, updated_at = ?
+          WHERE id = ? AND lease_owner = ?
+        `).run(this.now().getTime() + backoffMs, JSON.stringify(attempts), this.now().toISOString(), job.id, job.workerId);
+        return { status: "retry" };
+      }
+      const delivery = createDeliveryResult(job.event, job.channel, attempts);
+      this.completeOutbox(job, "dead", attempts, delivery);
+      return { status: "dead", delivery };
+    });
+  }
+  completeOutbox(job, status, attempts, delivery) {
+    const timestamp = this.now().toISOString();
+    this.db.query(`
+      UPDATE outbox
+      SET status = ?, attempts_json = ?, lease_owner = NULL,
+          lease_expires_at = NULL, updated_at = ?
+      WHERE id = ? AND lease_owner = ?
+    `).run(status, JSON.stringify(attempts), timestamp, job.id, job.workerId);
+    this.db.query(`
+      INSERT INTO deliveries (id, event_id, channel_id, result_json, created_at)
+      VALUES (?, ?, ?, ?, ?)
+    `).run(delivery.id, job.event.id, job.channel.id, JSON.stringify(delivery), timestamp);
+  }
+  findEvent(id, dedupeKey) {
+    if (dedupeKey === undefined) {
+      return this.db.query("SELECT envelope_json FROM events WHERE id = ? LIMIT 1").get(id);
+    }
+    return this.db.query(`
+      SELECT envelope_json FROM events
+      WHERE id = ? OR dedupe_key = ?
+      LIMIT 1
+    `).get(id, dedupeKey);
+  }
+  queueMatchingChannels(event) {
+    const channels = this.db.query("SELECT config_json FROM channels WHERE enabled = 1 ORDER BY id").all();
+    let queued = 0;
+    for (const row of channels) {
+      const channel = parseJson(row.config_json);
+      if (!channelMatchesEvent(channel, event))
+        continue;
+      const channelEvent = redactPaths(event, channel.redact?.paths ?? [], channel.redact?.replacement ?? "[REDACTED]");
+      const timestamp = this.now().toISOString();
+      const inserted = this.db.query(`
+        INSERT OR IGNORE INTO outbox (
+          id, event_id, channel_id, event_json, channel_json, status,
+          attempt_count, available_at, attempts_json, created_at, updated_at
+        ) VALUES (?, ?, ?, ?, ?, 'pending', 0, ?, '[]', ?, ?)
+      `).run(randomUUID3(), event.id, channel.id, JSON.stringify(channelEvent), JSON.stringify(channel), this.now().getTime(), timestamp, timestamp);
+      queued += Number(inserted.changes);
+    }
+    return queued;
+  }
+  count(sql) {
+    const row = this.db.query(sql).get();
+    return Number(row?.count ?? 0);
+  }
+  immediate(operation) {
+    this.db.exec("BEGIN IMMEDIATE;");
+    try {
+      const result = operation();
+      this.db.exec("COMMIT;");
+      return result;
+    } catch (error) {
+      this.db.exec("ROLLBACK;");
+      throw error;
+    }
+  }
+  ensureSchema() {
+    const version = this.readSchemaVersion();
+    if (!Number.isInteger(version) || version < 0) {
+      throw new Error("Durable SQLite schema version is invalid");
+    }
+    if (version > DURABLE_SCHEMA_VERSION) {
+      throw new Error(`Durable SQLite schema version ${version} is newer than supported version ${DURABLE_SCHEMA_VERSION}`);
+    }
+    if (version === 0) {
+      this.immediate(() => {
+        if (this.readSchemaVersion() !== 0) {
+          throw new Error("Durable SQLite schema version changed during initialization");
+        }
+        this.assertEmptyApplicationSchema();
+        this.createSchemaV1();
+        this.assertSchemaV1();
+        this.db.exec(`PRAGMA user_version = ${DURABLE_SCHEMA_VERSION};`);
+        if (this.readSchemaVersion() !== DURABLE_SCHEMA_VERSION) {
+          throw new Error("Durable SQLite schema version could not be recorded");
+        }
+      });
+      return;
+    }
+    this.assertSchemaV1();
+  }
+  createSchemaV1() {
+    for (const sql of Object.values(SCHEMA_V1_TABLE_SQL))
+      this.db.exec(`${sql};`);
+    for (const sql of Object.values(SCHEMA_V1_INDEX_SQL))
+      this.db.exec(`${sql};`);
+  }
+  assertSchemaV1() {
+    const objects = this.applicationSchemaObjects();
+    const expectedObjects = [
+      ...Object.entries(SCHEMA_V1_TABLE_SQL).map(([name, sql]) => ({ type: "table", name, table: name, sql })),
+      ...Object.entries(SCHEMA_V1_INDEX_SQL).map(([name, sql]) => ({
+        type: "index",
+        name,
+        table: schemaIndexTable(name),
+        sql
+      }))
+    ].sort(compareSchemaObjects);
+    assertSchemaShape("application objects", objects.map(({ type, name, table }) => ({ type, name, table })), expectedObjects.map(({ type, name, table }) => ({ type, name, table })));
+    for (const table of Object.keys(SCHEMA_V1_TABLE_SQL)) {
+      const columns = this.db.query(`PRAGMA table_info(${schemaIdentifier(table)})`).all().map((column) => ({
+        name: column.name,
+        type: column.type,
+        notnull: Number(column.notnull),
+        defaultValue: column.dflt_value,
+        pk: Number(column.pk)
+      }));
+      assertSchemaShape(`${table} columns`, columns, SCHEMA_V1_COLUMNS[table]);
+      const foreignKeys = this.db.query(`PRAGMA foreign_key_list(${schemaIdentifier(table)})`).all().map((foreignKey) => ({
+        table: foreignKey.table,
+        from: foreignKey.from,
+        to: foreignKey.to,
+        onUpdate: foreignKey.on_update,
+        onDelete: foreignKey.on_delete,
+        match: foreignKey.match
+      })).sort((left, right) => `${left.from}:${left.table}`.localeCompare(`${right.from}:${right.table}`));
+      assertSchemaShape(`${table} foreign keys`, foreignKeys, SCHEMA_V1_FOREIGN_KEYS[table]);
+      const indexes = this.db.query(`PRAGMA index_list(${schemaIdentifier(table)})`).all().map((index) => ({
+        name: index.name,
+        unique: Number(index.unique),
+        origin: index.origin,
+        partial: Number(index.partial),
+        columns: this.db.query(`PRAGMA index_info(${schemaIdentifier(index.name)})`).all().sort((left, right) => Number(left.seqno) - Number(right.seqno)).map((column) => column.name)
+      })).sort((left, right) => left.name.localeCompare(right.name));
+      const expectedIndexes = [...SCHEMA_V1_INDEXES[table]].sort((left, right) => left.name.localeCompare(right.name));
+      assertSchemaShape(`${table} indexes`, indexes, expectedIndexes);
+    }
+    for (const expected of expectedObjects) {
+      const actual = objects.find((object) => object.type === expected.type && object.name === expected.name);
+      if (!actual?.sql || normalizeSchemaSql(actual.sql) !== normalizeSchemaSql(expected.sql)) {
+        throw incompatibleSchema(`${expected.type} ${expected.name} SQL`);
+      }
+    }
+  }
+  readSchemaVersion() {
+    const row = this.db.query("PRAGMA user_version").get();
+    return Number(row?.user_version);
+  }
+  applicationSchemaObjects() {
+    return this.db.query(`
+      SELECT type, name, tbl_name, sql
+      FROM sqlite_master
+      WHERE substr(name, 1, 7) <> 'sqlite_'
+      ORDER BY type, name
+    `).all().map((row) => ({
+      type: row.type,
+      name: row.name,
+      table: row.tbl_name,
+      sql: row.sql
+    }));
+  }
+  assertEmptyApplicationSchema() {
+    if (this.applicationSchemaObjects().length !== 0) {
+      throw new Error("Durable SQLite schema version 0 requires an empty application schema");
+    }
+  }
+  secureDatabaseFiles() {
+    for (const path of [this.databasePath, `${this.databasePath}-wal`, `${this.databasePath}-shm`]) {
+      if (!existsSync2(path))
+        continue;
+      chmodSync(path, 384);
+    }
+  }
+}
+function schemaIndexTable(name) {
+  if (name === "events_dedupe_key_unique" || name === "events_source_type_idx")
+    return "events";
+  if (name === "outbox_due_idx")
+    return "outbox";
+  throw new Error(`Unknown durable schema index: ${name}`);
+}
+function schemaIdentifier(value) {
+  if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(value))
+    throw new Error("Invalid durable schema identifier");
+  return value;
+}
+function compareSchemaObjects(left, right) {
+  return `${left.type}:${left.name}`.localeCompare(`${right.type}:${right.name}`);
+}
+function normalizeSchemaSql(sql) {
+  return sql.trim().replace(/;$/, "").replace(/\s+/g, " ").replace(/\s*([(),])\s*/g, "$1").toLowerCase();
+}
+function assertSchemaShape(label, actual, expected) {
+  if (JSON.stringify(actual) !== JSON.stringify(expected))
+    throw incompatibleSchema(label);
+}
+function incompatibleSchema(detail) {
+  return new Error(`Durable SQLite schema version 1 is incompatible: ${detail}`);
+}
+function normalizePositiveInteger(value, fallback, name) {
+  const resolved = value ?? fallback;
+  if (!Number.isInteger(resolved) || resolved < 1)
+    throw new Error(`${name} must be a positive integer`);
+  return resolved;
+}
+function normalizeRetryPolicy2(policy) {
+  const normalized = {
+    maxAttempts: policy?.maxAttempts ?? 1,
+    backoffMs: policy?.backoffMs ?? 250,
+    multiplier: policy?.multiplier ?? 2
+  };
+  validateRetryPolicy(normalized);
+  return normalized;
+}
+function validateRetryPolicy(policy) {
+  const maxAttempts = policy.maxAttempts ?? 1;
+  const backoffMs = policy.backoffMs ?? 250;
+  const multiplier = policy.multiplier ?? 2;
+  if (!Number.isInteger(maxAttempts) || maxAttempts < 1 || maxAttempts > MAX_RETRY_ATTEMPTS) {
+    throw new Error(`retry.maxAttempts must be an integer from 1 to ${MAX_RETRY_ATTEMPTS}`);
+  }
+  if (!Number.isInteger(backoffMs) || backoffMs < 0 || backoffMs > MAX_RETRY_DELAY_MS) {
+    throw new Error(`retry.backoffMs must be an integer from 0 to ${MAX_RETRY_DELAY_MS}`);
+  }
+  if (!Number.isFinite(multiplier) || multiplier < 1 || multiplier > MAX_RETRY_MULTIPLIER) {
+    throw new Error(`retry.multiplier must be finite and from 1 to ${MAX_RETRY_MULTIPLIER}`);
+  }
+  if (maxAttempts > 1)
+    retryBackoffMs({ maxAttempts, backoffMs, multiplier }, maxAttempts - 1);
+}
+function retryBackoffMs(policy, attempt) {
+  const delay = Math.round(policy.backoffMs * policy.multiplier ** (attempt - 1));
+  if (!Number.isSafeInteger(delay) || delay < 0 || delay > MAX_RETRY_DELAY_MS) {
+    throw new Error(`retry policy must not produce a delay above ${MAX_RETRY_DELAY_MS}ms`);
+  }
+  return delay;
+}
+function parseJson(value) {
+  return JSON.parse(value);
+}
+function validateDurableWebhookConfig(webhook) {
+  let url;
+  try {
+    url = new URL(webhook.url);
+  } catch {
+    throw new Error("Durable webhook URL must be a valid URL");
+  }
+  if (url.protocol !== "https:" && url.protocol !== "http:") {
+    throw new Error("Durable webhook URL must use http or https");
+  }
+  if (url.username || url.password) {
+    throw new Error("Durable webhook URL must not contain credentials");
+  }
+  for (const name of url.searchParams.keys()) {
+    if (/authorization|cookie|api[-_]?key|token|secret|credential|signature/i.test(name)) {
+      throw new Error("Durable webhook URL must not contain credential query parameters");
+    }
+  }
+  for (const name of Object.keys(webhook.headers ?? {})) {
+    if (/^x-hasna-/i.test(name)) {
+      throw new Error("Durable webhook X-Hasna headers are reserved for signed delivery metadata");
+    }
+    if (/authorization|cookie|api[-_]?key|token|secret|credential/i.test(name)) {
+      throw new Error("Durable webhook credential headers are not persisted; use webhook.secretRef");
+    }
+  }
+}
+function sanitizeDurableAttempt(attempt) {
+  const { responseBody: _responseBody, stdout: _stdout, stderr: _stderr, ...metadata } = attempt;
+  if (metadata.status === "failed") {
+    metadata.error = metadata.responseStatus === undefined ? "Webhook delivery failed" : `Webhook returned HTTP ${metadata.responseStatus}`;
+  }
+  return metadata;
+}
+function parseSpoolEnvelope(raw) {
+  const value = parseJson(raw);
+  if (!value || typeof value !== "object")
+    throw new Error("Invalid durable event spool record");
+  for (const field of ["id", "source", "type", "time", "schemaVersion"]) {
+    if (typeof value[field] !== "string" || value[field].length === 0) {
+      throw new Error("Invalid durable event spool record");
+    }
+  }
+  if (!value.data || typeof value.data !== "object" || Array.isArray(value.data)) {
+    throw new Error("Invalid durable event spool record");
+  }
+  if (!value.metadata || typeof value.metadata !== "object" || Array.isArray(value.metadata)) {
+    throw new Error("Invalid durable event spool record");
+  }
+  return value;
+}
+function syncDirectory(path) {
+  const descriptor = openSync(path, "r");
+  try {
+    fsyncSync(descriptor);
+  } finally {
+    closeSync(descriptor);
+  }
+}
+function isNodeError(error, code) {
+  return Boolean(error && typeof error === "object" && "code" in error && error.code === code);
+}
+function spoolFileName(event) {
+  const identity = event.dedupeKey ?? event.id;
+  return `${createHash("sha256").update(identity, "utf8").digest("hex")}.json`;
+}
+
+// src/durable-worker.ts
+import { chmodSync as chmodSync2, mkdirSync as mkdirSync2, watch } from "fs";
+import { randomUUID as randomUUID5 } from "crypto";
+import { join as join4 } from "path";
+
+// src/durable-spool.ts
+import { createHash as createHash2, randomUUID as randomUUID4 } from "crypto";
+import {
+  chmod as chmod2,
+  link,
+  mkdir as mkdir2,
+  open,
+  readdir,
+  readFile as readFile2,
+  stat,
+  unlink
+} from "fs/promises";
+import { join as join3 } from "path";
+class DurableEventSpool {
+  dataDir;
+  inboxDir;
+  constructor(options) {
+    if (!options.dataDir)
+      throw new Error("DurableEventSpool requires dataDir");
+    this.dataDir = options.dataDir;
+    this.inboxDir = join3(options.dataDir, "spool", "inbox");
+  }
+  async enqueue(input) {
+    const event = redactSensitiveKeys(createSpoolEvent(input));
+    await this.ensureInbox();
+    const finalPath = this.pathFor(event);
+    const tempPath = join3(this.inboxDir, `.tmp-${process.pid}-${randomUUID4()}`);
+    const handle = await open(tempPath, "wx", 384);
+    try {
+      await handle.writeFile(`${JSON.stringify(event)}
+`, "utf8");
+      await handle.sync();
+    } finally {
+      await handle.close();
+    }
+    let stored = false;
+    try {
+      await link(tempPath, finalPath);
+      stored = true;
+    } catch (error) {
+      if (!isNodeError2(error, "EEXIST")) {
+        await unlink(tempPath).catch(() => {
+          return;
+        });
+        throw error;
+      }
+      await this.assertSameIdentity(finalPath, event);
+    }
+    await unlink(tempPath);
+    await this.syncInbox();
+    return { event, stored, deduped: !stored };
+  }
+  async recover(options = {}) {
+    await this.ensureInbox();
+    const olderThanMs = Math.max(0, options.olderThanMs ?? 60000);
+    const threshold = Date.now() - olderThanMs;
+    const result = { recovered: 0, deduped: 0, cleaned: 0 };
+    const names = (await readdir(this.inboxDir)).filter((name) => name.startsWith(".tmp-")).sort();
+    for (const name of names) {
+      const tempPath = join3(this.inboxDir, name);
+      const details = await stat(tempPath).catch(() => {
+        return;
+      });
+      if (!details || details.mtimeMs > threshold)
+        continue;
+      let event;
+      try {
+        event = parseEnvelope(await readFile2(tempPath, "utf8"));
+      } catch {
+        await unlink(tempPath).catch(() => {
+          return;
+        });
+        result.cleaned += 1;
+        continue;
+      }
+      const finalPath = this.pathFor(event);
+      try {
+        await link(tempPath, finalPath);
+        result.recovered += 1;
+      } catch (error) {
+        if (!isNodeError2(error, "EEXIST"))
+          throw error;
+        await this.assertSameIdentity(finalPath, event);
+        result.deduped += 1;
+      }
+      await unlink(tempPath).catch(() => {
+        return;
+      });
+    }
+    if (result.recovered || result.deduped || result.cleaned)
+      await this.syncInbox();
+    return result;
+  }
+  async close() {}
+  pathFor(event) {
+    const identity = event.dedupeKey ?? event.id;
+    const digest = createHash2("sha256").update(identity, "utf8").digest("hex");
+    return join3(this.inboxDir, `${digest}.json`);
+  }
+  async assertSameIdentity(path, event) {
+    const existing = parseEnvelope(await readFile2(path, "utf8"));
+    const matches = existing.id === event.id || event.dedupeKey !== undefined && existing.dedupeKey === event.dedupeKey;
+    if (!matches)
+      throw new Error("Durable spool identity collision");
+  }
+  async ensureInbox() {
+    const spoolDir = join3(this.dataDir, "spool");
+    await mkdir2(this.inboxDir, { recursive: true, mode: 448 });
+    await chmod2(this.dataDir, 448);
+    await chmod2(spoolDir, 448);
+    await chmod2(this.inboxDir, 448);
+    await this.syncDirectory(this.dataDir);
+    await this.syncDirectory(spoolDir);
+  }
+  async syncInbox() {
+    await this.syncDirectory(this.inboxDir);
+  }
+  async syncDirectory(path) {
+    const directory = await open(path, "r");
+    try {
+      await directory.sync();
+    } finally {
+      await directory.close();
+    }
+  }
+}
+function createSpoolEvent(input) {
+  return {
+    id: input.id ?? randomUUID4(),
+    source: input.source,
+    type: input.type,
+    time: input.time instanceof Date ? input.time.toISOString() : input.time ?? new Date().toISOString(),
+    subject: input.subject,
+    severity: input.severity ?? "info",
+    data: input.data ?? {},
+    message: input.message,
+    dedupeKey: input.dedupeKey,
+    schemaVersion: input.schemaVersion ?? "1.0",
+    metadata: input.metadata ?? {}
+  };
+}
+function parseEnvelope(raw) {
+  const value = JSON.parse(raw);
+  if (!value || typeof value !== "object")
+    throw new Error("Invalid durable event spool record");
+  for (const field of ["id", "source", "type", "time", "schemaVersion"]) {
+    if (typeof value[field] !== "string" || value[field].length === 0) {
+      throw new Error("Invalid durable event spool record");
+    }
+  }
+  if (!value.data || typeof value.data !== "object" || Array.isArray(value.data)) {
+    throw new Error("Invalid durable event spool record");
+  }
+  if (!value.metadata || typeof value.metadata !== "object" || Array.isArray(value.metadata)) {
+    throw new Error("Invalid durable event spool record");
+  }
+  return value;
+}
+function isNodeError2(error, code) {
+  return Boolean(error && typeof error === "object" && "code" in error && error.code === code);
+}
+
+// src/durable-worker.ts
+var MAX_TIMER_DELAY_MS = 2147483647;
+async function runDurableWorker(options) {
+  const workerId = options.workerId ?? randomUUID5();
+  const limit = positiveInteger(options.limit, 100, "limit");
+  const leaseMs = positiveInteger(options.leaseMs, 60000, "leaseMs");
+  const debounceMs = nonNegativeInteger(options.debounceMs, 50, "debounceMs");
+  const reconcileMs = positiveInteger(options.reconcileMs, 30000, "reconcileMs");
+  const watchRestartMs = positiveInteger(options.watchRestartMs, 1000, "watchRestartMs");
+  const spool = new DurableEventSpool({ dataDir: options.broker.dataDir });
+  const inboxDir = spool.inboxDir;
+  mkdirSync2(inboxDir, { recursive: true, mode: 448 });
+  chmodSync2(join4(options.broker.dataDir, "spool"), 448);
+  chmodSync2(inboxDir, 448);
+  const totals = {
+    workerId,
+    cycles: 0,
+    imported: 0,
+    deduped: 0,
+    delivered: 0,
+    retried: 0,
+    dead: 0,
+    lost: 0
+  };
+  return new Promise((resolve, reject) => {
+    let watcher;
+    let debounceTimer;
+    let retryTimer;
+    let reconcileTimer;
+    let restartTimer;
+    let running = false;
+    let rerun = false;
+    let stopped = false;
+    const clearRetryTimer = () => {
+      if (retryTimer)
+        clearTimeout(retryTimer);
+      retryTimer = undefined;
+    };
+    const stop = () => {
+      if (stopped)
+        return;
+      stopped = true;
+      watcher?.close();
+      if (debounceTimer)
+        clearTimeout(debounceTimer);
+      clearRetryTimer();
+      if (reconcileTimer)
+        clearInterval(reconcileTimer);
+      if (restartTimer)
+        clearTimeout(restartTimer);
+      options.signal.removeEventListener("abort", stop);
+      if (!running)
+        resolve(totals);
+    };
+    const scheduleRetryWake = () => {
+      clearRetryTimer();
+      if (stopped)
+        return;
+      const nextWakeAt = options.broker.nextWakeAt();
+      if (nextWakeAt === undefined)
+        return;
+      const delay = Math.min(MAX_TIMER_DELAY_MS, Math.max(0, nextWakeAt - Date.now()));
+      retryTimer = setTimeout(() => {
+        retryTimer = undefined;
+        runCycle();
+      }, delay);
+    };
+    const runCycle = async () => {
+      if (stopped)
+        return;
+      if (running) {
+        rerun = true;
+        return;
+      }
+      running = true;
+      clearRetryTimer();
+      try {
+        await spool.recover();
+        const imported = options.broker.importSpool({ limit });
+        const drained = await options.broker.drain({ workerId, limit, leaseMs });
+        const cycle = { imported, drained };
+        totals.cycles += 1;
+        totals.imported += imported.imported;
+        totals.deduped += imported.deduped;
+        totals.delivered += drained.delivered;
+        totals.retried += drained.retried;
+        totals.dead += drained.dead;
+        totals.lost += drained.lost;
+        await options.onCycle?.(cycle);
+        if (imported.scanned >= limit || drained.claimed >= limit)
+          rerun = true;
+      } catch (error) {
+        reject(error);
+        stop();
+        return;
+      } finally {
+        running = false;
+      }
+      if (stopped) {
+        resolve(totals);
+      } else if (rerun) {
+        rerun = false;
+        queueMicrotask(() => {
+          runCycle();
+        });
+      } else {
+        scheduleRetryWake();
+      }
+    };
+    const scheduleDebouncedCycle = () => {
+      if (stopped)
+        return;
+      if (debounceTimer)
+        clearTimeout(debounceTimer);
+      debounceTimer = setTimeout(() => {
+        debounceTimer = undefined;
+        runCycle();
+      }, debounceMs);
+    };
+    const startWatcher = () => {
+      if (stopped)
+        return;
+      watcher?.close();
+      try {
+        watcher = watch(inboxDir, (_eventType, filename) => {
+          if (!filename || filename.toString().endsWith(".json"))
+            scheduleDebouncedCycle();
+        });
+        watcher.on("error", () => {
+          watcher?.close();
+          watcher = undefined;
+          scheduleDebouncedCycle();
+          if (!stopped)
+            restartTimer = setTimeout(startWatcher, watchRestartMs);
+        });
+      } catch {
+        scheduleDebouncedCycle();
+        if (!stopped)
+          restartTimer = setTimeout(startWatcher, watchRestartMs);
+      }
+    };
+    options.signal.addEventListener("abort", stop, { once: true });
+    if (options.signal.aborted) {
+      stop();
+      return;
+    }
+    startWatcher();
+    reconcileTimer = setInterval(() => {
+      runCycle();
+    }, reconcileMs);
+    runCycle();
+  });
+}
+function positiveInteger(value, fallback, name) {
+  const resolved = value ?? fallback;
+  if (!Number.isInteger(resolved) || resolved < 1)
+    throw new Error(`${name} must be a positive integer`);
+  return resolved;
+}
+function nonNegativeInteger(value, fallback, name) {
+  const resolved = value ?? fallback;
+  if (!Number.isInteger(resolved) || resolved < 0)
+    throw new Error(`${name} must be a non-negative integer`);
+  return resolved;
+}
+
 // src/filter-options.ts
 function parseFieldMatchers(values, label, typed = false) {
   if (!values?.length)
@@ -978,8 +2128,8 @@ function parseMatcherExpression(value, label) {
 // src/cli/index.ts
 function version() {
   try {
-    const packagePath = join2(dirname(fileURLToPath(import.meta.url)), "..", "..", "package.json");
-    return JSON.parse(readFileSync(packagePath, "utf-8")).version ?? "0.0.0";
+    const packagePath = join5(dirname(fileURLToPath(import.meta.url)), "..", "..", "package.json");
+    return JSON.parse(readFileSync2(packagePath, "utf-8")).version ?? "0.0.0";
   } catch {
     return "0.0.0";
   }
@@ -1102,9 +2252,24 @@ Usage:
   ${name} [--dir <path>] [--json] events emit <type>${options.source ? "" : " --source <source>"} [options]
   ${name} [--dir <path>] [--json] events list [--limit <n>]
   ${name} [--dir <path>] [--json] events replay [--id <event-id>] [--cursor <cursor>] [--limit <n>] [--dry-run]
+  ${name} [--dir <path>] [--json] durable channel <url> [options]
+  ${name} [--dir <path>] [--json] durable enqueue <type> --source <source> [options]
+  ${name} [--dir <path>] [--json] durable import [--limit <n>]
+  ${name} [--dir <path>] [--json] durable drain [--limit <n>] [--lease-ms <ms>]
+  ${name} [--dir <path>] [--json] durable work [--limit <n>] [--lease-ms <ms>] [--reconcile-ms <ms>]
+  ${name} [--dir <path>] [--json] durable retry-dead [--event-id <id>] [--channel-id <id>] [--limit <n>]
+  ${name} [--dir <path>] [--json] durable status
+
+Global options (must precede the command group):
+  --dir <path>              Data directory
+  -j, --json               Print JSON output
+  -h, --help               Show help
+  -v, --version            Show version
 
 Environment:
-  HASNA_EVENTS_DIR or HASNA_EVENTS_HOME overrides the default ${getEventsDataDir()}`);
+  HASNA_EVENTS_DIR          Primary data-directory override
+  HASNA_EVENTS_HOME         Legacy data-directory fallback
+  Default directory         ${getEventsDataDir()}`);
 }
 function printChannelsHelp(options = {}) {
   const name = commandName(options);
@@ -1118,22 +2283,24 @@ Usage:
   ${name} [--dir <path>] [--json] channels match <id>
   ${name} [--dir <path>] [--json] channels status
 
-Options:
-  --id <id>                 Channel id for add
-  --type <pattern>          Event type filter, supports wildcards
-  --source <source>         Event source filter
-  --subject <subject>       Event subject filter
-  --severity <severity>     Event severity filter
-  --data <path=value|path!=value> Event data field filter, repeatable; strings, dot paths, array-member matching, * segment wildcard, ** recursive wildcard
-  --metadata <path=value|path!=value> Event metadata field filter, repeatable; strings, dot paths, array-member matching, * segment wildcard, ** recursive wildcard
-  --data-json <path=json|path!=json> Event data field filter with typed JSON value
-  --metadata-json <path=json|path!=json> Event metadata field filter with typed JSON value
-  --honor-filters           On channels test, skip delivery when the sample event does not match filters
-  --transport <kind>        webhook or command
-  --secret <secret>         Webhook signing secret
-  --header <name=value>     Webhook header, repeatable
-  --redact <path>           Redaction path, repeatable
-  --no-deliver              Available on events emit`);
+Commands:
+  add                       Add or replace a channel
+  list                      List configured channels
+  remove                    Remove a channel
+  test                      Send a sample event to one channel
+  match                     Preview a sample event without delivery
+  status                    Show channel storage status
+
+Run '${name} channels add --help' for add options.
+
+Test and match options:
+  --source <source>         Event source (default: ${options.source ?? "hasna.events"})
+  --type <type>             Event type (default: events.test)
+  --subject <subject>       Event subject (default: channel id)
+  --message <message>       Event message
+  --data <json>             Event data object
+  --metadata <json>         Event metadata object
+  --honor-filters           Test only: skip delivery on a filter mismatch`);
 }
 function printChannelAddHelp(options = {}) {
   const name = commandName(options);
@@ -1144,23 +2311,24 @@ Usage:
   ${name} [--dir <path>] [--json] channels add <command> --transport command [options] -- [command-args...]
 
 Options:
-  --id <id>                 Channel id
+  --id <id>                 Channel id (default: generated UUID)
   --name <name>             Display name
-  --transport <kind>        webhook or command
+  --transport <kind>        webhook or command (default: webhook)
   --type <pattern>          Event type filter, supports wildcards
+  --event-type <pattern>    Alias for --type
   --source <source>         Event source filter
   --subject <subject>       Event subject filter
   --severity <severity>     Event severity filter
-  --data <path=value|path!=value> Event data field filter, repeatable
-  --metadata <path=value|path!=value> Event metadata field filter, repeatable
-  --data-json <path=json|path!=json> Event data field filter with typed JSON value
-  --metadata-json <path=json|path!=json> Event metadata field filter with typed JSON value
+  --data <path=value>       String data filter; repeatable; != negates
+  --metadata <path=value>   String metadata filter; repeatable; != negates
+  --data-json <path=json>   Typed JSON data filter; repeatable; != negates
+  --metadata-json <path=json> Typed JSON metadata filter; repeatable; != negates
   --secret <secret>         Webhook signing secret
   --header <name=value>     Webhook header, repeatable
   --arg <arg>               Command argument, repeatable; values may begin with dashes
-  --timeout-ms <ms>         Transport timeout in milliseconds
-  --retry-attempts <n>      Maximum delivery attempts
-  --retry-backoff-ms <ms>   Initial retry backoff in milliseconds
+  --timeout-ms <ms>         Transport timeout (default: 15000)
+  --retry-attempts <n>      Maximum delivery attempts (default: 1)
+  --retry-backoff-ms <ms>   Initial retry backoff (default: 250)
   --redact <path>           Redaction path, repeatable
   --disabled                Create channel disabled
 
@@ -1179,15 +2347,25 @@ Usage:
   ${name} [--dir <path>] [--json] events list [--limit <n>]
   ${name} [--dir <path>] [--json] events replay [--id <event-id>] [--cursor <cursor>] [--limit <n>] [--dry-run]
 
-Options:
+Emit options:
   --source <source>         Event source${options.source ? ` (default: ${options.source})` : ""}
   --subject <subject>       Event subject
-  --severity <severity>     Event severity
+  --severity <severity>     debug|info|notice|warning|error|critical (default: info)
   --message <message>       Human-readable event message
   --dedupe-key <key>        Deduplicate repeated events
   --data <json>             JSON object payload
   --metadata <json>         JSON object metadata
   --no-deliver              Record without delivering channels
+
+List options:
+  --source <source>         Filter by exact source
+  --type <type>             Filter by exact type
+  --limit <n>               Most recent events; 0 or omitted lists all
+
+Replay options:
+  --id <event-id>           Filter by exact event id
+  --source <source>         Filter by exact source
+  --type <type>             Filter by exact type
   --cursor <cursor>         Opaque cursor returned by a previous replay page
   --limit <n>               Maximum events to replay
   --dry-run                 Preview replay matches without delivery`);
@@ -1211,6 +2389,19 @@ async function runEventsCli(argv = process.argv.slice(2), options = {}) {
     });
     return;
   }
+  if (group === "durable") {
+    if (!command || command === "--help" || command === "-h" || tail.includes("--help") || tail.includes("-h")) {
+      printDurableHelp(options);
+      return;
+    }
+    const broker = new DurableEventsBroker({ dataDir: parsed.dir ?? getEventsDataDir() });
+    try {
+      await handleDurable(broker, command, tail, parsed);
+    } finally {
+      broker.close();
+    }
+    return;
+  }
   const store = new JsonEventsStore(parsed.dir);
   const client = new EventsClient({ store });
   if (group === "channels") {
@@ -1243,6 +2434,150 @@ async function runEventsCli(argv = process.argv.slice(2), options = {}) {
   }
   throw new Error(`Unknown command group: ${group}`);
 }
+function printDurableHelp(options = {}) {
+  const name = commandName(options);
+  console.log(`${name} durable
+
+Usage:
+  ${name} [--dir <path>] [--json] durable channel <url> --id <id> --source <source> --type <type> --secret-ref <ref> [options]
+  ${name} [--dir <path>] [--json] durable enqueue <type> --source <source> [options]
+  ${name} [--dir <path>] [--json] durable import [--limit <n>]
+  ${name} [--dir <path>] [--json] durable drain [--limit <n>] [--lease-ms <ms>]
+  ${name} [--dir <path>] [--json] durable work [--limit <n>] [--lease-ms <ms>] [--reconcile-ms <ms>]
+  ${name} [--dir <path>] [--json] durable retry-dead [--event-id <id>] [--channel-id <id>] [--limit <n>]
+  ${name} [--dir <path>] [--json] durable status
+
+Channel options:
+  --id <id>                 Required stable channel id
+  --source <source>         Required exact source filter
+  --type <type>             Required exact event type filter
+  --secret-ref <ref>        Runtime secret reference, e.g. env:HASNA_WEBHOOK_SECRET
+  --timeout-ms <ms>         Webhook timeout (default: 15000)
+  --retry-attempts <n>      Maximum durable attempts (default: 1)
+  --retry-backoff-ms <ms>   Initial persisted backoff (default: 250)
+  --disabled                Persist the route disabled
+
+Enqueue options:
+  --id <id>                 Stable event id
+  --subject <subject>       Stable event subject
+  --time <iso-time>         Event occurrence time
+  --schema-version <value>  Envelope schema version
+  --dedupe-key <key>        Stable business idempotency key
+  --data <json>             Event data object
+  --metadata <json>         Event metadata object`);
+}
+async function handleDurable(broker, command, tail, parsed) {
+  if (command === "channel") {
+    const args = [...tail];
+    const target = args.shift();
+    if (!target)
+      throw new Error("durable channel requires a webhook URL");
+    const id = takeOption(args, "--id");
+    const source = takeOption(args, "--source");
+    const type = takeOption(args, "--type");
+    if (!id || !source || !type)
+      throw new Error("durable channel requires --id, --source, and --type");
+    if (source.includes("*") || type.includes("*"))
+      throw new Error("durable channel source/type filters must be exact");
+    const secretRef = takeOption(args, "--secret-ref");
+    if (!secretRef)
+      throw new Error("durable channel requires --secret-ref");
+    const timeoutMs = numberOption(takeOption(args, "--timeout-ms"));
+    const retryAttempts = numberOption(takeOption(args, "--retry-attempts"));
+    const retryBackoffMs2 = numberOption(takeOption(args, "--retry-backoff-ms"));
+    const channel = broker.addChannel({
+      id,
+      enabled: !takeFlag(args, "--disabled"),
+      transport: "webhook",
+      filters: [{ source, type }],
+      webhook: { url: target, secretRef, timeoutMs },
+      retry: retryAttempts || retryBackoffMs2 ? { maxAttempts: retryAttempts, backoffMs: retryBackoffMs2 } : undefined
+    });
+    output(parsed, sanitizeChannelForOutput(channel), () => console.log(`Added durable webhook channel ${channel.id}`));
+    return;
+  }
+  if (command === "enqueue") {
+    const args = [...tail];
+    const type = args.shift();
+    if (!type)
+      throw new Error("durable enqueue requires an event type");
+    const source = takeOption(args, "--source");
+    if (!source)
+      throw new Error("durable enqueue requires --source");
+    const result = broker.enqueue({
+      id: takeOption(args, "--id"),
+      source,
+      type,
+      time: takeOption(args, "--time"),
+      subject: takeOption(args, "--subject"),
+      dedupeKey: takeOption(args, "--dedupe-key"),
+      schemaVersion: takeOption(args, "--schema-version"),
+      data: parseJsonOption(takeOption(args, "--data"), {}),
+      metadata: parseJsonOption(takeOption(args, "--metadata"), {})
+    });
+    output(parsed, result, () => console.log(`${result.deduped ? "Deduped" : "Enqueued"} ${result.event.id} to ${result.queued} channel(s)`));
+    return;
+  }
+  if (command === "import") {
+    const args = [...tail];
+    const result = broker.importSpool({ limit: numberOption(takeOption(args, "--limit")) });
+    output(parsed, result, () => console.log(`Imported ${result.imported}, deduped ${result.deduped}, queued ${result.queued}`));
+    return;
+  }
+  if (command === "drain") {
+    const args = [...tail];
+    const limit = numberOption(takeOption(args, "--limit"));
+    const imported = broker.importSpool({ limit });
+    const drained = await broker.drain({
+      limit,
+      leaseMs: numberOption(takeOption(args, "--lease-ms")),
+      workerId: takeOption(args, "--worker-id")
+    });
+    const result = { imported, drained };
+    output(parsed, result, () => console.log(`Claimed ${drained.claimed}, delivered ${drained.delivered}, retried ${drained.retried}, dead ${drained.dead}`));
+    return;
+  }
+  if (command === "work") {
+    const args = [...tail];
+    const controller = new AbortController;
+    const stop = () => controller.abort();
+    process.once("SIGTERM", stop);
+    process.once("SIGINT", stop);
+    try {
+      const result = await runDurableWorker({
+        broker,
+        signal: controller.signal,
+        limit: numberOption(takeOption(args, "--limit")),
+        leaseMs: numberOption(takeOption(args, "--lease-ms")),
+        workerId: takeOption(args, "--worker-id"),
+        debounceMs: numberOption(takeOption(args, "--debounce-ms")),
+        reconcileMs: numberOption(takeOption(args, "--reconcile-ms")),
+        watchRestartMs: numberOption(takeOption(args, "--watch-restart-ms"))
+      });
+      output(parsed, result, () => console.log(`Worker stopped after ${result.cycles} cycle(s), delivered ${result.delivered}`));
+    } finally {
+      process.removeListener("SIGTERM", stop);
+      process.removeListener("SIGINT", stop);
+    }
+    return;
+  }
+  if (command === "status") {
+    const result = broker.status();
+    output(parsed, result, () => console.log(`events durable: ${result.counts.pending} pending, ${result.counts.leased} leased, ${result.counts.dead} dead`));
+    return;
+  }
+  if (command === "retry-dead") {
+    const args = [...tail];
+    const result = broker.retryDead({
+      eventId: takeOption(args, "--event-id"),
+      channelId: takeOption(args, "--channel-id"),
+      limit: numberOption(takeOption(args, "--limit"))
+    });
+    output(parsed, result, () => console.log(`Requeued ${result.requeued} dead delivery job(s)`));
+    return;
+  }
+  throw new Error(`Unknown durable command: ${command}`);
+}
 async function handleChannels(client, command, tail, parsed, options) {
   if (command === "add") {
     const { args, delimiterArgs } = splitDelimiter(tail);
@@ -1252,7 +2587,7 @@ async function handleChannels(client, command, tail, parsed, options) {
     const secret = takeOption(args, "--secret");
     const timeoutMs = numberOption(takeOption(args, "--timeout-ms"));
     const retryAttempts = numberOption(takeOption(args, "--retry-attempts"));
-    const retryBackoffMs = numberOption(takeOption(args, "--retry-backoff-ms"));
+    const retryBackoffMs2 = numberOption(takeOption(args, "--retry-backoff-ms"));
     const disabled = takeFlag(args, "--disabled");
     const headerValues = takeMany(args, "--header");
     const commandArgs = takeMany(args, "--arg");
@@ -1268,7 +2603,7 @@ async function handleChannels(client, command, tail, parsed, options) {
       enabled: !disabled,
       transport,
       filters,
-      retry: retryAttempts || retryBackoffMs ? { maxAttempts: retryAttempts, backoffMs: retryBackoffMs } : undefined,
+      retry: retryAttempts || retryBackoffMs2 ? { maxAttempts: retryAttempts, backoffMs: retryBackoffMs2 } : undefined,
       redact: redactions.length > 0 ? { paths: redactions } : undefined,
       createdAt: now2,
       updatedAt: now2