@dudousxd/nestjs-durable-core 0.80.1 → 0.82.0

package/dist/index.d.ts

@@ -1150,6 +1150,16 @@ interface StepError {
     retryable?: boolean | undefined;
     stack?: string | undefined;
 }
+/**
+ * See {@link StateStore.listOrphanedRuns}: the live leases a rebooted engine instance may take back
+ * immediately, i.e. those its previous incarnation (same `instanceId`) held when it died.
+ */
+interface OwnedLeaseReclaim {
+    /** The engine instance id the lease must be held by. */
+    owner: string;
+    /** Only leases expiring strictly before this epoch ms (the caller's boot time + `leaseMs`). */
+    lockedBefore: number;
+}
 interface StateStore {
     /**
      * Provision the tables/collections this store needs, idempotently. Called on boot when the
@@ -1251,8 +1261,16 @@ interface StateStore {
      * Optional but recommended: without it the engine lists every incomplete run and filters the
      * leases in process, which on a busy fleet reads every healthy running run once per tick per
      * worker.
-     */
-    listOrphanedRuns?(nowMs: number, limit: number, namespace?: string): Promise<WorkflowRun[]>;
+     *
+     * When `ownedBy` is given, ALSO return the runs whose lease is still live but held by
+     * `ownedBy.owner` with `lockedUntil < ownedBy.lockedBefore` (strictly), under the same status,
+     * namespace, order and `limit`. The engine passes its own `instanceId` and its boot time plus
+     * `leaseMs`: a lease that expires before then was taken by a PREVIOUS process with the same stable
+     * `instanceId` (one killed without a graceful shutdown), never by this one, so it reclaims those
+     * at once instead of waiting out the lease. A store that ignores the argument keeps the plain
+     * behaviour: those runs are reclaimed once their lease expires.
+     */
+    listOrphanedRuns?(nowMs: number, limit: number, namespace?: string, ownedBy?: OwnedLeaseReclaim): Promise<WorkflowRun[]>;
     /** The oldest `pending` runs awaiting dispatch (FIFO, by `createdAt`), capped at `limit`. */
     listPendingRuns(limit: number, namespace?: string): Promise<WorkflowRun[]>;
     /**
@@ -1267,8 +1285,15 @@ interface StateStore {
      * acquired — so concurrent engine instances never recover the same run twice.
      */
     tryLockRun(runId: string, owner: string, leaseUntilMs: number, nowMs: number): Promise<boolean>;
-    /** Release a run's recovery lease so another instance can pick it up (e.g. once it suspends). */
-    releaseRunLock(runId: string): Promise<void>;
+    /**
+     * Release a run's recovery lease so another instance can pick it up (e.g. once it suspends).
+     *
+     * `owner`, when given, makes the release owner-scoped: clear the lease ONLY if `owner` still holds
+     * it, so an instance releasing a lease it may have lost (a drain that timed out) never frees the
+     * lease another instance took over. Without it the release is unconditional. A store that ignores
+     * the argument stays correct, only less precise in that race.
+     */
+    releaseRunLock(runId: string, owner?: string): Promise<void>;
     /**
      * Extend a run's lease to `leaseUntilMs`, but ONLY if `owner` still holds it — so a live worker
      * heartbeating its long run keeps the lease, while a dead worker's lease still expires and gets
@@ -1568,6 +1593,13 @@ interface ScheduleQuery {
 /** The terminal run statuses — a run in one of these is finished and will never change on its own.
  *  Only these are eligible for retention pruning (a {@link RetentionPolicy} targeting a non-terminal
  *  status would race the engine and delete live work). */
+/**
+ * Normalise a namespace to the worker pool it names: `''` is the default pool, exactly like
+ * `'default'` (the transport already maps both to the bare token), so it is stamped, polled and
+ * compared as `'default'`. `undefined` passes through untouched: an UNSET engine namespace is the
+ * operator (drives every namespace), and an unset run namespace belongs to everyone.
+ */
+declare function poolNamespace(namespace: string | undefined): string | undefined;
 declare const TERMINAL_RUN_STATUSES: readonly RunStatus[];
 /**
  * One retention rule for hard-pruning terminal run history. Within `statuses` (terminal only), a run
@@ -3218,6 +3250,20 @@ interface EntityHost {
     getEvent<T>(runId: string, key: string): Promise<T | undefined>;
     signal(token: string, payload: unknown): Promise<unknown>;
 }
+/**
+ * What a workflow-side send needs on top of {@link EntityHost}: a durable buffer write it can AWAIT
+ * inside its turn, and a way to wake an entity run that is parked on its wait. Optional so a bare
+ * {@link EntityHost} (tests, older hosts) still works through {@link Entities.dispatch}.
+ */
+interface EntityWorkflowHost {
+    /** Durably buffer `payload` on `token` (the store's `bufferSignal`). */
+    bufferSignal(token: string, payload: unknown): Promise<void>;
+    /** If a run is parked on `token`, wake it with `payload`; if none is, do nothing (no buffering). */
+    wakeWaiter(token: string, payload: unknown): Promise<unknown>;
+    /** Start `runId` of `workflow` if it doesn't exist yet (idempotent by run id). */
+    ensureStarted(workflow: string, input: unknown, runId: string): Promise<unknown>;
+}
+declare const ENTITY_WORKFLOW = "__entity";
 /**
  * Durable keyed **entities** (virtual objects): a keyed actor whose handlers run **serialized per
  * key** over **durable state**, exactly once. Each key is one long-lived run (`entity:<name>:<key>`)
@@ -3226,14 +3272,35 @@ interface EntityHost {
  */
 declare class Entities {
     private readonly host;
+    private readonly workflowHost?;
     private readonly configs;
-    constructor(host: EntityHost);
+    constructor(host: EntityHost, workflowHost?: EntityWorkflowHost | undefined);
     register<S>(name: string, config: EntityConfig<S>): void;
     /** Deliver an op to an entity's runner, starting it on first contact. `reply` (a signal token)
      *  receives the handler's result, for `ctx.callEntity`. */
     dispatch(name: string, key: string, op: string, arg: unknown, reply?: string): Promise<{
         runId: string;
     }>;
+    /**
+     * The durable half of a send from INSIDE a workflow (`ctx.callEntity` / `ctx.signalEntity`): write
+     * the op to the entity's signal buffer and return once it is stored, so the caller can checkpoint
+     * after it. The op carries `id`, the caller's stable `<runId>:<seq>`, so if the caller dies between
+     * this write and its checkpoint and sends again on replay, the entity skips the second copy. The
+     * entity's run is also ensured here, awaited (`start` only enqueues, it never runs the body
+     * inline), so an op sent on first contact can't be stranded in a buffer no run will ever read if
+     * the process dies right after. The wake-up ({@link kick}) is separate and may be lost: a busy
+     * entity reads the buffer at its next wait, and a parked one is paired with it by the engine's
+     * `reconcileMs` sweep. Returns `false` on a host without a workflow host.
+     */
+    enqueue(name: string, key: string, op: string, arg: unknown, id: string, reply?: string): Promise<boolean>;
+    /**
+     * Make the entity act on what {@link enqueue} buffered: wake its run if it is parked on its wait
+     * (the run itself was ensured by `enqueue`; ensured again here, idempotently, for a caller replay
+     * that only re-kicks). A run that is busy needs nothing: its next wait reads the buffer before
+     * suspending. The wake carries a no-op `nudge`, never the op itself, so the op stays in
+     * the buffer in arrival order and a lost or repeated kick costs at most one empty iteration.
+     */
+    kick(name: string, key: string): Promise<void>;
     signal(name: string, key: string, op: string, arg?: unknown): Promise<void>;
     getState<S = unknown>(name: string, key: string): Promise<S | undefined>;
     /** The built-in runner: one long-lived run per key, processing ops serially over state. */
@@ -3943,6 +4010,60 @@ declare class ScheduleClient {
     private write;
 }
 
+/** Default idle threshold for a stranded run: 15 minutes. */
+declare const DEFAULT_STALLED_AFTER_MS: number;
+/** The oldest unresolved remote step of a run — the lost-dispatch signature when it is old. */
+interface StalePendingStep {
+    seq: number;
+    name: string;
+    /** How many times this step has been (re-)dispatched. A lost dispatch typically sits at 1. */
+    attempts: number;
+    /** Milliseconds since the step was enqueued to the transport. */
+    ageMs: number;
+    /**
+     * The step's lease (`wakeAt`, epoch ms) when it has one: a step with a `timeoutMs`, a heartbeat
+     * renewing it, or `remoteRedispatchMs`. `null` when nothing is leasing the step.
+     */
+    leaseUntil: number | null;
+}
+/** What an `engine.onStalled` listener (and {@link findStalledRuns}) receives: a stranded run and why. */
+interface StalledRunInfo {
+    run: WorkflowRun;
+    /** Milliseconds since the run's last activity (`updatedAt`). */
+    ageMs: number;
+    /** Suspended with NO wake timer — nothing will re-drive it (the `reconcileMs: 0` hazard). */
+    wakeForever: boolean;
+    /** The oldest pending remote step with no live lease, when that is the stranding signature. */
+    stalePending: StalePendingStep | null;
+}
+/** Options for {@link findStalledRuns}. */
+interface FindStalledRunsOptions {
+    /** Idle threshold in ms. Default {@link DEFAULT_STALLED_AFTER_MS}. */
+    thresholdMs?: number | undefined;
+    /** Max candidate runs inspected (newest first). Default 1000. */
+    scan?: number | undefined;
+    /** Evaluate as of this time (epoch ms). Default `Date.now()`. */
+    now?: number | undefined;
+    /** Only runs in this namespace. Omit for every namespace. */
+    namespace?: string | undefined;
+}
+/**
+ * The stranded runs in a store right now — the query behind `engine.sweepStalled`/`onStalled`,
+ * `engine.listStalledRuns` and the CLI's `durable inspect --stale`. Works on a bare store, so an
+ * ops script or a CLI can run it without an engine.
+ *
+ * A `running`/`suspended` run qualifies when it has been untouched for `thresholdMs` AND either:
+ *
+ * - it is suspended with NO wake timer (`wakeForever`): nothing will ever re-drive it; or
+ * - its oldest pending REMOTE step is older than the threshold and has no lease in the future
+ *   (`stalePending`): the dispatch was most likely lost.
+ *
+ * Healthy long work is excluded: a long `ctx.sleep` has a future `wakeAt` and no pending step, and a
+ * remote step with a `timeoutMs`, a heartbeat or `remoteRedispatchMs` carries a future lease. Issues
+ * one `listCheckpoints` per idle candidate, bounded by `scan`: an operator read, not a hot path.
+ */
+declare function findStalledRuns(store: Pick<StateStore, 'listRuns' | 'listCheckpoints'>, options?: FindStalledRunsOptions): Promise<StalledRunInfo[]>;
+
 type WorkflowFn = (ctx: InternalWorkflowCtx, input: unknown) => Promise<unknown>;
 /**
  * Options for {@link WorkflowEngine.start}.
@@ -4119,6 +4240,14 @@ interface WorkflowEngineDeps {
      * for a genuinely-orphaned run. Default 5min; set `0` to disable (the prior wake-forever behavior).
      */
     reconcileMs?: number | undefined;
+    /**
+     * How long an in-flight run must sit untouched, with the stranded signature (a wake-forever
+     * suspension, or an old pending remote step with no live lease), before the
+     * {@link WorkflowEngine.onStalled} listeners are notified. Default 900 000 (15 min); floored at
+     * 60 000. The sweep ({@link WorkflowEngine.sweepStalled}) only does work when a listener is
+     * registered.
+     */
+    stalledAfterMs?: number | undefined;
     /**
      * The most due timers one {@link WorkflowEngine.resumeDueTimers} pass loads and drives, most
      * overdue first. Every driving instance runs that pass each tick, so a wave of thousands of due
@@ -4226,6 +4355,15 @@ interface WorkflowEngineDeps {
      */
     runDispatcher?: RunDispatcher | undefined;
 }
+/** Options for {@link WorkflowEngine.listStalledRuns}. */
+interface ListStalledRunsOptions {
+    /** Idle threshold in ms. Defaults to the engine's `stalledAfterMs` (15 min). */
+    thresholdMs?: number | undefined;
+    /** Max candidate runs inspected (newest first). Default 1000. */
+    scan?: number | undefined;
+    /** Evaluate as of this clock time. Defaults to the engine clock. */
+    now?: number | undefined;
+}
 /**
  * The orchestrator. Owns workflow state and replays runs deterministically: each step's
  * result is checkpointed, so on resume a completed step returns its saved output instead of
@@ -4241,6 +4379,12 @@ declare class WorkflowEngine {
     private readonly instanceId;
     private readonly namespace;
     private readonly leaseMs;
+    /**
+     * Leases held by this `instanceId` that expire strictly before this epoch ms were taken by a
+     * PREVIOUS process with the same id (every lease this one takes or renews expires at
+     * `clock() + leaseMs`, so at or after it). See {@link orphanedRuns}.
+     */
+    private readonly ownLeaseCutoffMs;
     private readonly maxRecoveryAttempts?;
     private readonly remoteAdvanceSilenceMs?;
     private readonly reconcileMs;
@@ -4344,6 +4488,18 @@ declare class WorkflowEngine {
     private readonly stepQueue;
     /** Executions currently in flight, so a graceful shutdown can wait for them to settle. */
     private readonly inflight;
+    /**
+     * The run lease of each execution in flight on THIS instance, by run id — renewed while it runs
+     * and checked by every settle (the zombie fence, see {@link ExecutionLease}). Also what `drain()`
+     * releases when its budget runs out.
+     */
+    private readonly executionLeases;
+    /** Pager hooks for stranded runs (see {@link onStalled}). */
+    private readonly stalledListeners;
+    /** Runs already paged about, by id → the `updatedAt` of the paged episode (see {@link sweepStalled}). */
+    private readonly notifiedStalled;
+    private lastStalledSweepAt;
+    private readonly stalledAfterMs;
     private draining;
     /** Wait already spent on this shutdown before `drain()` (see `beginDrain`). */
     private drainSpentMs;
@@ -4509,6 +4665,33 @@ declare class WorkflowEngine {
      * Returns an unsubscribe function.
      */
     onDead(listener: (run: WorkflowRun) => void): () => void;
+    /**
+     * Register a pager hook for STRANDED runs: an in-flight run untouched past `stalledAfterMs` that is
+     * either suspended with NO wake timer (wake-forever: nothing will ever re-drive it) or parked on an
+     * old pending remote step with no live lease (dispatched and, most likely, lost). The timer poller
+     * sweeps for these ({@link sweepStalled}, throttled to one pass a minute) and notifies each episode
+     * ONCE per instance: a run is paged again only after it makes progress and strands again. Wire your
+     * alerting here like {@link onDead}. A listener that throws never breaks the sweep. Returns an
+     * unsubscribe function.
+     */
+    onStalled(listener: (info: StalledRunInfo) => void): () => void;
+    /**
+     * Detect stranded in-flight runs and notify the {@link onStalled} listeners. Self-throttled to one
+     * pass a minute, skipped while draining, and a no-op without listeners — call it every tick (the
+     * NestJS timer poller does). Scoped to this engine's `namespace` (an operator engine with no
+     * namespace sweeps every namespace). Returns the runs notified THIS pass.
+     */
+    sweepStalled(now?: number): Promise<StalledRunInfo[]>;
+    /**
+     * The stranded runs right now, without notifying anyone: the query behind {@link sweepStalled} and
+     * the CLI's `durable inspect --stale`. A `running`/`suspended` run qualifies when it has been
+     * untouched for `thresholdMs` (default `stalledAfterMs`) AND either it is suspended with no wake
+     * timer, or its oldest pending remote step is older than the threshold with no lease in the future
+     * (a step with a `timeoutMs`, a heartbeat or `remoteRedispatchMs` keeps a lease; a long
+     * `ctx.sleep` has a future `wakeAt`; neither is stranded). Scans up to `scan` candidates (default
+     * 1000), newest first, in this engine's namespace.
+     */
+    listStalledRuns(options?: ListStalledRunsOptions): Promise<StalledRunInfo[]>;
     private notifyDead;
     /** Emit a locally-produced lifecycle event: deliver to subscribers AND broadcast it on the
      *  control plane so other instances (e.g. a dashboard pod) can live-tail this run. */
@@ -4520,6 +4703,9 @@ declare class WorkflowEngine {
     start<TInput>(workflow: string, input: TInput, runId: string, opts?: StartOptions): Promise<RunResult>;
     /** Read a run's current persisted state (or null if unknown). A thin pass-through to the store. */
     getRun(runId: string): Promise<WorkflowRun | null>;
+    /** A run's full checkpoint timeline, ordered by seq. A thin pass-through to the store (it is what
+     *  the testing kit's `captureHistory` reads, next to {@link getRun}). */
+    listCheckpoints(runId: string): Promise<StepCheckpoint[]>;
     /**
      * Re-execute a run's body (replaying its checkpoints). This is the EXPLICIT entry point: besides
      * driving a live run, it re-drives a `failed` run — the manual retry (prefer {@link requeue}, which
@@ -4671,12 +4857,31 @@ declare class WorkflowEngine {
      * for part of it waits only for the remainder. With nothing reported, the full `timeoutMs` applies.
      */
     drain(timeoutMs?: number): Promise<void>;
+    /**
+     * The drain budget ran out with executions still in flight: release their recovery leases so
+     * another instance re-drives those runs on its next recovery pass, instead of waiting out
+     * `leaseMs` after this process exits. Each still-running turn is FENCED first, so whatever it
+     * computes after this point is never written over the new owner's work (see settleRun). Its
+     * completed steps are checkpointed, so the new owner replays them; a step still executing here
+     * may run again there, exactly as after a crash. The release is owner-scoped where the store
+     * supports it (only a lease this instance still holds is cleared). Best effort: never throws.
+     */
+    private releaseInflightLeases;
     /**
      * Cancel in-flight runs that have outlived their workflow's `executionTimeout`. Call it from the
      * timer poller alongside {@link resumeDueTimers}. A timed-out run is moved to `cancelled` with an
      * `execution_timeout` error (terminal, so a late step result can't resurrect it), AND its children
      * are cascaded exactly as an explicit {@link cancel} cascades them.
      *
+     * WHICH RUNS. Every run not yet finished, counted from `createdAt`: `pending` and `blocked` as well
+     * as `running` and `suspended`. A run nobody picks up (no worker on its queue) or nobody can run (no
+     * worker with its capabilities) is as stuck as one that hangs mid-body, and the cap is the backstop
+     * for exactly that — leaving them out meant a run that never started lived forever while one that
+     * started and hung was cut off. Cancelling one a worker is picking up at that moment is safe: the
+     * worker's settle only writes over a live status ({@link SETTLE_ELIGIBLE_STATUSES}), so it can't
+     * bring the run back. `cancelling` is left alone on purpose — a compensating cancel's saga undo is
+     * running, it ends `cancelled` by itself, and cutting it short would skip the undo.
+     *
      * WHY THE TERMINAL WRITE IS DIRECT, not a call to {@link cancel}. Two reasons, both still standing:
      * the run must land with the `execution_timeout` error `cancel` knows nothing about (`cancel` writes
      * a plain `cancelled`, and the code is what a dashboard/alert distinguishes a timeout by), and this
@@ -4689,8 +4894,8 @@ declare class WorkflowEngine {
      * children kept running with the parent gone and nothing pointing at them — a silent orphan you
      * could only find by reading the runs table by hand. {@link cancelChildren} is the SAME recursive
      * walk `cancel` uses, so children of children go too, and it inherits that path's two guards:
-     * `cancel` returns early on a run that is already `completed`/`cancelled`/`dead` (a child that beat
-     * the sweep to the finish is never clobbered, and a re-cancel is a no-op), and it writes the
+     * `cancel` returns early on a run that is already terminal (a child that beat the sweep to the
+     * finish is never clobbered, and a re-cancel is a no-op), and it writes the
      * parent's terminal status BEFORE recursing, so a cyclic parent→child graph terminates on the
      * second visit instead of looping. Two pollers sweeping the same run concurrently therefore write
      * the same terminal state twice and cascade into already-cancelled children — idempotent, not
@@ -4707,6 +4912,27 @@ declare class WorkflowEngine {
      * replay from their checkpoints, so only the work that had not finished runs again.
      */
     recoverIncomplete(nowMs?: number): Promise<RunResult[]>;
+    /** A run whose still-live lease is held by this very `instanceId` (see {@link reclaimOwnLease}). */
+    private isOwnLiveLease;
+    /**
+     * Recover a run whose lease is still live but held by THIS `instanceId` and predates this process
+     * (listed by {@link orphanedRuns}): the previous process with this stable id died without a
+     * graceful shutdown (OOM, SIGKILL), so nothing is renewing that lease and waiting for it to expire
+     * only delays the run. The lease is taken back with `renewRunLock` (a compare-and-set on the
+     * owner; `tryLockRun` refuses a live lease), so the lease alone cannot fence a live execution in
+     * THIS process from its own recovery: the in-process run gate does. A run with a
+     * gate is executing (or about to) here and is skipped; otherwise a gate is held while the run is
+     * recovered, so a resume landing meanwhile queues behind the recovery instead of running beside it.
+     * The gate is released before the re-dispatch, which may resume the run on this instance.
+     */
+    private reclaimOwnLease;
+    /**
+     * One run of a {@link recoverIncomplete} pass: take its lease and decide on it. Resolves the
+     * pass's result for it and whether it must be re-dispatched, or `undefined` when it was not ours.
+     * `ownLease`: the run's live lease is this instance id's own, left by a previous process (see
+     * {@link reclaimOwnLease}), so it is taken back by owner rather than acquired as a free one.
+     */
+    private recoverOrphan;
     /**
      * The runs {@link recoverIncomplete} should try to reclaim: incomplete runs whose lease is free or
      * expired, never the healthy ones a live turn is renewing. Every worker runs recovery on every
@@ -4715,6 +4941,10 @@ declare class WorkflowEngine {
      * ({@link StateStore.listOrphanedRuns}, bounded by {@link RECOVERY_BATCH}); else the full list is
      * filtered here, which still spares the probes. Shuffled, like the due-timer pass, so instances
      * recovering at once spread over the batch instead of contending for the same leases.
+     *
+     * Also listed: runs still leased by THIS `instanceId` with a lease taken before this process
+     * booted ({@link ownLeaseCutoffMs}). With a stable `instanceId` (pinned to the pod identity), that
+     * is the previous process, killed without a graceful shutdown; see {@link reclaimOwnLease}.
      */
     private orphanedRuns;
     /**
@@ -4947,6 +5177,13 @@ declare class WorkflowEngine {
      * side actually removes the row is the one that delivers, so a signal is never delivered twice.
      */
     signal(token: string, payload: unknown): Promise<RunResult | null>;
+    /**
+     * Wake the run parked on `token` with `payload`, if there is one; otherwise do nothing — unlike
+     * {@link signal}, it never buffers. For a wake-up whose real payload is ALREADY buffered on the
+     * token (an entity op, see `Entities.kick`): a run that isn't parked reads that buffer at its next
+     * wait, so there is nothing to keep.
+     */
+    private wakeSignalWaiter;
     /**
      * Ensure a run exists for `runId`, then deliver a signal to it — atomically race-free thanks to
      * signal buffering: if the run is new (or busy / not yet waiting), the signal is buffered and
@@ -5165,8 +5402,35 @@ declare class WorkflowEngine {
     /** Checkpoint a step that failed terminally, so the failure point is visible (not just the run). */
     private failStep;
     /** Admission persists the wait atomically; never overwrite a cancellation after it returns. */
+    /**
+     * A run's first execution: `pending` -> `running`. A singleton run not yet admitted is stamped
+     * {@link SINGLETON_TRACKED_TAG} in the same write, BEFORE it competes for a slot, so a run this
+     * replica is about to admit or deny is never mistaken for a holder admitted by a replica older
+     * than 0.73 (see `legacySingletonHolders`).
+     */
+    private markStarted;
     private singletonWaitResult;
     private execute;
+    /**
+     * Renew `runId`'s lease for as long as this execution holds it, and register it in
+     * {@link executionLeases} so settles can check the zombie fence and `drain()` can release it.
+     *
+     * A renewal that returns `false` means the lease is gone: this turn stalled past `leaseMs` and
+     * another instance reclaimed the run, so this executor is now a zombie. It is FENCED (`lost`): its
+     * settles degrade to an echo of the store's state instead of clobbering the new owner's writes, and
+     * its own lease release is skipped (it would free the new owner's lease). A renewal that THROWS (a
+     * transient store error) is not evidence of a takeover, so it stays swallowed and the next
+     * interval retries. A lease this execution released on purpose (`handedOff`) is not renewed, and a
+     * renewal resolving after the execution ended (`done`) fences nothing.
+     */
+    private holdExecutionLease;
+    /** Whether `runId`'s execution on this instance lost its lease (see {@link holdExecutionLease}). */
+    private isFenced;
+    /**
+     * Mark `runId`'s lease as given away on purpose by its own execution (released mid-turn), so a
+     * renewal that now fails is not read as a takeover.
+     */
+    private handOffLease;
     /**
      * Advance a remote (cross-SDK) workflow one turn: hand its history to the executor (which dispatches
      * a workflow task to the worker and awaits its replay) and apply the decision. Mirrors
@@ -5680,6 +5944,14 @@ declare class DurableWorkflow {
  */
 declare function parseDuration(duration: string | number): number;
 
+/**
+ * Format marker of a run-history replay fixture (`{ version, run, checkpoints }`). Written by the
+ * testing kit's `serializeRunHistory` and the CLI's `durable export`, checked by `parseRunHistory`.
+ * Lives in core so both writers (which already depend on core, not on each other) share one value.
+ * Bump it only when the fixture shape changes incompatibly.
+ */
+declare const RUN_HISTORY_FIXTURE_VERSION = 1;
+
 /**
  * Thrown inside a step to signal an unrecoverable failure: the engine will NOT retry it,
  * regardless of the step's `retries` setting, and fails the run immediately. Use it for
@@ -6086,6 +6358,15 @@ declare function fanPageEtag(group: string, stats: CheckpointStat[], query: FanP
 /** Whether an `If-None-Match` header value names `etag` (weak comparison, as RFC 9110 asks for). */
 declare function etagMatches(ifNoneMatch: string | undefined, etag: string): boolean;
 
+/**
+ * Split a `ctx.webhook()` token (`wh:<runId>:<seq>`) into its run id and logical position, or `null`
+ * for any other token. The run id may itself contain `:` (an entity run is `entity:<name>:<key>`), so
+ * the seq is the LAST segment.
+ */
+declare function parseWebhookToken(token: string): {
+    runId: string;
+    seq: number;
+} | null;
 /**
  * Resolve WHAT a suspended run is parked on from the token of the {@link SignalWaiter} it registered.
  * The token prefix carries the kind — no extra store lookup and no new persisted field. Used by the
@@ -6133,26 +6414,45 @@ interface PayloadCodec {
     encode(value: unknown): unknown;
     decode(value: unknown): unknown;
 }
+/** What {@link CodecStateStore} runs through the codec. */
+interface CodecStateStoreOptions {
+    /**
+     * `'payloads'` (default, the historical behaviour): run/step `input` + `output` only (plus a
+     * schedule's `input` and buffered signal/event payloads, which are always encoded). **Know what
+     * that leaves in the clear**: step `events` (everything step code passes to `ctx.log` and every
+     * sub-step outcome) and the structured step/run `error` (message, stack, details). A deployment
+     * sold as "encrypted payloads" still leaks whatever its steps log or throw.
+     *
+     * `'extended'`: also encode step `events`, step `error` and run `error`. Searchable metadata (ids,
+     * status, workflow, tags, search attributes, namespace, origin, timestamps) stays clear — it must
+     * remain queryable. ONLY enable on a FRESH table, or with a codec whose `decode` recognizes its own
+     * ciphertext and passes other values through: rows written before the switch hold those fields as
+     * plaintext, and a decode that can't tell would garble them.
+     */
+    coverage?: 'payloads' | 'extended';
+}
 /**
- * A `StateStore` decorator that runs run/step **payloads** (input + output) through a
- * {@link PayloadCodec} — encoded on write, decoded on read — so they're never stored in the clear.
- * Adapter-agnostic: wrap any store. Searchable metadata (id, status, workflow, tags, timestamps) and
- * the structured `error` are left untouched so the dashboard, queries, and recovery still work.
+ * A `StateStore` decorator that runs run/step **payloads** through a {@link PayloadCodec} — encoded
+ * on write, decoded on read — so they're never stored in the clear. Adapter-agnostic: wrap any
+ * store. Searchable metadata (id, status, workflow, tags, timestamps) is left untouched so the
+ * dashboard, queries, and recovery still work. See {@link CodecStateStoreOptions.coverage} for
+ * exactly which fields are covered — the default covers `input`/`output` only.
  *
  * ```ts
- * const store = new CodecStateStore(new TypeOrmStateStore(ds), aesCodec);
+ * const store = new CodecStateStore(new TypeOrmStateStore(ds), aesCodec, { coverage: 'extended' });
  * ```
  */
 declare class CodecStateStore implements StateStore {
     private readonly inner;
     private readonly codec;
+    private readonly extended;
     /** Atomic claims touch only searchable metadata and bypass payload encoding. */
     readonly tryAdmitSingleton?: (runId: string, tag: string, workflow: string, limit: number, retryWakeAt?: number) => Promise<boolean>;
     /**
      * Forwarded verbatim — a facet cell counts `status`/`origin`, neither of which the codec touches
-     * (it encodes payloads: input/output/error). Bound as a PROPERTY, and only when the inner store
-     * actually aggregates, so `store.runFacets?.()` still reports absence through the wrapper instead
-     * of resolving to a silently wrong empty result.
+     * (it encodes payloads: input/output, plus events/error under `extended` coverage). Bound as a
+     * PROPERTY, and only when the inner store actually aggregates, so `store.runFacets?.()` still
+     * reports absence through the wrapper instead of resolving to a silently wrong empty result.
      */
     readonly runFacets?: (query: RunFacetQuery) => Promise<RunFacetRow[]>;
     /**
@@ -6166,7 +6466,7 @@ declare class CodecStateStore implements StateStore {
     readonly deleteRuns?: (runIds: string[]) => Promise<void>;
     /** Decodes the runs like {@link listIncompleteRuns}. Bound only when the inner store has it, so
      *  the engine's list-and-filter fallback still kicks in through the wrapper. */
-    readonly listOrphanedRuns?: (nowMs: number, limit: number, namespace?: string) => Promise<WorkflowRun[]>;
+    readonly listOrphanedRuns?: (nowMs: number, limit: number, namespace?: string, ownedBy?: OwnedLeaseReclaim) => Promise<WorkflowRun[]>;
     /** Encodes the patch like {@link updateRun}. Bound only when the inner store has it, so the
      *  engine's read-then-write fallback still kicks in through the wrapper. */
     readonly updateRunIf?: (runId: string, expectedStatuses: RunStatus[], patch: Partial<WorkflowRun>) => Promise<boolean>;
@@ -6206,7 +6506,7 @@ declare class CodecStateStore implements StateStore {
     readonly updateSchedule?: (id: string, patch: Partial<Omit<ScheduleRecord, 'id' | 'createdAt'>>, expectedNextFireAt?: number | null) => Promise<boolean>;
     readonly deleteSchedule?: (id: string) => Promise<boolean>;
     readonly listSchedules?: (query: ScheduleQuery) => Promise<ScheduleRecord[]>;
-    constructor(inner: StateStore, codec: PayloadCodec);
+    constructor(inner: StateStore, codec: PayloadCodec, options?: CodecStateStoreOptions);
     private enc;
     private dec;
     private encRun;
@@ -6232,7 +6532,7 @@ declare class CodecStateStore implements StateStore {
     listPendingRuns(limit: number, namespace?: string): Promise<WorkflowRun[]>;
     listDueTimers(nowMs: number, namespace?: string, limit?: number): Promise<WorkflowRun[]>;
     tryLockRun(runId: string, owner: string, leaseUntilMs: number, nowMs: number): Promise<boolean>;
-    releaseRunLock(runId: string): Promise<void>;
+    releaseRunLock(runId: string, owner?: string): Promise<void>;
     renewRunLock(runId: string, owner: string, leaseUntilMs: number): Promise<boolean>;
     putSignalWaiter(waiter: SignalWaiter): Promise<void>;
     takeSignalWaiter(token: string): Promise<SignalWaiter | null>;
@@ -6669,12 +6969,12 @@ declare class InMemoryStateStore implements StateStore {
     saveCheckpoint(checkpoint: StepCheckpoint): Promise<void>;
     saveCheckpointIfPending(checkpoint: StepCheckpoint): Promise<boolean>;
     saveCheckpointsIfPending(checkpoints: StepCheckpoint[]): Promise<boolean[]>;
-    listOrphanedRuns(nowMs: number, limit: number, namespace?: string): Promise<WorkflowRun[]>;
+    listOrphanedRuns(nowMs: number, limit: number, namespace?: string, ownedBy?: OwnedLeaseReclaim): Promise<WorkflowRun[]>;
     listIncompleteRuns(namespace?: string): Promise<WorkflowRun[]>;
     listPendingRuns(limit: number, namespace?: string): Promise<WorkflowRun[]>;
     listDueTimers(nowMs: number, namespace?: string, limit?: number): Promise<WorkflowRun[]>;
     tryLockRun(runId: string, owner: string, leaseUntilMs: number, nowMs: number): Promise<boolean>;
-    releaseRunLock(runId: string): Promise<void>;
+    releaseRunLock(runId: string, owner?: string): Promise<void>;
     renewRunLock(runId: string, owner: string, leaseUntilMs: number): Promise<boolean>;
     putSignalWaiter(waiter: SignalWaiter): Promise<void>;
     takeSignalWaiter(token: string): Promise<SignalWaiter | null>;
@@ -6769,7 +7069,42 @@ declare class InMemoryTransport implements Transport, ControlPlane {
 
 /** Reserved engine metadata: a durable singleton slot, independent of the execution lease. */
 declare const SINGLETON_ADMITTED_TAG = "durable:singleton:admitted";
+/**
+ * Reserved engine metadata: this not-yet-admitted run's admission is decided by the tag scheme, so
+ * it holds no slot unless it carries {@link SINGLETON_ADMITTED_TAG}. Stamped on a run's first
+ * execution (`pending` -> `running`) and on every denial. An untagged run WITHOUT it that a
+ * replica has executed was executed by a replica older than 0.73: see
+ * {@link legacySingletonHolders}. Admission and terminal settlement remove it.
+ */
+declare const SINGLETON_TRACKED_TAG = "durable:singleton:tracked";
+/** Tags only the engine/store may write; stripped from user-supplied start tags. */
+declare const SINGLETON_RESERVED_TAGS: readonly string[];
 declare const SINGLETON_ACTIVE_STATUSES: RunStatus[];
+/** `tags` without the engine's singleton admission metadata. */
+declare function withoutSingletonMarkers(tags: string[] | undefined): string[] | undefined;
+/** `tags` carrying {@link SINGLETON_TRACKED_TAG} (unchanged when admitted or already tracked). */
+declare function withSingletonTracked(tags: string[] | undefined): string[];
+/**
+ * The runs other than `runId` that may hold a slot of this key WITHOUT carrying
+ * {@link SINGLETON_ADMITTED_TAG}: holders admitted by a replica older than 0.73, during a rolling
+ * upgrade that mixes old and new replicas.
+ *
+ * Old replicas admit by a scan: a run may execute when it is among the `limit` oldest
+ * `running`/`suspended`/`cancelling` runs sharing the key, by `(createdAt, id)`, and they write no
+ * tag. Among those statuses, an untagged run counts as a legacy holder when either:
+ *
+ * - it lacks {@link SINGLETON_TRACKED_TAG}. A new replica stamps that marker on a run's first
+ *   execution and on every denial, so an untagged executed run without it was executed (admitted)
+ *   by an old replica. A denial alone cannot be told apart from a holder (both old and new denials
+ *   park the run `suspended` with a retry `wakeAt`, exactly like a holder sleeping in `ctx.sleep`),
+ *   which is why the marker exists. Waiters an old replica parked count too until a new replica
+ *   re-checks them (one retry, ~1s), which only delays, never over-admits.
+ * - it sits inside the old scan's own window (the `limit` oldest of those runs). An old replica can
+ *   admit a run a new replica had marked, without clearing the marker; the window is what it
+ *   admitted it on. Without old replicas this never changes a `limit: 1` decision (a run inside the
+ *   window is the head of the FIFO, admitted next anyway); with a larger limit it can only delay one.
+ */
+declare function legacySingletonHolders(active: WorkflowRun[], runId: string, limit: number): WorkflowRun[];
 /** Call only inside a store's atomic admission transaction/critical section. */
 declare function singletonAdmissionTags(runs: WorkflowRun[], runId: string, tag: string, workflow: string, limit: number): string[] | null;
 /** Terminal runs release admission, including when later resumed directly rather than requeued. */
@@ -6778,7 +7113,8 @@ declare function clearTerminalSingletonAdmission(runId: string, patch: Partial<W
 declare function singletonAdmissionDenialPatch(runs: WorkflowRun[], runId: string, tag: string, workflow: string, retryWakeAt?: number): {
     status: 'suspended';
     wakeAt: number;
+    tags: string[];
     updatedAt: Date;
 } | undefined;
 
-export { type AccumulatorHost, type Admission, type AdmissionBackend, type AdmissionItem, type AllOptions, type AllSettledOptions, type AllStepsOptions, type AllStepsSettledOptions, type AnnouncedWorkflow, type AnnouncementEvidence, type AttributeFilter, type AttributeOp, type AttributePredicateOperand, type AttributeValue, type BackoffStrategy, type BlockedDispatch, type BlockedResolution, CHILD_EDGE_PREFIXES, CONTROL_FLOW_SIGNAL, CURRENT_PROTOCOL_VERSION, type CapabilityRequirement, type CheckpointAggregatingStore, type CheckpointNameKind, type CheckpointQuery, type CheckpointStat, type ChildCallOptions, type ChildWait, CodecStateStore, type ConcurrencyConfig, ConcurrencyLimitError, type ConcurrencyQuota, ContinueAsNew, type ControlMessage, type ControlPlane, DEFAULT_CONCURRENCY_STATUSES, DEFAULT_PARTITION, DURABLE_OPTIONS, DURABLE_OPTIONS_CANONICAL, DURABLE_STEP_CONFIG, DURABLE_STEP_NAME, type Disagreement, type DispatchDiagnostics, type DispatchPlan, type DurableExecution, type DurableExecutionWrapper, type DurableTopology, type DurableWebhook, DurableWorkflow, type DynamicWorkflowCtx, ENGINE_MINTED_TAG_PREFIXES, EVENT_BUFFER_SCAN_LIMIT, EVENT_TOKEN_PREFIX, type EngineEvent, type EngineEventType, type EngineListener, Entities, type EntityConfig, type EntityHandler, type EntityHost, EventAccumulators, type EventBatchConfig, FAN_SUMMARY_FAILURES, type FanJoin, type FanPage, type FanPageQuery, type FanSummary, type FanWait, FatalError, GatherError, type GatherItemFailure, type GroupHealth, HANDOFF_SEQ_BASE, type Heartbeat, type HeartbeatSighting, type HeartbeatStatus, type HistoryEvent, InMemoryAdmissionBackend, InMemoryStateStore, InMemoryTransport, type InferSearchAttributes, LEGACY_V1_CAPABILITIES, LEGACY_V1_PROTOCOL, type MetricsCollector, type MetricsSnapshot, type NamedTransport, type NegotiateOptions, type NegotiationOutcome, type NegotiationReason, type NegotiationResult, NestedWorkflowCallError, NonDeterminismError, type OnErrorInput, type OnErrorRoute, type PartitionSighting, type PayloadCodec, type QueueConfig, QueueController, RUN_VALUE_FACET_LIMIT, RUN_VALUE_FACET_SCAN, type RawWorkerDescriptor, RemoteStepError, RemoteStepTimeout, type RemoteTask, RemoteWorkflowExecutor, RemoteWorkflowTimeout, type RetentionPolicy, type RoutableDispatch, type RoutableResolution, type RoutingResolution, type RunAttributeRow, type RunDetail, type RunDetailOptions, type RunDispatcher, type RunFacetQuery, type RunFacetRow, RunGateway, type RunListItem, type RunQuery, type RunReply, type RunReplyResult, type RunRequest, type RunRequestKind, type RunResult, type RunSchedulesOptions, type RunScope, type RunStatus, type RunValueAxis, type RunValueFacetOptions, type RunValueFacetOrder, type RunValueFacetRow, type RunWaiting, SINGLETON_ACTIVE_STATUSES, SINGLETON_ADMITTED_TAG, STATE_STORE, STATE_STORE_CANONICAL, SUMMARY_CHILD_LIMIT, type ScalarAttributeFilter, ScheduleAlreadyExistsError, ScheduleClient, type ScheduleClientOptions, type ScheduleDescription, type ScheduleHost, type ScheduleListQuery, ScheduleNotFoundError, type ScheduleOptions, type ScheduleQuery, type ScheduleRecord, type ScheduledWorkflow, type SearchAttributes, type SearchAttributesSchema, type Settled, SignalTimeoutError, type SignalWaiter, type SingletonConfig, SingletonQueueFullError, StandardSchemaV1, type StartOptions, type StartRunMessage, type StateStore, type StepCheckpoint, type StepConfig, type StepDef, type StepDispatchOpts, type StepError, type StepEvent, type StepHandler, type StepInterceptor, type StepInvocation, type StepKind, type StepLogger, type StepOptions, type StepRef, type StepResult, type StepScope, type StepUndo, type StoreTransaction, type SubProcessHandle, TERMINAL_RUN_STATUSES, TRANSPORT, TRANSPORT_CANONICAL, type TenantEvent, type Transport, type UndoOf, type UpdateResult, type UpdateValidator, VERSION_UNDECLARED_TAG, WORKFLOW_NAME_KEY, type WireDates, type WorkerAdjust, type WorkerConcurrencyStatus, type WorkerDescriptor, type WorkerHeartbeat, type WorkerLifecycle, type WorkerStatus, type WorkflowAnnouncement, WorkflowBlocked, type WorkflowClass, type WorkflowCommand, type WorkflowCtx, type WorkflowDecision, type WorkflowDirectory, WorkflowEngine, type WorkflowEngineDeps, type WorkflowExecutor, type WorkflowHandler, type WorkflowInputOf, type WorkflowOutputOf, type WorkflowRef, type WorkflowRegistration, type WorkflowRun, type WorkflowStartClient, type WorkflowStepEvent, WorkflowSuspended, type WorkflowTask, aggregateAnnouncements, aggregatesCheckpoints, announcementsOf, applyAttributeQuery, assertConcurrency, assertRoutes, attributeColumnFor, attributeOperand, attributePredicateOperands, axisIsRunColumn, bindWorkflowClass, breakpointToken, buildWorkflowDirectory, canRoute, capableWorkers, checkpointNameKind, checkpointStatsOf, childIdsOf, classifyWaiterToken, clearDurableExecutionWrappers, clearTerminalSingletonAdmission, codeAndDetails, codeOf, collectMetrics, concurrencyTag, controlPlaneDescriptor, countRuns, coveredTokens, createStepLogger, currentStep, currentStepScope, currentWorkflowCtx, debug, describeWorker, descriptorHash, detailsOf, error, etagMatches, eventMatchOf, eventMatches, eventNameOf, eventPrefix, eventToken, facetOrigin, fanPageBounds, fanPageEtag, foldedCount, handoffHandlerId, handoffName, hasDurableExecutionWrappers, heartbeatStatus, indexWaitersByRun, info, isEngineMintedTag, isEventToken, isFailedMember, isLegacyDescriptor, isNonEmptyRunScope, isWorkflowControlFlowSignal, listSignalWaitersOfRuns, liveHandoff, log, matchesAttributes, mergeRunFacetRows, mergeRunValueFacetRows, missingCapabilities, negotiate, nextCronFireMs, normalizeAttributeRows, normalizeDescriptor, observedAnnouncements, onErrorRunId, pageFan, pageFanFromStore, parentRunIdOf, parseDuration, partitionOfToken, planDispatch, prevCronFireMs, queryCheckpointsOf, readSearchAttributes, requiredCapabilities, resolveConcurrency, resolveRouting, resolveRunWaiting, retiredHandoffName, routeFor, runDetailEtag, runDurableExecution, runInStepLogger, runInStepScope, runInWorkflowCtx, runOutsideWorkflowCtx, runSchedules, runStepHandler, runValueFacetsFromRuns, sanitizeQueueToken, scheduledRunId, singletonAdmissionDenialPatch, singletonAdmissionTags, sqlComparator, stepConfigOf, stepId, stepNameOf, sub, subEvent, subProcess, summarizeFan, summarizeRunFromStore, summarizeTimeline, tenantGroup, useDurableExecution, warn, workflowName };
+export { type AccumulatorHost, type Admission, type AdmissionBackend, type AdmissionItem, type AllOptions, type AllSettledOptions, type AllStepsOptions, type AllStepsSettledOptions, type AnnouncedWorkflow, type AnnouncementEvidence, type AttributeFilter, type AttributeOp, type AttributePredicateOperand, type AttributeValue, type BackoffStrategy, type BlockedDispatch, type BlockedResolution, CHILD_EDGE_PREFIXES, CONTROL_FLOW_SIGNAL, CURRENT_PROTOCOL_VERSION, type CapabilityRequirement, type CheckpointAggregatingStore, type CheckpointNameKind, type CheckpointQuery, type CheckpointStat, type ChildCallOptions, type ChildWait, CodecStateStore, type CodecStateStoreOptions, type ConcurrencyConfig, ConcurrencyLimitError, type ConcurrencyQuota, ContinueAsNew, type ControlMessage, type ControlPlane, DEFAULT_CONCURRENCY_STATUSES, DEFAULT_PARTITION, DEFAULT_STALLED_AFTER_MS, DURABLE_OPTIONS, DURABLE_OPTIONS_CANONICAL, DURABLE_STEP_CONFIG, DURABLE_STEP_NAME, type Disagreement, type DispatchDiagnostics, type DispatchPlan, type DurableExecution, type DurableExecutionWrapper, type DurableTopology, type DurableWebhook, DurableWorkflow, type DynamicWorkflowCtx, ENGINE_MINTED_TAG_PREFIXES, ENTITY_WORKFLOW, EVENT_BUFFER_SCAN_LIMIT, EVENT_TOKEN_PREFIX, type EngineEvent, type EngineEventType, type EngineListener, Entities, type EntityConfig, type EntityHandler, type EntityHost, type EntityWorkflowHost, EventAccumulators, type EventBatchConfig, FAN_SUMMARY_FAILURES, type FanJoin, type FanPage, type FanPageQuery, type FanSummary, type FanWait, FatalError, type FindStalledRunsOptions, GatherError, type GatherItemFailure, type GroupHealth, HANDOFF_SEQ_BASE, type Heartbeat, type HeartbeatSighting, type HeartbeatStatus, type HistoryEvent, InMemoryAdmissionBackend, InMemoryStateStore, InMemoryTransport, type InferSearchAttributes, LEGACY_V1_CAPABILITIES, LEGACY_V1_PROTOCOL, type ListStalledRunsOptions, type MetricsCollector, type MetricsSnapshot, type NamedTransport, type NegotiateOptions, type NegotiationOutcome, type NegotiationReason, type NegotiationResult, NestedWorkflowCallError, NonDeterminismError, type OnErrorInput, type OnErrorRoute, type OwnedLeaseReclaim, type PartitionSighting, type PayloadCodec, type QueueConfig, QueueController, RUN_HISTORY_FIXTURE_VERSION, RUN_VALUE_FACET_LIMIT, RUN_VALUE_FACET_SCAN, type RawWorkerDescriptor, RemoteStepError, RemoteStepTimeout, type RemoteTask, RemoteWorkflowExecutor, RemoteWorkflowTimeout, type RetentionPolicy, type RoutableDispatch, type RoutableResolution, type RoutingResolution, type RunAttributeRow, type RunDetail, type RunDetailOptions, type RunDispatcher, type RunFacetQuery, type RunFacetRow, RunGateway, type RunListItem, type RunQuery, type RunReply, type RunReplyResult, type RunRequest, type RunRequestKind, type RunResult, type RunSchedulesOptions, type RunScope, type RunStatus, type RunValueAxis, type RunValueFacetOptions, type RunValueFacetOrder, type RunValueFacetRow, type RunWaiting, SINGLETON_ACTIVE_STATUSES, SINGLETON_ADMITTED_TAG, SINGLETON_RESERVED_TAGS, SINGLETON_TRACKED_TAG, STATE_STORE, STATE_STORE_CANONICAL, SUMMARY_CHILD_LIMIT, type ScalarAttributeFilter, ScheduleAlreadyExistsError, ScheduleClient, type ScheduleClientOptions, type ScheduleDescription, type ScheduleHost, type ScheduleListQuery, ScheduleNotFoundError, type ScheduleOptions, type ScheduleQuery, type ScheduleRecord, type ScheduledWorkflow, type SearchAttributes, type SearchAttributesSchema, type Settled, SignalTimeoutError, type SignalWaiter, type SingletonConfig, SingletonQueueFullError, type StalePendingStep, type StalledRunInfo, StandardSchemaV1, type StartOptions, type StartRunMessage, type StateStore, type StepCheckpoint, type StepConfig, type StepDef, type StepDispatchOpts, type StepError, type StepEvent, type StepHandler, type StepInterceptor, type StepInvocation, type StepKind, type StepLogger, type StepOptions, type StepRef, type StepResult, type StepScope, type StepUndo, type StoreTransaction, type SubProcessHandle, TERMINAL_RUN_STATUSES, TRANSPORT, TRANSPORT_CANONICAL, type TenantEvent, type Transport, type UndoOf, type UpdateResult, type UpdateValidator, VERSION_UNDECLARED_TAG, WORKFLOW_NAME_KEY, type WireDates, type WorkerAdjust, type WorkerConcurrencyStatus, type WorkerDescriptor, type WorkerHeartbeat, type WorkerLifecycle, type WorkerStatus, type WorkflowAnnouncement, WorkflowBlocked, type WorkflowClass, type WorkflowCommand, type WorkflowCtx, type WorkflowDecision, type WorkflowDirectory, WorkflowEngine, type WorkflowEngineDeps, type WorkflowExecutor, type WorkflowHandler, type WorkflowInputOf, type WorkflowOutputOf, type WorkflowRef, type WorkflowRegistration, type WorkflowRun, type WorkflowStartClient, type WorkflowStepEvent, WorkflowSuspended, type WorkflowTask, aggregateAnnouncements, aggregatesCheckpoints, announcementsOf, applyAttributeQuery, assertConcurrency, assertRoutes, attributeColumnFor, attributeOperand, attributePredicateOperands, axisIsRunColumn, bindWorkflowClass, breakpointToken, buildWorkflowDirectory, canRoute, capableWorkers, checkpointNameKind, checkpointStatsOf, childIdsOf, classifyWaiterToken, clearDurableExecutionWrappers, clearTerminalSingletonAdmission, codeAndDetails, codeOf, collectMetrics, concurrencyTag, controlPlaneDescriptor, countRuns, coveredTokens, createStepLogger, currentStep, currentStepScope, currentWorkflowCtx, debug, describeWorker, descriptorHash, detailsOf, error, etagMatches, eventMatchOf, eventMatches, eventNameOf, eventPrefix, eventToken, facetOrigin, fanPageBounds, fanPageEtag, findStalledRuns, foldedCount, handoffHandlerId, handoffName, hasDurableExecutionWrappers, heartbeatStatus, indexWaitersByRun, info, isEngineMintedTag, isEventToken, isFailedMember, isLegacyDescriptor, isNonEmptyRunScope, isWorkflowControlFlowSignal, legacySingletonHolders, listSignalWaitersOfRuns, liveHandoff, log, matchesAttributes, mergeRunFacetRows, mergeRunValueFacetRows, missingCapabilities, negotiate, nextCronFireMs, normalizeAttributeRows, normalizeDescriptor, observedAnnouncements, onErrorRunId, pageFan, pageFanFromStore, parentRunIdOf, parseDuration, parseWebhookToken, partitionOfToken, planDispatch, poolNamespace, prevCronFireMs, queryCheckpointsOf, readSearchAttributes, requiredCapabilities, resolveConcurrency, resolveRouting, resolveRunWaiting, retiredHandoffName, routeFor, runDetailEtag, runDurableExecution, runInStepLogger, runInStepScope, runInWorkflowCtx, runOutsideWorkflowCtx, runSchedules, runStepHandler, runValueFacetsFromRuns, sanitizeQueueToken, scheduledRunId, singletonAdmissionDenialPatch, singletonAdmissionTags, sqlComparator, stepConfigOf, stepId, stepNameOf, sub, subEvent, subProcess, summarizeFan, summarizeRunFromStore, summarizeTimeline, tenantGroup, useDurableExecution, warn, withSingletonTracked, withoutSingletonMarkers, workflowName };