@dudousxd/nestjs-durable-core 0.63.0 → 0.65.0

package/dist/index.d.ts

@@ -168,6 +168,34 @@ declare class InMemoryAdmissionBackend implements AdmissionBackend {
  * wire contract — the adonis + python SDKs build the byte-identical shape (design §7.8), and the
  * golden fixtures in `<repo>/fixtures/wire/` pin the exact bytes all three SDKs must agree on.
  */
+/**
+ * One workflow a worker ANNOUNCES it can execute — the richer form of a `workflows` name.
+ *
+ * The rule is "announce only what you can run": a process publishes a registration for a workflow
+ * whose body it holds and whose queue it consumes. It never publishes one for a workflow it merely
+ * knows how to *route to* (an engine's `registerRemote`), because that claim says nothing about a
+ * live executor existing — which is precisely the ambiguity an aggregate registry has to remove.
+ *
+ * Every field but `name` is optional because the SDKs hold different amounts of this. A worker that
+ * knows only names (the Python `@worker.workflow("x")` form, or any pre-registrations SDK) publishes
+ * bare `workflows` names instead and is still a first-class announcer — see {@link WorkerDescriptor.registrations}.
+ * A reader must therefore treat an absent field as "not stated", never as a value: the aggregate in
+ * `./announced` never invents a version, a group or an origin that nobody announced.
+ */
+interface WorkflowRegistration {
+    /** Registered workflow name — the `workflow` a {@link WorkflowTask} carries. */
+    name: string;
+    /** Registered version, when the announcer knows one. Absent = unversioned announcement. */
+    version?: string;
+    /** The routing token this workflow's turns are dispatched to (the queue this worker consumes for
+     *  it). Absent = the announcer did not say; a reader must NOT assume the by-convention token. */
+    group?: string;
+    /** Capabilities a worker must advertise to run it (design §7.5), as the announcer declares them. */
+    requires?: string[];
+    /** The package that DECLARED the workflow (see `WorkflowRun.origin`). Absent = unknown; nothing
+     *  ever substitutes a default, because a wrong origin is worse than no origin. */
+    origin?: string;
+}
 /**
  * A worker's (or control-plane's) advertised identity, wire-protocol support, feature capabilities
  * and registered handlers. Published on startup + on change (design §7.2) and consumed by
@@ -200,6 +228,19 @@ interface WorkerDescriptor {
     workflows: string[];
     /** Registered step handler names → routing targets. Order-insensitive (a set). */
     steps: string[];
+    /**
+     * The richer, per-workflow ANNOUNCEMENT of what this instance can execute (name + version + group
+     * + requires + origin). OPTIONAL and purely additive: an SDK that has only names keeps publishing
+     * {@link workflows} and is aggregated all the same, just unversioned. An SDK that publishes this
+     * SHOULD also list the same names in {@link workflows}, so a reader that predates this field still
+     * sees the workflow at all.
+     *
+     * It rides the descriptor rather than a registry of its own so it inherits the whole liveness
+     * story for free: the descriptor key is written with the heartbeat's TTL and refreshed by the same
+     * beat, so an announcement from a worker that has since died EXPIRES instead of offering a choice
+     * that fails at run time.
+     */
+    registrations?: WorkflowRegistration[];
     /** Optional routing partition (queue/group sharding). */
     partition?: string;
     /** Optional tenant namespace this instance serves. */
@@ -252,7 +293,13 @@ declare function isLegacyDescriptor(raw: RawWorkerDescriptor | WorkerDescriptor)
  * - absent `workflows`/`steps` → `[]`, absent `sdk` → an `unknown` marker, absent `startedAt` → `0`.
  *
  * The undefined-vs-`[]` distinction is deliberate: an absent field means "legacy, doesn't advertise
- * this axis"; an explicit empty array means "modern SDK that genuinely advertises nothing".
+ * this axis"; an explicit empty array means "modern SDK that genuinely advertises nothing". The same
+ * reasoning keeps `registrations` ABSENT when it was absent (rather than defaulting to `[]`): "this
+ * SDK does not announce registrations" and "this SDK announces none" are different facts, and only
+ * the second one licenses a reader to conclude the worker serves nothing. (No SDK publishes `[]`
+ * today — {@link describeWorker} and the Python builder both OMIT the field when there is nothing to
+ * announce, so a worker with no workflows keeps its pre-announcement bytes and ETag — but a reader
+ * must not collapse the two cases on that basis.)
  */
 declare function normalizeDescriptor(raw: RawWorkerDescriptor | WorkerDescriptor): WorkerDescriptor;
 /**
@@ -292,6 +339,35 @@ declare function heartbeatStatus(descriptor: RawWorkerDescriptor | WorkerDescrip
     ts?: number;
     status?: WorkerLifecycle;
 }): HeartbeatStatus;
+/**
+ * Build a worker's own {@link WorkerDescriptor} in the exact §7.1 shape every SDK publishes — the
+ * single builder both TS advertisers use (the BullMQ transport's in-app worker and the standalone
+ * `runRedisWorker`), so two processes in the same fleet cannot drift into two dialects of the same
+ * wire.
+ *
+ * Set-valued fields are sorted here (not just in the hash projection) so the published BYTES are
+ * stable across registration order too — a re-registration in a different order must not look like a
+ * change to a reader diffing the raw value. `partition` and `namespace` are omitted when empty, and
+ * `namespace` additionally when it is `default`, keeping a single-tenant deployment byte-identical
+ * to the un-namespaced scheme. `capabilities` is the canonical v1 baseline this protocol guarantees.
+ */
+declare function describeWorker(opts: {
+    instanceId: string;
+    runtime: 'node' | 'python';
+    sdk: {
+        name: string;
+        version: string;
+    };
+    steps: string[];
+    workflows?: string[] | undefined;
+    /** What this instance announces it can EXECUTE — see {@link WorkflowRegistration}. Omitted from
+     *  the descriptor entirely when absent or empty, so a worker with nothing to announce keeps the
+     *  pre-registrations bytes (and therefore the pre-registrations hash). */
+    registrations?: readonly WorkflowRegistration[] | undefined;
+    startedAt: number;
+    partition?: string | undefined;
+    namespace?: string | undefined;
+}): WorkerDescriptor;
 
 /**
  * Capability- & protocol-aware dispatch planning (design §7.5/§7.6). Sits BETWEEN the pure handshake
@@ -1463,6 +1539,19 @@ interface Transport {
      * a run can dispatch to `group` or must park `blocked`.
      */
     readWorkerDescriptors?(group: string): Promise<WorkerDescriptor[]>;
+    /**
+     * Every live {@link WorkerDescriptor} in the deployment, across all groups — the read behind
+     * {@link WorkflowEngine.announcedWorkflows}. Optional, same as {@link readWorkerDescriptors}: a
+     * transport that cannot introspect the advertisement keyspace returns nothing and the registry is
+     * simply empty.
+     *
+     * Deliberately NOT `listWorkerGroups()` + a read per group: a worker publishes the SAME descriptor
+     * under every token it consumes, so per-group reads cost one round trip per group to re-fetch bytes
+     * the caller already has. One pass over the advertisement keyspace, de-duplicated by `instanceId`,
+     * answers with one scan and no per-group fan-out — and it also sees an instance whose groups the
+     * caller could not have enumerated.
+     */
+    readAllWorkerDescriptors?(): Promise<WorkerDescriptor[]>;
     /**
      * DB-less tenant worker → control plane: publish a {@link StartRunMessage} requesting a new run.
      * Optional — only transports that carry the hosted-control-plane protocol (P4) implement this.
@@ -1615,6 +1704,19 @@ type BackoffStrategy = 'fixed' | 'exp';
 interface ChildCallOptions {
     /** Deterministic child run id; defaults to one derived from the parent run id + call position. */
     childId?: string | undefined;
+    /**
+     * Pin the child to this EXACT registered version instead of the newest one — the same contract as
+     * `StartOptions.version`, reached from inside a workflow body: an unregistered version fails the
+     * child's start rather than quietly running a different body, and a version can only be pinned on a
+     * workflow that is really registered (not on the synthesized remote/convention routes). A `ctx.child`
+     * whose pinned start fails surfaces it as a failed child on the parent's waiter; a fire-and-forget
+     * `ctx.startChild` buffers it until the parent joins the id.
+     *
+     * Replay-safe as long as you pass a CONSTANT (`{ version: '2' }`), which is the point — it names the
+     * body you meant. Computing it from a live registry read at call time would make the body
+     * non-deterministic, exactly like reading the clock.
+     */
+    version?: string | undefined;
     /**
      * Dispatch priority for a REMOTE child workflow — stamped on the child run and carried onto every
      * {@link WorkflowTask} dispatched to advance it, so an urgent child can jump ahead of enqueued
@@ -2288,6 +2390,253 @@ declare class EventAccumulators {
     private batch;
 }
 
+/**
+ * The announced workflow registry (design §7.9) — the aggregate answer to "what workflows exist in
+ * this deployment?", built ONLY from what live workers say about themselves.
+ *
+ * ## Why this is announced, not inferred
+ *
+ * `WorkflowEngine.workflowBody(name, version)` answers for the process that asks, and a missing body
+ * is ambiguous by design: it means "not registered here", but equally "registered via
+ * `registerRemote` against another SDK" or "a group this pod resolves by convention against a live
+ * worker". A picker built on that inference would offer different options depending on which replica
+ * served the request. So the registry is not derived from any engine's registry: a worker publishes
+ * what it can execute ({@link WorkerDescriptor.registrations}, or bare `workflows` names), and this
+ * module folds those statements together. Every entry is therefore a fact somebody asserted, and the
+ * aggregate is the same on every pod because every pod reads the same published statements.
+ *
+ * The announcer is always the process that CONSUMES the queue, never the engine that dispatches to
+ * it — including when the two share a process (the co-located in-app worker announces; the engine
+ * beside it does not). One consequence is worth stating plainly rather than leaving to be
+ * rediscovered: a pure operator (`store` with no `connection`) runs its bodies inline, consumes no
+ * queue, and therefore announces NOTHING. Its workflows are real and startable through its own
+ * `start()`, but they are not in this registry, because nothing about them is externally addressable
+ * for a picker to point at.
+ *
+ * ## Liveness
+ *
+ * There is no expiry logic here because there is no state here. An announcement lives on the
+ * descriptor key, which is written with the worker-heartbeat TTL and refreshed by the same beat; a
+ * worker that dies stops refreshing and its key expires, taking its announcements with it. The
+ * resolution of that liveness is therefore the TTL (35s against a 10s beat), so an entry can name a
+ * worker that died within the last beat window — the same staleness the capability router already
+ * accepts when it reads descriptors to decide whether to dispatch. A caller that needs a stronger
+ * guarantee should not seek it here: dispatch to a dead worker parks the run `blocked`/`pending` on
+ * its queue and the existing worker-health surface reports it. What this design DOES rule out is the
+ * unbounded failure — an announcement that outlives its worker forever.
+ *
+ * ## Disagreement
+ *
+ * Two live workers can announce the same `name@version` with different groups, origins or capability
+ * demands. The aggregate keeps EVERY distinct claim and reports the axes they differ on
+ * ({@link AnnouncedWorkflow.disagreements}); it never merges them into one value and never picks a
+ * winner, because either choice would make a caller act on a claim nobody made. Silence is not a
+ * claim: a worker that announced no origin does not disagree with one that did.
+ *
+ * ## Steps are deliberately out of scope
+ *
+ * There is no equivalent registry for steps, and this is not an omission to be fixed later. A step is
+ * not addressable from outside a run: it is identified by its `(runId, seq)` position in one
+ * workflow's history, `ctx.step` is only callable from inside a replaying body, and no engine entry
+ * point starts a step on its own. "Call this step" is therefore not something the engine can do, so a
+ * picker offering steps would be offering an operation that does not exist. Step HANDLER names are
+ * still advertised (`WorkerDescriptor.steps`) — that is a routing/capability fact used to decide
+ * whether a dispatched step can be run, not an invocable catalog.
+ */
+
+/** One live worker's claim about one workflow: the registration plus who announced it. */
+interface WorkflowAnnouncement extends WorkflowRegistration {
+    /** The announcing worker's instance id. */
+    instanceId: string;
+    /** The announcing worker's runtime — how a Python-served workflow is told from a Node-served one. */
+    runtime: 'node' | 'python';
+}
+/** An axis on which the live announcers of one workflow do not agree. `values` holds every distinct
+ *  DECLARED value (sorted); an announcer that stated nothing on the axis contributes nothing. */
+interface Disagreement {
+    axis: 'group' | 'origin' | 'requires';
+    values: string[];
+}
+/** One workflow the live fleet announces, folded across every worker that announced it. */
+interface AnnouncedWorkflow {
+    /** `name@version`, or the bare `name` when no announcer stated a version. Stable sort key. */
+    key: string;
+    name: string;
+    /** Absent when no announcer stated one — never inferred from another announcer's version. */
+    version?: string;
+    /** Every distinct routing group announced (sorted). Empty = nobody stated one. */
+    groups: string[];
+    /** Every distinct declaring package announced (sorted). Empty = nobody stated one. */
+    origins: string[];
+    /** Every distinct capability demand announced, each de-duplicated + sorted. Empty = nobody stated
+     *  one. Two entries here means two workers demand different capabilities for the same version. */
+    requires: string[][];
+    /** Runtimes of the live announcers (sorted, de-duplicated). */
+    runtimes: ('node' | 'python')[];
+    /** Instance ids of the live workers announcing it (sorted, de-duplicated). Its length is how many
+     *  workers can currently run this workflow — `1` is a single point of failure, and it is never 0
+     *  (an entry exists only because somebody announced it). */
+    instances: string[];
+    /** The axes the announcers differ on, empty when they speak with one voice. A caller that must
+     *  pick a single target has to resolve these itself — the registry refuses to guess. */
+    disagreements: Disagreement[];
+}
+/**
+ * What one descriptor announces. `registrations` is authoritative when present; any `workflows` name
+ * it does not cover is still announced as a bare, unversioned claim, so a worker that describes some
+ * of its workflows richly and others by name alone is reported in full rather than in part.
+ *
+ * A descriptor with neither field announces nothing — including the control plane's own descriptor,
+ * which is a router, not an executor.
+ */
+declare function announcementsOf(raw: RawWorkerDescriptor | WorkerDescriptor): WorkflowAnnouncement[];
+/**
+ * Fold every live descriptor's announcements into one entry per `name@version`, sorted by key.
+ *
+ * Pure: it holds nothing and caches nothing, so no pod ever carries a growing table of the fleet's
+ * registrations — the caller reads the live descriptors it already knows how to read, folds them
+ * here, and drops the result. The work is O(descriptors × announcements) per call, on demand.
+ *
+ * The same instance announcing the same workflow twice (a worker publishes its descriptor under
+ * every routing token it consumes, so the same bytes arrive several times) folds to ONE announcer:
+ * `instances` is a set, so it counts workers, not keys.
+ */
+declare function aggregateAnnouncements(descriptors: readonly (RawWorkerDescriptor | WorkerDescriptor)[]): AnnouncedWorkflow[];
+
+/**
+ * Bilateral compatibility negotiation between two handshake descriptors (design §7.3/§7.4). Pure
+ * logic: given a local and a remote {@link WorkerDescriptor}, compute the negotiated session (highest
+ * common protocol major + capability intersection) and classify it into one of three outcomes with a
+ * precise, structured reason — never a bare boolean (design §7.6).
+ */
+
+/**
+ * The three compatibility outcomes (design §7.4):
+ * - `compatible`   — protocol ranges intersect + full capability parity → dispatch freely.
+ * - `degraded`     — ranges intersect but a capability is missing on one side → dispatch, but route
+ *                    capability-requiring work only to capable workers (soft warning).
+ * - `incompatible` — no protocol-range overlap → do NOT dispatch; red flag with the exact reason.
+ */
+type NegotiationOutcome = 'compatible' | 'degraded' | 'incompatible';
+/** Structured failure/warning payload — carries the precise delta so a diagnostics event can render
+ *  it on the timeline + dashboard health panel (design §7.6). Never a bare boolean. */
+interface NegotiationReason {
+    /** Stable machine code for alerting/telescope. */
+    code: 'protocol.incompatible' | 'capability.unavailable';
+    /** Human-readable one-liner (dashboard/telescope copy). */
+    message: string;
+    /** The exact delta: which protocol ranges failed to overlap, or which capabilities are missing. */
+    detail: {
+        localRange?: [number, number];
+        remoteRange?: [number, number];
+        /** Capabilities the local side advertises that the remote lacks. */
+        missingOnRemote?: string[];
+        /** Capabilities the remote side advertises that the local lacks. */
+        missingOnLocal?: string[];
+        /** Explicitly-required capabilities not satisfied by the negotiated session. */
+        missingRequired?: string[];
+    };
+}
+/** The negotiated session + full delta between two sides. Carries both normalized descriptors so a
+ *  downstream diagnostics event can attach them wholesale (design §7.6). */
+interface NegotiationResult {
+    outcome: NegotiationOutcome;
+    /** Highest common protocol major, or `null` when ranges do not overlap (incompatible). */
+    negotiatedProtocol: number | null;
+    protocol: {
+        localRange: [number, number];
+        remoteRange: [number, number];
+    };
+    capabilities: {
+        /** Intersection — the capabilities the negotiated session can rely on everywhere. */
+        shared: string[];
+        /** Local advertises, remote lacks. */
+        missingOnRemote: string[];
+        /** Remote advertises, local lacks. */
+        missingOnLocal: string[];
+    };
+    /** Present for `degraded` + `incompatible`; absent for `compatible`. */
+    reason?: NegotiationReason;
+    local: WorkerDescriptor;
+    remote: WorkerDescriptor;
+}
+interface NegotiateOptions {
+    /**
+     * Capabilities the local side needs the negotiated session to provide. A required capability the
+     * remote lacks degrades the session (dispatch generally, but capability-requiring runs park via
+     * the router, design §7.5) — it never, on its own, makes the pair *incompatible*: only a protocol
+     * range gap does that (design §7.4).
+     */
+    required?: string[];
+}
+/**
+ * Negotiate compatibility between `local` and `remote` (design §7.3/§7.4). Accepts raw/partial
+ * descriptors (a missing `protocol`/`capabilities` is normalized to the legacy-v1 baseline, so a
+ * legacy peer negotiates as **assume-compatible**, design §7.7).
+ *
+ * Outcome logic:
+ * 1. no protocol-range overlap → `incompatible` (`protocol.incompatible`);
+ * 2. else if a `required` capability is missing on the remote → `degraded` (`capability.unavailable`);
+ * 3. else if the capability sets differ at all (either direction) → `degraded`;
+ * 4. else full parity → `compatible`.
+ *
+ * **Bilateral-symmetric** on outcome for the parity path: `negotiate(a, b).outcome ===
+ * negotiate(b, a).outcome` (the `missingOnLocal`/`missingOnRemote` delta swaps). `required` is the
+ * caller's own need and intentionally asymmetric.
+ */
+declare function negotiate(localRaw: RawWorkerDescriptor | WorkerDescriptor, remoteRaw: RawWorkerDescriptor | WorkerDescriptor, opts?: NegotiateOptions): NegotiationResult;
+
+/**
+ * Capability-aware routing (design §7.5). A workflow/step handler may declare
+ * `requires: ['saga', 'search-attr-v2']`; the control-plane dispatches only to workers whose
+ * descriptor advertises every required capability. If no live capable worker exists the run must
+ * **park as `blocked`** with a precise reason (visible in the dashboard) — never a silent hang.
+ *
+ * Pure logic: no transport, no store. Consumers (the dispatcher/provider) feed live descriptors in.
+ */
+
+/** A handler's capability demand — either a bare list, or anything carrying a `requires` array
+ *  (a workflow/step ref). An absent/empty list means "runs anywhere" (design §7.5). */
+type CapabilityRequirement = string[] | {
+    requires?: string[];
+};
+/** Normalize the two accepted shapes to a de-duplicated list of required capability names. */
+declare function requiredCapabilities(handler: CapabilityRequirement): string[];
+/**
+ * Can `worker` run a handler with these requirements? True iff the worker's (normalized) descriptor
+ * advertises **every** required capability. A legacy worker (no `capabilities` field) is normalized
+ * to the v1 baseline first (design §7.7), so it can still run baseline-only work.
+ */
+declare function canRoute(handler: CapabilityRequirement, worker: RawWorkerDescriptor | WorkerDescriptor): boolean;
+/**
+ * The capabilities a handler requires that `worker` does NOT advertise — the precise routing delta.
+ * Empty iff {@link canRoute} is true.
+ */
+declare function missingCapabilities(handler: CapabilityRequirement, worker: RawWorkerDescriptor | WorkerDescriptor): string[];
+/** Filter a fleet down to the workers that can run a handler (design §7.5). */
+declare function capableWorkers<T extends RawWorkerDescriptor | WorkerDescriptor>(handler: CapabilityRequirement, workers: readonly T[]): T[];
+/** A run is dispatchable — at least one live worker can execute the handler. */
+interface RoutableResolution {
+    status: 'routable';
+    /** The normalized subset of the fleet that can run it. */
+    workers: WorkerDescriptor[];
+    requires: string[];
+}
+/** No live capable worker — the run parks as `blocked` with a human reason (design §7.5). */
+interface BlockedResolution {
+    status: 'blocked';
+    /** Exactly the dashboard copy: `blocked: no compatible worker (requires <caps>)`. */
+    reason: string;
+    requires: string[];
+}
+type RoutingResolution = RoutableResolution | BlockedResolution;
+/**
+ * Decide whether a handler can be dispatched to the given live fleet (design §7.5). Returns
+ * `routable` with the capable subset, or `blocked` with a precise reason when nobody can run it —
+ * so the run parks visibly instead of hanging silently. An empty fleet always blocks.
+ */
+declare function resolveRouting(handler: CapabilityRequirement, workers: readonly (RawWorkerDescriptor | WorkerDescriptor)[]): RoutingResolution;
+
 type WorkflowFn = (ctx: InternalWorkflowCtx, input: unknown) => Promise<unknown>;
 /**
  * Options for {@link WorkflowEngine.start}.
@@ -2298,6 +2647,26 @@ type WorkflowFn = (ctx: InternalWorkflowCtx, input: unknown) => Promise<unknown>
  * another lib's, and an origin filter would quietly lie.
  */
 interface StartOptions {
+    /**
+     * Start THIS registered version instead of the newest one. Omit (the default) and the run starts on
+     * the newest registered version, exactly as it always has — this option only ever narrows.
+     *
+     * Resolved against the by-name@version registry, so it pins anything explicitly registered:
+     * {@link WorkflowEngine.register}, {@link WorkflowEngine.registerRemote}, {@link WorkflowEngine.remote}.
+     * A version that is NOT registered throws before a run row is created and NEVER falls back to
+     * `latest` — a silent fallback is the exact failure this option exists to prevent (a caller that
+     * asked for `name@3` and got `name@4` has no way to tell, and its run is already going).
+     *
+     * NOT available on the two SYNTHESIZED registration paths, which exist precisely because nothing is
+     * registered: a child inheriting its remote ancestor's routing (see `findInheritedRegistration`),
+     * and convention routing to a live worker group of the same name (`resolveRemoteByConvention`).
+     * Both INVENT the version they stamp — the ancestor's, and the `'1'` convention default — as a
+     * routing placeholder; neither is evidence that the worker has a body at the version you asked for.
+     * A pinned start that reaches them therefore throws rather than pretending to have honoured the pin.
+     * To pin a cross-SDK workflow, register it for real — `engine.remote('name', { version: '2', group })`
+     * — which puts `name@2` in the registry and pins like any other registration.
+     */
+    version?: string | undefined;
     /** Run-scoped tags, merged with the workflow's static `@Workflow({ tags })` onto the run. */
     tags?: string[] | undefined;
     /** Typed, queryable run data stamped on the run (e.g. `{ amount: 200, tier: 'pro' }`). */
@@ -2645,6 +3014,10 @@ declare class WorkflowEngine {
      * remote (a `registerRemote` / synthesized child carries only a throwing stub, never handed out).
      */
     workflowBody(name: string, version: string): WorkflowFn | undefined;
+    /** The registered versions of `name`, for the pinned-start error — "2 is not registered" is a
+     *  guess-the-typo error without them, and the answer (which versions this deploy actually carries)
+     *  is right here. `none` when the name is unknown entirely. */
+    private registeredVersions;
     /**
      * Register a workflow whose body runs in another SDK (e.g. Python). The engine owns the run exactly
      * as for a TS workflow — it persists checkpoints, recovers, runs timers — but advances it by handing
@@ -2800,7 +3173,32 @@ declare class WorkflowEngine {
     /**
      * Cancel in-flight runs that have outlived their workflow's `executionTimeout`. Call it from the
      * timer poller alongside {@link resumeDueTimers}. A timed-out run is moved to `cancelled` with an
-     * `execution_timeout` error (terminal, so a late step result can't resurrect it).
+     * `execution_timeout` error (terminal, so a late step result can't resurrect it), AND its children
+     * are cascaded exactly as an explicit {@link cancel} cascades them.
+     *
+     * WHY THE TERMINAL WRITE IS DIRECT, not a call to {@link cancel}. Two reasons, both still standing:
+     * the run must land with the `execution_timeout` error `cancel` knows nothing about (`cancel` writes
+     * a plain `cancelled`, and the code is what a dashboard/alert distinguishes a timeout by), and this
+     * is a SCAN — it walks every in-flight run of every timed workflow on every poller tick, so it must
+     * not pay `cancel`'s per-run re-read and singleton/control-plane work on runs it isn't cancelling.
+     * The cascade below is charged only to the runs that ACTUALLY timed out, which are rare by
+     * construction; the scan itself is unchanged.
+     *
+     * The subtree, though, has no reason to differ, and before this it did: a timed-out parent's
+     * children kept running with the parent gone and nothing pointing at them — a silent orphan you
+     * could only find by reading the runs table by hand. {@link cancelChildren} is the SAME recursive
+     * walk `cancel` uses, so children of children go too, and it inherits that path's two guards:
+     * `cancel` returns early on a run that is already `completed`/`cancelled`/`dead` (a child that beat
+     * the sweep to the finish is never clobbered, and a re-cancel is a no-op), and it writes the
+     * parent's terminal status BEFORE recursing, so a cyclic parent→child graph terminates on the
+     * second visit instead of looping. Two pollers sweeping the same run concurrently therefore write
+     * the same terminal state twice and cascade into already-cancelled children — idempotent, not
+     * corrupting. The one window it does NOT close is the pre-existing check-then-write race an
+     * explicit `cancel` has always had (a child that completes between `cancel`'s read and its write);
+     * closing that needs a compare-and-set in the store contract, not a change here.
+     *
+     * Cascade failures are swallowed per subtree for the same reason `cancelChildren` swallows them per
+     * child: one unreachable child must not abort the sweep and leave every LATER timed-out run alive.
      */
     sweepTimeouts(now?: number): Promise<void>;
     /**
@@ -3064,6 +3462,10 @@ declare class WorkflowEngine {
      * `child:<id>` waiter) and fire-and-forget (`ctx.startChild`, found via its `spawn:<id>`
      * checkpoint). Recursive, so a whole subtree is cancelled; the terminal guard in `cancel` stops it
      * at finished / already-cancelled runs (no loops, no re-cancel).
+     *
+     * Two callers, deliberately the same walk: an explicit {@link cancel}, and {@link sweepTimeouts}
+     * when a parent hits its `executionTimeout` — a timed-out parent's subtree dies the same way an
+     * explicitly cancelled one's does, or the children are orphans nobody is holding a reference to.
      */
     private cancelChildren;
     /**
@@ -3090,6 +3492,25 @@ declare class WorkflowEngine {
      *  from registrations, shows once its workers beat). Empty when no transport can introspect health
      *  (only the BullMQ transport implements `groupHealth`). */
     workerHealth(extra?: string[]): Promise<GroupHealth[]>;
+    /**
+     * What workflows the LIVE fleet announces it can execute — the deployment-wide registry a picker
+     * ("call this existing workflow") needs, and the one question this engine's own registry cannot
+     * answer. {@link workflowBody} answers only for this process, and a missing body is ambiguous: it
+     * means "not registered here", but equally "registered via {@link registerRemote} against another
+     * SDK" or "a group resolved by convention against a worker". An inferred answer would therefore
+     * differ per replica. This one does not: every pod folds the same published announcements.
+     *
+     * Scoped like every other poll surface — an engine WITH a `namespace` sees only workers in it, and
+     * an operator (namespace unset) sees the whole deployment ("ver tudo = ausência de namespace"). A
+     * descriptor that states no namespace is `default`, matching how a single-tenant fleet publishes.
+     *
+     * Cost: one advertisement scan per CALL, on demand. Nothing is added to the poll loop and nothing
+     * is retained — no pod holds a table of the fleet's registrations. Empty when no transport can
+     * introspect the advertisement keyspace (a pure in-process transport advertises nothing).
+     *
+     * Workflows only, and deliberately: see the "steps are out of scope" note in `handshake/announced`.
+     */
+    announcedWorkflows(): Promise<AnnouncedWorkflow[]>;
     /**
      * The routing groups of every in-flight run's still-`pending` remote step — the queues where work is
      * dispatched and awaiting a worker. Folded into {@link workerHealth} so a step waiting on a group
@@ -3177,8 +3598,22 @@ declare class WorkflowEngine {
      * cancel flag stays too, re-derived from the status on any later re-drive regardless.
      */
     private compensateAndCancel;
-    /** The run body, lease held + renewed by {@link execute}. */
+    /**
+     * The run body, lease held + renewed by {@link execute}, wrapped in the registered
+     * {@link runDurableExecution} wrappers so an observability scope covers ONE WHOLE TURN.
+     *
+     * The wrap goes here — around the entire turn — rather than tightly around the `fn(ctx, input)`
+     * call, because the store writes that bracket the body (the `pending` → `running` transition, the
+     * step checkpoints, the terminal `settleRun` update) are exactly the queries an operator wants
+     * correlated to the turn that issued them. Narrowing the wrap to the body would leave them
+     * uncorrelated for the sake of a purity that buys nothing.
+     *
+     * Only the TS path is wrapped. {@link runRemoteExecution} does not execute a body at all — it
+     * dispatches a workflow task and awaits the worker's decision — so a scope opened there would
+     * describe a dispatch, not an execution, and would mislead anyone reading the trace.
+     */
     private runExecution;
+    private runExecutionTurn;
     /**
      * Undo every registered saga compensation in strict reverse order — the shared unwind both the
      * run-failure path (`runExecution`'s catch) and the compensating-cancel path
@@ -3537,138 +3972,68 @@ declare class ContinueAsNew extends Error {
 }
 
 /**
- * Bilateral compatibility negotiation between two handshake descriptors (design §7.3/§7.4). Pure
- * logic: given a local and a remote {@link WorkerDescriptor}, compute the negotiated session (highest
- * common protocol major + capability intersection) and classify it into one of three outcomes with a
- * precise, structured reason — never a bare boolean (design §7.6).
- */
-
-/**
- * The three compatibility outcomes (design §7.4):
- * - `compatible`   — protocol ranges intersect + full capability parity → dispatch freely.
- * - `degraded`     — ranges intersect but a capability is missing on one side → dispatch, but route
- *                    capability-requiring work only to capable workers (soft warning).
- * - `incompatible` — no protocol-range overlap → do NOT dispatch; red flag with the exact reason.
- */
-type NegotiationOutcome = 'compatible' | 'degraded' | 'incompatible';
-/** Structured failure/warning payload — carries the precise delta so a diagnostics event can render
- *  it on the timeline + dashboard health panel (design §7.6). Never a bare boolean. */
-interface NegotiationReason {
-    /** Stable machine code for alerting/telescope. */
-    code: 'protocol.incompatible' | 'capability.unavailable';
-    /** Human-readable one-liner (dashboard/telescope copy). */
-    message: string;
-    /** The exact delta: which protocol ranges failed to overlap, or which capabilities are missing. */
-    detail: {
-        localRange?: [number, number];
-        remoteRange?: [number, number];
-        /** Capabilities the local side advertises that the remote lacks. */
-        missingOnRemote?: string[];
-        /** Capabilities the remote side advertises that the local lacks. */
-        missingOnLocal?: string[];
-        /** Explicitly-required capabilities not satisfied by the negotiated session. */
-        missingRequired?: string[];
-    };
-}
-/** The negotiated session + full delta between two sides. Carries both normalized descriptors so a
- *  downstream diagnostics event can attach them wholesale (design §7.6). */
-interface NegotiationResult {
-    outcome: NegotiationOutcome;
-    /** Highest common protocol major, or `null` when ranges do not overlap (incompatible). */
-    negotiatedProtocol: number | null;
-    protocol: {
-        localRange: [number, number];
-        remoteRange: [number, number];
-    };
-    capabilities: {
-        /** Intersection — the capabilities the negotiated session can rely on everywhere. */
-        shared: string[];
-        /** Local advertises, remote lacks. */
-        missingOnRemote: string[];
-        /** Remote advertises, local lacks. */
-        missingOnLocal: string[];
-    };
-    /** Present for `degraded` + `incompatible`; absent for `compatible`. */
-    reason?: NegotiationReason;
-    local: WorkerDescriptor;
-    remote: WorkerDescriptor;
-}
-interface NegotiateOptions {
-    /**
-     * Capabilities the local side needs the negotiated session to provide. A required capability the
-     * remote lacks degrades the session (dispatch generally, but capability-requiring runs park via
-     * the router, design §7.5) — it never, on its own, makes the pair *incompatible*: only a protocol
-     * range gap does that (design §7.4).
-     */
-    required?: string[];
-}
-/**
- * Negotiate compatibility between `local` and `remote` (design §7.3/§7.4). Accepts raw/partial
- * descriptors (a missing `protocol`/`capabilities` is normalized to the legacy-v1 baseline, so a
- * legacy peer negotiates as **assume-compatible**, design §7.7).
+ * Wrappers around the **real execution** of a unit of durable work — a workflow turn, or a step
+ * handler body. Distinct from {@link StepInterceptor} (`engine.use`), which only sees the in-process
+ * `localStep` primitives (`ctx.now`, `ctx.sideEffect`, `ctx.task`'s dispatch step, saga
+ * compensations): a user's `ctx.step` is ALWAYS dispatched, so its handler runs inside a transport
+ * callback or a worker process where no engine is in scope at all.
  *
- * Outcome logic:
- * 1. no protocol-range overlap → `incompatible` (`protocol.incompatible`);
- * 2. else if a `required` capability is missing on the remote → `degraded` (`capability.unavailable`);
- * 3. else if the capability sets differ at all (either direction) → `degraded`;
- * 4. else full parity → `compatible`.
- *
- * **Bilateral-symmetric** on outcome for the parity path: `negotiate(a, b).outcome ===
- * negotiate(b, a).outcome` (the `missingOnLocal`/`missingOnRemote` delta swaps). `required` is the
- * caller's own need and intentionally asymmetric.
- */
-declare function negotiate(localRaw: RawWorkerDescriptor | WorkerDescriptor, remoteRaw: RawWorkerDescriptor | WorkerDescriptor, opts?: NegotiateOptions): NegotiationResult;
-
-/**
- * Capability-aware routing (design §7.5). A workflow/step handler may declare
- * `requires: ['saga', 'search-attr-v2']`; the control-plane dispatches only to workers whose
- * descriptor advertises every required capability. If no live capable worker exists the run must
- * **park as `blocked`** with a precise reason (visible in the dashboard) — never a silent hang.
+ * That is exactly why this registry is process-level rather than per-engine. `runStepHandler` is a
+ * free function every transport shares, and a thin worker (`DurableModule` with a `connection` and
+ * no `store`) holds no `WorkflowEngine` to hang a hook off. A per-engine registry could not reach
+ * either, so the seam that covers every deployment shape has to sit above the engine.
  *
- * Pure logic: no transport, no store. Consumers (the dispatcher/provider) feed live descriptors in.
+ * The intended consumer is an observability bridge (Telescope, OTel, a logger) that needs to
+ * establish an ambient scope — an AsyncLocalStorage batch, a span — that the executing code records
+ * into. It is deliberately NOT a transform point: see {@link runDurableExecution}.
  */
-
-/** A handler's capability demand — either a bare list, or anything carrying a `requires` array
- *  (a workflow/step ref). An absent/empty list means "runs anywhere" (design §7.5). */
-type CapabilityRequirement = string[] | {
-    requires?: string[];
-};
-/** Normalize the two accepted shapes to a de-duplicated list of required capability names. */
-declare function requiredCapabilities(handler: CapabilityRequirement): string[];
+/** The unit of durable work a wrapper is being invoked around. */
+interface DurableExecution {
+    /** `'workflow'` = one turn of a run's body; `'step'` = one step handler body. */
+    readonly unit: 'workflow' | 'step';
+    readonly runId: string;
+    /** The workflow name. Present on a turn; a dispatched step task does not carry it on the wire. */
+    readonly workflow: string | undefined;
+    /** The step name, for `unit: 'step'`. Undefined for a turn. */
+    readonly name: string | undefined;
+    /** The step's logical position within the run, for `unit: 'step'`. */
+    readonly seq: number | undefined;
+    /** 1-based dispatch attempt, when the task carries one. */
+    readonly attempt: number | undefined;
+}
 /**
- * Can `worker` run a handler with these requirements? True iff the worker's (normalized) descriptor
- * advertises **every** required capability. A legacy worker (no `capabilities` field) is normalized
- * to the v1 baseline first (design §7.7), so it can still run baseline-only work.
+ * Wraps one unit of durable work. Call `next()` to run the body (or the next wrapper). Whatever the
+ * wrapper returns or throws is discarded — see {@link runDurableExecution} for why.
  */
-declare function canRoute(handler: CapabilityRequirement, worker: RawWorkerDescriptor | WorkerDescriptor): boolean;
+type DurableExecutionWrapper = (execution: DurableExecution, next: () => Promise<unknown>) => Promise<unknown>;
 /**
- * The capabilities a handler requires that `worker` does NOT advertise — the precise routing delta.
- * Empty iff {@link canRoute} is true.
+ * Register a {@link DurableExecutionWrapper}. Returns an unregister function.
+ *
+ * Registering is the ONLY cost an unused hook imposes: with an empty registry
+ * {@link runDurableExecution} returns the body's own promise without allocating a chain, so a host
+ * that wires no observability pays nothing at all on the execution path.
  */
-declare function missingCapabilities(handler: CapabilityRequirement, worker: RawWorkerDescriptor | WorkerDescriptor): string[];
-/** Filter a fleet down to the workers that can run a handler (design §7.5). */
-declare function capableWorkers<T extends RawWorkerDescriptor | WorkerDescriptor>(handler: CapabilityRequirement, workers: readonly T[]): T[];
-/** A run is dispatchable — at least one live worker can execute the handler. */
-interface RoutableResolution {
-    status: 'routable';
-    /** The normalized subset of the fleet that can run it. */
-    workers: WorkerDescriptor[];
-    requires: string[];
-}
-/** No live capable worker — the run parks as `blocked` with a human reason (design §7.5). */
-interface BlockedResolution {
-    status: 'blocked';
-    /** Exactly the dashboard copy: `blocked: no compatible worker (requires <caps>)`. */
-    reason: string;
-    requires: string[];
-}
-type RoutingResolution = RoutableResolution | BlockedResolution;
+declare function useDurableExecution(wrapper: DurableExecutionWrapper): () => void;
+/** Drop every registered wrapper. For tests that must not leak a wrapper into the next file. */
+declare function clearDurableExecutionWrappers(): void;
+/** Whether any wrapper is registered — lets a hot path skip building an execution descriptor. */
+declare function hasDurableExecutionWrappers(): boolean;
 /**
- * Decide whether a handler can be dispatched to the given live fleet (design §7.5). Returns
- * `routable` with the capable subset, or `blocked` with a precise reason when nobody can run it —
- * so the run parks visibly instead of hanging silently. An empty fleet always blocks.
+ * Run `body` inside every registered wrapper and settle with **the body's own outcome**.
+ *
+ * The wrappers' return values and throws are deliberately ignored. An observer that misbehaves —
+ * returns early without calling `next()` is the one case we cannot paper over, but one that throws
+ * *after* the body settled, or swallows the body's error and returns normally, is common enough in
+ * telemetry code — must not be able to change what the workflow saw. A wrapper that turned a failed
+ * step into a completed one would corrupt the run's history and its checkpoints, which is a far
+ * worse failure than a missing trace. This is the same reasoning the bullmq/schedule Telescope
+ * watchers apply when they re-throw the host's error rather than swallowing it, pushed down into
+ * the seam so every wrapper gets it for free instead of having to remember.
+ *
+ * The one unrecoverable case is a wrapper that never calls `next()`: the body did not run, so there
+ * is no outcome to return and we throw rather than invent one.
  */
-declare function resolveRouting(handler: CapabilityRequirement, workers: readonly (RawWorkerDescriptor | WorkerDescriptor)[]): RoutingResolution;
+declare function runDurableExecution<T>(execution: DurableExecution, body: () => Promise<T>): Promise<T>;
 
 /** Canonical step id — the stable identity of a step within a run, used for dedupe and
  *  correlation. The format is part of the cross-language wire contract (Python builds the same). */
@@ -4345,4 +4710,4 @@ declare class InMemoryTransport implements Transport, ControlPlane {
     onControl(handler: (msg: ControlMessage) => void): void;
 }
 
-export { type AccumulatorHost, type Admission, type AdmissionBackend, type AdmissionItem, type AttributeFilter, type AttributeOp, type BackoffStrategy, type BlockedDispatch, type BlockedResolution, CONTROL_FLOW_SIGNAL, CURRENT_PROTOCOL_VERSION, type CapabilityRequirement, type ChildCallOptions, CodecStateStore, ContinueAsNew, type ControlMessage, type ControlPlane, DURABLE_OPTIONS, DURABLE_OPTIONS_CANONICAL, DURABLE_STEP_CONFIG, DURABLE_STEP_NAME, type DispatchDiagnostics, type DispatchPlan, type DurableTopology, type DurableWebhook, DurableWorkflow, EVENT_BUFFER_SCAN_LIMIT, EVENT_TOKEN_PREFIX, type EngineEvent, type EngineEventType, type EngineListener, Entities, type EntityConfig, type EntityHandler, type EntityHost, EventAccumulators, type EventBatchConfig, FatalError, GatherError, type GroupHealth, type Heartbeat, type HeartbeatStatus, type HistoryEvent, InMemoryAdmissionBackend, InMemoryStateStore, InMemoryTransport, type InferSearchAttributes, LEGACY_V1_CAPABILITIES, LEGACY_V1_PROTOCOL, type MetricsCollector, type MetricsSnapshot, type NamedTransport, type NegotiateOptions, type NegotiationOutcome, type NegotiationReason, type NegotiationResult, NonDeterminismError, type PayloadCodec, type QueueConfig, QueueController, type RawWorkerDescriptor, RemoteStepError, RemoteStepTimeout, type RemoteTask, RemoteWorkflowExecutor, RemoteWorkflowTimeout, type RetentionPolicy, type RoutableDispatch, type RoutableResolution, type RoutingResolution, type RunAttributeRow, type RunDetail, type RunDispatcher, RunGateway, type RunListItem, type RunQuery, type RunReply, type RunReplyResult, type RunRequest, type RunRequestKind, type RunResult, type RunSchedulesOptions, type RunStatus, type RunWaiting, STATE_STORE, STATE_STORE_CANONICAL, type ScheduledWorkflow, type SearchAttributes, type SearchAttributesSchema, SignalTimeoutError, type SignalWaiter, type SingletonConfig, SingletonQueueFullError, StandardSchemaV1, type StartOptions, type StartRunMessage, type StateStore, type StepCheckpoint, type StepConfig, type StepDef, type StepDispatchOpts, type StepError, type StepEvent, type StepHandler, type StepInterceptor, type StepInvocation, type StepKind, type StepLogger, type StepOptions, type StepRef, type StepResult, type StepUndo, type StoreTransaction, type SubProcessHandle, TERMINAL_RUN_STATUSES, TRANSPORT, TRANSPORT_CANONICAL, type TenantEvent, type Transport, type UndoOf, type UpdateResult, type UpdateValidator, WORKFLOW_NAME_KEY, type WireDates, type WorkerAdjust, type WorkerConcurrencyStatus, type WorkerDescriptor, type WorkerHeartbeat, type WorkerLifecycle, type WorkerStatus, WorkflowBlocked, type WorkflowClass, type WorkflowCommand, type WorkflowCtx, type WorkflowDecision, WorkflowEngine, type WorkflowEngineDeps, type WorkflowExecutor, type WorkflowHandler, type WorkflowInputOf, type WorkflowOutputOf, type WorkflowRef, type WorkflowRun, type WorkflowStartClient, type WorkflowStepEvent, WorkflowSuspended, type WorkflowTask, applyAttributeQuery, attributeColumnFor, attributeOperand, bindWorkflowClass, breakpointToken, canRoute, capableWorkers, classifyWaiterToken, collectMetrics, controlPlaneDescriptor, createStepLogger, currentStep, currentWorkflowCtx, debug, descriptorHash, error, eventMatchOf, eventMatches, eventNameOf, eventPrefix, eventToken, heartbeatStatus, indexWaitersByRun, info, isEventToken, isLegacyDescriptor, isWorkflowControlFlowSignal, log, matchesAttributes, missingCapabilities, negotiate, normalizeAttributeRows, normalizeDescriptor, parseDuration, planDispatch, prevCronFireMs, readSearchAttributes, requiredCapabilities, resolveRouting, resolveRunWaiting, runInStepLogger, runInWorkflowCtx, runSchedules, runStepHandler, sanitizeQueueToken, scheduledRunId, sqlComparator, stepConfigOf, stepId, stepNameOf, sub, subEvent, subProcess, tenantGroup, warn, workflowName };
+export { type AccumulatorHost, type Admission, type AdmissionBackend, type AdmissionItem, type AnnouncedWorkflow, type AttributeFilter, type AttributeOp, type BackoffStrategy, type BlockedDispatch, type BlockedResolution, CONTROL_FLOW_SIGNAL, CURRENT_PROTOCOL_VERSION, type CapabilityRequirement, type ChildCallOptions, CodecStateStore, ContinueAsNew, type ControlMessage, type ControlPlane, DURABLE_OPTIONS, DURABLE_OPTIONS_CANONICAL, DURABLE_STEP_CONFIG, DURABLE_STEP_NAME, type Disagreement, type DispatchDiagnostics, type DispatchPlan, type DurableExecution, type DurableExecutionWrapper, type DurableTopology, type DurableWebhook, DurableWorkflow, EVENT_BUFFER_SCAN_LIMIT, EVENT_TOKEN_PREFIX, type EngineEvent, type EngineEventType, type EngineListener, Entities, type EntityConfig, type EntityHandler, type EntityHost, EventAccumulators, type EventBatchConfig, FatalError, GatherError, type GroupHealth, type Heartbeat, type HeartbeatStatus, type HistoryEvent, InMemoryAdmissionBackend, InMemoryStateStore, InMemoryTransport, type InferSearchAttributes, LEGACY_V1_CAPABILITIES, LEGACY_V1_PROTOCOL, type MetricsCollector, type MetricsSnapshot, type NamedTransport, type NegotiateOptions, type NegotiationOutcome, type NegotiationReason, type NegotiationResult, NonDeterminismError, type PayloadCodec, type QueueConfig, QueueController, type RawWorkerDescriptor, RemoteStepError, RemoteStepTimeout, type RemoteTask, RemoteWorkflowExecutor, RemoteWorkflowTimeout, type RetentionPolicy, type RoutableDispatch, type RoutableResolution, type RoutingResolution, type RunAttributeRow, type RunDetail, type RunDispatcher, RunGateway, type RunListItem, type RunQuery, type RunReply, type RunReplyResult, type RunRequest, type RunRequestKind, type RunResult, type RunSchedulesOptions, type RunStatus, type RunWaiting, STATE_STORE, STATE_STORE_CANONICAL, type ScheduledWorkflow, type SearchAttributes, type SearchAttributesSchema, SignalTimeoutError, type SignalWaiter, type SingletonConfig, SingletonQueueFullError, StandardSchemaV1, type StartOptions, type StartRunMessage, type StateStore, type StepCheckpoint, type StepConfig, type StepDef, type StepDispatchOpts, type StepError, type StepEvent, type StepHandler, type StepInterceptor, type StepInvocation, type StepKind, type StepLogger, type StepOptions, type StepRef, type StepResult, type StepUndo, type StoreTransaction, type SubProcessHandle, TERMINAL_RUN_STATUSES, TRANSPORT, TRANSPORT_CANONICAL, type TenantEvent, type Transport, type UndoOf, type UpdateResult, type UpdateValidator, WORKFLOW_NAME_KEY, type WireDates, type WorkerAdjust, type WorkerConcurrencyStatus, type WorkerDescriptor, type WorkerHeartbeat, type WorkerLifecycle, type WorkerStatus, type WorkflowAnnouncement, WorkflowBlocked, type WorkflowClass, type WorkflowCommand, type WorkflowCtx, type WorkflowDecision, WorkflowEngine, type WorkflowEngineDeps, type WorkflowExecutor, type WorkflowHandler, type WorkflowInputOf, type WorkflowOutputOf, type WorkflowRef, type WorkflowRegistration, type WorkflowRun, type WorkflowStartClient, type WorkflowStepEvent, WorkflowSuspended, type WorkflowTask, aggregateAnnouncements, announcementsOf, applyAttributeQuery, attributeColumnFor, attributeOperand, bindWorkflowClass, breakpointToken, canRoute, capableWorkers, classifyWaiterToken, clearDurableExecutionWrappers, collectMetrics, controlPlaneDescriptor, createStepLogger, currentStep, currentWorkflowCtx, debug, describeWorker, descriptorHash, error, eventMatchOf, eventMatches, eventNameOf, eventPrefix, eventToken, hasDurableExecutionWrappers, heartbeatStatus, indexWaitersByRun, info, isEventToken, isLegacyDescriptor, isWorkflowControlFlowSignal, log, matchesAttributes, missingCapabilities, negotiate, normalizeAttributeRows, normalizeDescriptor, parseDuration, planDispatch, prevCronFireMs, readSearchAttributes, requiredCapabilities, resolveRouting, resolveRunWaiting, runDurableExecution, runInStepLogger, runInWorkflowCtx, runSchedules, runStepHandler, sanitizeQueueToken, scheduledRunId, sqlComparator, stepConfigOf, stepId, stepNameOf, sub, subEvent, subProcess, tenantGroup, useDurableExecution, warn, workflowName };