@inflexa-ai/harness 0.45.0 → 0.46.0

package/dist/execution/run-canceler.d.ts

@@ -1,18 +1,32 @@
 /**
  * RunCanceler — the encapsulated external-cancel path for an `executeAnalysis` run.
  *
- * A cancelled DBOS workflow can never execute another step, so the body's own
- * terminal block (`collectAndComplete`) is unreachable on external cancel and
- * nothing converges: the run row stays `running` (blocking same-plan relaunch
- * through `queryActiveRun`'s active-status dedup), pending step rows never
- * sweep, the running charge never closes, and the run mandate is never
- * revoked. This module is the host-side counterpart: cancel the engine's
- * parent + children, then converge each ledger the workflow would have.
+ * A cancelled DBOS workflow can never start another step, so the body's own
+ * terminal block (`collectAndComplete`) can be unreachable once the cancel lands
+ * and nothing converges: the run row stays `running` (blocking same-plan relaunch
+ * through `queryActiveRun`'s active-status dedup) and pending step rows never
+ * sweep. A step that started before the cancel still runs to its end, and its
+ * run status write is conditional on a `running` row. This module is the
+ * host-side counterpart: cancel the engine's parent + children, then converge
+ * the ledgers the workflow would have.
+ *
+ * The writer that wins the conditional terminal write of the run row owns the
+ * run end: the run emit, the charge close, and the mandate revoke. This module
+ * does those acts only when its write changed the row. A refused write means
+ * the body won the row and owns them; a failed write leaves the row `running`,
+ * so a second cancel converges the run. The step rows settle on every path.
+ *
+ * One exception: after a failed status write the body does the run end and
+ * records it as a workflow event (`run-end-record.ts`), while the row stays
+ * `running`. This module reads that record before its terminal write. A present
+ * record makes the terminal write carry the recorded status and error, and no
+ * act of the run end follows. A failed read writes nothing, so a second cancel
+ * converges the run.
  *
  * The engine capability stays internal — the production default is the
  * purger's `DBOSClient`-backed child-cascading cancel, which needs no launched
  * engine (see `dbos-workflow-purger.ts` for why the static `DBOS` facade is
- * the wrong tool here). `cancelWorkflows` is an optional test seam over it.
+ * the wrong tool here). `cancelWorkflows` is an optional injected function over it.
  *
  * No stream writes: `DBOS.writeStream` writes only from inside the workflow
  * that owns the stream, so the run-event reader (`run-event-stream.ts`)
@@ -22,13 +36,14 @@ import type { Pool } from "pg";
 import type { AgentSession } from "../auth/types.js";
 import type { RunCharge } from "../billing/run-charge.js";
 import type { Logger } from "../lib/logger.js";
+import type { ProvenanceSeam } from "../provenance/seam.js";
 import type { RunStatus } from "../state/schema.js";
 import type { RunAuthorizer } from "./run-authorizer.js";
 export declare class UnknownRunError extends Error {
     readonly runId: string;
     constructor(runId: string);
 }
-export interface CancelRunResult {
+export type CancelRunResult = {
     readonly runId: string;
     /** The DBOS parent workflow id — equal to `runId` by the launch contract
      * (`execute_analysis` launches with `workflowId: runId`). */
@@ -40,29 +55,36 @@ export interface CancelRunResult {
      * (the conditional write refuses to clobber it).
      */
     readonly finalStatus: RunStatus;
-    /** What actually converged. `mandate` is vacuously true for a row with no
-     * persisted jti — nothing to revoke, so hosts alert on any false flag. */
+    /** What actually converged. `charge` and `mandate` are vacuously true when
+     * there is nothing for this cancel to converge — a refused terminal write
+     * (the body owns them) and, for `mandate`, a row with no persisted mandate id — so
+     * hosts alert on any false flag. */
     readonly converged: {
         readonly steps: boolean;
         readonly charge: boolean;
         readonly mandate: boolean;
     };
-}
-export interface RunCancelerDeps {
+};
+export type RunCancelerDeps = {
     readonly pool: Pool;
     readonly runCharge: RunCharge;
     readonly runAuthorizer: RunAuthorizer;
     readonly logger?: Logger;
-    /** Test seam over the engine cancel. Production default: the workflow
+    /** Receives the end of a run that this canceler cancels. An absent binding, or a binding with no run emit, emits nothing. */
+    readonly provenance?: ProvenanceSeam;
+    /** The engine cancel. Production default: the workflow
      * purger's `DBOSClient`-backed cancel, child-cascading and launch-free. */
     readonly cancelWorkflows?: (workflowIds: readonly string[]) => Promise<void>;
-}
-export interface RunCanceler {
+    /** The run end that the body recorded: `null` when it recorded none, a rejection when the read fails.
+     * The value is unchecked engine data. Production default: `DBOSClient.getEvent` with a zero timeout. */
+    readonly readRecordedRunEnd?: (runId: string) => Promise<unknown>;
+};
+export type RunCanceler = {
     /**
      * Cancel the run's workflows and converge its ledgers. Rejects when the
      * engine cancel itself fails (retry-safe: nothing converged) or the run is
      * unknown; convergence-phase failures resolve with their flag false.
      */
     cancel(runId: string, session: AgentSession): Promise<CancelRunResult>;
-}
+};
 export declare function createRunCanceler(deps: RunCancelerDeps): RunCanceler;

package/dist/execution/run-canceler.js

@@ -1,18 +1,32 @@
 /**
  * RunCanceler — the encapsulated external-cancel path for an `executeAnalysis` run.
  *
- * A cancelled DBOS workflow can never execute another step, so the body's own
- * terminal block (`collectAndComplete`) is unreachable on external cancel and
- * nothing converges: the run row stays `running` (blocking same-plan relaunch
- * through `queryActiveRun`'s active-status dedup), pending step rows never
- * sweep, the running charge never closes, and the run mandate is never
- * revoked. This module is the host-side counterpart: cancel the engine's
- * parent + children, then converge each ledger the workflow would have.
+ * A cancelled DBOS workflow can never start another step, so the body's own
+ * terminal block (`collectAndComplete`) can be unreachable once the cancel lands
+ * and nothing converges: the run row stays `running` (blocking same-plan relaunch
+ * through `queryActiveRun`'s active-status dedup) and pending step rows never
+ * sweep. A step that started before the cancel still runs to its end, and its
+ * run status write is conditional on a `running` row. This module is the
+ * host-side counterpart: cancel the engine's parent + children, then converge
+ * the ledgers the workflow would have.
+ *
+ * The writer that wins the conditional terminal write of the run row owns the
+ * run end: the run emit, the charge close, and the mandate revoke. This module
+ * does those acts only when its write changed the row. A refused write means
+ * the body won the row and owns them; a failed write leaves the row `running`,
+ * so a second cancel converges the run. The step rows settle on every path.
+ *
+ * One exception: after a failed status write the body does the run end and
+ * records it as a workflow event (`run-end-record.ts`), while the row stays
+ * `running`. This module reads that record before its terminal write. A present
+ * record makes the terminal write carry the recorded status and error, and no
+ * act of the run end follows. A failed read writes nothing, so a second cancel
+ * converges the run.
  *
  * The engine capability stays internal — the production default is the
  * purger's `DBOSClient`-backed child-cascading cancel, which needs no launched
  * engine (see `dbos-workflow-purger.ts` for why the static `DBOS` facade is
- * the wrong tool here). `cancelWorkflows` is an optional test seam over it.
+ * the wrong tool here). `cancelWorkflows` is an optional injected function over it.
  *
  * No stream writes: `DBOS.writeStream` writes only from inside the workflow
  * that owns the stream, so the run-event reader (`run-event-stream.ts`)
@@ -22,9 +36,11 @@ import { createNoopLogger } from "../lib/console-logger.js";
 import { deliverNotice } from "../lib/hooks.js";
 import { elapsedSinceIso, recordRunCompleted, recordStepCompleted } from "../lib/metrics.js";
 import { unwrapOrThrow } from "../lib/result.js";
-import { markRunCanceledIfActive, queryRun } from "../state/runs.js";
-import { queryStepsByRun, sweepPendingStepExecutions } from "../state/step-executions.js";
-import { createDbosWorkflowPurger } from "./dbos-workflow-purger.js";
+import { markRunCanceledIfActive, queryRun, updateRunStatus } from "../state/runs.js";
+import { cancelRunningStepExecutions, queryStepsByRun, sweepPendingStepExecutions } from "../state/step-executions.js";
+import { clearPausesOfWork } from "../state/paused-work.js";
+import { createDbosWorkflowPurger, dbosClientFor } from "./dbos-workflow-purger.js";
+import { parseRecordedRunEnd, RUN_END_EVENT_KEY } from "./run-end-record.js";
 /** The reason stamped on the run row and the revoke — the same literal
  * `collectAndComplete` records for a cancel it observes from inside. */
 const EXTERNAL_CANCEL_REASON = "external_cancel";
@@ -36,7 +52,7 @@ export class UnknownRunError extends Error {
         this.name = "UnknownRunError";
     }
 }
-const TERMINAL = new Set(["completed", "partial", "failed", "canceled", "suspended_insufficient_funds"]);
+const TERMINAL = new Set(["completed", "partial", "failed", "canceled"]);
 export function createRunCanceler(deps) {
     const { pool, runCharge, runAuthorizer } = deps;
     const logger = (deps.logger ?? createNoopLogger()).named("run-canceler");
@@ -52,9 +68,22 @@ export function createRunCanceler(deps) {
         })();
         await engineCancel(workflowIds);
     };
+    const readRecordedRunEnd = deps.readRecordedRunEnd ??
+        (async (runId) => (await dbosClientFor(pool, logger)).getEvent(runId, RUN_END_EVENT_KEY, 0));
     /** Steps whose child started (a persisted child workflow id) and has not written its terminal row. */
     const incompleteSteps = async (runId) => unwrapOrThrow(await queryStepsByRun(pool, runId)).filter((step) => step.childWorkflowId !== null && step.completedAt === null);
     const childIds = (steps) => steps.flatMap((step) => (step.childWorkflowId !== null ? [step.childWorkflowId] : []));
+    const emitRunEvent = deps.provenance?.emitRunEvent;
+    const emitGuarded = (event, session) => {
+        if (emitRunEvent === undefined)
+            return;
+        try {
+            emitRunEvent(event, session);
+        }
+        catch (err) {
+            logger.error("the run emit of the provenance binding threw", { runId: event.runId, event: event.type, ...logger.errorFields(err) });
+        }
+    };
     return {
         async cancel(runId, session) {
             const row = unwrapOrThrow(await queryRun(pool, runId));
@@ -89,38 +118,118 @@ export function createRunCanceler(deps) {
             catch (err) {
                 logger.error("late-child cancel sweep failed", { runId, ...logger.errorFields(err) });
             }
-            // Convergence — each phase isolated so one failure skips nothing after it.
-            let transitioned = false;
+            // The cancel ended each wait of a paused step, and no workflow of the run deletes its row again.
+            const cleared = await clearPausesOfWork(pool, runId);
+            if (cleared.isErr())
+                logger.error("the pauses of the run did not clear", { runId, op: cleared.error.op });
+            // The run end that the body recorded after a failed status write. A value
+            // that is not a recorded run end counts as a failed read.
+            let recorded = null;
+            let readFailed = false;
             try {
-                transitioned = unwrapOrThrow(await markRunCanceledIfActive(pool, runId, EXTERNAL_CANCEL_REASON));
+                const value = await readRecordedRunEnd(runId);
+                if (value !== null && value !== undefined) {
+                    recorded = parseRecordedRunEnd(value);
+                    if (recorded === null) {
+                        readFailed = true;
+                        logger.error("the recorded run end has the wrong shape", { runId });
+                    }
+                }
             }
             catch (err) {
-                logger.error("markRunCanceledIfActive failed", { runId, ...logger.errorFields(err) });
+                readFailed = true;
+                logger.error("the read of the recorded run end failed", { runId, ...logger.errorFields(err) });
+            }
+            // Convergence — each phase isolated so one failure skips nothing after it.
+            // The terminal write has three outcomes: changed (this cancel won the row),
+            // refused (the body won it), failed (the row is unchanged). A failed read of
+            // the recorded run end is a failed write that never ran.
+            let writeOutcome = "failed";
+            if (!readFailed) {
+                try {
+                    const changed = recorded === null
+                        ? unwrapOrThrow(await markRunCanceledIfActive(pool, runId, EXTERNAL_CANCEL_REASON))
+                        : unwrapOrThrow(await updateRunStatus(pool, runId, recorded.status, recorded.error));
+                    writeOutcome = changed ? "changed" : "refused";
+                }
+                catch (err) {
+                    logger.error("the terminal write of the run failed", { runId, ...logger.errorFields(err) });
+                }
+            }
+            const transitioned = writeOutcome === "changed";
+            // A terminal step of the workflow that started before the cancel can still
+            // write, but its write is conditional on a `running` row too. The first
+            // write wins, and the run-end acts ride behind the write that won: a
+            // refused write means the run settled on its own and its own terminal step
+            // does them. A cut child never reached its terminal row, so its step
+            // records here too. A recorded run end means the body did the acts, so
+            // only the run metric rides behind the repair write.
+            if (transitioned && recorded !== null) {
+                recordRunCompleted({ workflow: "analysis", status: recorded.status, durationMs: elapsedSinceIso(row.startedAt) });
             }
-            // The workflow's own terminal step never runs after a cancel, so this
-            // conditional write is the one terminal write of an external cancel, and
-            // the outcome metrics ride behind it: a refused write means the run
-            // settled on its own and its own terminal step recorded them. A cut
-            // child never reached its terminal row, so its step records here too.
-            if (transitioned) {
+            if (transitioned && recorded === null) {
                 recordRunCompleted({ workflow: "analysis", status: "canceled", durationMs: elapsedSinceIso(row.startedAt) });
                 for (const step of cutSteps ?? [])
                     recordStepCompleted({ agentId: step.agentId, status: "canceled" });
+                // The end of the run rides the same condition. One wall-clock read stamps every event:
+                // the canceler is not a workflow, so no replay fires these emits again.
+                const atMs = Date.now();
+                for (const step of cutSteps ?? []) {
+                    const durationMs = elapsedSinceIso(step.startedAt, atMs);
+                    const event = {
+                        type: "step_completed",
+                        analysisId: row.analysisId,
+                        runId,
+                        stepId: step.stepId,
+                        status: "canceled",
+                        atMs,
+                    };
+                    if (durationMs !== undefined)
+                        event.durationMs = durationMs;
+                    emitGuarded(event, session);
+                }
+                emitGuarded({
+                    type: "run_completed",
+                    analysisId: row.analysisId,
+                    runId,
+                    status: "canceled",
+                    atMs,
+                    durationMs: Math.max(0, atMs - Date.parse(row.startedAt)),
+                }, session);
             }
-            let steps = false;
+            let pendingSwept = false;
             try {
                 unwrapOrThrow(await sweepPendingStepExecutions(pool, runId));
-                steps = true;
+                pendingSwept = true;
             }
             catch (err) {
                 logger.error("pending-step sweep failed", { runId, ...logger.errorFields(err) });
             }
-            const charge = await deliverNotice(logger.with({ runId }), "RunCharge.close", runCharge.close({ analysisId: row.analysisId, runId, outcome: { kind: "canceled" }, session }));
-            const mandate = row.mandateJti === null ||
-                (await deliverNotice(logger.with({ runId, jti: row.mandateJti }), "RunAuthorizer.revokeByJti", runAuthorizer.revokeByJti({ jti: row.mandateJti, auth: session.auth }, EXTERNAL_CANCEL_REASON)));
+            let runningSettled = false;
+            try {
+                unwrapOrThrow(await cancelRunningStepExecutions(pool, runId, EXTERNAL_CANCEL_REASON));
+                runningSettled = true;
+            }
+            catch (err) {
+                logger.error("running-step settle failed", { runId, ...logger.errorFields(err) });
+            }
+            const steps = pendingSwept && runningSettled;
+            // Only the writer that won the row closes the charge and revokes. A refused
+            // write left both to the body; a failed write left the row `running`, so a
+            // second cancel converges the run. The flags of a refused write are true
+            // because there is nothing for this cancel to converge. With a recorded run
+            // end the body did both acts, and the flags are its results.
+            let charge = recorded !== null ? recorded.closed : writeOutcome === "refused";
+            let mandate = recorded !== null ? recorded.revoked : writeOutcome === "refused" || (writeOutcome === "failed" && row.mandateId === null);
+            if (transitioned && recorded === null) {
+                charge = await deliverNotice(logger.with({ runId }), "RunCharge.close", runCharge.close({ analysisId: row.analysisId, runId, outcome: { kind: "canceled" }, session }));
+                mandate =
+                    row.mandateId === null ||
+                        (await deliverNotice(logger.with({ runId, mandateId: row.mandateId }), "RunAuthorizer.revokeByMandateId", runAuthorizer.revokeByMandateId({ mandateId: row.mandateId, auth: session.auth }, EXTERNAL_CANCEL_REASON)));
+            }
             // No transition means the run reached a terminal state on its own (or the
             // write failed) — report the row as it stands rather than claiming `canceled`.
-            let finalStatus = "canceled";
+            let finalStatus = recorded?.status ?? "canceled";
             if (!transitioned) {
                 const reread = unwrapOrThrow(await queryRun(pool, runId));
                 finalStatus = reread?.status ?? "canceled";

package/dist/execution/run-end-record.d.ts

@@ -0,0 +1,29 @@
+import { z } from "zod";
+/**
+ * The workflow event under which the body of `executeAnalysis` records its run
+ * end after a failed status write. The run canceler reads it with
+ * `DBOSClient.getEvent`.
+ */
+export declare const RUN_END_EVENT_KEY = "run-end";
+/**
+ * The run end that the body did: the status and the error that its failed
+ * status write tried to write, and the results of the charge close and of the
+ * revoke.
+ */
+export declare const RecordedRunEndSchema: z.ZodObject<{
+    status: z.ZodEnum<{
+        canceled: "canceled";
+        completed: "completed";
+        failed: "failed";
+        partial: "partial";
+    }>;
+    error: z.ZodNullable<z.ZodString>;
+    closed: z.ZodBoolean;
+    revoked: z.ZodBoolean;
+}, z.core.$strip>;
+export type RecordedRunEnd = z.infer<typeof RecordedRunEndSchema>;
+/**
+ * The engine hands back deserialized data, thus a value of an event is unknown
+ * until this check. A value of the wrong shape gives `null`.
+ */
+export declare function parseRecordedRunEnd(value: unknown): RecordedRunEnd | null;

package/dist/execution/run-end-record.js

@@ -0,0 +1,27 @@
+import { z } from "zod";
+import { RunStatus } from "../state/schema.js";
+/**
+ * The workflow event under which the body of `executeAnalysis` records its run
+ * end after a failed status write. The run canceler reads it with
+ * `DBOSClient.getEvent`.
+ */
+export const RUN_END_EVENT_KEY = "run-end";
+/**
+ * The run end that the body did: the status and the error that its failed
+ * status write tried to write, and the results of the charge close and of the
+ * revoke.
+ */
+export const RecordedRunEndSchema = z.object({
+    status: RunStatus.exclude(["running"]),
+    error: z.string().nullable(),
+    closed: z.boolean(),
+    revoked: z.boolean(),
+});
+/**
+ * The engine hands back deserialized data, thus a value of an event is unknown
+ * until this check. A value of the wrong shape gives `null`.
+ */
+export function parseRecordedRunEnd(value) {
+    const parsed = RecordedRunEndSchema.safeParse(value);
+    return parsed.success ? parsed.data : null;
+}

package/dist/execution/run-event-parts.d.ts

@@ -17,14 +17,6 @@ import type { ChatPart } from "../contracts/chat-parts.js";
  * contract is the `ChatPart` union, so anything the registry does not
  * classify is not deliverable — which also covers a part written by a producer
  * newer than the reader.
- *
- * The registry is keyed by the discriminant alone, so this validates `type` and
- * trusts the producer for the payload. The part schemas in `contracts/schemas/`
- * are for a consumer at the edge of the package, which parses what it receives.
- * Both ends of this stream are typed against the same union inside this package,
- * so the discriminant is the boundary that can drift (a producer that emits
- * something else entirely), and a part that fails its schema still reaches the
- * consumer for its own check.
  */
 export declare function parseRunEventPart(value: unknown): ChatPart | null;
 /**

package/dist/execution/run-event-parts.js

@@ -7,8 +7,23 @@
  * They live apart from the reader, thus a test drives them directly instead of
  * through a subscription.
  */
+import { setTimeout as sleep } from "node:timers/promises";
 import { reconcileKey } from "../contracts/chat-frame.js";
 import { PART_REGISTRY } from "../contracts/part-registry.js";
+import { parseUnknownRecord } from "../lib/unknown-containers.js";
+/**
+ * The registry is keyed by the discriminant alone, so this validates `type` and
+ * trusts the producer for the payload. The part schemas in `contracts/schemas/`
+ * are for a consumer at the edge of the package, which parses what it receives.
+ * Both ends of this stream are typed against the same union inside this package,
+ * so the discriminant is the boundary that can drift (a producer that emits
+ * something else entirely), and a part that fails its schema still reaches the
+ * consumer for its own check.
+ */
+function isChatPartRecord(record) {
+    const { type } = record;
+    return typeof type === "string" && Object.hasOwn(PART_REGISTRY, type);
+}
 /**
  * Narrow one raw stream value to a chat data part, or `null` when it is not one.
  *
@@ -18,24 +33,12 @@ import { PART_REGISTRY } from "../contracts/part-registry.js";
  * contract is the `ChatPart` union, so anything the registry does not
  * classify is not deliverable — which also covers a part written by a producer
  * newer than the reader.
- *
- * The registry is keyed by the discriminant alone, so this validates `type` and
- * trusts the producer for the payload. The part schemas in `contracts/schemas/`
- * are for a consumer at the edge of the package, which parses what it receives.
- * Both ends of this stream are typed against the same union inside this package,
- * so the discriminant is the boundary that can drift (a producer that emits
- * something else entirely), and a part that fails its schema still reaches the
- * consumer for its own check.
  */
 export function parseRunEventPart(value) {
-    if (typeof value !== "object" || value === null)
-        return null;
-    const type = value.type;
-    if (typeof type !== "string")
+    const record = parseUnknownRecord(value);
+    if (record === undefined || !isChatPartRecord(record))
         return null;
-    if (!Object.hasOwn(PART_REGISTRY, type))
-        return null;
-    return value;
+    return record;
 }
 /**
  * Collapse a batch of parts so each reconciling id appears once, carrying its
@@ -78,10 +81,12 @@ export function foldRunEventParts(parts) {
 export async function pipeFoldedRunEvents(entries, emit, flushMs) {
     const latestByKey = new Map();
     const pendingKeys = new Set();
-    let flushTimer = null;
+    // The gate of the one armed flush wait: present while a window is open, so a
+    // second entry in the window reuses it instead of arming a second flush.
+    let flushGate;
     let flushChain = Promise.resolve();
     const flushPending = async () => {
-        flushTimer = null;
+        flushGate = undefined;
         const keys = [...pendingKeys];
         pendingKeys.clear();
         for (const key of keys) {
@@ -91,14 +96,15 @@ export async function pipeFoldedRunEvents(entries, emit, flushMs) {
         }
     };
     const scheduleFlush = () => {
-        if (flushTimer !== null)
+        if (flushGate !== undefined)
             return;
-        flushTimer = setTimeout(() => {
+        flushGate = new AbortController();
+        sleep(flushMs, undefined, { signal: flushGate.signal }).then(() => {
             // A timed flush has no caller to report to. A lasting emit failure
             // still reaches the caller, through the next direct emit or the
             // final flush.
             flushChain = flushChain.then(flushPending).catch(() => undefined);
-        }, flushMs);
+        }, () => undefined);
     };
     try {
         for await (const entry of entries) {
@@ -114,10 +120,9 @@ export async function pipeFoldedRunEvents(entries, emit, flushMs) {
         }
     }
     finally {
-        if (flushTimer !== null) {
-            clearTimeout(flushTimer);
-            flushTimer = null;
-        }
+        // The abort ends the armed wait, whose rejection the second arm swallows,
+        // so the teardown does not wait out the window.
+        flushGate?.abort();
         await flushChain;
         if (pendingKeys.size > 0)
             await flushPending();

package/dist/execution/run-event-stream.d.ts

@@ -37,17 +37,17 @@ import { type DbError } from "../lib/db-result.js";
 import type { Logger } from "../lib/logger.js";
 import type { RunStatus } from "../state/schema.js";
 /** The part of a run row that the terminal part is made from. */
-export interface RunEventRunRead {
+export type RunEventRunRead = {
     readonly status: RunStatus;
     readonly error: string | null;
-}
+};
 /**
  * Construction-time dependencies. The pool is the application pool the run
  * ledger lives in; the logger is where every contained failure is reported, and
  * defaults to silence so an embedder that wired none sees nothing rather than
  * having console forced on it.
  */
-export interface RunEventStreamDeps {
+export type RunEventStreamDeps = {
     readonly pool: Pool;
     readonly logger?: Logger;
     /** Reads the status and the error of the run row, `null` when no row exists. Defaults to `queryRun` on `pool`. */
@@ -59,7 +59,7 @@ export interface RunEventStreamDeps {
     readonly readWorkflowStatus?: (runId: string) => Promise<string | null>;
     /** The wait between two reads of the run row. Defaults to a timer. */
     readonly sleep?: (ms: number) => Promise<void>;
-}
+};
 /**
  * Receives one part. May be async — the subscription awaits it, so a handler is
  * never invoked concurrently with itself and back-pressure is the caller's to
@@ -67,20 +67,20 @@ export interface RunEventStreamDeps {
  */
 export type RunEventPartHandler = (part: ChatPart) => void | Promise<void>;
 /** Call-time parameters of one subscription. */
-export interface RunEventSubscribeOptions {
+export type RunEventSubscribeOptions = {
     /** The run to observe. Also the parent workflow's id. */
     readonly runId: string;
     /** Where each delivered part goes. */
     readonly onPart: RunEventPartHandler;
     /** Aborting stops delivery and settles the returned promise. */
     readonly signal: AbortSignal;
-}
+};
 /**
  * The run-event read seam. One method, because a run-scoped subscription is the
  * whole capability: a general-purpose stream reader would leak the engine's model
  * back into the surface this exists to quarantine.
  */
-export interface RunEventStream {
+export type RunEventStream = {
     /**
      * Deliver every part the run produces — parent and children alike — to
      * `onPart`, resolving when the run is terminal, every stream opened has
@@ -103,7 +103,7 @@ export interface RunEventStream {
      * `runId`/`stepId` and the reconciling fold is per id.
      */
     subscribe(options: RunEventSubscribeOptions): Promise<void>;
-}
+};
 /**
  * Build the DBOS-backed realization of {@link RunEventStream}.
  *

package/dist/execution/run-event-stream.js

@@ -43,10 +43,6 @@ function partOfRow(runId, row) {
     switch (row.status) {
         case "canceled":
             return canceledPart(runId);
-        case "suspended_insufficient_funds":
-            return row.error === null
-                ? { type: "data-run-failed", runId, error: "Run suspended" }
-                : { type: "data-run-failed", runId, error: row.error, reason: row.error };
         case "failed":
             return { type: "data-run-failed", runId, error: row.error ?? "Run failed" };
         case "completed":
@@ -138,6 +134,7 @@ export function createRunEventStream(deps) {
                     while (pending.length > 0 && !signal.aborted) {
                         const batch = pending.splice(0, pending.length);
                         for (const part of foldRunEventParts(batch)) {
+                            // oxlint-disable-next-line no-unnecessary-condition -- tsgolint cannot see the event wiring that aborts the signal; the re-check after each part is live (cancel stops delivery).
                             if (signal.aborted)
                                 return;
                             try {
@@ -228,6 +225,7 @@ export function createRunEventStream(deps) {
                     if (signal.aborted)
                         return;
                     await discoverChildren();
+                    // oxlint-disable-next-line no-unnecessary-condition -- tsgolint cannot see the event-wired abort or the parentRead .finally that sets parentDrained; both checks are live (discovery stops on cancel or a drained parent).
                     if (signal.aborted || parentDrained)
                         return;
                     await Promise.race([sleep(CHILD_DISCOVERY_INTERVAL_MS), aborted, parentRead]);
@@ -289,6 +287,7 @@ export function createRunEventStream(deps) {
                 await discovery;
                 await parentRead;
                 await Promise.all(childReads);
+                // oxlint-disable-next-line no-unnecessary-condition -- tsgolint cannot see the readWorkflowStream closure that sets sawTerminal or the event-wired abort; the fallback that mints the missing terminal part is live.
                 if (!sawTerminal && !signal.aborted) {
                     const terminal = await missingTerminalPart();
                     if (terminal !== null)

package/dist/execution/run-launcher.d.ts

@@ -10,11 +10,11 @@
  * reference, typed `(input) => Promise<result>`; the launcher only owns the
  * start/await/cancel mechanics around it.
  */
-export interface LaunchOptions {
+export type LaunchOptions = {
     /** Caller-chosen durable workflow id (e.g. the runId). */
     readonly workflowId: string;
-}
-export interface RunLauncher {
+};
+export type RunLauncher = {
     /** Fire-and-forget: resolves once the run is durably started. */
     launch<I>(workflow: (input: I) => Promise<unknown>, opts: LaunchOptions, input: I): Promise<void>;
-}
+};