@mcp-b/do-runtime 0.2.2 → 0.3.0

package/dist/index.js

@@ -1,1447 +1,9 @@
+import { a as isExceptionFromInputGateBroken, c as tryCurrentSlice, i as hasUserErrorDetail, l as InputGate, n as atCheckpointEnd, o as requireInputLock, r as captureGateStack, s as setUserErrorDetail, t as IoContext, u as OutputGate } from "./chunks/io-context-Ci3Rf6U5.js";
 import { RpcTarget as RpcTarget$1 } from "./cloudflare-workers.js";
 import { a as getInt64, c as isNull, i as getBlob, o as getText, r as SqliteDatabase, s as hasCurrentSqliteTable } from "./chunks/sqlite-DFg92Tgt.js";
 import { ALARM_RETRY_MAX_TRIES, ALARM_RETRY_START_SECONDS, AlarmScheduler, RETRY_BACKOFF_MAX, RETRY_JITTER_FACTOR, alarmRetryDelayMs } from "./server/alarm-scheduler.js";
 import { deserialize, serialize } from "@ungap/structured-clone";
 import { RpcTarget, newMessagePortRpcSession } from "capnweb";
-//#region src/io/io-gate.ts
-/**
-* ← workerd `src/workerd/io/io-gate.{h,c++}`
-*
-* An I/O gate allows someone to "lock" a type of I/O so that other concurrent tasks trying to
-* perform that type of I/O are blocked until the lock is released.
-*
-* I/O gates are used in actors to implement consistency guarantees, allowing in-memory state and
-* storage to be synchronized.
-*
-* Each Actor has two main gates:
-* - Input gate: While locked, blocks all incoming I/O events of any type from being delivered to
-*   the actor, other than the specific event or events that hold the lock. This includes
-*   blocking responses to subrequests, timer events, input streams, etc. Used when storage
-*   operations are outstanding, so that awaiting a storage operation does not risk allowing
-*   concurrent events that render the state inconsistent.
-* - Output gate: While locked, blocks all outgoing messages from an actor that would allow the
-*   rest of the world to observe the actor's state. Held while writes that have been confirmed
-*   to the application are still being flushed to disk. If the flush fails, these messages will
-*   never be sent, so that the rest of the world cannot observe a prematurely-confirmed write.
-*
-* Three things kj gives for free and JS does not, resolved the same way at every site:
-*
-*  1. **Destructors.** `~Lock` releases and `~CriticalSection` diagnoses a dropped section as
-*     deadlock. Both become explicit: `Lock.release()` and `CriticalSection.drop()`. A `Lock`
-*     released twice throws rather than corrupting the refcount.
-*  2. **Cancel-by-drop.** Dropping a `kj::Promise` unwinds its waiter. Every such site takes an
-*     `AbortSignal`, the convention `Timer.afterDelay` already set in `io-context.ts`. Aborting a
-*     `wait()` rejects it with `CanceledError`; a never-settling promise would be an invisible
-*     hang, which is what this repo's fail-closed tenet exists to prevent.
-*  3. **`kj::ForkedPromise` holding an exception with no branches.** JS reports that as an
-*     unhandled rejection, so every promise this module stores keeps a no-op `catch` of its own
-*     and hands observers a separate view.
-*
-* Error strings are copied verbatim from upstream; users and upstream tests match on them.
-*
-* Not ported: `SpanParent`/`SpanBuilder` tracing, since there is no `trace.h` here and upstream's
-* own tests pass `nullptr` at every call site; and the `~InputGate` assertion that no locks
-* outlive the gate, which guards against dangling references GC makes impossible.
-*
-* Spec: §1.1, §1.2, §1.5, decisions 3, 5 and 13 in
-* docs/decisions.md.
-*/
-/**
-* Raised when a `wait()` is cancelled through its `AbortSignal`.
-*
-* kj has no equivalent, because a cancelled continuation simply never runs. It is deliberately
-* NOT a gate failure: a cancelled waiter leaves the gate exactly as it found it, so
-* `CriticalSection.wait()` rethrows this one without calling `setBroken()`.
-*/
-var CanceledError = class extends Error {
-	name = "CanceledError";
-};
-/** Mirrors `OutputGate::makeUnfulfilledException()`: one place that spells the exception. */
-function makeCanceledError() {
-	return new CanceledError("input gate wait was canceled");
-}
-/**
-* `addEventListener("abort", ...)` never fires for a signal that has already aborted, so a
-* pre-aborted signal would silently hold its lock forever. Every cancellation site goes through
-* here, and every one of them first rejects a pre-aborted wait before touching gate state, so
-* "cancelled" always means "left the gate exactly as it found it".
-*/
-function onAbort(signal, run) {
-	if (signal === void 0) return;
-	if (signal.aborted) {
-		run();
-		return;
-	}
-	signal.addEventListener("abort", run, { once: true });
-}
-/** ← `InputGate::Hooks::DEFAULT`. */
-var DEFAULT_INPUT_GATE_HOOKS = {
-	inputGateLocked() {},
-	inputGateReleased() {},
-	inputGateWaiterAdded() {},
-	inputGateWaiterRemoved() {}
-};
-/** ← `InputGate::Waiter`: a `kj::List` node plus the adapted promise's fulfiller. */
-var Waiter = class {
-	/** Rewritten by `CriticalSection.succeeded()` when a straggler is reparented. */
-	gate;
-	isChildWaiter;
-	/** ← `link.isLinked()`. */
-	linked = true;
-	#resolve;
-	#reject;
-	constructor(gate, isChildWaiter, resolve, reject) {
-		this.gate = gate;
-		this.isChildWaiter = isChildWaiter;
-		this.#resolve = resolve;
-		this.#reject = reject;
-		gate.hooks.inputGateWaiterAdded();
-		if (isChildWaiter) gate.waitingChildren.push(this);
-		else gate.waiters.push(this);
-	}
-	unlink() {
-		if (!this.linked) return;
-		this.linked = false;
-		const list = this.isChildWaiter ? this.gate.waitingChildren : this.gate.waiters;
-		const index = list.indexOf(this);
-		if (index < 0) throw new Error("InputGate::Waiter is linked but absent from its gate's list");
-		list.splice(index, 1);
-	}
-	fulfill(lock) {
-		this.unlink();
-		this.gate.hooks.inputGateWaiterRemoved();
-		this.#resolve(lock);
-	}
-	reject(exception) {
-		this.unlink();
-		this.gate.hooks.inputGateWaiterRemoved();
-		this.#reject(exception);
-	}
-};
-/**
-* An InputGate blocks incoming events from being delivered to an actor while the lock is held.
-*
-* Upstream marks the state below `private` and befriends `Lock` and `CriticalSection`.
-* TypeScript has no friendship, and `protected` would not let `CriticalSection` reach these
-* members on its *parent* gate, which `succeeded()` does. The boundary that actually holds is
-* the package facade in `src/index.ts`, which exports none of these types.
-*/
-var InputGate = class {
-	hooks;
-	/**
-	* How many instances of `Lock` currently exist? When this reaches zero, we'll release some
-	* waiters.
-	*
-	* Upstream also carries a `bool isCriticalSection`, because `CriticalSection` inherits
-	* `InputGate` privately and has to `static_cast` back. `instanceof` is the same test with no
-	* cast and no field that can disagree with the object it describes.
-	*/
-	lockCount = 0;
-	waiters = [];
-	/**
-	* Waiters representing CriticalSections that are ready to start. These take priority over other
-	* waiters.
-	*/
-	waitingChildren = [];
-	/** A fulfiller for onBroken(), or an exception if already broken. */
-	brokenState;
-	#brokenPromise;
-	constructor(hooks = DEFAULT_INPUT_GATE_HOOKS) {
-		this.hooks = hooks;
-		const { promise, reject } = Promise.withResolvers();
-		this.#brokenPromise = promise;
-		this.brokenState = {
-			kind: "fulfiller",
-			reject
-		};
-		promise.catch(() => {});
-	}
-	/** Wait until there are no `Lock`s, then create a new one and return it. */
-	wait(signal) {
-		if (signal?.aborted === true) return Promise.reject(makeCanceledError());
-		else if (this.brokenState.kind === "exception") return Promise.reject(this.brokenState.exception);
-		else if (this.lockCount === 0) return Promise.resolve(new Lock(this));
-		else return this.newWaiterPromise(false, signal);
-	}
-	/**
-	* Rejects if and when calls to `wait()` become broken due to a failed critical section. The
-	* actor should be shut down in this case. This promise never resolves, only rejects.
-	*/
-	onBroken() {
-		if (this.brokenState.kind === "exception") return Promise.reject(this.brokenState.exception);
-		else return this.#brokenPromise;
-	}
-	/** ← `kj::newAdaptedPromise<Lock, Waiter>(gate, isChildWaiter, span)`. */
-	newWaiterPromise(isChildWaiter, signal) {
-		const { promise, resolve, reject } = Promise.withResolvers();
-		const waiter = new Waiter(this, isChildWaiter, resolve, reject);
-		onAbort(signal, () => {
-			if (!waiter.linked) return;
-			waiter.reject(makeCanceledError());
-		});
-		return promise;
-	}
-	releaseLock() {
-		if (this instanceof CriticalSection && this.state === "REPARENTED") {
-			if (this.waitingChildren.length !== 0 || this.waiters.length !== 0 || this.lockCount !== 0) throw new Error("releasing a lock on a reparented CriticalSection that still holds state");
-			this.parentAsInputGate().releaseLock();
-			return;
-		}
-		if (this.lockCount === 0) throw new Error("InputGate::releaseLock() with no locks outstanding");
-		this.lockCount--;
-		if (this.lockCount === 0) {
-			this.hooks.inputGateReleased();
-			const child = this.waitingChildren[0];
-			if (child !== void 0) child.fulfill(new Lock(this));
-			else {
-				const waiter = this.waiters[0];
-				if (waiter !== void 0) waiter.fulfill(new Lock(this));
-			}
-		}
-	}
-	/** Called when a critical section fails. All future waiters will throw this exception. */
-	setBroken(exception) {
-		for (const waiter of [...this.waitingChildren]) waiter.reject(exception);
-		for (const waiter of [...this.waiters]) waiter.reject(exception);
-		if (this.brokenState.kind === "fulfiller") this.brokenState.reject(exception);
-		this.brokenState = {
-			kind: "exception",
-			exception
-		};
-	}
-};
-/** ← `InputGate::Lock`. A lock that blocks all new events from being delivered while it exists. */
-var Lock = class Lock {
-	/** ← "Becomes null on move." Here it becomes undefined on `release()`. */
-	#gate;
-	constructor(gate) {
-		this.#gate = gate;
-		let gateToLock = gate;
-		if (gate instanceof CriticalSection && gate.state === "REPARENTED") gateToLock = gate.parentAsInputGate();
-		if (++gateToLock.lockCount === 1) gateToLock.hooks.inputGateLocked();
-	}
-	/** ← `~Lock`. */
-	release() {
-		const gate = this.#gate;
-		if (gate === void 0) throw new Error("InputGate::Lock was released twice");
-		this.#gate = void 0;
-		gate.releaseLock();
-	}
-	/**
-	* Increments the lock's refcount, returning a duplicate `Lock`. All `Lock`s must be released
-	* before the gate is unlocked.
-	*/
-	addRef() {
-		return new Lock(this.#requireGate());
-	}
-	/**
-	* Start a new critical section from this lock. After `wait()` has been called on the returned
-	* critical section for the first time, no further Locks will be handed out by
-	* InputGate::wait() until the CriticalSection has been dropped.
-	*
-	* CriticalSections can be nested. If this Lock is itself part of a CriticalSection, the new
-	* CriticalSection will be nested within it and the outer CriticalSection's wait() won't
-	* produce a Lock again until the inner CriticalSection is dropped.
-	*/
-	startCriticalSection() {
-		return new CriticalSection(this.#requireGate());
-	}
-	/** If this lock was taken in a CriticalSection, return it. */
-	getCriticalSection() {
-		const gate = this.#requireGate();
-		return gate instanceof CriticalSection ? gate : void 0;
-	}
-	isFor(otherGate) {
-		if (otherGate instanceof CriticalSection) throw new Error("InputGate::Lock::isFor() takes the root gate, not a CriticalSection");
-		let ptr = this.#requireGate();
-		while (ptr instanceof CriticalSection) ptr = ptr.parentAsInputGate();
-		return ptr === otherGate;
-	}
-	/** ← `operator==`. */
-	equals(other) {
-		return this.#requireGate() === other.#requireGate();
-	}
-	#requireGate() {
-		const gate = this.#gate;
-		if (gate === void 0) throw new Error("InputGate::Lock was used after release");
-		return gate;
-	}
-};
-/**
-* A CriticalSection is a procedure that must not be interrupted by anything "external".
-* While a CriticalSection is running, all events that were not initiated by the
-* CriticalSection itself will be blocked from being delivered.
-*
-* The difference between a Lock and a CriticalSection is that a critical section may succeed
-* or fail. A failed critical section permanently breaks the input gate. Locks, on the other
-* hand, are simply released when dropped.
-*
-* A CriticalSection itself holds a Lock, which blocks the "parent scope" from continuing
-* execution until the critical section is done. Meanwhile, the code running inside the critical
-* section obtains nested Locks. These nested locks control concurrency of the operations
-* initiated within the critical section in the same way that input locks normally do at the
-* top-level scope. E.g., if a critical section initiates a storage read and a fetch() at the
-* same time, the fetch() is prevented from returning until after the storage read has returned.
-*/
-var CriticalSection = class CriticalSection extends InputGate {
-	state = "NOT_STARTED";
-	/**
-	* Points to the parent scope, which may be another CriticalSection in the case of nesting.
-	* ← `kj::OneOf<InputGate*, kj::Own<CriticalSection>>`; the two arms are one `instanceof` apart.
-	*/
-	#parent;
-	/**
-	* A lock in the parent scope. `parentLock` becomes non-null after the first lock is obtained,
-	* and becomes null again when succeeded() is called.
-	*/
-	#parentLock;
-	constructor(parent) {
-		super();
-		this.#parent = parent;
-	}
-	/**
-	* Wait for a nested lock in order to continue this CriticalSection.
-	*
-	* The first call to wait() begins the CriticalSection. After that wait completes, until the
-	* CriticalSection is done and dropped, no other locks will be allowed on this InputGate, except
-	* locks requested by calling wait() on this CriticalSection -- or one of its children.
-	*
-	* Everything before the first `await` runs in the caller's synchronous slice, which is what
-	* lets the NOT_STARTED path take its parent lock before any other event can queue behind it.
-	*/
-	async wait(signal) {
-		if (signal?.aborted === true) throw makeCanceledError();
-		for (;;) switch (this.state) {
-			case "NOT_STARTED": {
-				this.state = "INITIAL_WAIT";
-				const target = this.parentAsInputGate();
-				if (target.brokenState.kind === "exception") {
-					const exception = target.brokenState.exception;
-					this.setBroken(exception);
-					throw exception;
-				}
-				if (target.lockCount === 0) {
-					this.state = "RUNNING";
-					this.#parentLock = new Lock(target);
-					continue;
-				} else {
-					let lock;
-					try {
-						lock = await target.newWaiterPromise(true, signal);
-					} catch (exception) {
-						if (exception instanceof CanceledError) throw exception;
-						this.state = "RUNNING";
-						this.setBroken(exception);
-						throw exception;
-					}
-					this.state = "RUNNING";
-					this.#parentLock = lock;
-					continue;
-				}
-			}
-			case "INITIAL_WAIT": throw new Error("CriticalSection::wait() should be called once initially");
-			case "RUNNING": return await super.wait(signal);
-			case "REPARENTED": return await this.#parent.wait(signal);
-		}
-	}
-	/**
-	* Call when the critical section has completed successfully. If this is not called before the
-	* CriticalSection is dropped, then failed() is called implicitly.
-	*
-	* Returns the input lock that was held on the parent critical section. This can be used to
-	* continue execution in the parent before any other input arrives.
-	*/
-	succeeded() {
-		if (this.state !== "RUNNING") throw new Error("CriticalSection::succeeded() requires a running critical section");
-		const parentGate = this.parentAsInputGate();
-		for (const waiter of this.waitingChildren) waiter.gate = parentGate;
-		parentGate.waitingChildren.push(...this.waitingChildren);
-		this.waitingChildren.length = 0;
-		for (const waiter of this.waiters) waiter.gate = parentGate;
-		parentGate.waiters.push(...this.waiters);
-		this.waiters.length = 0;
-		parentGate.lockCount += this.lockCount;
-		this.lockCount = 0;
-		this.state = "REPARENTED";
-		const result = this.#parentLock;
-		if (result === void 0) throw new Error("CriticalSection::succeeded() with no parent lock");
-		this.#parentLock = void 0;
-		return result;
-	}
-	/**
-	* Call to indicate the CriticalSection has failed with the given exception. This immediately
-	* breaks the InputGate.
-	*/
-	failed(exception) {
-		if (this.brokenState.kind === "exception") return;
-		this.setBroken(exception);
-		if (this.#parent instanceof CriticalSection) this.#parent.failed(exception);
-		else this.#parent.setBroken(exception);
-	}
-	/** ← `~CriticalSection`. */
-	drop() {
-		switch (this.state) {
-			case "NOT_STARTED": break;
-			case "INITIAL_WAIT": break;
-			case "RUNNING": this.failed(/* @__PURE__ */ new Error("jsg.Error: A critical section within this Durable Object awaited a Promise that apparently will never complete. This could happen in particular if a critical section awaits a task that was initiated outside of the critical section. Since a critical section blocks all other tasks from completing, this leads to deadlock."));
-		}
-		const parentLock = this.#parentLock;
-		if (parentLock !== void 0) {
-			this.#parentLock = void 0;
-			parentLock.release();
-		}
-	}
-	/** Return a reference for the parent scope, skipping any reparented CriticalSections */
-	parentAsInputGate() {
-		let parent = this.#parent;
-		for (;;) {
-			if (!(parent instanceof CriticalSection)) return parent;
-			if (parent.state !== "REPARENTED") return parent;
-			parent = parent.#parent;
-		}
-	}
-};
-/** ← `OutputGate::Hooks::DEFAULT`. */
-var DEFAULT_OUTPUT_GATE_HOOKS = {
-	/** ← `kj::NEVER_DONE`. */
-	makeTimeoutPromise: () => new Promise(() => {}),
-	outputGateLocked() {},
-	outputGateReleased() {},
-	outputGateWaiterAdded() {},
-	outputGateWaiterRemoved() {}
-};
-/** ← `OutputGate::makeUnfulfilledException()`. */
-function makeUnfulfilledException() {
-	return /* @__PURE__ */ new Error("output lock was canceled before completion");
-}
-/**
-* An OutputGate blocks outgoing messages from an Actor until writes which they might depend on
-* are confirmed.
-*
-* A promise chain, not a counter (§1.1): each `lockWhile` joins a new link onto the chain and
-* re-forks it, so a `wait()` is bound to exactly the locks outstanding when it was taken and is
-* unaffected by any later `lockWhile`.
-*/
-var OutputGate = class {
-	#hooks;
-	#pastLocksPromise = Promise.resolve();
-	/** A fulfiller for onBroken(), or an exception if already broken. */
-	#brokenState = { kind: "none" };
-	constructor(hooks = DEFAULT_OUTPUT_GATE_HOOKS) {
-		this.#hooks = hooks;
-	}
-	/**
-	* Block all future `wait()` calls until `promise` completes. Returns a wrapper around
-	* `promise`. If `promise` rejects, the exception will propagate to all future `wait()`s. If the
-	* returned promise is canceled before completion, all future `wait()`s will also throw.
-	*/
-	lockWhile(promise, signal) {
-		const fulfiller = this.#lock();
-		const raced = Promise.race([promise, this.#hooks.makeTimeoutPromise()]);
-		this.#hooks.outputGateLocked();
-		return new Promise((resolve, reject) => {
-			onAbort(signal, () => {
-				if (!fulfiller.isWaiting()) return;
-				this.#hooks.outputGateReleased();
-				const exception = makeUnfulfilledException();
-				this.#setBroken(exception);
-				fulfiller.reject(exception);
-				reject(exception);
-			});
-			raced.then((value) => {
-				if (!fulfiller.isWaiting()) return;
-				fulfiller.fulfill();
-				this.#hooks.outputGateReleased();
-				resolve(value);
-			}, (exception) => {
-				if (!fulfiller.isWaiting()) return;
-				this.#setBroken(exception);
-				fulfiller.reject(exception);
-				this.#hooks.outputGateReleased();
-				reject(exception);
-			});
-		});
-	}
-	/**
-	* Wait until all preceding locks are released. The wait will not be affected by any future
-	* call to `lockWhile()`.
-	*/
-	wait() {
-		this.#hooks.outputGateWaiterAdded();
-		return this.#pastLocksPromise.then(() => {
-			this.#hooks.outputGateWaiterRemoved();
-		}, (exception) => {
-			this.#hooks.outputGateWaiterRemoved();
-			throw exception;
-		});
-	}
-	/**
-	* Rejects if and when calls to `wait()` become broken due to a failed lockWhile(). The actor
-	* should be shut down in this case. This promise never resolves, only rejects.
-	*
-	* This method can only be called once.
-	*/
-	onBroken() {
-		if (this.#brokenState.kind === "fulfiller") throw new Error("onBroken() can only be called once");
-		if (this.#brokenState.kind === "exception") return Promise.reject(this.#brokenState.exception);
-		else {
-			const { promise, reject } = Promise.withResolvers();
-			this.#brokenState = {
-				kind: "fulfiller",
-				reject
-			};
-			promise.catch(() => {});
-			return promise;
-		}
-	}
-	isBroken() {
-		return this.#brokenState.kind === "exception";
-	}
-	#lock() {
-		const { promise, resolve, reject } = Promise.withResolvers();
-		this.#setPastLocks(Promise.allSettled([this.#pastLocksPromise, promise]).then((results) => {
-			for (const result of results) if (result.status === "rejected") throw result.reason;
-		}));
-		let waiting = true;
-		return {
-			isWaiting: () => waiting,
-			fulfill: () => {
-				waiting = false;
-				resolve();
-			},
-			reject: (exception) => {
-				waiting = false;
-				reject(exception);
-			}
-		};
-	}
-	#setPastLocks(promise) {
-		this.#pastLocksPromise = promise;
-		promise.catch(() => {});
-	}
-	#setBroken(exception) {
-		if (this.#brokenState.kind === "fulfiller") this.#brokenState.reject(exception);
-		this.#brokenState = {
-			kind: "exception",
-			exception
-		};
-	}
-};
-//#endregion
-//#region src/io/io-context.ts
-/**
-* ← workerd `src/workerd/io/io-context.{h,c++}`
-*
-* IoContext: the one door, plus the two await forms.
-*
-* This is the file with no true upstream correspondence for its *enforcement*.
-* Workerd acquires the input gate at isolate entry, so acquisition is
-* structural. We have no isolate hook, so a lock is taken at our own dispatch
-* boundary instead. See "The enforcement point is the one thing we cannot port"
-* in the design record.
-*
-* What this file does, stated before anything about how it got here:
-*
-*  1. `#currentInputLocks` is a STACK of the locks held by the slices that are
-*     running. It is upstream's single `kj::Maybe<InputGate::Lock>
-*     currentInputLock` member (`io-context.h:993`) with the `Maybe` widened,
-*     and a "frame" is an entry in it. A frame carries nothing else: the only
-*     two things ever read from one are the lock (`getInputLock`) and the
-*     critical section that lock belongs to (`getCriticalSection`), and the
-*     lock answers both.
-*  2. A lock is released, and leaves the stack, at the END OF THE MICROTASK
-*     CHECKPOINT of the slice holding it — not when that slice's synchronous
-*     body returns. That is upstream's own boundary, not a relaxation of it:
-*     `runImpl`'s inner `KJ_DEFER` calls `js.runMicrotasks()`
-*     (`io-context.c++:1262`) and `runInContextScope`'s outer one then clears
-*     `currentInputLock` (`:1214`), inner scope first, so the whole checkpoint
-*     drains under the lock. `currentInputLock` holds the `Lock` by value, so
-*     clearing it is the release. `atCheckpointEnd` below is that point.
-*  3. NEITHER await form releases anything at the moment of the await.
-*     `awaitIo` reads `getCriticalSection()` and `awaitIoWithInputLock` takes
-*     an `addRef`; both then return a promise and let the slice end normally.
-*     So an invocation that calls `awaitIo` keeps the gate until its own
-*     checkpoint-end exit and the gate opens there — which is still before any
-*     real I/O can complete, so "a bare timer releases the input gate" holds.
-*     Upstream is the same: `getCriticalSection()` (`io-context.c++:362`) does
-*     not touch `currentInputLock`, and `:1214` is the only place that clears
-*     it. The difference between the two forms is entirely on the far side —
-*     `awaitIo` re-enters through `run(func, criticalSection)` and queues for a
-*     fresh lock, `awaitIoWithInputLock` re-enters holding the ref it took.
-*  4. Removal from the stack is by identity, not by popping, because entries do
-*     overlap — three deep in the unit tests. One invocation can have several
-*     held awaits outstanding (`Promise.all` over two storage reads), and a
-*     section's last body slice overlaps the slice that resolves it.
-*
-* Two mechanics were validated against real workerd before this scaffolding
-* landed, and both are easy to get wrong:
-*
-*  1. The ambient "which lock am I under" must be a STACK of invocation frames,
-*     not a single slot, so that `current` always names the running invocation.
-*     The prototype that found this stated it as "`awaitIo` splices its frame
-*     out and re-pushes the SAME frame on resume". That is not what happens
-*     here and the difference is worth knowing: nothing splices at the point of
-*     the await, because a lock already leaves the stack when its slice ends,
-*     which is the same event that releases it (`#exit` does both). A
-*     resumption then pushes a fresh lock. The prototype needed the splice
-*     because its door held one lock for a whole invocation; the identity that
-*     has to survive an await here is the critical section, and that is
-*     captured at the call rather than looked up later.
-*  2. That ambient is safe here for a reason that does NOT generalise to the
-*     §2.3 ambient-field hazard: the gate guarantees pushes and pops nest
-*     properly in time, because only one holder chain is inside at once.
-*     `_cf_currentSubAgentBridge` has no such guarantee, which is why it is a
-*     live bug and this is not.
-*
-* Consequence: no async context is required. Do not add a dependency on
-* decision 8 here without re-running the conformance gate suite first.
-*
-* The invariant a future simplifier has to re-check: a single slot would pass
-* every test in `io-context.test.ts`, and that was established by trying it,
-* not by argument. `current()` is only read from inside a slice, every slice
-* pushes its own lock last, and no second slice can begin while an earlier
-* frame is still waiting for its checkpoint-end exit — that frame is holding
-* the gate. So the top of a stack and the last write to a slot always agree.
-* The stack is still what is here, because a slot would be holding a stale
-* value at every one of the overlaps in (4), and that is unobservable for
-* exactly as long as the invariant holds. Tightening (2) back to the end of the
-* synchronous body breaks it immediately, which is the regime the mechanic was
-* found in.
-*
-* Spec: §1.2, §1.3, §1.5, §1.6, §1.7.1, §1.9, decisions 1, 2, 4 and 13 in
-* docs/decisions.md.
-*
-* `TimeoutManager` is the only part of this file a consumer's own code reaches
-* directly: every host-provided async primitive a
-* Durable Object can await has to route through here, or the continuation after
-* it resumes with an empty invocation stack. `TimeoutManager` below is the
-* timer half; `api/global-scope.ts` and `api/web-socket.ts` are the rest.
-*
-* Not ported, because the substrate has no equivalent to port onto: isolate and
-* async locks (`Worker::Lock`, `jsg::Lock`, `takeAsyncLock`) and everything
-* that exists to enter or leave an isolate — which is precisely the thing this
-* file substitutes for; the limit enforcer and `afterLimitTimeout` (the
-* deadline takes the `Timer` port instead); trace spans, already a recorded
-* divergence documented in §1.12; subrequest channels and HTTP, which are
-* `api/http.ts`'s gating over the substrate's own `fetch`;
-* `IoOwn`/`IoPtr`/`DeleteQueue`, which guard cross-context dereferences that GC
-* makes impossible; hang detection and `registerPendingEvent`, which need the
-* isolate's own idea of pending work; and the thread-local
-* `IoContext::current()` static, whose lock-resolving half the invocation stack
-* replaces — its *identity* half is `currentSlice` below, narrowed to the
-* synchronous slice, with one consumer and no resolver. `EventOutcome` and
-* `RequestObserver` are metrics types with no port, so `waitUntilStatus()`
-* returns the first exception instead.
-*/
-/** ← `static constexpr int64_t max = 3153600000000;  // Milliseconds in 100 years`. */
-var MAX_TIMEOUT_MS = 31536e8;
-/** ← `afterLimitTimeout(30 * kj::SECONDS)` in `IoContext::blockConcurrencyWhile`. */
-var BLOCK_CONCURRENCY_WHILE_TIMEOUT_MS = 3e4;
-/** Copied verbatim: users and upstream tests match on it. */
-var BLOCK_CONCURRENCY_WHILE_TIMEOUT_MESSAGE = "A call to blockConcurrencyWhile() in a Durable Object waited for too long. The call was canceled and the Durable Object was reset.";
-/** ← `jsg::annotateBroken(msg, "broken.inputGateBroken")`. */
-var INPUT_GATE_BROKEN_PREFIX = "broken.inputGateBroken; ";
-/**
-* THE check every storage entry point in `api/` makes before touching the
-* database, and the only place this package throws for a missing input lock.
-*
-* Upstream never faces the question. `IoContext::current()` is a thread-local
-* read with a `KJ_REQUIRE` behind it, and it cannot fail for a storage call
-* because isolate entry is the only way into an actor and it always took a
-* lock. We have no isolate hook (see this file's header), so a continuation
-* that resumed from a raw `setTimeout`, a raw `fetch`, or any other promise the
-* runtime does not own comes back with an empty invocation stack, and its next
-* storage call reaches `ActorSqlite` — which is synchronous, touches no gate,
-* and would happily serve it outside any transaction boundary.
-*
-* So this throws, matching the assert. It is deliberately ONE function called
-* from every entry point rather than a check written at each of them: the
-* policy is a design decision that belongs to the design record, and when it
-* changes it has to change in one place rather than across a surface the
-* vendored consumer reaches from hundreds of call sites. There is no lenient
-* mode, no flag, and no implicit acquire — a lost invocation is loud, and a
-* lost transaction boundary is not.
-*/
-function requireInputLock(ctx, op) {
-	if (ctx.hasCurrent()) return;
-	throw new Error(`${op}: no input lock available in this context${ctx.describeLostLock()}`);
-}
-/**
-* A stack for `noteGateUse`, captured where user frames are still on the stack.
-*
-* The invocation stack's own push and pop are scheduler moments — `#runImpl`
-* runs from a gate resumption and `#exit` from a `MessageChannel` callback — so
-* a trace taken there names only runtime internals. The moments that still see
-* the caller are the synchronous entries into the gate machinery: an `awaitIo`
-* call, an `entry` dispatch, a callback's registration. V8's zero-cost async
-* traces extend those with the awaiting chain, which is usually the frame the
-* reader actually wants.
-*
-* The first slice drops the `Error` header (absent on SpiderMonkey) and the two
-* runtime frames: this helper and the gate entry point that called it.
-*/
-function captureGateStack() {
-	const stack = (/* @__PURE__ */ new Error()).stack;
-	if (stack === void 0) return void 0;
-	const frames = stack.split("\n");
-	const trimmed = frames.slice(frames[0]?.startsWith("Error") ? 3 : 2).join("\n");
-	return trimmed === "" ? void 0 : trimmed;
-}
-/**
-* The end of the microtask checkpoint — the moment `runImpl`'s `KJ_DEFER` fires.
-*
-* Upstream drains the whole checkpoint INSIDE the isolate run: the defer calls
-* `js.runMicrotasks()` and only the outer defer in `runInContextScope` then
-* clears `currentInputLock`. So a continuation that awaits nothing but
-* already-resolved promises stays under the same lock, and a continuation that
-* waits on real I/O does not. In JS the only observable end of a microtask drain
-* is the next macrotask, so that is where a lock leaves the invocation stack.
-*
-* Measured, because the obvious alternatives are wrong in ways nothing catches:
-* releasing synchronously when the invoked function returns, or on the next
-* microtask, both hand the lock back BEFORE the code awaiting the I/O resumes as
-* soon as one promise sits between the two — one `async` wrapper, a `.then`, a
-* `Promise.all` — and `actor-state.ts` is exactly such a wrapper. The gate would
-* then open in the middle of a storage await with no test failing, which is the
-* silent loss of atomicity §1.7.1 names.
-*
-* `MessageChannel` and not `setTimeout`, decided by benchmark rather than by
-* argument, because the two are three orders of magnitude apart on the shapes
-* that wait for a release. A chain of these schedules each hand-off from inside
-* the previous one's callback, so a `setTimeout` chain's nesting level climbs
-* past five and stays there, where browsers clamp it to 4ms. Median per hand-off
-* over 50 chained hops:
-*
-*   |                        | setTimeout | MessageChannel |
-*   | node                   | 1.273 ms   | 0.018 ms       |
-*   | chromium page          | 4.96 ms    | 0.024 ms       |
-*   | chromium Worker        | 5.542 ms   | 0.022 ms       |
-*
-* Only two shapes pay it: an `awaitIo` chain, which has to re-acquire the lock
-* its slice gave up, and a queue of events waiting on the holder. A chain of
-* held storage awaits does not — the lock passes from `addRef` to `addRef` and
-* the release is off the critical path. So 50 sequential facet RPCs cost 277ms
-* of pure clamp in a Worker under `setTimeout` and 1.1ms under this.
-*
-* One channel per BATCH, and a batch is an explicit array: `atCheckpointEnd`
-* pushes onto `pendingCheckpointEnds` and only the push that finds it empty opens
-* a channel. Ordering then comes from the array, which the language guarantees,
-* rather than from delivery order across separate channels, which no
-* specification does. That mattered because the storage engine below depends on
-* a commit scheduled inside a slice running before the release scheduled at the
-* end of that slice; separate channels do deliver in post order in Node,
-* measured across 200 of them including one scheduled from inside another's
-* callback, but a browser that chose otherwise would open the gate onto a
-* transaction a previous event left open, and nothing would say so.
-*
-* A callback scheduled DURING a drain lands in the next batch, which is the
-* semantics to want: one hand-off is one checkpoint end, and a slice that begins
-* inside this drain gets its own. The drain runs every callback even if one
-* throws, and rethrows the first exception afterwards, because abandoning the
-* rest of a batch is how a gate wedges with nothing to see.
-*
-* A long-lived shared port was rejected for the reason it always is: it has to be
-* closed on abort and `unref`'d so it cannot hold a test runner's event loop
-* open, and an `unref`'d port can drop a release at exit — a wedged gate. A
-* channel that lives for exactly one message cannot. Batching gets most of what
-* a shared port was worth anyway: a slice that schedules a commit and a release
-* now allocates one channel where it used to allocate two.
-*
-* **Exported because `kj::evalLater()` is this same point.** `ActorSqlite` opens
-* its implicit transaction on the first write and commits it "on the next turn of
-* the event loop" (`actor-sqlite.c++:352-357`); upstream's next turn is after the
-* isolate run, which is after `js.runMicrotasks()`, which is after
-* `currentInputLock` is cleared. Upstream's two boundaries are one boundary, and
-* they stay one here only if the commit rides the same primitive as the release.
-* Two consequences the storage engine depends on, both properties of this
-* function rather than of `ActorSqlite`:
-*
-*  1. **Everything that holds the input lock across an await is a microtask
-*     chain.** `awaitIoWithInputLock` resumes through `#awaitIoImpl`'s `.then`
-*     into `run(func, lock)`, which never waits on the gate. So a whole run of
-*     held storage awaits finishes before the next hand-off and its writes are
-*     one transaction (§1.7.1 row 1).
-*  2. **Everything that releases it needs at least one hand-off.** `awaitIo`
-*     resumes through `gate.wait()`, which cannot resolve until `#exit` runs
-*     here. So a timer or outbound await puts the commit between the two writes
-*     (§1.7.1 row 2).
-*
-*/
-function atCheckpointEnd(run) {
-	pendingCheckpointEnds.push(run);
-	if (pendingCheckpointEnds.length > 1) return;
-	const channel = new MessageChannel();
-	channel.port1.onmessage = () => {
-		channel.port1.close();
-		channel.port2.close();
-		const batch = pendingCheckpointEnds.splice(0);
-		let failure;
-		for (const callback of batch) try {
-			callback();
-		} catch (exception) {
-			failure ??= { exception };
-		}
-		if (failure !== void 0) throw failure.exception;
-	};
-	channel.port2.postMessage(0);
-}
-/** The current batch. Its order is the hand-off order every consumer below relies on. */
-var pendingCheckpointEnds = [];
-/**
-* ← `static thread_local IoContext* threadLocalRequest` (`io-context.c++:25`).
-*
-* **This is NOT an async context and must not become one.** It is set on entry
-* to a slice's SYNCHRONOUS body and restored the instant that body returns —
-* which for an `async` function is its first `await`. It propagates through
-* exactly nothing. The package's "no async context is required" property
-* (README, Part 4 mechanic 1) is undisturbed: nothing resolves a lock through
-* this, and deleting it would change no gate behaviour.
-*
-* Upstream's scope is wider and cannot be matched. `runInContextScope` saves the
-* previous context, installs itself, and restores at the end of the isolate run
-* — which drains the whole microtask checkpoint synchronously, so upstream's
-* `current()` covers a slice's continuations too. JS cannot drain a checkpoint
-* synchronously, so covering continuations here would mean holding the value
-* until `atCheckpointEnd`, and by then a SECOND actor's body can have run and
-* left. That is not a hazard upstream has: two actors' slices genuinely overlap
-* in this window (§1.10 gives every facet its own gates, so nothing serialises
-* a parent against its child), and the value would be wrong with nothing to say
-* so.
-*
-* So the port keeps only the half that is exact, and the one consumer is a
-* tripwire that refuses on mismatch and stays quiet on `undefined` — never a
-* resolver. See `requireOwnSlice` in `api/global-scope.ts`.
-*/
-var currentSlice;
-/** ← `IoContext::tryCurrent()` (`io-context.c++:1416-1422`), over the narrowed scope above. */
-function tryCurrentSlice() {
-	return currentSlice;
-}
-/**
-* ← the `SuppressIoContextScope` constructor's `threadLocalRequest = this` half
-* (`io-context.c++:1208`), as a function rather than an assignment in `#runImpl`.
-*
-* A function because `currentSlice = this` reads to a linter as a `this` alias — the
-* ES5 `var self = this` habit — when it is the opposite: publishing the running
-* context to a module scope, which is exactly what the C++ does to a thread local.
-*/
-function enterSlice(context) {
-	currentSlice = context;
-}
-/** ← `promiseForExceptionOrT()`: merge the rejection into the value so it survives the hop. */
-function promiseForExceptionOrT(promise) {
-	return promise.then((value) => ({
-		ok: true,
-		value
-	}), (exception) => ({
-		ok: false,
-		exception
-	}));
-}
-/** ← `IdentityFunc<T>`. */
-function identity(value) {
-	return value;
-}
-/**
-* ← the `if (!msg.startsWith("broken."))` guard in `blockConcurrencyWhile`'s error
-* handler. Upstream rewrites the exception's description in place, so this does
-* too. `jsg`'s exception tunnelling — the `jsg.Error:` / `remote.` prefixes
-* `annotateBroken()` also produces — has no port here, so only the brokenness tag
-* it exists to carry survives.
-*/
-function annotateInputGateBroken(exception) {
-	if (!(exception instanceof Error)) return;
-	if (exception.message.startsWith("broken.") || exception.message.startsWith("remote.broken.")) return;
-	exception.message = INPUT_GATE_BROKEN_PREFIX + exception.message;
-}
-/**
-* ← `jsg::isExceptionFromInputGateBroken` (`jsg/exception.c++:168-172`):
-* "annotateBroken() produces 'broken.inputGateBroken; {message}', optionally
-* prefixed with 'remote.' when crossing RPC boundaries. Strip the remote prefix
-* first, then check the tag."
-*
-* Its writer is `annotateInputGateBroken` directly above, which is why the two
-* live together rather than the reader moving to its consumer: `jsg/` has no
-* module here, and a prefix known in two places is a prefix that drifts.
-*/
-function isExceptionFromInputGateBroken(exception) {
-	if (!(exception instanceof Error)) return false;
-	let description = exception.message;
-	while (description.startsWith(REMOTE_EXCEPTION_PREFIX)) description = description.slice(REMOTE_EXCEPTION_PREFIX.length);
-	return description.startsWith(INPUT_GATE_BROKEN_PREFIX);
-}
-/** ← `ERROR_REMOTE_PREFIX` (`jsg/exception.h`). */
-var REMOTE_EXCEPTION_PREFIX = "remote.";
-/**
-* ← `jsg::EXCEPTION_IS_USER_ERROR` (`jsg/exception.h:160`), a
-* `kj::Exception::DetailTypeId` attached to an arbitrary exception rather than a
-* type of exception.
-*
-* A symbol-keyed property is the closest JS has: it rides any thrown object,
-* survives a rethrow, and cannot collide with anything an application writes.
-* `Symbol.for` rather than `Symbol()` so the detail is still legible after the
-* exception crosses a realm — the mistake decision 18 records capnweb making.
-*/
-var EXCEPTION_IS_USER_ERROR = Symbol.for("workerd.exceptionIsUserError");
-/** ← `error.setDetail(jsg::EXCEPTION_IS_USER_ERROR, kj::heapArray<byte>(0))`. */
-function setUserErrorDetail(exception) {
-	if (typeof exception !== "object" || exception === null) return;
-	Object.defineProperty(exception, EXCEPTION_IS_USER_ERROR, {
-		value: true,
-		enumerable: false,
-		configurable: true
-	});
-}
-/** ← `e.getDetail(jsg::EXCEPTION_IS_USER_ERROR) != kj::none`. */
-function hasUserErrorDetail(exception) {
-	if (typeof exception !== "object" || exception === null) return false;
-	return exception[EXCEPTION_IS_USER_ERROR] === true;
-}
-/**
-* ← `IoContext::TimeoutManagerImpl` (`io-context.c++:40-140`, `:742-880`).
-*
-* **The one mechanic worth reading twice: a timer is NOT `awaitIo`.** Upstream
-* says why in a comment on the very line (`io-context.c++:756-758`): "the manual
-* use of run() here (including carrying over the critical section) is kind of
-* ugly, but using awaitIo() doesn't work here because we need the ability to
-* cancel the timer, so we don't want to addTask() it, which awaitIo() does
-* implicitly." So the shape is `cs = ctx.getCriticalSection()` captured at the
-* call, then `ctx.run(callback, cs)` when it fires. The captured section is what
-* makes a timer armed inside `blockConcurrencyWhile` run INSIDE that section
-* rather than queueing on the root gate behind it.
-*
-* **Substrate divergence: one `Timer.afterDelay` per timeout, where upstream
-* keeps a sorted `timeoutTimes` map and a single `timerTask` for the nearest.**
-* That structure exists because `kj::TimerChannel::atTime` supports one pending
-* wait, so upstream has to multiplex; `Timer.afterDelay` takes as many
-* concurrent waits as are asked for. The observable properties it produced —
-* timers fire in deadline order, ties broken by arming order — are the ones both
-* lane timers already have, since both are `setTimeout` underneath. Nothing else
-* in `resetTimerTask` is observable, so nothing else is ported.
-*
-* Not ported: `TimeoutId::Generator` and its cross-`ServiceWorkerGlobalScope`
-* assertion (`io-context.c++:52-60`), which exists to catch an IoContext being
-* current for a different V8 context — a confusion with no shape here, since a
-* timeout id is minted by the manager that owns it; `registerPendingEvent`,
-* which needs the isolate's own idea of pending work; and `getNextTimeout`,
-* whose only caller is the limit enforcer.
-*/
-var TimeoutManager = class {
-	#timer;
-	#timeouts = /* @__PURE__ */ new Map();
-	#nextId = 1;
-	constructor(timer) {
-		this.#timer = timer;
-	}
-	/** ← `TimeoutManagerImpl::setTimeout` (`io-context.c++:51-67`). */
-	setTimeout(ctx, params) {
-		const id = this.#nextId++;
-		const state = {
-			params,
-			isCanceled: false,
-			armed: void 0
-		};
-		this.#timeouts.set(id, state);
-		this.#arm(ctx, id, state);
-		return id;
-	}
-	/** ← `TimeoutManagerImpl::clearTimeout` (`io-context.c++:874-883`). */
-	clearTimeout(id) {
-		const state = this.#timeouts.get(id);
-		if (state === void 0) return;
-		this.#cancel(id, state);
-	}
-	/** ← `TimeoutManagerImpl::getTimeoutCount` (`io-context.c++:71-73`). */
-	getTimeoutCount() {
-		return this.#timeouts.size;
-	}
-	/** ← `TimeoutManagerImpl::cancelAll` (`io-context.c++:83-87`). */
-	cancelAll() {
-		for (const [id, state] of [...this.#timeouts]) this.#cancel(id, state);
-	}
-	/** ← `TimeoutState::cancel` — clear the flag, drop the callback reference, disarm. */
-	#cancel(id, state) {
-		state.isCanceled = true;
-		state.params.callback = void 0;
-		state.armed?.abort();
-		state.armed = void 0;
-		this.#timeouts.delete(id);
-	}
-	/** ← `TimeoutManagerImpl::setTimeoutImpl` (`io-context.c++:742-853`). */
-	#arm(ctx, id, state) {
-		const criticalSection = ctx.getCriticalSection();
-		const wake = new AbortController();
-		state.armed = wake;
-		const fired = this.#timer.afterDelay(state.params.msDelay, wake.signal).then(async () => {
-			if (state.isCanceled) return;
-			state.armed = void 0;
-			await this.#fire(ctx, id, state, criticalSection);
-		}, (exception) => {
-			if (!state.isCanceled) throw exception;
-		});
-		ctx.addWaitUntil(fired);
-	}
-	/** ← the body of the `.then` at `io-context.c++:759-816`, which is one `context.run`. */
-	async #fire(ctx, id, state, criticalSection) {
-		await ctx.run(() => {
-			if (state.isCanceled) return;
-			const callback = state.params.callback;
-			if (callback === void 0) return;
-			if (!state.params.repeat) {
-				state.params.callback = void 0;
-				this.#timeouts.delete(id);
-			}
-			try {
-				callback();
-			} finally {
-				if (state.params.repeat && !state.isCanceled) this.#arm(ctx, id, state);
-			}
-		}, criticalSection);
-	}
-};
-/**
-* A set of background promises, with the one behaviour `kj::TaskSet` adds over an
-* array: a failing task reports to `taskFailed` instead of becoming an unhandled
-* rejection, and the set can be waited on until empty.
-*/
-var TaskSet$1 = class {
-	#tasks = /* @__PURE__ */ new Set();
-	#taskFailed;
-	constructor(taskFailed) {
-		this.#taskFailed = taskFailed;
-	}
-	add(promise) {
-		const task = promise.then(() => {
-			this.#tasks.delete(task);
-		}, (exception) => {
-			this.#tasks.delete(task);
-			this.#taskFailed(exception);
-		});
-		this.#tasks.add(task);
-	}
-	/** ← `kj::TaskSet::onEmpty()`. Re-checks, since a task can add another. */
-	async onEmpty() {
-		while (this.#tasks.size > 0) await Promise.all([...this.#tasks]);
-	}
-};
-var IoContext = class {
-	#actor;
-	#timer;
-	/**
-	* ← `kj::Maybe<InputGate::Lock> currentInputLock`, made a stack.
-	*
-	* The top entry is the lock of the slice that is running right now. Entries are
-	* removed by identity rather than popped, so `#exit` never depends on the order
-	* the overlapping slices happen to leave in.
-	*/
-	#currentInputLocks = [];
-	/**
-	* Where this context's gate was last deliberately engaged, for
-	* `describeLostLock`. One slot, overwritten on every engagement — the gate
-	* serialises slices, so the latest note is the best available ancestor of
-	* whatever continuation is running lockless now.
-	*/
-	#lastGateUse;
-	#abortException;
-	#abortPromise;
-	#rejectAbort;
-	/**
-	* Two sets, as upstream: `abortWhen()` always uses `tasks` so that a monitor
-	* which never completes cannot hold up a drain, while `addTask()` in an actor
-	* is a waitUntil task.
-	*/
-	#tasks;
-	#waitUntilTasks;
-	#addTaskCounter = 0;
-	#waitUntilStatus;
-	/** ← `kj::Own<TimeoutManager> timeoutManager` (`io-context.h:1043`). */
-	#timeouts;
-	constructor(actor, timer) {
-		this.#actor = actor;
-		this.#timer = timer;
-		this.#timeouts = new TimeoutManager(timer);
-		const { promise, reject } = Promise.withResolvers();
-		this.#abortPromise = promise;
-		this.#rejectAbort = reject;
-		promise.catch(() => {});
-		this.#tasks = new TaskSet$1((exception) => this.#taskFailed(exception));
-		this.#waitUntilTasks = new TaskSet$1((exception) => this.#taskFailed(exception));
-		this.abortWhen(actor.getInputGate().onBroken());
-		this.abortWhen(actor.getOutputGate().onBroken());
-	}
-	/**
-	* Get the current input lock. Throws an exception if no input lock is held (e.g. because
-	* this is not an actor request).
-	*
-	* ← `KJ_ASSERT_NONNULL(currentInputLock, ...).addRef()`. The `addRef` IS the §1.2
-	* distinction: it is the only way to hold the gate past the end of this slice.
-	*/
-	getInputLock() {
-		return this.#requireCurrent().addRef();
-	}
-	/** Get the current CriticalSection, if there is one, or returns null if not. */
-	getCriticalSection() {
-		return this.#currentInputLocks.at(-1)?.getCriticalSection();
-	}
-	/** Is a gated slice running? The question `IoContext::hasCurrent()` answers upstream. */
-	hasCurrent() {
-		return this.#currentInputLocks.length > 0;
-	}
-	/**
-	* ← `IoContext::isCurrent()` (`io-context.c++:1428-1430`), over the narrowed
-	* scope `currentSlice` documents: true only while a synchronous body of THIS
-	* context is on the JS stack.
-	*
-	* Distinct from `hasCurrent()` above, which asks whether this context holds a
-	* lock at all — true throughout an outstanding held await, and true for a
-	* parent whose slice is awaiting a facet while the facet's body runs. This one
-	* is the question a shared global has to answer: is the code calling me this
-	* actor's?
-	*/
-	isCurrentSlice() {
-		return currentSlice === this;
-	}
-	/**
-	* Record that user code just engaged this context's gate — an `awaitIo`, an
-	* `entry` dispatch, a re-entry callback firing. No upstream analogue, because
-	* upstream cannot lose the lock; here a continuation that awaits a promise
-	* the runtime does not own comes back lockless, the throw lands at the next
-	* storage call three layers later, and the gap between "where the code last
-	* verifiably ran gated" and the throw site is exactly where the foreign await
-	* hides. This is that first coordinate. Always on: the capture rides calls
-	* that already allocate promise machinery, and a stack costs microseconds
-	* against the diagnosis it replaces.
-	*/
-	noteGateUse(what, stack) {
-		this.#lastGateUse = {
-			what,
-			stack,
-			at: this.now()
-		};
-	}
-	/**
-	* The suffix `requireInputLock` appends when the invocation stack is empty:
-	* where this context's gate was last engaged, and how long before the throw.
-	*
-	* "Last engaged" is the honest claim, not "this continuation's ancestor" —
-	* once the offending chain went lockless the gate reopened, so another slice
-	* may have run in between and be the note this reports. In practice the loss
-	* is discovered within the same event storm and the note is the parent; when
-	* it is not, an engagement of this actor moments earlier is still the right
-	* neighbourhood to search.
-	*/
-	describeLostLock() {
-		const use = this.#lastGateUse;
-		if (use === void 0) return " (this context has never held its gate: the call arrived from outside any actor invocation)";
-		const age = Math.round(this.now() - use.at);
-		const stackSuffix = use.stack === void 0 ? "" : `, at:\n${use.stack}`;
-		return ` (an await after the last gated point resumed from a promise the runtime does not own; the gate was last engaged by ${use.what} ${age}ms before this call${stackSuffix})`;
-	}
-	/**
-	* ← `IoContext::getActorOrThrow()`. Upstream's throws when the request is not
-	* an actor request; there is no such request here, so it is a plain accessor.
-	*/
-	getActorOrThrow() {
-		return this.#actor;
-	}
-	/** ← `IoContext::now()` (`io-context.h:703`), which reads the same timer. */
-	now() {
-		return this.#timer.now();
-	}
-	/**
-	* ← `IoContext::setTimeoutImpl` (`io-context.c++:885-899`), clamp included.
-	*
-	* The generator parameter is gone with `TimeoutId::Generator` — see
-	* `TimeoutManager`'s header — so the signature is upstream's minus that one
-	* argument.
-	*/
-	setTimeoutImpl(repeat, callback, msDelay) {
-		const delay = msDelay <= 0 || Number.isNaN(msDelay) ? 0 : msDelay >= MAX_TIMEOUT_MS ? MAX_TIMEOUT_MS : Math.trunc(msDelay);
-		return this.#timeouts.setTimeout(this, {
-			repeat,
-			msDelay: delay,
-			callback
-		});
-	}
-	/** ← `IoContext::clearTimeoutImpl` (`io-context.c++:901-903`). */
-	clearTimeoutImpl(id) {
-		this.#timeouts.clearTimeout(id);
-	}
-	/** ← `IoContext::getTimeoutCount` (`io-context.c++:905-907`). */
-	getTimeoutCount() {
-		return this.#timeouts.getTimeoutCount();
-	}
-	/**
-	* Wait until all outstanding output locks have been unlocked. Does not wait for future
-	* output locks, even if they are created before past locks are unlocked.
-	*/
-	waitForOutputLocks() {
-		return this.#actor.getOutputGate().wait();
-	}
-	/**
-	* Check if the output gate is currently broken. This indicates that there was a problem
-	* with committing storage writes.
-	*/
-	isOutputGateBroken() {
-		return this.#actor.getOutputGate().isBroken();
-	}
-	/** Lock output until the given promise completes. */
-	lockOutputWhile(promise, signal) {
-		return this.#actor.getOutputGate().lockWhile(promise, signal);
-	}
-	/**
-	* Rejects if and when the context should be aborted, e.g. because a gate broke. This
-	* promise never resolves, only rejects.
-	*/
-	onAbort() {
-		return this.#abortPromise;
-	}
-	/** Force context abort now. */
-	abort(exception) {
-		if (this.#abortException !== void 0) return;
-		this.#abortException = { exception };
-		this.#actor.shutdownActorCache(exception);
-		this.#timeouts.cancelAll();
-		this.#rejectAbort(exception);
-	}
-	/**
-	* Await the given promise and, if it throws, call `abort()` with the exception. The promise
-	* given here should just be a monitoring promise, it should not represent any sort of
-	* background work beyond monitoring.
-	*/
-	abortWhen(promise) {
-		if (this.#abortException === void 0) this.#tasks.add(promise.then(() => {}, (exception) => {
-			this.abort(exception);
-		}));
-	}
-	/**
-	* Arrange for the given promise to execute as part of this request.
-	*
-	* "In Actors, we treat all tasks as wait-until tasks, because it's perfectly legit to start
-	* a task under one request and then expect some other request to handle it later." Every
-	* context here is an actor context, so that branch is the only branch.
-	*/
-	addTask(promise) {
-		++this.#addTaskCounter;
-		this.addWaitUntil(promise);
-	}
-	/**
-	* Indicates that the script has requested that it stay active until the given promise
-	* resolves. `drainWaitUntil()` waits until all such promises have completed. Touches
-	* neither gate (§1.9).
-	*/
-	addWaitUntil(promise) {
-		this.#waitUntilTasks.add(promise);
-	}
-	/** Returns the number of times addTask() has been called (even if the tasks have completed). */
-	taskCount() {
-		return this.#addTaskCounter;
-	}
-	/**
-	* The first exception a background task failed with, if any.
-	*
-	* ← `waitUntilStatus()`, which returns an `EventOutcome` derived from the exception by
-	* `RequestObserver`. There is no observer here, so the exception itself is the status —
-	* and keeping it is what stops a failed background task from being swallowed, since
-	* upstream's other half of `taskFailed()` is a log this package has no port for.
-	*/
-	waitUntilStatus() {
-		return this.#waitUntilStatus?.exception;
-	}
-	/**
-	* ← `IncomingRequest::drain()`, actor branch. "For actors, all promises are canceled on
-	* actor shutdown, not on a fixed timeout, because work doesn't necessarily happen on a
-	* per-request basis in actors."
-	*/
-	async drainWaitUntil() {
-		await Promise.race([this.#waitUntilTasks.onEmpty(), this.#abortPromise.catch(() => {})]);
-	}
-	/**
-	* Run the given callback within this context, holding an input lock.
-	*
-	* ← the two `IoContext::run()` overloads: given a CriticalSection it waits on that, given
-	* an already-held Lock it runs under it, and given neither it takes a fresh lock from the
-	* gate. The third case is what a new external event does, and it is the reason inheritance
-	* cannot be read from gate state — see `makeReentryCallback`.
-	*/
-	async run(func, ilOrCs) {
-		const aborted = this.#abortException;
-		if (aborted !== void 0) throw aborted.exception;
-		let lock;
-		if (ilOrCs === void 0) lock = await this.#actor.getInputGate().wait();
-		else if (ilOrCs instanceof CriticalSection) lock = await ilOrCs.wait();
-		else lock = ilOrCs;
-		return await this.#runImpl(func, lock);
-	}
-	/**
-	* Make a function which, when called, re-enters this IoContext to run some code.
-	*
-	* Upstream, on why the critical section travels with the callback at all:
-	*
-	* > "What if the call was made within blockConcurrencyWhile()? The callback will be blocked
-	* > until the critical section ends, which could lead to deadlock if the critical section
-	* > code is waiting on it? ... The callback is allowed to run within the critical section
-	* > (blockConcurrencyWhile()) from which it was called."
-	*
-	* The section is read here, at the point of capture, and never on invocation: a new
-	* external event that inherited the running section would skip the queue and
-	* `blockConcurrencyWhile` would silently block nothing (Part 4, mechanic 2).
-	*
-	* The returned function can be called multiple times.
-	*
-	* It does not route through `io-gate.ts`'s `makeReentryCallback`, which is the same idea
-	* expressed at the gate. Upstream's `IoContext::makeReentryCallback` is literally
-	* `ctx.run(func, cs)`, and going through the gate helper instead would take a lock this
-	* file then has to make current a second time. The gate copy stays: it is the shape a
-	* consumer holding only a gate needs, and Section 1's tests cover it.
-	*/
-	makeReentryCallback(func) {
-		this.#requireCurrent();
-		const criticalSection = this.getCriticalSection();
-		const registrationStack = captureGateStack();
-		return async (...args) => {
-			this.noteGateUse("a re-entry callback registered at the site below", registrationStack);
-			const call = this.run((lock) => func(lock, ...args), criticalSection);
-			this.addTask(call.then(() => {}, () => {}));
-			return await call;
-		};
-	}
-	awaitIo(promise, func = identity) {
-		this.noteGateUse("awaitIo", captureGateStack());
-		return this.#awaitIoImpl(promise, this.getCriticalSection(), func);
-	}
-	awaitIoWithInputLock(promise, func = identity) {
-		let inputLock;
-		try {
-			inputLock = this.getInputLock();
-		} catch (exception) {
-			return Promise.reject(exception);
-		}
-		this.noteGateUse("awaitIoWithInputLock", captureGateStack());
-		return this.#awaitIoImpl(promise, inputLock, func);
-	}
-	/**
-	* Runs `callback` within its own critical section, returning its final result. If
-	* `callback` throws, the input lock will break, resetting the actor.
-	*
-	* Three behaviours live here rather than in `io-gate.ts`, which has no timer, and rather
-	* than in `api/actor-state.ts`, whose own `blockConcurrencyWhile` is a one-line forward:
-	* the 30-second deadline, the brokenness annotation, and the fact that on failure the
-	* returned promise is never settled at all.
-	*/
-	blockConcurrencyWhile(callback) {
-		const lock = this.getInputLock();
-		this.noteGateUse("blockConcurrencyWhile", captureGateStack());
-		const criticalSection = lock.startCriticalSection();
-		const { promise: result, resolve } = Promise.withResolvers();
-		this.addTask((async () => {
-			try {
-				const value = await this.#runCriticalSection(criticalSection, callback);
-				await this.#runImpl(() => {
-					resolve(value);
-				}, criticalSection.succeeded());
-			} catch (exception) {
-				annotateInputGateBroken(exception);
-				criticalSection.failed(exception);
-				throw exception;
-			} finally {
-				criticalSection.drop();
-			}
-		})());
-		lock.release();
-		return result;
-	}
-	/**
-	* ← `runImpl()` + `runInContextScope()`: check the lock belongs to this actor, make it the
-	* current one, run, and let `KJ_DEFER` clear it.
-	*
-	* The defer fires after the microtask checkpoint, not when `func` returns — see
-	* `atCheckpointEnd`. Everything else about the scope is isolate machinery with no port.
-	*/
-	async #runImpl(func, lock) {
-		if (!lock.isFor(this.#actor.getInputGate())) throw new Error("IoContext::runImpl() was given a lock belonging to another actor");
-		this.#currentInputLocks.push(lock);
-		let result;
-		const previousSlice = currentSlice;
-		enterSlice(this);
-		try {
-			result = func(lock);
-		} finally {
-			enterSlice(previousSlice);
-			atCheckpointEnd(() => {
-				this.#exit(lock);
-			});
-		}
-		return await result;
-	}
-	/**
-	* ← `requireCurrent()`. Upstream asks whether this IoContext is the thread's current one;
-	* with no thread-local there is only one question left, and it is the one every caller of
-	* `requireCurrent()` actually depends on: is a gated slice running?
-	*/
-	#requireCurrent() {
-		const lock = this.#currentInputLocks.at(-1);
-		if (lock === void 0) throw new Error(`no input lock available in this context${this.describeLostLock()}`);
-		return lock;
-	}
-	/** ← the far side of `runInContextScope`'s `KJ_DEFER`. */
-	#exit(lock) {
-		const at = this.#currentInputLocks.lastIndexOf(lock);
-		if (at < 0) throw new Error("IoContext invocation stack lost a lock it was holding");
-		this.#currentInputLocks.splice(at, 1);
-		lock.release();
-	}
-	/**
-	* ← `awaitIoImpl()`.
-	*
-	* The KJ-side rejection is merged into the value so a single continuation handles both, the
-	* continuation re-enters through `run(func, ilOrCs)`, and the whole thing rides `addTask()`.
-	* When `ilOrCs` is a Lock this is `awaitIoWithInputLock` and the gate never opened; when it
-	* is a CriticalSection or nothing this is `awaitIo` and the resumption queues for a fresh
-	* lock like any other event.
-	*/
-	#awaitIoImpl(promise, ilOrCs, func) {
-		const { promise: result, resolve, reject } = Promise.withResolvers();
-		this.addTask(promiseForExceptionOrT(promise).then(async (outcome) => {
-			try {
-				await this.run(() => {
-					if (outcome.ok) try {
-						resolve(func(outcome.value));
-					} catch (exception) {
-						reject(exception);
-					}
-					else reject(outcome.exception);
-				}, ilOrCs);
-			} catch (exception) {
-				if (ilOrCs instanceof Lock) ilOrCs.release();
-				throw exception;
-			}
-		}));
-		return result;
-	}
-	/**
-	* ← the first `.then()` of `blockConcurrencyWhile`: start the section, run the callback
-	* under its first nested lock, and race the deadline.
-	*/
-	async #runCriticalSection(criticalSection, callback) {
-		const inputLock = await criticalSection.wait();
-		return await this.#runImpl((lock) => {
-			const running = callback(lock);
-			const deadline = new AbortController();
-			const timeout = this.#timer.afterDelay(BLOCK_CONCURRENCY_WHILE_TIMEOUT_MS, deadline.signal).then(() => {
-				throw new Error(BLOCK_CONCURRENCY_WHILE_TIMEOUT_MESSAGE);
-			});
-			return Promise.race([Promise.resolve(running), timeout]).finally(() => {
-				deadline.abort();
-			});
-		}, inputLock);
-	}
-	/** ← `IoContext::taskFailed()`, minus the logging half, which has no port. */
-	#taskFailed(exception) {
-		if (this.#waitUntilStatus === void 0) this.#waitUntilStatus = { exception };
-	}
-};
-//#endregion
 //#region src/api/actor.ts
 /**
 * ← the `[1, 2048]` bound in `ColoLocalActorNamespace::get`.
@@ -3685,6 +2247,42 @@ var BODY_CONSUMERS = [
 	"json",
 	"text"
 ];
+/** A consumed Blob is a second-order body: every read it produces needs the same gate. */
+function gateBlob(ctx, blob) {
+	const arrayBuffer = blob.arrayBuffer.bind(blob);
+	const bytes = blob.bytes.bind(blob);
+	const slice = blob.slice.bind(blob);
+	const stream = blob.stream.bind(blob);
+	const text = blob.text.bind(blob);
+	Object.defineProperties(blob, {
+		arrayBuffer: {
+			configurable: true,
+			writable: true,
+			value: () => ctx.awaitIo(arrayBuffer())
+		},
+		bytes: {
+			configurable: true,
+			writable: true,
+			value: () => ctx.awaitIo(bytes())
+		},
+		slice: {
+			configurable: true,
+			writable: true,
+			value: (start, end, contentType) => gateBlob(ctx, slice(start, end, contentType))
+		},
+		stream: {
+			configurable: true,
+			writable: true,
+			value: () => gateReadableStream(ctx, stream())
+		},
+		text: {
+			configurable: true,
+			writable: true,
+			value: () => ctx.awaitIo(text())
+		}
+	});
+	return blob;
+}
 /**
 * Wrap a `Request` or `Response` so every asynchronous step of reading it
 * resumes inside a gated slice.
@@ -3718,7 +2316,10 @@ function gateBody(ctx, value) {
 			return clone;
 		}
 		if (BODY_CONSUMERS.includes(property)) {
-			const consume = (...args) => ctx.awaitIo(subject[property].apply(subject, args));
+			const consume = (...args) => {
+				const result = subject[property].apply(subject, args);
+				return ctx.awaitIo(result, (value) => property === "blob" ? gateBlob(ctx, value) : value);
+			};
 			bound.set(property, consume);
 			return consume;
 		}
@@ -3748,11 +2349,45 @@ function gateResponseBody(ctx, response) {
 */
 var BYOB_READER_UNGATABLE_MESSAGE = "getReader({ mode: 'byob' }): a BYOB reader cannot be gated by this runtime, because `ReadableStream.getReader` is the only seam it has and a byte stream's `read(view)` returns the caller's own buffer. Read the body through `arrayBuffer()` or a default reader.";
 function gateReadableStream(ctx, stream) {
+	const cancel = stream.cancel.bind(stream);
 	const getReader = stream.getReader.bind(stream);
 	const tee = stream.tee.bind(stream);
 	const pipeThrough = stream.pipeThrough.bind(stream);
 	const pipeTo = stream.pipeTo.bind(stream);
+	const values = async function* (options) {
+		const reader = gateReader(ctx, getReader());
+		let finished = false;
+		try {
+			for (;;) {
+				let result;
+				try {
+					result = await reader.read();
+				} catch (exception) {
+					finished = true;
+					throw exception;
+				}
+				if (result.done) {
+					finished = true;
+					return;
+				}
+				yield result.value;
+			}
+		} finally {
+			try {
+				if (!finished && options?.preventCancel !== true) await reader.cancel();
+			} finally {
+				reader.releaseLock();
+			}
+		}
+	};
 	Object.defineProperties(stream, {
+		cancel: {
+			configurable: true,
+			writable: true,
+			value(reason) {
+				return ctx.awaitIo(cancel(reason));
+			}
+		},
 		getReader: {
 			configurable: true,
 			writable: true,
@@ -3782,15 +2417,47 @@ function gateReadableStream(ctx, stream) {
 			value(destination, options) {
 				return ctx.awaitIo(pipeTo(destination, options));
 			}
+		},
+		values: {
+			configurable: true,
+			writable: true,
+			value: values
+		},
+		[Symbol.asyncIterator]: {
+			configurable: true,
+			writable: true,
+			value: values
 		}
 	});
 	return stream;
 }
 function gateReader(ctx, reader) {
+	const bound = /* @__PURE__ */ new Map();
 	return new Proxy(reader, { get(subject, property) {
-		if (property === "read") return () => ctx.awaitIo(subject.read());
+		const cached = bound.get(property);
+		if (cached !== void 0) return cached;
+		if (property === "closed") {
+			const closed = ctx.awaitIo(subject.closed);
+			bound.set(property, closed);
+			return closed;
+		}
+		if (property === "read") {
+			const read = () => ctx.awaitIo(subject.read());
+			bound.set(property, read);
+			return read;
+		}
+		if (property === "cancel") {
+			const cancel = (reason) => ctx.awaitIo(subject.cancel(reason));
+			bound.set(property, cancel);
+			return cancel;
+		}
 		const value = Reflect.get(subject, property, subject);
-		return typeof value === "function" ? value.bind(subject) : value;
+		if (typeof value === "function") {
+			const method = value.bind(subject);
+			bound.set(property, method);
+			return method;
+		}
+		return value;
 	} });
 }
 //#endregion