@dudousxd/nestjs-durable-core 0.82.0 → 0.84.0

package/dist/index.d.cts

@@ -2877,8 +2877,8 @@ interface WorkflowCtx<A extends SearchAttributes = SearchAttributes> {
      *
      * When the workflow declares a `@Workflow({ searchAttributes })` schema, the MERGED result (this
      * run's existing `searchAttributes` shallow-merged with `attrs`) is validated against it before the
-     * write — an invalid merge throws, naming the workflow, the offending key(s), and the schema's
-     * issues. Validation runs once, on the same first-run-only position as the write itself (skipped
+     * write — an invalid merge throws a `SchemaValidationError` (code `schema_validation`, never
+     * retried) naming the workflow, with the schema's issues. Validation runs once, on the same first-run-only position as the write itself (skipped
      * entirely on replay, so it's never a source of nondeterminism); it must be synchronous — a schema
      * whose `validate` returns a `Promise` throws instead of being awaited. No schema declared ⇒
      * unchanged, unvalidated behavior.
@@ -3827,7 +3827,10 @@ declare function liveHandoff<C extends {
     seq: number;
     name: string;
 }>(runId: string, checkpoints: readonly C[]): C | undefined;
-/** The route a failure takes: the one for its exact code, else the catch-all, else none. */
+/**
+ * The route a failure takes: the one for its exact code, else (for an `invalid_input` /
+ * `invalid_output` failure) a `schema_validation` route, else the catch-all, else none.
+ */
 declare function routeFor(routes: OnErrorRoute[] | undefined, error: StepError): OnErrorRoute | undefined;
 /** Reject two routes for one code, or two catch-alls — ambiguous config, caught at registration. */
 declare function assertRoutes(workflow: string, routes: OnErrorRoute[]): void;
@@ -4064,6 +4067,85 @@ interface FindStalledRunsOptions {
  */
 declare function findStalledRuns(store: Pick<StateStore, 'listRuns' | 'listCheckpoints'>, options?: FindStalledRunsOptions): Promise<StalledRunInfo[]>;
 
+/**
+ * Layered tenant auth for the store-less cluster. On a tenant worker the `tenant` on a
+ * {@link import('./interfaces').RunRequest} / {@link import('./interfaces').StartRunMessage} is only
+ * a CLAIM: without a signed proof, any broker client can act as any tenant. This module is the
+ * default defense in depth on top of prefix/network isolation: a symmetric HMAC token the tenant
+ * worker presents IN the existing `tenant` wire field, which the operator's {@link TenantVerifier}
+ * checks and DERIVES the real tenant from, never trusting the body.
+ *
+ * Wire-compatible with Agora (`@adonis-agora/durable`) byte for byte: the token is
+ * `<claim>.<base64url(HMAC-SHA256(secret, claim))>`, where `claim` is the tenant name, optionally
+ * followed by `.exp<epochMs>`. It fits the `tenant: string` field with NO envelope change, so an
+ * operator that does not verify simply treats the whole string as the tenant name (and finds no
+ * runs, a safe failure), while an operator configured with {@link hmacTenantVerifier} verifies the
+ * signature and scopes to the embedded tenant. Agora and Aviary tokens are interchangeable.
+ *
+ * HMAC (shared secret) is the zero-infra default; a deployment that prefers asymmetric or issued
+ * tokens supplies its own {@link TenantVerifier} instead.
+ */
+/** The identity a {@link TenantVerifier} derives from a tenant's signed claim. */
+interface VerifiedTenant {
+    /** The tenant the token authenticates as. The responder trusts THIS, never the request body. */
+    tenant: string;
+    /** Capabilities the token grants, if the issuer scopes them. */
+    capabilities?: string[] | undefined;
+}
+/**
+ * Verifies a tenant's signed claim on the **operator** side, returning the {@link VerifiedTenant} it
+ * authenticates as, or `null` (or throwing) to reject a tampered/invalid/absent token. The signed
+ * token travels in the wire `tenant` field, so the responder passes that value as both `token` and
+ * the advisory `tenant`.
+ */
+type TenantVerifier = (input: {
+    /** The signed token presented on the request. */
+    token?: string | undefined;
+    /** The tenant the request *claims* to be. Advisory only: the verifier derives the real one. */
+    tenant?: string | undefined;
+}) => VerifiedTenant | null | Promise<VerifiedTenant | null>;
+/**
+ * Where the tenant side gets the token it presents: a static string, or a function called before
+ * every request (so a short-lived token from {@link signTenantToken} with `ttlMs` can be re-minted
+ * or fetched from a secret store without restarting the worker).
+ */
+type TenantTokenSource = string | (() => string | Promise<string>);
+/**
+ * Mint the signed token a tenant worker presents:
+ * `` `${tenant}.${base64url(HMAC-SHA256(secret, tenant))}` ``. The worker carries only the token
+ * (never the secret); the operator verifies it with the SAME `secret` via {@link hmacTenantVerifier}.
+ */
+declare function signTenantToken(tenant: string, secret: string, opts?: {
+    /**
+     * Optional lifetime: the claim gains a `.exp<epochMs>` suffix, signed together with the tenant,
+     * and {@link hmacTenantVerifier} rejects the token once that instant passes. Without it the
+     * token never expires. Expiring and non-expiring tokens verify side by side. Tenant names
+     * ending in `.exp<digits>` are reserved by this scheme.
+     */
+    ttlMs?: number;
+    /** Injectable clock for tests. */
+    now?: number;
+}): string;
+/**
+ * Build the operator-side {@link TenantVerifier} for {@link signTenantToken} tokens under `secret`.
+ * It recomputes the HMAC over the embedded claim and compares it in constant time, so a tampered
+ * tenant, a forged/absent signature, a token signed with another secret, or an expired token all
+ * return `null`. The tenant is DERIVED from the token's own claim.
+ *
+ * A LIST of secrets makes rotation a two-step deploy: verify with `[next, current]` everywhere first,
+ * then re-mint tenant tokens with `next` at leisure. `capabilities`, if given, is a static grant
+ * stamped onto every {@link VerifiedTenant} this verifier authenticates.
+ */
+declare function hmacTenantVerifier(secret: string | string[], capabilities?: string[]): TenantVerifier;
+/**
+ * Resolve the tenant a wire message is ALLOWED to act as. With a verifier, the wire `tenant` is the
+ * signed token: it is verified and the real tenant derived from it (`null` on reject). Without one,
+ * the wire value is trusted verbatim (prefix/network isolation only, today's behaviour).
+ */
+declare function resolveWireTenant(wireTenant: string, verifyTenant: TenantVerifier | undefined): Promise<string | null>;
+/** Resolve a {@link TenantTokenSource} to the token string to put on the wire. */
+declare function resolveTenantToken(source: TenantTokenSource): Promise<string>;
+
 type WorkflowFn = (ctx: InternalWorkflowCtx, input: unknown) => Promise<unknown>;
 /**
  * Options for {@link WorkflowEngine.start}.
@@ -4207,6 +4289,13 @@ interface WorkflowEngineDeps {
      * plane: "ver tudo = ausência de namespace".
      */
     namespace?: string | undefined;
+    /**
+     * Verifies the signed tenant token a store-less tenant worker presents in the `tenant` field of a
+     * {@link StartRunMessage}, and DERIVES the run's namespace from it (see `hmacTenantVerifier`).
+     * A message whose token is rejected (or whose verifier throws) is dropped without creating a run.
+     * Absent: the wire `tenant` is trusted verbatim, as before.
+     */
+    verifyTenant?: TenantVerifier | undefined;
     /** Recovery lease duration in ms — how long this instance owns a run it picked up. Default 30s. */
     leaseMs?: number | undefined;
     /**
@@ -4847,6 +4936,8 @@ declare class WorkflowEngine {
      * between this call and `drain()` (other hooks, the HTTP server closing) never is. Calls add up.
      */
     beginDrain(spentMs?: number): void;
+    /** True once {@link beginDrain} (or {@link drain}) has been called. */
+    isDraining(): boolean;
     /**
      * Graceful shutdown: stop picking up new runs (recovery/timer become no-ops) and wait for
      * in-flight executions to settle, up to `timeoutMs`. Call from your app's shutdown hook so a
@@ -5966,6 +6057,44 @@ declare class FatalError extends Error {
     readonly retryable = false;
     constructor(message: string, code?: string, details?: unknown);
 }
+/** One schema issue in JSON-safe form: its message and the path segments, as strings. */
+interface SchemaIssue {
+    message: string;
+    path: string[];
+}
+/**
+ * The code a {@link SchemaValidationError} carries: `invalid_input` for an input schema (a
+ * workflow's or a step's), `invalid_output` for an output schema, `schema_validation` for anything
+ * else (a typed `searchAttributes` write). The same codes `@adonis-agora/durable` uses.
+ */
+type SchemaValidationCode = 'invalid_input' | 'invalid_output' | 'schema_validation';
+/**
+ * Thrown when a value fails a schema the app declared: `@Workflow({ input, output })`,
+ * `@Step({ input, output })`, or the workflow's typed `searchAttributes`. A {@link FatalError}, so it
+ * is NOT retried — retrying cannot fix a value that doesn't match its schema. Its `code` says which
+ * schema rejected the value ({@link SchemaValidationCode}). `issues` (also `details.issues`, so it
+ * survives the transport to the run's error and an onError handler's input) lists every issue with
+ * a JSON-safe `path`. Route one code with `onError: [{ code: 'invalid_input', workflow }]`, or all
+ * three with `onError: [{ code: SchemaValidationError, workflow }]`: its `static code`,
+ * `schema_validation`, also catches an `invalid_input` or `invalid_output` no route of its own
+ * matches. Same class, codes, message and `details` as `@adonis-agora/durable`.
+ */
+declare class SchemaValidationError extends FatalError {
+    static readonly code = "schema_validation";
+    readonly issues: SchemaIssue[];
+    /**
+     * @param label What was validated, e.g. `workflow "checkout" input`; the message is
+     *   `invalid <label>: <path>: <message>; …`.
+     * @param summary Overrides the `<path>: <message>; …` part, for issues whose messages already
+     *   name their field (class-validator's `orderId must be a string`).
+     */
+    constructor(label: string, issues: ReadonlyArray<{
+        readonly message: string;
+        readonly path?: ReadonlyArray<PropertyKey | {
+            readonly key: PropertyKey;
+        }> | undefined;
+    }>, code?: SchemaValidationCode, summary?: string);
+}
 /**
  * Thrown by `start` when a run would exceed its concurrency quota: `active` runs sharing the quota
  * `key` are already in flight (in the quota's counted statuses) and the `limit` is `limit`. Nothing
@@ -6634,11 +6763,20 @@ type Subscribable = {
  */
 declare function collectMetrics(engine: Subscribable): MetricsCollector;
 
-interface ScheduledWorkflow {
+/**
+ * A recurring start of `workflow`, fired on a fixed interval or a cron.
+ *
+ * `workflow` is a registered name or a `@Workflow` class. A class types `input` against its `run`;
+ * annotate the schedule to get that check, as in
+ * `const nightly: ScheduledWorkflow<typeof ReportWorkflow> = { workflow: ReportWorkflow, … }`.
+ */
+interface ScheduledWorkflow<W extends WorkflowRef = WorkflowRef> {
     /** Stable key identifying this schedule — part of the deterministic run id. */
     key: string;
-    workflow: string;
-    input?: unknown;
+    /** The workflow to start: a registered name (any runtime) or a `@Workflow` class. */
+    workflow: W;
+    /** The input every run starts with — typed against `run` when `workflow` is a class. */
+    input?: WorkflowInputOf<W>;
     /** Start one run every `everyMs`. Mutually exclusive with `cron`. */
     everyMs?: number;
     /**
@@ -6676,6 +6814,16 @@ interface ScheduledWorkflow {
     backfill?: {
         maxCatchup: number;
     };
+    /**
+     * The namespace this schedule's runs are stamped with, overriding the ticking engine's own. Opt-in;
+     * absent = the run gets the namespace of whichever engine fired it.
+     *
+     * The run id is a time bucket, so the instance that wins the race to fire a window decides which
+     * namespace (worker pool) the run lands in. When the workflow can only run in one pool — its steps
+     * need a capability only that pool's workers have — pin it here, so whoever fires the window, the
+     * run is stamped for (and only picked up by) that pool.
+     */
+    namespace?: string;
 }
 /** Injectable dispatch-path effects (kept out of the deterministic run-id logic). Defaults to real
  *  `Math.random` + `setTimeout`; overridden in tests so jitter is deterministic and instant. */
@@ -6697,14 +6845,23 @@ declare function prevCronFireMs(expr: string, nowMs: number, timezone?: string):
  * schedule is next due.
  */
 declare function nextCronFireMs(expr: string, afterMs: number, timezone?: string): number;
+/**
+ * The deterministic, idempotent run id for a schedule at `nowMs` — its current fire window
+ * (`sched:<key>:<bucket>`, the bucket being a fixed-interval index or the cron fire time). Pass the
+ * same `ScheduledWorkflow` you registered to look a window's run up, e.g.
+ * `engine.getRun(scheduleRunIdAt(dailyReport, Date.now()))`, rather than rebuilding the id by hand.
+ */
+declare function scheduleRunIdAt(s: ScheduledWorkflow, nowMs: number): string;
 /**
  * Start each schedule's current-window run. The run id is the time bucket (a fixed-interval index,
  * or the cron fire time) and `engine.start` is idempotent, so firing this on an interval — or
  * racing two instances on the same tick — starts **each window exactly once**. Wire it to a
- * `setInterval`, the durable timer poller, or `@nestjs/schedule`. Returns the run ids for the
- * current windows.
+ * `setInterval`, the durable timer poller, or `@nestjs/schedule`. Returns the run ids this call
+ * started: a window that already has a run is not started or returned again, and once this process
+ * has seen a window's run exist, later calls in that window skip it without a store read or a
+ * jitter sleep.
  */
-declare function runSchedules(engine: Pick<WorkflowEngine, 'start' | 'getRun'>, schedules: readonly ScheduledWorkflow[], nowMs: number, opts?: RunSchedulesOptions): Promise<string[]>;
+declare function runSchedules(engine: Pick<WorkflowEngine, 'start' | 'getRun'> & Partial<Pick<WorkflowEngine, 'isDraining'>>, schedules: readonly ScheduledWorkflow[], nowMs: number, opts?: RunSchedulesOptions): Promise<string[]>;
 
 /**
  * A {@link StepLogger} that appends to `events`, stamping each line with `now()`. Shared by the
@@ -7117,4 +7274,4 @@ declare function singletonAdmissionDenialPatch(runs: WorkflowRun[], runId: strin
     updatedAt: Date;
 } | undefined;
 
-export { type AccumulatorHost, type Admission, type AdmissionBackend, type AdmissionItem, type AllOptions, type AllSettledOptions, type AllStepsOptions, type AllStepsSettledOptions, type AnnouncedWorkflow, type AnnouncementEvidence, type AttributeFilter, type AttributeOp, type AttributePredicateOperand, type AttributeValue, type BackoffStrategy, type BlockedDispatch, type BlockedResolution, CHILD_EDGE_PREFIXES, CONTROL_FLOW_SIGNAL, CURRENT_PROTOCOL_VERSION, type CapabilityRequirement, type CheckpointAggregatingStore, type CheckpointNameKind, type CheckpointQuery, type CheckpointStat, type ChildCallOptions, type ChildWait, CodecStateStore, type CodecStateStoreOptions, type ConcurrencyConfig, ConcurrencyLimitError, type ConcurrencyQuota, ContinueAsNew, type ControlMessage, type ControlPlane, DEFAULT_CONCURRENCY_STATUSES, DEFAULT_PARTITION, DEFAULT_STALLED_AFTER_MS, DURABLE_OPTIONS, DURABLE_OPTIONS_CANONICAL, DURABLE_STEP_CONFIG, DURABLE_STEP_NAME, type Disagreement, type DispatchDiagnostics, type DispatchPlan, type DurableExecution, type DurableExecutionWrapper, type DurableTopology, type DurableWebhook, DurableWorkflow, type DynamicWorkflowCtx, ENGINE_MINTED_TAG_PREFIXES, ENTITY_WORKFLOW, EVENT_BUFFER_SCAN_LIMIT, EVENT_TOKEN_PREFIX, type EngineEvent, type EngineEventType, type EngineListener, Entities, type EntityConfig, type EntityHandler, type EntityHost, type EntityWorkflowHost, EventAccumulators, type EventBatchConfig, FAN_SUMMARY_FAILURES, type FanJoin, type FanPage, type FanPageQuery, type FanSummary, type FanWait, FatalError, type FindStalledRunsOptions, GatherError, type GatherItemFailure, type GroupHealth, HANDOFF_SEQ_BASE, type Heartbeat, type HeartbeatSighting, type HeartbeatStatus, type HistoryEvent, InMemoryAdmissionBackend, InMemoryStateStore, InMemoryTransport, type InferSearchAttributes, LEGACY_V1_CAPABILITIES, LEGACY_V1_PROTOCOL, type ListStalledRunsOptions, type MetricsCollector, type MetricsSnapshot, type NamedTransport, type NegotiateOptions, type NegotiationOutcome, type NegotiationReason, type NegotiationResult, NestedWorkflowCallError, NonDeterminismError, type OnErrorInput, type OnErrorRoute, type OwnedLeaseReclaim, type PartitionSighting, type PayloadCodec, type QueueConfig, QueueController, RUN_HISTORY_FIXTURE_VERSION, RUN_VALUE_FACET_LIMIT, RUN_VALUE_FACET_SCAN, type RawWorkerDescriptor, RemoteStepError, RemoteStepTimeout, type RemoteTask, RemoteWorkflowExecutor, RemoteWorkflowTimeout, type RetentionPolicy, type RoutableDispatch, type RoutableResolution, type RoutingResolution, type RunAttributeRow, type RunDetail, type RunDetailOptions, type RunDispatcher, type RunFacetQuery, type RunFacetRow, RunGateway, type RunListItem, type RunQuery, type RunReply, type RunReplyResult, type RunRequest, type RunRequestKind, type RunResult, type RunSchedulesOptions, type RunScope, type RunStatus, type RunValueAxis, type RunValueFacetOptions, type RunValueFacetOrder, type RunValueFacetRow, type RunWaiting, SINGLETON_ACTIVE_STATUSES, SINGLETON_ADMITTED_TAG, SINGLETON_RESERVED_TAGS, SINGLETON_TRACKED_TAG, STATE_STORE, STATE_STORE_CANONICAL, SUMMARY_CHILD_LIMIT, type ScalarAttributeFilter, ScheduleAlreadyExistsError, ScheduleClient, type ScheduleClientOptions, type ScheduleDescription, type ScheduleHost, type ScheduleListQuery, ScheduleNotFoundError, type ScheduleOptions, type ScheduleQuery, type ScheduleRecord, type ScheduledWorkflow, type SearchAttributes, type SearchAttributesSchema, type Settled, SignalTimeoutError, type SignalWaiter, type SingletonConfig, SingletonQueueFullError, type StalePendingStep, type StalledRunInfo, StandardSchemaV1, type StartOptions, type StartRunMessage, type StateStore, type StepCheckpoint, type StepConfig, type StepDef, type StepDispatchOpts, type StepError, type StepEvent, type StepHandler, type StepInterceptor, type StepInvocation, type StepKind, type StepLogger, type StepOptions, type StepRef, type StepResult, type StepScope, type StepUndo, type StoreTransaction, type SubProcessHandle, TERMINAL_RUN_STATUSES, TRANSPORT, TRANSPORT_CANONICAL, type TenantEvent, type Transport, type UndoOf, type UpdateResult, type UpdateValidator, VERSION_UNDECLARED_TAG, WORKFLOW_NAME_KEY, type WireDates, type WorkerAdjust, type WorkerConcurrencyStatus, type WorkerDescriptor, type WorkerHeartbeat, type WorkerLifecycle, type WorkerStatus, type WorkflowAnnouncement, WorkflowBlocked, type WorkflowClass, type WorkflowCommand, type WorkflowCtx, type WorkflowDecision, type WorkflowDirectory, WorkflowEngine, type WorkflowEngineDeps, type WorkflowExecutor, type WorkflowHandler, type WorkflowInputOf, type WorkflowOutputOf, type WorkflowRef, type WorkflowRegistration, type WorkflowRun, type WorkflowStartClient, type WorkflowStepEvent, WorkflowSuspended, type WorkflowTask, aggregateAnnouncements, aggregatesCheckpoints, announcementsOf, applyAttributeQuery, assertConcurrency, assertRoutes, attributeColumnFor, attributeOperand, attributePredicateOperands, axisIsRunColumn, bindWorkflowClass, breakpointToken, buildWorkflowDirectory, canRoute, capableWorkers, checkpointNameKind, checkpointStatsOf, childIdsOf, classifyWaiterToken, clearDurableExecutionWrappers, clearTerminalSingletonAdmission, codeAndDetails, codeOf, collectMetrics, concurrencyTag, controlPlaneDescriptor, countRuns, coveredTokens, createStepLogger, currentStep, currentStepScope, currentWorkflowCtx, debug, describeWorker, descriptorHash, detailsOf, error, etagMatches, eventMatchOf, eventMatches, eventNameOf, eventPrefix, eventToken, facetOrigin, fanPageBounds, fanPageEtag, findStalledRuns, foldedCount, handoffHandlerId, handoffName, hasDurableExecutionWrappers, heartbeatStatus, indexWaitersByRun, info, isEngineMintedTag, isEventToken, isFailedMember, isLegacyDescriptor, isNonEmptyRunScope, isWorkflowControlFlowSignal, legacySingletonHolders, listSignalWaitersOfRuns, liveHandoff, log, matchesAttributes, mergeRunFacetRows, mergeRunValueFacetRows, missingCapabilities, negotiate, nextCronFireMs, normalizeAttributeRows, normalizeDescriptor, observedAnnouncements, onErrorRunId, pageFan, pageFanFromStore, parentRunIdOf, parseDuration, parseWebhookToken, partitionOfToken, planDispatch, poolNamespace, prevCronFireMs, queryCheckpointsOf, readSearchAttributes, requiredCapabilities, resolveConcurrency, resolveRouting, resolveRunWaiting, retiredHandoffName, routeFor, runDetailEtag, runDurableExecution, runInStepLogger, runInStepScope, runInWorkflowCtx, runOutsideWorkflowCtx, runSchedules, runStepHandler, runValueFacetsFromRuns, sanitizeQueueToken, scheduledRunId, singletonAdmissionDenialPatch, singletonAdmissionTags, sqlComparator, stepConfigOf, stepId, stepNameOf, sub, subEvent, subProcess, summarizeFan, summarizeRunFromStore, summarizeTimeline, tenantGroup, useDurableExecution, warn, withSingletonTracked, withoutSingletonMarkers, workflowName };
+export { type AccumulatorHost, type Admission, type AdmissionBackend, type AdmissionItem, type AllOptions, type AllSettledOptions, type AllStepsOptions, type AllStepsSettledOptions, type AnnouncedWorkflow, type AnnouncementEvidence, type AttributeFilter, type AttributeOp, type AttributePredicateOperand, type AttributeValue, type BackoffStrategy, type BlockedDispatch, type BlockedResolution, CHILD_EDGE_PREFIXES, CONTROL_FLOW_SIGNAL, CURRENT_PROTOCOL_VERSION, type CapabilityRequirement, type CheckpointAggregatingStore, type CheckpointNameKind, type CheckpointQuery, type CheckpointStat, type ChildCallOptions, type ChildWait, CodecStateStore, type CodecStateStoreOptions, type ConcurrencyConfig, ConcurrencyLimitError, type ConcurrencyQuota, ContinueAsNew, type ControlMessage, type ControlPlane, DEFAULT_CONCURRENCY_STATUSES, DEFAULT_PARTITION, DEFAULT_STALLED_AFTER_MS, DURABLE_OPTIONS, DURABLE_OPTIONS_CANONICAL, DURABLE_STEP_CONFIG, DURABLE_STEP_NAME, type Disagreement, type DispatchDiagnostics, type DispatchPlan, type DurableExecution, type DurableExecutionWrapper, type DurableTopology, type DurableWebhook, DurableWorkflow, type DynamicWorkflowCtx, ENGINE_MINTED_TAG_PREFIXES, ENTITY_WORKFLOW, EVENT_BUFFER_SCAN_LIMIT, EVENT_TOKEN_PREFIX, type EngineEvent, type EngineEventType, type EngineListener, Entities, type EntityConfig, type EntityHandler, type EntityHost, type EntityWorkflowHost, EventAccumulators, type EventBatchConfig, FAN_SUMMARY_FAILURES, type FanJoin, type FanPage, type FanPageQuery, type FanSummary, type FanWait, FatalError, type FindStalledRunsOptions, GatherError, type GatherItemFailure, type GroupHealth, HANDOFF_SEQ_BASE, type Heartbeat, type HeartbeatSighting, type HeartbeatStatus, type HistoryEvent, InMemoryAdmissionBackend, InMemoryStateStore, InMemoryTransport, type InferSearchAttributes, LEGACY_V1_CAPABILITIES, LEGACY_V1_PROTOCOL, type ListStalledRunsOptions, type MetricsCollector, type MetricsSnapshot, type NamedTransport, type NegotiateOptions, type NegotiationOutcome, type NegotiationReason, type NegotiationResult, NestedWorkflowCallError, NonDeterminismError, type OnErrorInput, type OnErrorRoute, type OwnedLeaseReclaim, type PartitionSighting, type PayloadCodec, type QueueConfig, QueueController, RUN_HISTORY_FIXTURE_VERSION, RUN_VALUE_FACET_LIMIT, RUN_VALUE_FACET_SCAN, type RawWorkerDescriptor, RemoteStepError, RemoteStepTimeout, type RemoteTask, RemoteWorkflowExecutor, RemoteWorkflowTimeout, type RetentionPolicy, type RoutableDispatch, type RoutableResolution, type RoutingResolution, type RunAttributeRow, type RunDetail, type RunDetailOptions, type RunDispatcher, type RunFacetQuery, type RunFacetRow, RunGateway, type RunListItem, type RunQuery, type RunReply, type RunReplyResult, type RunRequest, type RunRequestKind, type RunResult, type RunSchedulesOptions, type RunScope, type RunStatus, type RunValueAxis, type RunValueFacetOptions, type RunValueFacetOrder, type RunValueFacetRow, type RunWaiting, SINGLETON_ACTIVE_STATUSES, SINGLETON_ADMITTED_TAG, SINGLETON_RESERVED_TAGS, SINGLETON_TRACKED_TAG, STATE_STORE, STATE_STORE_CANONICAL, SUMMARY_CHILD_LIMIT, type ScalarAttributeFilter, ScheduleAlreadyExistsError, ScheduleClient, type ScheduleClientOptions, type ScheduleDescription, type ScheduleHost, type ScheduleListQuery, ScheduleNotFoundError, type ScheduleOptions, type ScheduleQuery, type ScheduleRecord, type ScheduledWorkflow, type SchemaIssue, type SchemaValidationCode, SchemaValidationError, type SearchAttributes, type SearchAttributesSchema, type Settled, SignalTimeoutError, type SignalWaiter, type SingletonConfig, SingletonQueueFullError, type StalePendingStep, type StalledRunInfo, StandardSchemaV1, type StartOptions, type StartRunMessage, type StateStore, type StepCheckpoint, type StepConfig, type StepDef, type StepDispatchOpts, type StepError, type StepEvent, type StepHandler, type StepInterceptor, type StepInvocation, type StepKind, type StepLogger, type StepOptions, type StepRef, type StepResult, type StepScope, type StepUndo, type StoreTransaction, type SubProcessHandle, TERMINAL_RUN_STATUSES, TRANSPORT, TRANSPORT_CANONICAL, type TenantEvent, type TenantTokenSource, type TenantVerifier, type Transport, type UndoOf, type UpdateResult, type UpdateValidator, VERSION_UNDECLARED_TAG, type VerifiedTenant, WORKFLOW_NAME_KEY, type WireDates, type WorkerAdjust, type WorkerConcurrencyStatus, type WorkerDescriptor, type WorkerHeartbeat, type WorkerLifecycle, type WorkerStatus, type WorkflowAnnouncement, WorkflowBlocked, type WorkflowClass, type WorkflowCommand, type WorkflowCtx, type WorkflowDecision, type WorkflowDirectory, WorkflowEngine, type WorkflowEngineDeps, type WorkflowExecutor, type WorkflowHandler, type WorkflowInputOf, type WorkflowOutputOf, type WorkflowRef, type WorkflowRegistration, type WorkflowRun, type WorkflowStartClient, type WorkflowStepEvent, WorkflowSuspended, type WorkflowTask, aggregateAnnouncements, aggregatesCheckpoints, announcementsOf, applyAttributeQuery, assertConcurrency, assertRoutes, attributeColumnFor, attributeOperand, attributePredicateOperands, axisIsRunColumn, bindWorkflowClass, breakpointToken, buildWorkflowDirectory, canRoute, capableWorkers, checkpointNameKind, checkpointStatsOf, childIdsOf, classifyWaiterToken, clearDurableExecutionWrappers, clearTerminalSingletonAdmission, codeAndDetails, codeOf, collectMetrics, concurrencyTag, controlPlaneDescriptor, countRuns, coveredTokens, createStepLogger, currentStep, currentStepScope, currentWorkflowCtx, debug, describeWorker, descriptorHash, detailsOf, error, etagMatches, eventMatchOf, eventMatches, eventNameOf, eventPrefix, eventToken, facetOrigin, fanPageBounds, fanPageEtag, findStalledRuns, foldedCount, handoffHandlerId, handoffName, hasDurableExecutionWrappers, heartbeatStatus, hmacTenantVerifier, indexWaitersByRun, info, isEngineMintedTag, isEventToken, isFailedMember, isLegacyDescriptor, isNonEmptyRunScope, isWorkflowControlFlowSignal, legacySingletonHolders, listSignalWaitersOfRuns, liveHandoff, log, matchesAttributes, mergeRunFacetRows, mergeRunValueFacetRows, missingCapabilities, negotiate, nextCronFireMs, normalizeAttributeRows, normalizeDescriptor, observedAnnouncements, onErrorRunId, pageFan, pageFanFromStore, parentRunIdOf, parseDuration, parseWebhookToken, partitionOfToken, planDispatch, poolNamespace, prevCronFireMs, queryCheckpointsOf, readSearchAttributes, requiredCapabilities, resolveConcurrency, resolveRouting, resolveRunWaiting, resolveTenantToken, resolveWireTenant, retiredHandoffName, routeFor, runDetailEtag, runDurableExecution, runInStepLogger, runInStepScope, runInWorkflowCtx, runOutsideWorkflowCtx, runSchedules, runStepHandler, runValueFacetsFromRuns, sanitizeQueueToken, scheduleRunIdAt, scheduledRunId, signTenantToken, singletonAdmissionDenialPatch, singletonAdmissionTags, sqlComparator, stepConfigOf, stepId, stepNameOf, sub, subEvent, subProcess, summarizeFan, summarizeRunFromStore, summarizeTimeline, tenantGroup, useDurableExecution, warn, withSingletonTracked, withoutSingletonMarkers, workflowName };

package/dist/index.d.ts

@@ -2877,8 +2877,8 @@ interface WorkflowCtx<A extends SearchAttributes = SearchAttributes> {
      *
      * When the workflow declares a `@Workflow({ searchAttributes })` schema, the MERGED result (this
      * run's existing `searchAttributes` shallow-merged with `attrs`) is validated against it before the
-     * write — an invalid merge throws, naming the workflow, the offending key(s), and the schema's
-     * issues. Validation runs once, on the same first-run-only position as the write itself (skipped
+     * write — an invalid merge throws a `SchemaValidationError` (code `schema_validation`, never
+     * retried) naming the workflow, with the schema's issues. Validation runs once, on the same first-run-only position as the write itself (skipped
      * entirely on replay, so it's never a source of nondeterminism); it must be synchronous — a schema
      * whose `validate` returns a `Promise` throws instead of being awaited. No schema declared ⇒
      * unchanged, unvalidated behavior.
@@ -3827,7 +3827,10 @@ declare function liveHandoff<C extends {
     seq: number;
     name: string;
 }>(runId: string, checkpoints: readonly C[]): C | undefined;
-/** The route a failure takes: the one for its exact code, else the catch-all, else none. */
+/**
+ * The route a failure takes: the one for its exact code, else (for an `invalid_input` /
+ * `invalid_output` failure) a `schema_validation` route, else the catch-all, else none.
+ */
 declare function routeFor(routes: OnErrorRoute[] | undefined, error: StepError): OnErrorRoute | undefined;
 /** Reject two routes for one code, or two catch-alls — ambiguous config, caught at registration. */
 declare function assertRoutes(workflow: string, routes: OnErrorRoute[]): void;
@@ -4064,6 +4067,85 @@ interface FindStalledRunsOptions {
  */
 declare function findStalledRuns(store: Pick<StateStore, 'listRuns' | 'listCheckpoints'>, options?: FindStalledRunsOptions): Promise<StalledRunInfo[]>;
 
+/**
+ * Layered tenant auth for the store-less cluster. On a tenant worker the `tenant` on a
+ * {@link import('./interfaces').RunRequest} / {@link import('./interfaces').StartRunMessage} is only
+ * a CLAIM: without a signed proof, any broker client can act as any tenant. This module is the
+ * default defense in depth on top of prefix/network isolation: a symmetric HMAC token the tenant
+ * worker presents IN the existing `tenant` wire field, which the operator's {@link TenantVerifier}
+ * checks and DERIVES the real tenant from, never trusting the body.
+ *
+ * Wire-compatible with Agora (`@adonis-agora/durable`) byte for byte: the token is
+ * `<claim>.<base64url(HMAC-SHA256(secret, claim))>`, where `claim` is the tenant name, optionally
+ * followed by `.exp<epochMs>`. It fits the `tenant: string` field with NO envelope change, so an
+ * operator that does not verify simply treats the whole string as the tenant name (and finds no
+ * runs, a safe failure), while an operator configured with {@link hmacTenantVerifier} verifies the
+ * signature and scopes to the embedded tenant. Agora and Aviary tokens are interchangeable.
+ *
+ * HMAC (shared secret) is the zero-infra default; a deployment that prefers asymmetric or issued
+ * tokens supplies its own {@link TenantVerifier} instead.
+ */
+/** The identity a {@link TenantVerifier} derives from a tenant's signed claim. */
+interface VerifiedTenant {
+    /** The tenant the token authenticates as. The responder trusts THIS, never the request body. */
+    tenant: string;
+    /** Capabilities the token grants, if the issuer scopes them. */
+    capabilities?: string[] | undefined;
+}
+/**
+ * Verifies a tenant's signed claim on the **operator** side, returning the {@link VerifiedTenant} it
+ * authenticates as, or `null` (or throwing) to reject a tampered/invalid/absent token. The signed
+ * token travels in the wire `tenant` field, so the responder passes that value as both `token` and
+ * the advisory `tenant`.
+ */
+type TenantVerifier = (input: {
+    /** The signed token presented on the request. */
+    token?: string | undefined;
+    /** The tenant the request *claims* to be. Advisory only: the verifier derives the real one. */
+    tenant?: string | undefined;
+}) => VerifiedTenant | null | Promise<VerifiedTenant | null>;
+/**
+ * Where the tenant side gets the token it presents: a static string, or a function called before
+ * every request (so a short-lived token from {@link signTenantToken} with `ttlMs` can be re-minted
+ * or fetched from a secret store without restarting the worker).
+ */
+type TenantTokenSource = string | (() => string | Promise<string>);
+/**
+ * Mint the signed token a tenant worker presents:
+ * `` `${tenant}.${base64url(HMAC-SHA256(secret, tenant))}` ``. The worker carries only the token
+ * (never the secret); the operator verifies it with the SAME `secret` via {@link hmacTenantVerifier}.
+ */
+declare function signTenantToken(tenant: string, secret: string, opts?: {
+    /**
+     * Optional lifetime: the claim gains a `.exp<epochMs>` suffix, signed together with the tenant,
+     * and {@link hmacTenantVerifier} rejects the token once that instant passes. Without it the
+     * token never expires. Expiring and non-expiring tokens verify side by side. Tenant names
+     * ending in `.exp<digits>` are reserved by this scheme.
+     */
+    ttlMs?: number;
+    /** Injectable clock for tests. */
+    now?: number;
+}): string;
+/**
+ * Build the operator-side {@link TenantVerifier} for {@link signTenantToken} tokens under `secret`.
+ * It recomputes the HMAC over the embedded claim and compares it in constant time, so a tampered
+ * tenant, a forged/absent signature, a token signed with another secret, or an expired token all
+ * return `null`. The tenant is DERIVED from the token's own claim.
+ *
+ * A LIST of secrets makes rotation a two-step deploy: verify with `[next, current]` everywhere first,
+ * then re-mint tenant tokens with `next` at leisure. `capabilities`, if given, is a static grant
+ * stamped onto every {@link VerifiedTenant} this verifier authenticates.
+ */
+declare function hmacTenantVerifier(secret: string | string[], capabilities?: string[]): TenantVerifier;
+/**
+ * Resolve the tenant a wire message is ALLOWED to act as. With a verifier, the wire `tenant` is the
+ * signed token: it is verified and the real tenant derived from it (`null` on reject). Without one,
+ * the wire value is trusted verbatim (prefix/network isolation only, today's behaviour).
+ */
+declare function resolveWireTenant(wireTenant: string, verifyTenant: TenantVerifier | undefined): Promise<string | null>;
+/** Resolve a {@link TenantTokenSource} to the token string to put on the wire. */
+declare function resolveTenantToken(source: TenantTokenSource): Promise<string>;
+
 type WorkflowFn = (ctx: InternalWorkflowCtx, input: unknown) => Promise<unknown>;
 /**
  * Options for {@link WorkflowEngine.start}.
@@ -4207,6 +4289,13 @@ interface WorkflowEngineDeps {
      * plane: "ver tudo = ausência de namespace".
      */
     namespace?: string | undefined;
+    /**
+     * Verifies the signed tenant token a store-less tenant worker presents in the `tenant` field of a
+     * {@link StartRunMessage}, and DERIVES the run's namespace from it (see `hmacTenantVerifier`).
+     * A message whose token is rejected (or whose verifier throws) is dropped without creating a run.
+     * Absent: the wire `tenant` is trusted verbatim, as before.
+     */
+    verifyTenant?: TenantVerifier | undefined;
     /** Recovery lease duration in ms — how long this instance owns a run it picked up. Default 30s. */
     leaseMs?: number | undefined;
     /**
@@ -4847,6 +4936,8 @@ declare class WorkflowEngine {
      * between this call and `drain()` (other hooks, the HTTP server closing) never is. Calls add up.
      */
     beginDrain(spentMs?: number): void;
+    /** True once {@link beginDrain} (or {@link drain}) has been called. */
+    isDraining(): boolean;
     /**
      * Graceful shutdown: stop picking up new runs (recovery/timer become no-ops) and wait for
      * in-flight executions to settle, up to `timeoutMs`. Call from your app's shutdown hook so a
@@ -5966,6 +6057,44 @@ declare class FatalError extends Error {
     readonly retryable = false;
     constructor(message: string, code?: string, details?: unknown);
 }
+/** One schema issue in JSON-safe form: its message and the path segments, as strings. */
+interface SchemaIssue {
+    message: string;
+    path: string[];
+}
+/**
+ * The code a {@link SchemaValidationError} carries: `invalid_input` for an input schema (a
+ * workflow's or a step's), `invalid_output` for an output schema, `schema_validation` for anything
+ * else (a typed `searchAttributes` write). The same codes `@adonis-agora/durable` uses.
+ */
+type SchemaValidationCode = 'invalid_input' | 'invalid_output' | 'schema_validation';
+/**
+ * Thrown when a value fails a schema the app declared: `@Workflow({ input, output })`,
+ * `@Step({ input, output })`, or the workflow's typed `searchAttributes`. A {@link FatalError}, so it
+ * is NOT retried — retrying cannot fix a value that doesn't match its schema. Its `code` says which
+ * schema rejected the value ({@link SchemaValidationCode}). `issues` (also `details.issues`, so it
+ * survives the transport to the run's error and an onError handler's input) lists every issue with
+ * a JSON-safe `path`. Route one code with `onError: [{ code: 'invalid_input', workflow }]`, or all
+ * three with `onError: [{ code: SchemaValidationError, workflow }]`: its `static code`,
+ * `schema_validation`, also catches an `invalid_input` or `invalid_output` no route of its own
+ * matches. Same class, codes, message and `details` as `@adonis-agora/durable`.
+ */
+declare class SchemaValidationError extends FatalError {
+    static readonly code = "schema_validation";
+    readonly issues: SchemaIssue[];
+    /**
+     * @param label What was validated, e.g. `workflow "checkout" input`; the message is
+     *   `invalid <label>: <path>: <message>; …`.
+     * @param summary Overrides the `<path>: <message>; …` part, for issues whose messages already
+     *   name their field (class-validator's `orderId must be a string`).
+     */
+    constructor(label: string, issues: ReadonlyArray<{
+        readonly message: string;
+        readonly path?: ReadonlyArray<PropertyKey | {
+            readonly key: PropertyKey;
+        }> | undefined;
+    }>, code?: SchemaValidationCode, summary?: string);
+}
 /**
  * Thrown by `start` when a run would exceed its concurrency quota: `active` runs sharing the quota
  * `key` are already in flight (in the quota's counted statuses) and the `limit` is `limit`. Nothing
@@ -6634,11 +6763,20 @@ type Subscribable = {
  */
 declare function collectMetrics(engine: Subscribable): MetricsCollector;
 
-interface ScheduledWorkflow {
+/**
+ * A recurring start of `workflow`, fired on a fixed interval or a cron.
+ *
+ * `workflow` is a registered name or a `@Workflow` class. A class types `input` against its `run`;
+ * annotate the schedule to get that check, as in
+ * `const nightly: ScheduledWorkflow<typeof ReportWorkflow> = { workflow: ReportWorkflow, … }`.
+ */
+interface ScheduledWorkflow<W extends WorkflowRef = WorkflowRef> {
     /** Stable key identifying this schedule — part of the deterministic run id. */
     key: string;
-    workflow: string;
-    input?: unknown;
+    /** The workflow to start: a registered name (any runtime) or a `@Workflow` class. */
+    workflow: W;
+    /** The input every run starts with — typed against `run` when `workflow` is a class. */
+    input?: WorkflowInputOf<W>;
     /** Start one run every `everyMs`. Mutually exclusive with `cron`. */
     everyMs?: number;
     /**
@@ -6676,6 +6814,16 @@ interface ScheduledWorkflow {
     backfill?: {
         maxCatchup: number;
     };
+    /**
+     * The namespace this schedule's runs are stamped with, overriding the ticking engine's own. Opt-in;
+     * absent = the run gets the namespace of whichever engine fired it.
+     *
+     * The run id is a time bucket, so the instance that wins the race to fire a window decides which
+     * namespace (worker pool) the run lands in. When the workflow can only run in one pool — its steps
+     * need a capability only that pool's workers have — pin it here, so whoever fires the window, the
+     * run is stamped for (and only picked up by) that pool.
+     */
+    namespace?: string;
 }
 /** Injectable dispatch-path effects (kept out of the deterministic run-id logic). Defaults to real
  *  `Math.random` + `setTimeout`; overridden in tests so jitter is deterministic and instant. */
@@ -6697,14 +6845,23 @@ declare function prevCronFireMs(expr: string, nowMs: number, timezone?: string):
  * schedule is next due.
  */
 declare function nextCronFireMs(expr: string, afterMs: number, timezone?: string): number;
+/**
+ * The deterministic, idempotent run id for a schedule at `nowMs` — its current fire window
+ * (`sched:<key>:<bucket>`, the bucket being a fixed-interval index or the cron fire time). Pass the
+ * same `ScheduledWorkflow` you registered to look a window's run up, e.g.
+ * `engine.getRun(scheduleRunIdAt(dailyReport, Date.now()))`, rather than rebuilding the id by hand.
+ */
+declare function scheduleRunIdAt(s: ScheduledWorkflow, nowMs: number): string;
 /**
  * Start each schedule's current-window run. The run id is the time bucket (a fixed-interval index,
  * or the cron fire time) and `engine.start` is idempotent, so firing this on an interval — or
  * racing two instances on the same tick — starts **each window exactly once**. Wire it to a
- * `setInterval`, the durable timer poller, or `@nestjs/schedule`. Returns the run ids for the
- * current windows.
+ * `setInterval`, the durable timer poller, or `@nestjs/schedule`. Returns the run ids this call
+ * started: a window that already has a run is not started or returned again, and once this process
+ * has seen a window's run exist, later calls in that window skip it without a store read or a
+ * jitter sleep.
  */
-declare function runSchedules(engine: Pick<WorkflowEngine, 'start' | 'getRun'>, schedules: readonly ScheduledWorkflow[], nowMs: number, opts?: RunSchedulesOptions): Promise<string[]>;
+declare function runSchedules(engine: Pick<WorkflowEngine, 'start' | 'getRun'> & Partial<Pick<WorkflowEngine, 'isDraining'>>, schedules: readonly ScheduledWorkflow[], nowMs: number, opts?: RunSchedulesOptions): Promise<string[]>;
 
 /**
  * A {@link StepLogger} that appends to `events`, stamping each line with `now()`. Shared by the
@@ -7117,4 +7274,4 @@ declare function singletonAdmissionDenialPatch(runs: WorkflowRun[], runId: strin
     updatedAt: Date;
 } | undefined;
 
-export { type AccumulatorHost, type Admission, type AdmissionBackend, type AdmissionItem, type AllOptions, type AllSettledOptions, type AllStepsOptions, type AllStepsSettledOptions, type AnnouncedWorkflow, type AnnouncementEvidence, type AttributeFilter, type AttributeOp, type AttributePredicateOperand, type AttributeValue, type BackoffStrategy, type BlockedDispatch, type BlockedResolution, CHILD_EDGE_PREFIXES, CONTROL_FLOW_SIGNAL, CURRENT_PROTOCOL_VERSION, type CapabilityRequirement, type CheckpointAggregatingStore, type CheckpointNameKind, type CheckpointQuery, type CheckpointStat, type ChildCallOptions, type ChildWait, CodecStateStore, type CodecStateStoreOptions, type ConcurrencyConfig, ConcurrencyLimitError, type ConcurrencyQuota, ContinueAsNew, type ControlMessage, type ControlPlane, DEFAULT_CONCURRENCY_STATUSES, DEFAULT_PARTITION, DEFAULT_STALLED_AFTER_MS, DURABLE_OPTIONS, DURABLE_OPTIONS_CANONICAL, DURABLE_STEP_CONFIG, DURABLE_STEP_NAME, type Disagreement, type DispatchDiagnostics, type DispatchPlan, type DurableExecution, type DurableExecutionWrapper, type DurableTopology, type DurableWebhook, DurableWorkflow, type DynamicWorkflowCtx, ENGINE_MINTED_TAG_PREFIXES, ENTITY_WORKFLOW, EVENT_BUFFER_SCAN_LIMIT, EVENT_TOKEN_PREFIX, type EngineEvent, type EngineEventType, type EngineListener, Entities, type EntityConfig, type EntityHandler, type EntityHost, type EntityWorkflowHost, EventAccumulators, type EventBatchConfig, FAN_SUMMARY_FAILURES, type FanJoin, type FanPage, type FanPageQuery, type FanSummary, type FanWait, FatalError, type FindStalledRunsOptions, GatherError, type GatherItemFailure, type GroupHealth, HANDOFF_SEQ_BASE, type Heartbeat, type HeartbeatSighting, type HeartbeatStatus, type HistoryEvent, InMemoryAdmissionBackend, InMemoryStateStore, InMemoryTransport, type InferSearchAttributes, LEGACY_V1_CAPABILITIES, LEGACY_V1_PROTOCOL, type ListStalledRunsOptions, type MetricsCollector, type MetricsSnapshot, type NamedTransport, type NegotiateOptions, type NegotiationOutcome, type NegotiationReason, type NegotiationResult, NestedWorkflowCallError, NonDeterminismError, type OnErrorInput, type OnErrorRoute, type OwnedLeaseReclaim, type PartitionSighting, type PayloadCodec, type QueueConfig, QueueController, RUN_HISTORY_FIXTURE_VERSION, RUN_VALUE_FACET_LIMIT, RUN_VALUE_FACET_SCAN, type RawWorkerDescriptor, RemoteStepError, RemoteStepTimeout, type RemoteTask, RemoteWorkflowExecutor, RemoteWorkflowTimeout, type RetentionPolicy, type RoutableDispatch, type RoutableResolution, type RoutingResolution, type RunAttributeRow, type RunDetail, type RunDetailOptions, type RunDispatcher, type RunFacetQuery, type RunFacetRow, RunGateway, type RunListItem, type RunQuery, type RunReply, type RunReplyResult, type RunRequest, type RunRequestKind, type RunResult, type RunSchedulesOptions, type RunScope, type RunStatus, type RunValueAxis, type RunValueFacetOptions, type RunValueFacetOrder, type RunValueFacetRow, type RunWaiting, SINGLETON_ACTIVE_STATUSES, SINGLETON_ADMITTED_TAG, SINGLETON_RESERVED_TAGS, SINGLETON_TRACKED_TAG, STATE_STORE, STATE_STORE_CANONICAL, SUMMARY_CHILD_LIMIT, type ScalarAttributeFilter, ScheduleAlreadyExistsError, ScheduleClient, type ScheduleClientOptions, type ScheduleDescription, type ScheduleHost, type ScheduleListQuery, ScheduleNotFoundError, type ScheduleOptions, type ScheduleQuery, type ScheduleRecord, type ScheduledWorkflow, type SearchAttributes, type SearchAttributesSchema, type Settled, SignalTimeoutError, type SignalWaiter, type SingletonConfig, SingletonQueueFullError, type StalePendingStep, type StalledRunInfo, StandardSchemaV1, type StartOptions, type StartRunMessage, type StateStore, type StepCheckpoint, type StepConfig, type StepDef, type StepDispatchOpts, type StepError, type StepEvent, type StepHandler, type StepInterceptor, type StepInvocation, type StepKind, type StepLogger, type StepOptions, type StepRef, type StepResult, type StepScope, type StepUndo, type StoreTransaction, type SubProcessHandle, TERMINAL_RUN_STATUSES, TRANSPORT, TRANSPORT_CANONICAL, type TenantEvent, type Transport, type UndoOf, type UpdateResult, type UpdateValidator, VERSION_UNDECLARED_TAG, WORKFLOW_NAME_KEY, type WireDates, type WorkerAdjust, type WorkerConcurrencyStatus, type WorkerDescriptor, type WorkerHeartbeat, type WorkerLifecycle, type WorkerStatus, type WorkflowAnnouncement, WorkflowBlocked, type WorkflowClass, type WorkflowCommand, type WorkflowCtx, type WorkflowDecision, type WorkflowDirectory, WorkflowEngine, type WorkflowEngineDeps, type WorkflowExecutor, type WorkflowHandler, type WorkflowInputOf, type WorkflowOutputOf, type WorkflowRef, type WorkflowRegistration, type WorkflowRun, type WorkflowStartClient, type WorkflowStepEvent, WorkflowSuspended, type WorkflowTask, aggregateAnnouncements, aggregatesCheckpoints, announcementsOf, applyAttributeQuery, assertConcurrency, assertRoutes, attributeColumnFor, attributeOperand, attributePredicateOperands, axisIsRunColumn, bindWorkflowClass, breakpointToken, buildWorkflowDirectory, canRoute, capableWorkers, checkpointNameKind, checkpointStatsOf, childIdsOf, classifyWaiterToken, clearDurableExecutionWrappers, clearTerminalSingletonAdmission, codeAndDetails, codeOf, collectMetrics, concurrencyTag, controlPlaneDescriptor, countRuns, coveredTokens, createStepLogger, currentStep, currentStepScope, currentWorkflowCtx, debug, describeWorker, descriptorHash, detailsOf, error, etagMatches, eventMatchOf, eventMatches, eventNameOf, eventPrefix, eventToken, facetOrigin, fanPageBounds, fanPageEtag, findStalledRuns, foldedCount, handoffHandlerId, handoffName, hasDurableExecutionWrappers, heartbeatStatus, indexWaitersByRun, info, isEngineMintedTag, isEventToken, isFailedMember, isLegacyDescriptor, isNonEmptyRunScope, isWorkflowControlFlowSignal, legacySingletonHolders, listSignalWaitersOfRuns, liveHandoff, log, matchesAttributes, mergeRunFacetRows, mergeRunValueFacetRows, missingCapabilities, negotiate, nextCronFireMs, normalizeAttributeRows, normalizeDescriptor, observedAnnouncements, onErrorRunId, pageFan, pageFanFromStore, parentRunIdOf, parseDuration, parseWebhookToken, partitionOfToken, planDispatch, poolNamespace, prevCronFireMs, queryCheckpointsOf, readSearchAttributes, requiredCapabilities, resolveConcurrency, resolveRouting, resolveRunWaiting, retiredHandoffName, routeFor, runDetailEtag, runDurableExecution, runInStepLogger, runInStepScope, runInWorkflowCtx, runOutsideWorkflowCtx, runSchedules, runStepHandler, runValueFacetsFromRuns, sanitizeQueueToken, scheduledRunId, singletonAdmissionDenialPatch, singletonAdmissionTags, sqlComparator, stepConfigOf, stepId, stepNameOf, sub, subEvent, subProcess, summarizeFan, summarizeRunFromStore, summarizeTimeline, tenantGroup, useDurableExecution, warn, withSingletonTracked, withoutSingletonMarkers, workflowName };
+export { type AccumulatorHost, type Admission, type AdmissionBackend, type AdmissionItem, type AllOptions, type AllSettledOptions, type AllStepsOptions, type AllStepsSettledOptions, type AnnouncedWorkflow, type AnnouncementEvidence, type AttributeFilter, type AttributeOp, type AttributePredicateOperand, type AttributeValue, type BackoffStrategy, type BlockedDispatch, type BlockedResolution, CHILD_EDGE_PREFIXES, CONTROL_FLOW_SIGNAL, CURRENT_PROTOCOL_VERSION, type CapabilityRequirement, type CheckpointAggregatingStore, type CheckpointNameKind, type CheckpointQuery, type CheckpointStat, type ChildCallOptions, type ChildWait, CodecStateStore, type CodecStateStoreOptions, type ConcurrencyConfig, ConcurrencyLimitError, type ConcurrencyQuota, ContinueAsNew, type ControlMessage, type ControlPlane, DEFAULT_CONCURRENCY_STATUSES, DEFAULT_PARTITION, DEFAULT_STALLED_AFTER_MS, DURABLE_OPTIONS, DURABLE_OPTIONS_CANONICAL, DURABLE_STEP_CONFIG, DURABLE_STEP_NAME, type Disagreement, type DispatchDiagnostics, type DispatchPlan, type DurableExecution, type DurableExecutionWrapper, type DurableTopology, type DurableWebhook, DurableWorkflow, type DynamicWorkflowCtx, ENGINE_MINTED_TAG_PREFIXES, ENTITY_WORKFLOW, EVENT_BUFFER_SCAN_LIMIT, EVENT_TOKEN_PREFIX, type EngineEvent, type EngineEventType, type EngineListener, Entities, type EntityConfig, type EntityHandler, type EntityHost, type EntityWorkflowHost, EventAccumulators, type EventBatchConfig, FAN_SUMMARY_FAILURES, type FanJoin, type FanPage, type FanPageQuery, type FanSummary, type FanWait, FatalError, type FindStalledRunsOptions, GatherError, type GatherItemFailure, type GroupHealth, HANDOFF_SEQ_BASE, type Heartbeat, type HeartbeatSighting, type HeartbeatStatus, type HistoryEvent, InMemoryAdmissionBackend, InMemoryStateStore, InMemoryTransport, type InferSearchAttributes, LEGACY_V1_CAPABILITIES, LEGACY_V1_PROTOCOL, type ListStalledRunsOptions, type MetricsCollector, type MetricsSnapshot, type NamedTransport, type NegotiateOptions, type NegotiationOutcome, type NegotiationReason, type NegotiationResult, NestedWorkflowCallError, NonDeterminismError, type OnErrorInput, type OnErrorRoute, type OwnedLeaseReclaim, type PartitionSighting, type PayloadCodec, type QueueConfig, QueueController, RUN_HISTORY_FIXTURE_VERSION, RUN_VALUE_FACET_LIMIT, RUN_VALUE_FACET_SCAN, type RawWorkerDescriptor, RemoteStepError, RemoteStepTimeout, type RemoteTask, RemoteWorkflowExecutor, RemoteWorkflowTimeout, type RetentionPolicy, type RoutableDispatch, type RoutableResolution, type RoutingResolution, type RunAttributeRow, type RunDetail, type RunDetailOptions, type RunDispatcher, type RunFacetQuery, type RunFacetRow, RunGateway, type RunListItem, type RunQuery, type RunReply, type RunReplyResult, type RunRequest, type RunRequestKind, type RunResult, type RunSchedulesOptions, type RunScope, type RunStatus, type RunValueAxis, type RunValueFacetOptions, type RunValueFacetOrder, type RunValueFacetRow, type RunWaiting, SINGLETON_ACTIVE_STATUSES, SINGLETON_ADMITTED_TAG, SINGLETON_RESERVED_TAGS, SINGLETON_TRACKED_TAG, STATE_STORE, STATE_STORE_CANONICAL, SUMMARY_CHILD_LIMIT, type ScalarAttributeFilter, ScheduleAlreadyExistsError, ScheduleClient, type ScheduleClientOptions, type ScheduleDescription, type ScheduleHost, type ScheduleListQuery, ScheduleNotFoundError, type ScheduleOptions, type ScheduleQuery, type ScheduleRecord, type ScheduledWorkflow, type SchemaIssue, type SchemaValidationCode, SchemaValidationError, type SearchAttributes, type SearchAttributesSchema, type Settled, SignalTimeoutError, type SignalWaiter, type SingletonConfig, SingletonQueueFullError, type StalePendingStep, type StalledRunInfo, StandardSchemaV1, type StartOptions, type StartRunMessage, type StateStore, type StepCheckpoint, type StepConfig, type StepDef, type StepDispatchOpts, type StepError, type StepEvent, type StepHandler, type StepInterceptor, type StepInvocation, type StepKind, type StepLogger, type StepOptions, type StepRef, type StepResult, type StepScope, type StepUndo, type StoreTransaction, type SubProcessHandle, TERMINAL_RUN_STATUSES, TRANSPORT, TRANSPORT_CANONICAL, type TenantEvent, type TenantTokenSource, type TenantVerifier, type Transport, type UndoOf, type UpdateResult, type UpdateValidator, VERSION_UNDECLARED_TAG, type VerifiedTenant, WORKFLOW_NAME_KEY, type WireDates, type WorkerAdjust, type WorkerConcurrencyStatus, type WorkerDescriptor, type WorkerHeartbeat, type WorkerLifecycle, type WorkerStatus, type WorkflowAnnouncement, WorkflowBlocked, type WorkflowClass, type WorkflowCommand, type WorkflowCtx, type WorkflowDecision, type WorkflowDirectory, WorkflowEngine, type WorkflowEngineDeps, type WorkflowExecutor, type WorkflowHandler, type WorkflowInputOf, type WorkflowOutputOf, type WorkflowRef, type WorkflowRegistration, type WorkflowRun, type WorkflowStartClient, type WorkflowStepEvent, WorkflowSuspended, type WorkflowTask, aggregateAnnouncements, aggregatesCheckpoints, announcementsOf, applyAttributeQuery, assertConcurrency, assertRoutes, attributeColumnFor, attributeOperand, attributePredicateOperands, axisIsRunColumn, bindWorkflowClass, breakpointToken, buildWorkflowDirectory, canRoute, capableWorkers, checkpointNameKind, checkpointStatsOf, childIdsOf, classifyWaiterToken, clearDurableExecutionWrappers, clearTerminalSingletonAdmission, codeAndDetails, codeOf, collectMetrics, concurrencyTag, controlPlaneDescriptor, countRuns, coveredTokens, createStepLogger, currentStep, currentStepScope, currentWorkflowCtx, debug, describeWorker, descriptorHash, detailsOf, error, etagMatches, eventMatchOf, eventMatches, eventNameOf, eventPrefix, eventToken, facetOrigin, fanPageBounds, fanPageEtag, findStalledRuns, foldedCount, handoffHandlerId, handoffName, hasDurableExecutionWrappers, heartbeatStatus, hmacTenantVerifier, indexWaitersByRun, info, isEngineMintedTag, isEventToken, isFailedMember, isLegacyDescriptor, isNonEmptyRunScope, isWorkflowControlFlowSignal, legacySingletonHolders, listSignalWaitersOfRuns, liveHandoff, log, matchesAttributes, mergeRunFacetRows, mergeRunValueFacetRows, missingCapabilities, negotiate, nextCronFireMs, normalizeAttributeRows, normalizeDescriptor, observedAnnouncements, onErrorRunId, pageFan, pageFanFromStore, parentRunIdOf, parseDuration, parseWebhookToken, partitionOfToken, planDispatch, poolNamespace, prevCronFireMs, queryCheckpointsOf, readSearchAttributes, requiredCapabilities, resolveConcurrency, resolveRouting, resolveRunWaiting, resolveTenantToken, resolveWireTenant, retiredHandoffName, routeFor, runDetailEtag, runDurableExecution, runInStepLogger, runInStepScope, runInWorkflowCtx, runOutsideWorkflowCtx, runSchedules, runStepHandler, runValueFacetsFromRuns, sanitizeQueueToken, scheduleRunIdAt, scheduledRunId, signTenantToken, singletonAdmissionDenialPatch, singletonAdmissionTags, sqlComparator, stepConfigOf, stepId, stepNameOf, sub, subEvent, subProcess, summarizeFan, summarizeRunFromStore, summarizeTimeline, tenantGroup, useDurableExecution, warn, withSingletonTracked, withoutSingletonMarkers, workflowName };