@flowdular/sdk 0.2.4 → 0.3.0

package/modules/workflows/src/services/database-repository.ts

@@ -1,10 +1,12 @@
 import { createHash, randomUUID } from 'node:crypto';
 import {
+	integer,
 	runDatabaseMigrations,
 	type DatabaseHandle,
 	type DatabaseTransaction,
 } from '@flowdular/sdk/database';
 import type { Actor, UserActor } from '@flowdular/sdk/kernel';
+import { keysetWhere } from '@flowdular/sdk/server';
 import type {
 	JsonValue,
 	WorkflowAuditEvent,
@@ -23,9 +25,9 @@ import type {
 	WorkflowRunDetail,
 	WorkflowRunEventTypeV1,
 	WorkflowRunEventV1,
-	WorkflowRunFilters,
-	WorkflowRunPage,
 	WorkflowRunStatus,
+	WorkflowRunSummary,
+	WorkflowSortDirection,
 	WorkflowUsageRollupV1,
 } from '../domain/types.ts';
 import { WORKFLOW_LIMITS } from '../domain/types.ts';
@@ -38,11 +40,18 @@ import { databaseMigrations } from './migration.ts';
 import type { WorkflowPayloadCodec } from './payload-codec.ts';
 import type {
 	CreateWorkflowRunWrite,
+	ExportedWorkflowDefinition,
+	ExportedWorkflowRun,
 	SettleAttemptWrite,
 	SettleEdgeWrite,
 	StartAttemptWrite,
-	WorkflowAuditPage,
+	WorkflowAuditListRead,
+	WorkflowDefinitionExportCursor,
+	WorkflowDefinitionListRead,
 	WorkflowDefinitionWrite,
+	WorkflowKeysetPage,
+	WorkflowRunExportCursor,
+	WorkflowRunListRead,
 	WorkflowRunRecord,
 	WorkflowsRepository,
 } from './repository.ts';
@@ -54,20 +63,11 @@ const TERMINAL_RUNS = new Set<WorkflowRunStatus>([
 	'cancelled',
 ]);
 
-/* PostgreSQL returns BIGINT as a string, so every integer column is
-   normalized on the way out of a row. */
-function integer(value: number | bigint | string): number {
-	const normalized = Number(value);
-	if (!Number.isSafeInteger(normalized)) {
-		throw new Error('The workflows database returned an invalid integer.');
-	}
-	return normalized;
-}
-
 function optionalInteger(
 	value: number | bigint | string | null,
+	field: string,
 ): number | null {
-	return value === null ? null : integer(value);
+	return value === null ? null : integer(value, field);
 }
 
 type Int = number | bigint | string;
@@ -97,6 +97,19 @@ interface RevisionRow {
 	published_actor_json: string | null;
 }
 
+/** A definition and the revision it publishes, read in one statement. */
+interface ExportDefinitionRow extends DefinitionRow {
+	revision_id: string;
+	revision_workflow_id: string;
+	revision_number: Int;
+	graph_json: string;
+	graph_checksum: string;
+	compiler_version: Int;
+	compiled_order_json: string;
+	published_at: Int | null;
+	published_actor_json: string | null;
+}
+
 interface RunRow {
 	id: string;
 	tenant_id: string;
@@ -179,6 +192,19 @@ interface EdgeRow {
 	settled_at: Int;
 }
 
+/** The run id a page of child rows carries, so one query serves many runs. */
+interface ExportNodeStateRow extends NodeStateRow {
+	run_id: string;
+}
+
+interface ExportAttemptRow extends AttemptRow {
+	run_id: string;
+}
+
+interface ExportEdgeRow extends EdgeRow {
+	run_id: string;
+}
+
 interface EventRow {
 	event_id: string;
 	tenant_id: string;
@@ -229,10 +255,16 @@ function definitionFromRow(row: DefinitionRow): WorkflowDefinition {
 		name: row.name,
 		description: row.description,
 		status: row.status,
-		currentDraftRevision: integer(row.current_draft_revision),
-		publishedRevision: optionalInteger(row.published_revision),
-		createdAt: integer(row.created_at),
-		updatedAt: integer(row.updated_at),
+		currentDraftRevision: integer(
+			row.current_draft_revision,
+			'current_draft_revision',
+		),
+		publishedRevision: optionalInteger(
+			row.published_revision,
+			'published_revision',
+		),
+		createdAt: integer(row.created_at, 'created_at'),
+		updatedAt: integer(row.updated_at, 'updated_at'),
 	};
 }
 
@@ -240,12 +272,12 @@ function revisionFromRow(row: RevisionRow): WorkflowRevision {
 	return {
 		id: row.id,
 		workflowId: row.workflow_id,
-		revision: integer(row.revision),
+		revision: integer(row.revision, 'revision'),
 		graph: parse<WorkflowGraphV1>(row.graph_json),
 		graphChecksum: row.graph_checksum,
-		compilerVersion: integer(row.compiler_version) as 1,
+		compilerVersion: integer(row.compiler_version, 'compiler_version') as 1,
 		compiledOrder: parse<readonly string[]>(row.compiled_order_json),
-		publishedAt: optionalInteger(row.published_at),
+		publishedAt: optionalInteger(row.published_at, 'published_at'),
 		publishedBy:
 			row.published_actor_json === null
 				? null
@@ -253,16 +285,51 @@ function revisionFromRow(row: RevisionRow): WorkflowRevision {
 	};
 }
 
+function nodeExecutionFromRow(
+	row: NodeStateRow,
+	attempts: readonly WorkflowNodeAttempt[],
+): WorkflowNodeExecution {
+	return {
+		nodeId: row.node_id,
+		status: row.status,
+		latestAttempt: integer(row.latest_attempt, 'latest_attempt'),
+		selectedOutcomePort: row.selected_outcome_port,
+		nextAttemptAt: optionalInteger(row.next_attempt_at, 'next_attempt_at'),
+		readyAt: optionalInteger(row.ready_at, 'ready_at'),
+		startedAt: optionalInteger(row.started_at, 'started_at'),
+		settledAt: optionalInteger(row.settled_at, 'settled_at'),
+		attempts,
+	};
+}
+
+function edgeFromRow(row: EdgeRow): WorkflowEdgeTransfer {
+	return {
+		edgeId: row.edge_id,
+		sourceNodeId: row.source_node_id,
+		sourcePort: row.source_port,
+		sourceAttempt: optionalInteger(row.source_attempt, 'source_attempt'),
+		targetNodeId: row.target_node_id,
+		targetPort: row.target_port,
+		state: row.state,
+		reason: row.reason,
+		evidence: parse<WorkflowPayloadEvidenceV1>(row.evidence_json),
+		settledAt: integer(row.settled_at, 'settled_at'),
+	};
+}
+
 function runFromRow(row: RunRow): WorkflowRunRecord {
-	const queuedAt = integer(row.queued_at);
-	const completedAt = optionalInteger(row.completed_at);
+	const queuedAt = integer(row.queued_at, 'queued_at');
+	const completedAt = optionalInteger(row.completed_at, 'completed_at');
 	return {
 		id: row.id,
 		tenantId: row.tenant_id,
 		workflowId: row.workflow_id,
 		workflowKey: row.workflow_key,
 		workflowName: row.workflow_name,
-		workflowRevision: optionalInteger(row.workflow_revision),
+		workflowRevision: optionalInteger(
+			row.workflow_revision,
+			'workflow_revision',
+		),
 		graphChecksum: row.graph_checksum,
 		graph: parse<WorkflowGraphV1>(row.graph_json),
 		compiledOrder: parse<readonly string[]>(row.compiled_order_json),
@@ -280,24 +347,27 @@ function runFromRow(row: RunRow): WorkflowRunRecord {
 		inputPayloadId: row.input_payload_id,
 		idempotencyKey: row.idempotency_key,
 		leaseOwner: row.lease_owner,
-		leaseExpiresAt: optionalInteger(row.lease_expires_at),
-		completedNodes: integer(row.completed_nodes),
-		totalNodes: integer(row.total_nodes),
+		leaseExpiresAt: optionalInteger(row.lease_expires_at, 'lease_expires_at'),
+		completedNodes: integer(row.completed_nodes, 'completed_nodes'),
+		totalNodes: integer(row.total_nodes, 'total_nodes'),
 		usage: parse<WorkflowUsageRollupV1>(row.usage_json),
 		cost: parse<WorkflowCostRollupV1>(row.cost_json),
 		failureCode: row.failure_code,
 		queuedAt,
-		startedAt: optionalInteger(row.started_at),
+		startedAt: optionalInteger(row.started_at, 'started_at'),
 		completedAt,
 		durationMs: completedAt === null ? null : completedAt - queuedAt,
-		cancellationRequestedAt: optionalInteger(row.cancellation_requested_at),
+		cancellationRequestedAt: optionalInteger(
+			row.cancellation_requested_at,
+			'cancellation_requested_at',
+		),
 	};
 }
 
 function attemptFromRow(row: AttemptRow): WorkflowNodeAttempt {
 	return {
 		nodeId: row.node_id,
-		attempt: integer(row.attempt),
+		attempt: integer(row.attempt, 'attempt'),
 		nodeType: row.node_type,
 		status: row.status,
 		outcomePort: row.outcome_port,
@@ -309,27 +379,34 @@ function attemptFromRow(row: AttemptRow): WorkflowNodeAttempt {
 		childId: row.child_id,
 		childObservationDeadlineAt: optionalInteger(
 			row.child_observation_deadline_at,
+			'child_observation_deadline_at',
 		),
 		failureCode: row.failure_code,
 		retryClassification: row.retry_classification,
-		selectedBackoffMs: optionalInteger(row.selected_backoff_ms),
-		nextAttemptAt: optionalInteger(row.next_attempt_at),
-		startedAt: integer(row.started_at),
-		completedAt: optionalInteger(row.completed_at),
-		durationMs: optionalInteger(row.duration_ms),
+		selectedBackoffMs: optionalInteger(
+			row.selected_backoff_ms,
+			'selected_backoff_ms',
+		),
+		nextAttemptAt: optionalInteger(row.next_attempt_at, 'next_attempt_at'),
+		startedAt: integer(row.started_at, 'started_at'),
+		completedAt: optionalInteger(row.completed_at, 'completed_at'),
+		durationMs: optionalInteger(row.duration_ms, 'duration_ms'),
 	};
 }
 
 function eventFromRow(row: EventRow): WorkflowRunEventV1 {
-	const virtualOffsetMs = optionalInteger(row.virtual_offset_ms);
+	const virtualOffsetMs = optionalInteger(
+		row.virtual_offset_ms,
+		'virtual_offset_ms',
+	);
 	return {
 		eventId: row.event_id,
 		schemaVersion: 1,
 		tenantId: row.tenant_id,
 		runId: row.run_id,
-		sequence: integer(row.sequence),
+		sequence: integer(row.sequence, 'sequence'),
 		type: row.event_type,
-		recordedAt: integer(row.recorded_at),
+		recordedAt: integer(row.recorded_at, 'recorded_at'),
 		...(virtualOffsetMs === null ? {} : { virtualOffsetMs }),
 		payload: parse<Readonly<Record<string, JsonValue>>>(row.payload_json),
 	};
@@ -337,14 +414,14 @@ function eventFromRow(row: EventRow): WorkflowRunEventV1 {
 
 function auditFromRow(row: AuditRow): WorkflowAuditEvent {
 	return {
-		sequence: integer(row.sequence),
+		sequence: integer(row.sequence, 'sequence'),
 		actor: parse<Actor>(row.actor_json),
 		origin: parse<WorkflowExecutionOrigin>(row.origin_json),
 		action: row.action,
 		subjectType: row.subject_type,
 		subjectId: row.subject_id,
 		metadata: parse<Readonly<Record<string, JsonValue>>>(row.metadata_json),
-		occurredAt: integer(row.occurred_at),
+		occurredAt: integer(row.occurred_at, 'occurred_at'),
 		previousHash: row.previous_hash,
 		eventHash: row.event_hash,
 	};
@@ -373,6 +450,64 @@ function jsonKind(column: string): string {
 	return `${column}::jsonb ->> 'kind'`;
 }
 
+/* A search term is matched as a substring, so the three characters LIKE reads
+   as syntax are escaped with PostgreSQL's default escape character. */
+function likePattern(term: string): string {
+	return '%' + term.replace(/[\\%_]/g, (character) => '\\' + character) + '%';
+}
+
+const ORDER: Readonly<Record<WorkflowSortDirection, 'ASC' | 'DESC'>> = {
+	asc: 'ASC',
+	desc: 'DESC',
+};
+
+/* The direction reaches the statement text, so anything but the two words the
+   type allows is refused before it is interpolated. */
+function orderDirection(direction: WorkflowSortDirection): 'ASC' | 'DESC' {
+	const order = ORDER[direction];
+	if (!order) throw new Error('A list direction is asc or desc.');
+	return order;
+}
+
+/** Numbered parameters for a statement assembled from optional predicates. */
+function binder() {
+	const parameters: Array<string | number> = [];
+	return {
+		parameters,
+		bind(value: string | number): string {
+			parameters.push(value);
+			return `$${parameters.length}`;
+		},
+	};
+}
+
+/**
+ * The person behind a run, in the order migration 0008 backfilled the column:
+ * the account a service actor was configured by, then the delegated
+ * authorization subject, then the actor itself. It must stay that order, or a
+ * run written now would answer an erasure differently from one backfilled.
+ */
+function subjectAccountId(
+	actor: Actor,
+	authorizationSubject: UserActor | null,
+): string {
+	if (actor.kind === 'service') return actor.configuredBy.id;
+	return authorizationSubject?.id ?? actor.id;
+}
+
+/** Appends into the bucket `key` names, creating it on first use. */
+function bucketed<T>(map: Map<string, T[]>, key: string, value: T): void {
+	const bucket = map.get(key);
+	if (bucket) bucket.push(value);
+	else map.set(key, [value]);
+}
+
+/* One node of one run. A run id is a UUID and a node id is a dotted
+   identifier, so neither can hold the separator and two pairs never collide. */
+function nodeKey(runId: string, nodeId: string): string {
+	return `${runId} ${nodeId}`;
+}
+
 /* Marks a stored evidence document expired without touching its hash or
    byte size, so the audit of what was there survives the redaction. */
 function expire(column: string): string {
@@ -397,8 +532,6 @@ const SQL = Object.freeze({
 		 (id, tenant_id, run_id, kind, schema_id, payload_hash,
 		  original_byte_size, ciphertext, encryption_key_id, created_at)
 		 VALUES ($1, $2, $3, 'execution', $4, $5, $6, $7, $8, $9)`,
-	listDefinitions: `SELECT * FROM workflow_definitions WHERE tenant_id = $1
-		 ORDER BY lower(name), id`,
 	findDefinition: `SELECT * FROM workflow_definitions
 		 WHERE tenant_id = $1 AND id = $2`,
 	findDefinitionByKey: `SELECT * FROM workflow_definitions
@@ -445,13 +578,13 @@ const SQL = Object.freeze({
 		 (id, tenant_id, workflow_id, workflow_key, workflow_name,
 		  workflow_revision, graph_checksum, compiler_version, graph_json,
 		  compiled_order_json, mode, status, actor_json, authorization_subject_json, origin_json,
-		  permission_snapshot_json, permission_digest, input_hash,
+		  subject_account_id, permission_snapshot_json, permission_digest, input_hash,
 		  input_payload_id, input_evidence_json, output_evidence_json,
 		  idempotency_key, limits_json, lease_owner, lease_expires_at,
 		  completed_nodes, total_nodes, usage_json, cost_json, failure_code,
 		  queued_at, started_at, completed_at, cancellation_requested_at)
 		 VALUES ($1, $2, $3, $4, $5, $6, $7, 1, $8, $9, $10, $11, $12, $13, $14, $15, $16, $17, $18, $19,
-		  NULL, $20, $21, NULL, NULL, 0, $22, $23, $24, NULL, $25, NULL, NULL, NULL)`,
+		  $20, NULL, $21, $22, NULL, NULL, 0, $23, $24, $25, NULL, $26, NULL, NULL, NULL)`,
 	insertNodeState: `INSERT INTO workflow_node_states
 		 (tenant_id, run_id, node_id, status, latest_attempt)
 		 VALUES ($1, $2, $3, 'pending', 0)`,
@@ -469,6 +602,11 @@ const SQL = Object.freeze({
 		  SELECT 1 FROM workflow_node_states n
 		  WHERE n.tenant_id = workflow_runs.tenant_id AND n.run_id = workflow_runs.id
 		  AND n.status = 'waiting-retry' AND n.next_attempt_at <= $3
+		 ))
+		 OR (status = 'waiting-approval' AND (lease_expires_at IS NULL OR lease_expires_at <= $6) AND EXISTS (
+		  SELECT 1 FROM workflow_node_states n
+		  WHERE n.tenant_id = workflow_runs.tenant_id AND n.run_id = workflow_runs.id
+		  AND n.status = 'waiting-child' AND n.next_attempt_at <= $7
 		 ))
 		  OR (status = 'cancel-requested' AND (lease_expires_at IS NULL OR lease_expires_at <= $4))
 		 )
@@ -492,8 +630,11 @@ const SQL = Object.freeze({
 		  semantic_group, side_effect_idempotency_key, input_payload_id,
 		  input_evidence_json, output_evidence_json, started_at)
 		 VALUES ($1, $2, $3, $4, $5, 'running', $6, $7, $8, $9, $10, $11)`,
+	/* The recheck a retry armed has fired by the time the attempt starts.
+		   Leaving it set would keep the node matching the claim poll's due-work
+		   predicate, which reads this column for every waiting state. */
 	startNodeState: `UPDATE workflow_node_states
-		 SET status = 'running', latest_attempt = $1,
+		 SET status = 'running', latest_attempt = $1, next_attempt_at = NULL,
 		  ready_at = coalesce(ready_at, $2), started_at = coalesce(started_at, $3)
 		 WHERE tenant_id = $4 AND run_id = $5 AND node_id = $6`,
 	markAttemptWaitingChild: `UPDATE workflow_node_attempts
@@ -501,10 +642,29 @@ const SQL = Object.freeze({
 		 child_observation_deadline_at = $3
 		 WHERE tenant_id = $4 AND run_id = $5 AND node_id = $6 AND attempt = $7
 		 AND status = 'running'`,
-	markNodeWaitingChild: `UPDATE workflow_node_states SET status = 'waiting-child'
+	/* An agent or an action child is polled while the run stays claimable on its
+		   own status, so such a node arms no recheck: only an approval does, and it
+		   arms it right after this. */
+	markNodeWaitingChild: `UPDATE workflow_node_states
+		 SET status = 'waiting-child', next_attempt_at = NULL
 		 WHERE tenant_id = $1 AND run_id = $2 AND node_id = $3`,
 	markRunWaitingAgent: `UPDATE workflow_runs SET status = 'waiting-agent'
 		 WHERE tenant_id = $1 AND id = $2 AND status = 'running'`,
+	markRunWaitingApproval: `UPDATE workflow_runs SET status = 'waiting-approval'
+		 WHERE tenant_id = $1 AND id = $2 AND status IN ('running', 'waiting-approval')`,
+	armNodeRecheck: `UPDATE workflow_node_states SET next_attempt_at = $1
+		 WHERE tenant_id = $2 AND run_id = $3 AND node_id = $4
+		 AND status = 'waiting-child'`,
+	wakeApprovalRun: `UPDATE workflow_node_states SET next_attempt_at = $1
+		 FROM workflow_node_attempts a
+		 WHERE workflow_node_states.tenant_id = $2
+		 AND workflow_node_states.run_id = $3
+		 AND workflow_node_states.status = 'waiting-child'
+		 AND a.tenant_id = workflow_node_states.tenant_id
+		 AND a.run_id = workflow_node_states.run_id
+		 AND a.node_id = workflow_node_states.node_id
+		 AND a.attempt = workflow_node_states.latest_attempt
+		 AND a.child_kind = 'approval' AND a.child_id = $4`,
 	getAttempt: `SELECT * FROM workflow_node_attempts
 		 WHERE tenant_id = $1 AND run_id = $2 AND node_id = $3 AND attempt = $4`,
 	settleAttempt: `UPDATE workflow_node_attempts
@@ -562,17 +722,17 @@ const SQL = Object.freeze({
 		 target_node_id, target_port, state, reason, evidence_json, settled_at
 		 FROM workflow_edge_transfers WHERE tenant_id = $1 AND run_id = $2
 		 ORDER BY edge_id`,
-	listAudit: `SELECT sequence, actor_json, origin_json, action, subject_type,
-		 subject_id, metadata_json, occurred_at, previous_hash, event_hash
-		 FROM workflow_audit_events WHERE tenant_id = $1
-		 ORDER BY sequence DESC LIMIT $2`,
-	listAuditBefore: `SELECT sequence, actor_json, origin_json, action, subject_type,
-		 subject_id, metadata_json, occurred_at, previous_hash, event_hash
-		 FROM workflow_audit_events WHERE tenant_id = $1 AND sequence < $2
-		 ORDER BY sequence DESC LIMIT $3`,
 	auditChain: `SELECT sequence, actor_json, origin_json, action, subject_type,
 		 subject_id, metadata_json, occurred_at, previous_hash, event_hash
 		 FROM workflow_audit_events WHERE tenant_id = $1 ORDER BY sequence`,
+	/* Chain order, which is the primary key's own order, so the export walk is
+	   an index range scan and an event appended during it lands ahead of the
+	   cursor rather than being visited twice. */
+	exportAuditEventsPage: `SELECT sequence, actor_json, origin_json, action,
+		 subject_type, subject_id, metadata_json, occurred_at, previous_hash,
+		 event_hash FROM workflow_audit_events
+		 WHERE tenant_id = $1 AND sequence > $2
+		 ORDER BY sequence LIMIT $3`,
 	/* Cross-tenant, routing columns only: the retention writes that follow
 		   run under the tenant each row named. */
 	retentionCandidates: `SELECT p.id, p.tenant_id, p.run_id, p.payload_hash
@@ -597,6 +757,77 @@ const SQL = Object.freeze({
 		 CASE WHEN output_evidence_json IS NULL THEN NULL ELSE ${expire('output_evidence_json')} END
 		 WHERE tenant_id = $1 AND id = $2`,
 	countRuns: `SELECT count(*) AS count FROM workflow_runs WHERE tenant_id = $1`,
+	/* The order workflow_runs_tenant_queue_idx already carries, so the export
+	   walk is an index range scan and a run queued during it lands ahead of the
+	   cursor rather than being visited twice. */
+	exportRunsPage: `SELECT * FROM workflow_runs WHERE tenant_id = $1
+		 ORDER BY queued_at DESC, id DESC LIMIT $2`,
+	exportRunsPageAfter: `SELECT * FROM workflow_runs WHERE tenant_id = $1
+		 AND (queued_at < $2 OR (queued_at = $3 AND id < $4))
+		 ORDER BY queued_at DESC, id DESC LIMIT $5`,
+	exportNodeStates: `SELECT run_id, node_id, status, latest_attempt,
+		 selected_outcome_port, next_attempt_at, ready_at, started_at, settled_at
+		 FROM workflow_node_states
+		 WHERE tenant_id = $1 AND run_id = ANY($2::text[])
+		 ORDER BY run_id, node_id`,
+	exportAttempts: `SELECT run_id, node_id, attempt, node_type, status,
+		 outcome_port, semantic_group, side_effect_idempotency_key,
+		 input_evidence_json, output_evidence_json, child_kind, child_id,
+		 child_observation_deadline_at, failure_code, retry_classification,
+		 selected_backoff_ms, next_attempt_at, started_at, completed_at,
+		 duration_ms FROM workflow_node_attempts
+		 WHERE tenant_id = $1 AND run_id = ANY($2::text[])
+		 ORDER BY run_id, node_id, attempt`,
+	exportEdges: `SELECT run_id, edge_id, source_node_id, source_port,
+		 source_attempt, target_node_id, target_port, state, reason,
+		 evidence_json, settled_at FROM workflow_edge_transfers
+		 WHERE tenant_id = $1 AND run_id = ANY($2::text[])
+		 ORDER BY run_id, edge_id`,
+	/* The inner select applies the batch limit; the child rows of the runs it
+	   names are removed with them in the same transaction. */
+	settledRunsBefore: `SELECT id FROM workflow_runs
+		 WHERE tenant_id = $1 AND completed_at < $2
+		  AND status IN ('succeeded', 'failed', 'refused', 'cancelled')
+		 ORDER BY completed_at LIMIT $3`,
+	/* One plain equality on the column 0008 resolves at write time, which is
+	   what makes an erasure an index range scan on the connection it runs on.
+	   Reading the person out of the actor document instead cannot use an index
+	   there: the jsonb extraction is not leakproof, so the forced row level
+	   security policy is applied first and the comparison stays a filter. */
+	runsOfSubject: `SELECT id FROM workflow_runs
+		 WHERE tenant_id = $1 AND subject_account_id = $2
+		 ORDER BY id LIMIT $3`,
+	deleteRunNodeStates: `DELETE FROM workflow_node_states
+		 WHERE tenant_id = $1 AND run_id = ANY($2::text[])`,
+	deleteRunAttempts: `DELETE FROM workflow_node_attempts
+		 WHERE tenant_id = $1 AND run_id = ANY($2::text[])`,
+	deleteRunEdges: `DELETE FROM workflow_edge_transfers
+		 WHERE tenant_id = $1 AND run_id = ANY($2::text[])`,
+	deleteRunEvents: `DELETE FROM workflow_run_events
+		 WHERE tenant_id = $1 AND run_id = ANY($2::text[])`,
+	deleteRunPayloads: `DELETE FROM workflow_payloads
+		 WHERE tenant_id = $1 AND run_id = ANY($2::text[])`,
+	deleteRunRows: `DELETE FROM workflow_runs
+		 WHERE tenant_id = $1 AND id = ANY($2::text[])`,
+	exportPublishedDefinitions: `SELECT d.*, r.id AS revision_id,
+		 r.workflow_id AS revision_workflow_id, r.revision AS revision_number,
+		 r.graph_json, r.graph_checksum, r.compiler_version,
+		 r.compiled_order_json, r.published_at, r.published_actor_json
+		 FROM workflow_definitions d
+		 JOIN workflow_revisions r ON r.tenant_id = d.tenant_id
+		  AND r.workflow_id = d.id AND r.revision = d.published_revision
+		 WHERE d.tenant_id = $1 AND d.published_revision IS NOT NULL
+		 ORDER BY d.name, d.id LIMIT $2`,
+	exportPublishedDefinitionsAfter: `SELECT d.*, r.id AS revision_id,
+		 r.workflow_id AS revision_workflow_id, r.revision AS revision_number,
+		 r.graph_json, r.graph_checksum, r.compiler_version,
+		 r.compiled_order_json, r.published_at, r.published_actor_json
+		 FROM workflow_definitions d
+		 JOIN workflow_revisions r ON r.tenant_id = d.tenant_id
+		  AND r.workflow_id = d.id AND r.revision = d.published_revision
+		 WHERE d.tenant_id = $1 AND d.published_revision IS NOT NULL
+		 AND (d.name > $2 OR (d.name = $3 AND d.id > $4))
+		 ORDER BY d.name, d.id LIMIT $5`,
 });
 
 export async function migrateWorkflowsDatabase(
@@ -685,7 +916,7 @@ export class DatabaseWorkflowsRepository implements WorkflowsRepository {
 			)
 		)[0];
 		const base = {
-			sequence: (previous ? integer(previous.sequence) : 0) + 1,
+			sequence: (previous ? integer(previous.sequence, 'sequence') : 0) + 1,
 			actor,
 			origin,
 			action,
@@ -728,7 +959,8 @@ export class DatabaseWorkflowsRepository implements WorkflowsRepository {
 				[tenantId, runId],
 			)
 		)[0];
-		const sequence = (optionalInteger(previous?.sequence ?? null) ?? 0) + 1;
+		const sequence =
+			(optionalInteger(previous?.sequence ?? null, 'sequence') ?? 0) + 1;
 		if (sequence > WORKFLOW_LIMITS.maxRunEvents) {
 			throw new Error('WORKFLOW_LIMIT_EXCEEDED');
 		}
@@ -853,16 +1085,54 @@ export class DatabaseWorkflowsRepository implements WorkflowsRepository {
 		]);
 	}
 
+	/* The name order is lower(name), which 0009 indexes as an expression. The
+	   keyset predicate compares plain columns, so the subquery names that
+	   expression once and the planner folds it back onto the index. */
 	async listDefinitions(
 		tenantId: string,
-	): Promise<readonly WorkflowDefinition[]> {
-		return this.#tx(tenantId, 'read', async (transaction) =>
-			(
-				await this.#query<DefinitionRow>(transaction, SQL.listDefinitions, [
-					tenantId,
-				])
-			).map(definitionFromRow),
+		read: WorkflowDefinitionListRead,
+	): Promise<WorkflowKeysetPage<WorkflowDefinition>> {
+		const { parameters, bind } = binder();
+		const clauses = [`tenant_id = ${bind(tenantId)}`];
+		if (read.status) clauses.push(`status = ${bind(read.status)}`);
+		if (read.search) {
+			const pattern = bind(likePattern(read.search));
+			clauses.push(`(name ILIKE ${pattern} OR workflow_key ILIKE ${pattern})`);
+		}
+		const sortColumn = read.sort === 'name' ? 'sort_name' : 'updated_at';
+		const order = orderDirection(read.direction);
+		let text = `SELECT * FROM (SELECT *, lower(name) AS sort_name
+		 FROM workflow_definitions WHERE ${clauses.join(' AND ')}) d`;
+		if (read.after) {
+			const keyset = keysetWhere(
+				[sortColumn, 'id'],
+				[read.after.key, read.after.id],
+				{ direction: read.direction, parameterOffset: parameters.length },
+			);
+			text += ` WHERE ${keyset.text}`;
+			parameters.push(...keyset.parameters);
+		}
+		text += ` ORDER BY ${sortColumn} ${order}, id ${order} LIMIT ${bind(read.limit)}`;
+		const rows = await this.#tx(tenantId, 'read', (transaction) =>
+			this.#query<DefinitionRow & { sort_name: string }>(
+				transaction,
+				text,
+				parameters,
+			),
 		);
+		const last = rows.at(-1);
+		return {
+			items: rows.map(definitionFromRow),
+			last: last
+				? {
+						key:
+							read.sort === 'name'
+								? last.sort_name
+								: integer(last.updated_at, 'updated_at'),
+						id: last.id,
+					}
+				: null,
+		};
 	}
 
 	async findDefinition(
@@ -1093,7 +1363,7 @@ export class DatabaseWorkflowsRepository implements WorkflowsRepository {
 			)[0];
 			if (
 				definition.publishedRevision !== null ||
-				integer(runs?.count ?? 0) > 0
+				integer(runs?.count ?? 0, 'count') > 0
 			) {
 				return 'in-use';
 			}
@@ -1136,7 +1406,7 @@ export class DatabaseWorkflowsRepository implements WorkflowsRepository {
 				id: row.id,
 				key: row.workflow_key,
 				name: row.name,
-				revision: integer(row.published_revision),
+				revision: integer(row.published_revision, 'published_revision'),
 				graphChecksum: row.graph_checksum,
 			})),
 		);
@@ -1168,6 +1438,7 @@ export class DatabaseWorkflowsRepository implements WorkflowsRepository {
 				JSON.stringify(run.actor),
 				JSON.stringify(run.authorizationSubject),
 				JSON.stringify(run.origin),
+				subjectAccountId(run.actor, run.authorizationSubject),
 				JSON.stringify(run.permissionSnapshot),
 				run.permissionDigest,
 				run.inputHash,
@@ -1247,72 +1518,48 @@ export class DatabaseWorkflowsRepository implements WorkflowsRepository {
 
 	async listRuns(
 		tenantId: string,
-		filters: WorkflowRunFilters,
-	): Promise<WorkflowRunPage> {
-		const limit = Math.min(
-			Math.max(1, Math.trunc(filters.limit ?? 50)),
-			WORKFLOW_LIMITS.maxInteractivePage,
-		);
-		const parameters: Array<string | number> = [];
-		const bind = (value: string | number) => {
-			parameters.push(value);
-			return `$${parameters.length}`;
-		};
+		read: WorkflowRunListRead,
+	): Promise<WorkflowKeysetPage<WorkflowRunSummary>> {
+		const { parameters, bind } = binder();
 		const clauses = [`tenant_id = ${bind(tenantId)}`];
-		if (filters.workflowId) {
-			clauses.push(`workflow_id = ${bind(filters.workflowId)}`);
+		if (read.workflowId) {
+			clauses.push(`workflow_id = ${bind(read.workflowId)}`);
 		}
-		if (filters.mode) clauses.push(`mode = ${bind(filters.mode)}`);
-		if (filters.status) clauses.push(`status = ${bind(filters.status)}`);
-		if (filters.actorKind) {
-			clauses.push(`${jsonKind('actor_json')} = ${bind(filters.actorKind)}`);
+		if (read.mode) clauses.push(`mode = ${bind(read.mode)}`);
+		if (read.status) clauses.push(`status = ${bind(read.status)}`);
+		if (read.actorKind) {
+			clauses.push(`${jsonKind('actor_json')} = ${bind(read.actorKind)}`);
 		}
-		if (filters.originKind) {
-			clauses.push(`${jsonKind('origin_json')} = ${bind(filters.originKind)}`);
+		if (read.originKind) {
+			clauses.push(`${jsonKind('origin_json')} = ${bind(read.originKind)}`);
 		}
-		let snapshot: { readonly queuedAt: number; readonly id: string } | null =
-			null;
-		if (filters.cursor) {
-			const [snapshotRaw, positionRaw, extra] = filters.cursor.split('|');
-			const parseBoundary = (raw: string | undefined) => {
-				const separator = raw?.indexOf(':') ?? -1;
-				const queuedAt = Number(raw?.slice(0, separator));
-				const id = raw?.slice(separator + 1) ?? '';
-				if (separator < 1 || !Number.isSafeInteger(queuedAt) || !id) {
-					throw new Error('WORKFLOW_CURSOR_INVALID');
-				}
-				return { queuedAt, id };
-			};
-			if (extra !== undefined) throw new Error('WORKFLOW_CURSOR_INVALID');
-			snapshot = parseBoundary(snapshotRaw);
-			const position = parseBoundary(positionRaw);
+		if (read.search) {
+			const pattern = bind(likePattern(read.search));
 			clauses.push(
-				`(queued_at < ${bind(snapshot.queuedAt)} OR (queued_at = ${bind(
-					snapshot.queuedAt,
-				)} AND id <= ${bind(snapshot.id)}))`,
+				`(workflow_name ILIKE ${pattern} OR workflow_key ILIKE ${pattern}
+				 OR id ILIKE ${pattern} OR actor_json::jsonb ->> 'label' ILIKE ${pattern})`,
 			);
-			clauses.push(
-				`(queued_at < ${bind(position.queuedAt)} OR (queued_at = ${bind(
-					position.queuedAt,
-				)} AND id < ${bind(position.id)}))`,
+		}
+		if (read.after) {
+			const keyset = keysetWhere(
+				['queued_at', 'id'],
+				[read.after.key, read.after.id],
+				{ direction: read.direction, parameterOffset: parameters.length },
 			);
+			clauses.push(keyset.text);
+			parameters.push(...keyset.parameters);
 		}
+		const order = orderDirection(read.direction);
 		const text = `SELECT * FROM workflow_runs WHERE ${clauses.join(' AND ')}
-		 ORDER BY queued_at DESC, id DESC LIMIT ${bind(limit + 1)}`;
+		 ORDER BY queued_at ${order}, id ${order} LIMIT ${bind(read.limit)}`;
 		const rows = await this.#tx(tenantId, 'read', (transaction) =>
 			this.#query<RunRow>(transaction, text, parameters),
 		);
-		const page = rows.slice(0, limit).map(runFromRow);
-		const first = page[0];
-		const last = page.at(-1);
-		const highWaterMark =
-			snapshot ?? (first ? { queuedAt: first.queuedAt, id: first.id } : null);
+		const items = rows.map(runFromRow);
+		const last = items.at(-1);
 		return {
-			runs: page,
-			nextCursor:
-				rows.length > limit && last && highWaterMark
-					? `${highWaterMark.queuedAt}:${highWaterMark.id}|${last.queuedAt}:${last.id}`
-					: null,
+			items,
+			last: last ? { key: last.queuedAt, id: last.id } : null,
 		};
 	}
 
@@ -1412,7 +1659,7 @@ export class DatabaseWorkflowsRepository implements WorkflowsRepository {
 				(transaction) =>
 					transaction.query<RunRoutingRow>({
 						text: SQL.claimCandidates,
-						parameters: [now, now, now, now, 20] as never,
+						parameters: [now, now, now, now, 20, now, now] as never,
 					}),
 				{ access: 'read' },
 			)
@@ -1443,7 +1690,8 @@ export class DatabaseWorkflowsRepository implements WorkflowsRepository {
 			)[0];
 			if (!row) return null;
 			const leaseExpired =
-				row.lease_expires_at === null || integer(row.lease_expires_at) <= now;
+				row.lease_expires_at === null ||
+				integer(row.lease_expires_at, 'lease_expires_at') <= now;
 			const claimable =
 				row.mode === 'live' &&
 				(row.status === 'queued' ||
@@ -1451,7 +1699,8 @@ export class DatabaseWorkflowsRepository implements WorkflowsRepository {
 						row.status,
 					) &&
 						leaseExpired) ||
-					(row.status === 'waiting-retry' && leaseExpired));
+					(['waiting-retry', 'waiting-approval'].includes(row.status) &&
+						leaseExpired));
 			if (!claimable) return null;
 			const priorLease = row.lease_owner;
 			const recovering = priorLease !== null && row.status !== 'queued';
@@ -1459,7 +1708,9 @@ export class DatabaseWorkflowsRepository implements WorkflowsRepository {
 			   after its node starts would make the new waiting-child projection
 			   unreachable by the next claim. */
 			const status =
-				row.status === 'queued' || row.status === 'waiting-retry'
+				row.status === 'queued' ||
+				row.status === 'waiting-retry' ||
+				row.status === 'waiting-approval'
 					? 'running'
 					: row.status;
 			const changed = await this.#exec(transaction, SQL.claimRun, [
@@ -1711,10 +1962,11 @@ export class DatabaseWorkflowsRepository implements WorkflowsRepository {
 		runId: string,
 		nodeId: string,
 		attempt: number,
-		childKind: 'agent' | 'action',
+		childKind: 'agent' | 'action' | 'approval',
 		childId: string,
 		observationDeadlineAt: number,
 		recordedAt: number,
+		recheckAt?: number,
 	): Promise<void> {
 		await this.#tx(tenantId, 'write', async (transaction) => {
 			const changed = await this.#exec(
@@ -1742,6 +1994,20 @@ export class DatabaseWorkflowsRepository implements WorkflowsRepository {
 					runId,
 				]);
 			}
+			/* An approval takes the run out of the claim queue entirely, so the
+			   recheck it arms is the only thing that brings it back on its own. */
+			if (childKind === 'approval') {
+				await this.#exec(transaction, SQL.armNodeRecheck, [
+					recheckAt ?? recordedAt,
+					tenantId,
+					runId,
+					nodeId,
+				]);
+				await this.#exec(transaction, SQL.markRunWaitingApproval, [
+					tenantId,
+					runId,
+				]);
+			}
 			await this.#appendEvent(
 				transaction,
 				tenantId,
@@ -1753,6 +2019,53 @@ export class DatabaseWorkflowsRepository implements WorkflowsRepository {
 		});
 	}
 
+	/**
+	 * Re-arms the wait on an approval the worker found still pending. It records
+	 * no event and touches no attempt: the run simply goes back to sleep with a
+	 * later recheck than the one that woke it.
+	 */
+	async suspendApproval(
+		tenantId: string,
+		runId: string,
+		nodeId: string,
+		recheckAt: number,
+	): Promise<void> {
+		await this.#tx(tenantId, 'write', async (transaction) => {
+			await this.#exec(transaction, SQL.armNodeRecheck, [
+				recheckAt,
+				tenantId,
+				runId,
+				nodeId,
+			]);
+			await this.#exec(transaction, SQL.markRunWaitingApproval, [
+				tenantId,
+				runId,
+			]);
+		});
+	}
+
+	/**
+	 * Brings a sleeping run back into the claim queue the moment approvals.core
+	 * reports a decision, by making the node's recheck due now. It matches on the
+	 * request id, so a callback for a request the run has moved past changes
+	 * nothing.
+	 */
+	async wakeApproval(
+		tenantId: string,
+		runId: string,
+		requestId: string,
+		now: number,
+	): Promise<void> {
+		await this.#tx(tenantId, 'write', async (transaction) => {
+			await this.#exec(transaction, SQL.wakeApprovalRun, [
+				now,
+				tenantId,
+				runId,
+				requestId,
+			]);
+		});
+	}
+
 	async settleAttempt(
 		write: SettleAttemptWrite,
 		actor: Actor,
@@ -1783,7 +2096,7 @@ export class DatabaseWorkflowsRepository implements WorkflowsRepository {
 						);
 			const duration = Math.max(
 				0,
-				write.recordedAt - integer(prior.started_at),
+				write.recordedAt - integer(prior.started_at, 'started_at'),
 			);
 			await this.#exec(transaction, SQL.settleAttempt, [
 				write.status,
@@ -2214,19 +2527,14 @@ export class DatabaseWorkflowsRepository implements WorkflowsRepository {
 				SQL.readAttempts,
 				[tenantId, runId],
 			);
-			return states.map((state) => ({
-				nodeId: state.node_id,
-				status: state.status,
-				latestAttempt: integer(state.latest_attempt),
-				selectedOutcomePort: state.selected_outcome_port,
-				nextAttemptAt: optionalInteger(state.next_attempt_at),
-				readyAt: optionalInteger(state.ready_at),
-				startedAt: optionalInteger(state.started_at),
-				settledAt: optionalInteger(state.settled_at),
-				attempts: attempts
-					.filter((attempt) => attempt.node_id === state.node_id)
-					.map(attemptFromRow),
-			}));
+			return states.map((state) =>
+				nodeExecutionFromRow(
+					state,
+					attempts
+						.filter((attempt) => attempt.node_id === state.node_id)
+						.map(attemptFromRow),
+				),
+			);
 		});
 	}
 
@@ -2240,46 +2548,50 @@ export class DatabaseWorkflowsRepository implements WorkflowsRepository {
 					tenantId,
 					runId,
 				])
-			).map((row) => ({
-				edgeId: row.edge_id,
-				sourceNodeId: row.source_node_id,
-				sourcePort: row.source_port,
-				sourceAttempt: optionalInteger(row.source_attempt),
-				targetNodeId: row.target_node_id,
-				targetPort: row.target_port,
-				state: row.state,
-				reason: row.reason,
-				evidence: parse<WorkflowPayloadEvidenceV1>(row.evidence_json),
-				settledAt: integer(row.settled_at),
-			})),
+			).map(edgeFromRow),
 		);
 	}
 
+	/* The chain order is the sequence; the time order rides the index 0001 made
+	   for it, with the sequence as the tie breaker in both. */
 	async listAudit(
 		tenantId: string,
-		limit: number,
-		beforeSequence?: number,
-	): Promise<WorkflowAuditPage> {
-		const bounded = Math.min(Math.max(1, Math.trunc(limit)), 100);
+		read: WorkflowAuditListRead,
+	): Promise<WorkflowKeysetPage<WorkflowAuditEvent>> {
+		const { parameters, bind } = binder();
+		const clauses = [`tenant_id = ${bind(tenantId)}`];
+		const columns =
+			read.sort === 'sequence' ? ['sequence'] : ['occurred_at', 'sequence'];
+		if (read.after) {
+			const keyset = keysetWhere(
+				columns,
+				read.sort === 'sequence'
+					? [read.after.id]
+					: [read.after.key, read.after.id],
+				{ direction: read.direction, parameterOffset: parameters.length },
+			);
+			clauses.push(keyset.text);
+			parameters.push(...keyset.parameters);
+		}
+		const order = orderDirection(read.direction);
+		const text = `SELECT sequence, actor_json, origin_json, action, subject_type,
+		 subject_id, metadata_json, occurred_at, previous_hash, event_hash
+		 FROM workflow_audit_events WHERE ${clauses.join(' AND ')}
+		 ORDER BY ${columns.map((column) => `${column} ${order}`).join(', ')}
+		 LIMIT ${bind(read.limit)}`;
 		const rows = await this.#tx(tenantId, 'read', (transaction) =>
-			beforeSequence === undefined
-				? this.#query<AuditRow>(transaction, SQL.listAudit, [
-						tenantId,
-						bounded + 1,
-					])
-				: this.#query<AuditRow>(transaction, SQL.listAuditBefore, [
-						tenantId,
-						beforeSequence,
-						bounded + 1,
-					]),
+			this.#query<AuditRow>(transaction, text, parameters),
 		);
-		const events = rows.slice(0, bounded).map(auditFromRow);
+		const items = rows.map(auditFromRow);
+		const last = items.at(-1);
 		return {
-			events,
-			nextCursor:
-				rows.length > bounded && events.at(-1)
-					? String(events.at(-1)!.sequence)
-					: null,
+			items,
+			last: last
+				? {
+						key: read.sort === 'sequence' ? last.sequence : last.occurredAt,
+						id: last.sequence,
+					}
+				: null,
 		};
 	}
 
@@ -2378,7 +2690,7 @@ export class DatabaseWorkflowsRepository implements WorkflowsRepository {
 						[row.tenant_id, row.run_id],
 					)
 				)[0];
-				if (integer(remaining?.count ?? 0) === 0) {
+				if (integer(remaining?.count ?? 0, 'count') === 0) {
 					await this.#exec(transaction, SQL.expireRunOutputEvidence, [
 						row.tenant_id,
 						row.run_id,
@@ -2400,7 +2712,184 @@ export class DatabaseWorkflowsRepository implements WorkflowsRepository {
 					])
 				)[0],
 		);
-		return integer(row?.count ?? 0);
+		return integer(row?.count ?? 0, 'count');
+	}
+
+	/* The operations behind the declared data classes. Each runs on this
+	   module's own lease, inside its own tenant-scoped transaction. */
+
+	async exportRunsPage(
+		tenantId: string,
+		after: WorkflowRunExportCursor | null,
+		limit: number,
+	): Promise<readonly ExportedWorkflowRun[]> {
+		return this.#tx(tenantId, 'read', async (transaction) => {
+			const runs =
+				after === null
+					? await this.#query<RunRow>(transaction, SQL.exportRunsPage, [
+							tenantId,
+							limit,
+						])
+					: await this.#query<RunRow>(transaction, SQL.exportRunsPageAfter, [
+							tenantId,
+							after.queuedAt,
+							after.queuedAt,
+							after.id,
+							limit,
+						]);
+			if (runs.length === 0) return [];
+			/* Three queries for the whole page: a run is a row, not four round
+			   trips. */
+			const ids = runs.map((run) => run.id);
+			const states = await this.#query<ExportNodeStateRow>(
+				transaction,
+				SQL.exportNodeStates,
+				[tenantId, ids],
+			);
+			const attempts = await this.#query<ExportAttemptRow>(
+				transaction,
+				SQL.exportAttempts,
+				[tenantId, ids],
+			);
+			const edges = await this.#query<ExportEdgeRow>(
+				transaction,
+				SQL.exportEdges,
+				[tenantId, ids],
+			);
+			/* One pass per result set into its buckets, so assembling a page costs
+			   O(runs + states + attempts + edges). Scanning each child set once per
+			   run is what turns a page of long runs quadratic. Each bucket keeps
+			   the order its query returned. */
+			const statesByRun = new Map<string, ExportNodeStateRow[]>();
+			for (const state of states) bucketed(statesByRun, state.run_id, state);
+			const attemptsByNode = new Map<string, ExportAttemptRow[]>();
+			for (const attempt of attempts) {
+				bucketed(
+					attemptsByNode,
+					nodeKey(attempt.run_id, attempt.node_id),
+					attempt,
+				);
+			}
+			const edgesByRun = new Map<string, ExportEdgeRow[]>();
+			for (const edge of edges) bucketed(edgesByRun, edge.run_id, edge);
+			return runs.map((run) => ({
+				run: runFromRow(run),
+				nodes: (statesByRun.get(run.id) ?? []).map((state) =>
+					nodeExecutionFromRow(
+						state,
+						(attemptsByNode.get(nodeKey(run.id, state.node_id)) ?? []).map(
+							attemptFromRow,
+						),
+					),
+				),
+				edges: (edgesByRun.get(run.id) ?? []).map(edgeFromRow),
+			}));
+		});
+	}
+
+	async exportAuditEventsPage(
+		tenantId: string,
+		afterSequence: number,
+		limit: number,
+	): Promise<readonly WorkflowAuditEvent[]> {
+		return this.#tx(tenantId, 'read', async (transaction) =>
+			(
+				await this.#query<AuditRow>(transaction, SQL.exportAuditEventsPage, [
+					tenantId,
+					afterSequence,
+					limit,
+				])
+			).map(auditFromRow),
+		);
+	}
+
+	async deleteRunsSettledBefore(
+		tenantId: string,
+		before: number,
+		limit: number,
+	): Promise<number> {
+		return this.#tx(tenantId, 'write', async (transaction) => {
+			const rows = await this.#query<{ id: string }>(
+				transaction,
+				SQL.settledRunsBefore,
+				[tenantId, before, limit],
+			);
+			return this.#deleteRunsIn(transaction, tenantId, rows);
+		});
+	}
+
+	/* A run this removes while a worker holds it takes its lease with it: the
+	   next renewal finds no row and the worker stops as it does for any lease
+	   it lost. */
+	async deleteRunsOfSubject(
+		tenantId: string,
+		accountId: string,
+		limit: number,
+	): Promise<number> {
+		return this.#tx(tenantId, 'write', async (transaction) => {
+			const rows = await this.#query<{ id: string }>(
+				transaction,
+				SQL.runsOfSubject,
+				[tenantId, accountId, limit],
+			);
+			return this.#deleteRunsIn(transaction, tenantId, rows);
+		});
+	}
+
+	/* No foreign key hangs off a run, so the child rows are named here. A run
+	   and its evidence leave in one transaction or not at all. */
+	async #deleteRunsIn(
+		transaction: DatabaseTransaction,
+		tenantId: string,
+		rows: readonly { readonly id: string }[],
+	): Promise<number> {
+		if (rows.length === 0) return 0;
+		const ids = rows.map((row) => row.id);
+		for (const statement of [
+			SQL.deleteRunNodeStates,
+			SQL.deleteRunAttempts,
+			SQL.deleteRunEdges,
+			SQL.deleteRunEvents,
+			SQL.deleteRunPayloads,
+		]) {
+			await this.#exec(transaction, statement, [tenantId, ids]);
+		}
+		return this.#exec(transaction, SQL.deleteRunRows, [tenantId, ids]);
+	}
+
+	async exportPublishedDefinitionsPage(
+		tenantId: string,
+		after: WorkflowDefinitionExportCursor | null,
+		limit: number,
+	): Promise<readonly ExportedWorkflowDefinition[]> {
+		return this.#tx(tenantId, 'read', async (transaction) => {
+			const rows =
+				after === null
+					? await this.#query<ExportDefinitionRow>(
+							transaction,
+							SQL.exportPublishedDefinitions,
+							[tenantId, limit],
+						)
+					: await this.#query<ExportDefinitionRow>(
+							transaction,
+							SQL.exportPublishedDefinitionsAfter,
+							[tenantId, after.name, after.name, after.id, limit],
+						);
+			return rows.map((row) => ({
+				definition: definitionFromRow(row),
+				revision: revisionFromRow({
+					id: row.revision_id,
+					workflow_id: row.revision_workflow_id,
+					revision: row.revision_number,
+					graph_json: row.graph_json,
+					graph_checksum: row.graph_checksum,
+					compiler_version: row.compiler_version,
+					compiled_order_json: row.compiled_order_json,
+					published_at: row.published_at,
+					published_actor_json: row.published_actor_json,
+				}),
+			}));
+		});
 	}
 
 	async close(): Promise<void> {}