@voltro/workflow 0.81.0 → 0.82.0

package/dist/index.d.ts

@@ -8,6 +8,8 @@ import { DurableRateLimiter as durableRateLimiterModule } from '@effect/workflow
 import { Duration } from 'effect';
 import { Effect } from 'effect';
 import { FiberRef } from 'effect';
+import { FieldBinding } from '@voltro/database';
+import { FieldCipher } from '@voltro/database';
 import { FieldDefinitions } from '@voltro/database';
 import { Layer } from 'effect';
 import { ParseResult } from 'effect';
@@ -24,6 +26,8 @@ import { WorkflowEngine } from '@effect/workflow';
 import { Workflow as workflowModule } from '@effect/workflow';
 import { WorkflowParentClosePolicy } from '@voltro/protocol';
 import { WorkflowQueuedCancellationResult } from '@voltro/protocol';
+import { WorkflowRestartObservation } from '@voltro/protocol';
+import { WorkflowRestartTarget } from '@voltro/protocol';
 
 /** Dispatch an already committed admission using the same attempt/ACK boundary
  * as the drainer. Returning requires durable acceptance, not just a prepared ID.
@@ -586,11 +590,12 @@ export declare const beginWorkflowControlDispatchInTransaction: (tx: Store, id:
             readonly enteredAt: number;
         } | null;
         readonly generation: string;
+        readonly runId: string;
         readonly requestedAt: number;
         readonly executionId: string;
-        readonly runId: string;
         readonly workflowName: string;
         readonly operation: "resume" | "cancel" | "terminate";
+        readonly dispatchAttempts: number;
         readonly owner: {
             readonly tenantId: string | null;
         } | null;
@@ -599,7 +604,6 @@ export declare const beginWorkflowControlDispatchInTransaction: (tx: Store, id:
             readonly replyId: string;
             readonly restartToken: string | null;
         } | null;
-        readonly dispatchAttempts: number;
     };
     run?: never;
 } | {
@@ -626,11 +630,12 @@ export declare const beginWorkflowControlDispatchInTransaction: (tx: Store, id:
             readonly enteredAt: number;
         } | null;
         readonly generation: string;
+        readonly runId: string;
         readonly requestedAt: number;
         readonly executionId: string;
-        readonly runId: string;
         readonly workflowName: string;
         readonly operation: "resume" | "cancel" | "terminate";
+        readonly dispatchAttempts: number;
         readonly owner: {
             readonly tenantId: string | null;
         } | null;
@@ -639,7 +644,6 @@ export declare const beginWorkflowControlDispatchInTransaction: (tx: Store, id:
             readonly replyId: string;
             readonly restartToken: string | null;
         } | null;
-        readonly dispatchAttempts: number;
     };
     run?: never;
 } | {
@@ -666,11 +670,12 @@ export declare const beginWorkflowControlDispatchInTransaction: (tx: Store, id:
             readonly enteredAt: number;
         } | null;
         readonly generation: string;
+        readonly runId: string;
         readonly requestedAt: number;
         readonly executionId: string;
-        readonly runId: string;
         readonly workflowName: string;
         readonly operation: "resume" | "cancel" | "terminate";
+        readonly dispatchAttempts: number;
         readonly owner: {
             readonly tenantId: string | null;
         } | null;
@@ -679,7 +684,6 @@ export declare const beginWorkflowControlDispatchInTransaction: (tx: Store, id:
             readonly replyId: string;
             readonly restartToken: string | null;
         } | null;
-        readonly dispatchAttempts: number;
     };
     run?: never;
 } | {
@@ -706,11 +710,12 @@ export declare const beginWorkflowControlDispatchInTransaction: (tx: Store, id:
             readonly enteredAt: number;
         } | null;
         readonly generation: string;
+        readonly runId: string;
         readonly requestedAt: number;
         readonly executionId: string;
-        readonly runId: string;
         readonly workflowName: string;
         readonly operation: "resume" | "cancel" | "terminate";
+        readonly dispatchAttempts: number;
         readonly owner: {
             readonly tenantId: string | null;
         } | null;
@@ -719,7 +724,6 @@ export declare const beginWorkflowControlDispatchInTransaction: (tx: Store, id:
             readonly replyId: string;
             readonly restartToken: string | null;
         } | null;
-        readonly dispatchAttempts: number;
     };
     run: Readonly<Record<string, unknown>>;
 } | {
@@ -747,9 +751,9 @@ export declare const beginWorkflowControlDispatchInTransaction: (tx: Store, id:
             readonly enteredAt: number;
         } | null;
         generation: string;
+        runId: string;
         requestedAt: number;
         executionId: string;
-        runId: string;
         workflowName: string;
         operation: "resume" | "cancel" | "terminate";
         owner: {
@@ -797,11 +801,12 @@ export declare const bindWorkflowResumeJournalInTransaction: (tx: Store, id: str
             readonly enteredAt: number;
         } | null;
         readonly generation: string;
+        readonly runId: string;
         readonly requestedAt: number;
         readonly executionId: string;
-        readonly runId: string;
         readonly workflowName: string;
         readonly operation: "resume" | "cancel" | "terminate";
+        readonly dispatchAttempts: number;
         readonly owner: {
             readonly tenantId: string | null;
         } | null;
@@ -810,7 +815,6 @@ export declare const bindWorkflowResumeJournalInTransaction: (tx: Store, id: str
             readonly replyId: string;
             readonly restartToken: string | null;
         } | null;
-        readonly dispatchAttempts: number;
     };
 } | {
     kind: "unknown";
@@ -836,11 +840,12 @@ export declare const bindWorkflowResumeJournalInTransaction: (tx: Store, id: str
             readonly enteredAt: number;
         } | null;
         readonly generation: string;
+        readonly runId: string;
         readonly requestedAt: number;
         readonly executionId: string;
-        readonly runId: string;
         readonly workflowName: string;
         readonly operation: "resume" | "cancel" | "terminate";
+        readonly dispatchAttempts: number;
         readonly owner: {
             readonly tenantId: string | null;
         } | null;
@@ -849,7 +854,6 @@ export declare const bindWorkflowResumeJournalInTransaction: (tx: Store, id: str
             readonly replyId: string;
             readonly restartToken: string | null;
         } | null;
-        readonly dispatchAttempts: number;
     };
 } | {
     kind: "superseded";
@@ -875,11 +879,12 @@ export declare const bindWorkflowResumeJournalInTransaction: (tx: Store, id: str
             readonly enteredAt: number;
         } | null;
         readonly generation: string;
+        readonly runId: string;
         readonly requestedAt: number;
         readonly executionId: string;
-        readonly runId: string;
         readonly workflowName: string;
         readonly operation: "resume" | "cancel" | "terminate";
+        readonly dispatchAttempts: number;
         readonly owner: {
             readonly tenantId: string | null;
         } | null;
@@ -888,7 +893,6 @@ export declare const bindWorkflowResumeJournalInTransaction: (tx: Store, id: str
             readonly replyId: string;
             readonly restartToken: string | null;
         } | null;
-        readonly dispatchAttempts: number;
     };
 } | {
     kind: "not-suspended";
@@ -914,11 +918,12 @@ export declare const bindWorkflowResumeJournalInTransaction: (tx: Store, id: str
             readonly enteredAt: number;
         } | null;
         readonly generation: string;
+        readonly runId: string;
         readonly requestedAt: number;
         readonly executionId: string;
-        readonly runId: string;
         readonly workflowName: string;
         readonly operation: "resume" | "cancel" | "terminate";
+        readonly dispatchAttempts: number;
         readonly owner: {
             readonly tenantId: string | null;
         } | null;
@@ -927,7 +932,6 @@ export declare const bindWorkflowResumeJournalInTransaction: (tx: Store, id: str
             readonly replyId: string;
             readonly restartToken: string | null;
         } | null;
-        readonly dispatchAttempts: number;
     };
 } | {
     kind: "bound";
@@ -953,11 +957,12 @@ export declare const bindWorkflowResumeJournalInTransaction: (tx: Store, id: str
             readonly enteredAt: number;
         } | null;
         readonly generation: string;
+        readonly runId: string;
         readonly requestedAt: number;
         readonly executionId: string;
-        readonly runId: string;
         readonly workflowName: string;
         readonly operation: "resume" | "cancel" | "terminate";
+        readonly dispatchAttempts: number;
         readonly owner: {
             readonly tenantId: string | null;
         } | null;
@@ -966,7 +971,6 @@ export declare const bindWorkflowResumeJournalInTransaction: (tx: Store, id: str
             readonly replyId: string;
             readonly restartToken: string | null;
         } | null;
-        readonly dispatchAttempts: number;
     };
 } | {
     kind: "waiting-journal";
@@ -992,11 +996,12 @@ export declare const bindWorkflowResumeJournalInTransaction: (tx: Store, id: str
             readonly enteredAt: number;
         } | null;
         readonly generation: string;
+        readonly runId: string;
         readonly requestedAt: number;
         readonly executionId: string;
-        readonly runId: string;
         readonly workflowName: string;
         readonly operation: "resume" | "cancel" | "terminate";
+        readonly dispatchAttempts: number;
         readonly owner: {
             readonly tenantId: string | null;
         } | null;
@@ -1005,7 +1010,6 @@ export declare const bindWorkflowResumeJournalInTransaction: (tx: Store, id: str
             readonly replyId: string;
             readonly restartToken: string | null;
         } | null;
-        readonly dispatchAttempts: number;
     };
 }>;
 
@@ -1652,7 +1656,9 @@ export declare const dueIntents: (store: AdmissionDataStore, now: number, limit:
 export { durableClock }
 
 /** Define a durable queue for concurrency-controlled side work. */
-export declare const durableQueue: typeof durableQueueModule.make;
+export declare const durableQueue: typeof durableQueueModule.make & (<Options extends Parameters<typeof durableQueueModule.make>[0] & {
+    readonly encrypted?: boolean;
+}>(options: Options) => ReturnType<typeof durableQueueModule.make>);
 
 export { durableQueueModule }
 
@@ -1677,6 +1683,7 @@ export declare const enterWorkflowRunGenerationInTransaction: (tx: AdmissionData
     readonly row: Row;
     readonly previous: Row | undefined;
     readonly terminalEvent?: Row;
+    readonly restartEvent?: Row;
 }>;
 
 /**
@@ -1767,6 +1774,9 @@ export declare const getCurrentWorkflowRunId: () => Effect.Effect<string | undef
  *  the path it took before this feature existed. */
 export declare const getWorkflowFlowControl: (value: unknown) => ResolvedFlowControl | undefined;
 
+/** The journal cipher in effect, if any. */
+export declare const getWorkflowJournalCipher: () => FieldCipher | undefined;
+
 /** The resolved schedule attached to a workflow definition, or undefined. */
 export declare const getWorkflowSchedule: (value: unknown) => ResolvedWorkflowSchedule | undefined;
 
@@ -1878,6 +1888,9 @@ export declare const isFinishExpired: (control: ResolvedFlowControl, run: {
     readonly terminal: boolean;
 }, now: number) => boolean;
 
+/** A value in one of the cipher's envelopes (`enc:v1:` / `enc:v2:`). */
+export declare const isSealedJournalValue: (value: unknown) => value is string;
+
 /**
  * Has a pending row outlived `timeouts.start`?
  *
@@ -1898,6 +1911,9 @@ export declare const isStartExpired: (control: ResolvedFlowControl, pending: {
  */
 export declare const isUnacknowledgedSubmission: (cause: unknown) => boolean;
 
+/** Is the workflow of this name declared `encrypted`? */
+export declare const isWorkflowEncrypted: (name: string) => boolean;
+
 export declare const isWorkflowWorkerLayer: (value: unknown) => value is WorkflowWorkerLayerBrand;
 
 /**
@@ -2007,6 +2023,36 @@ export declare const noteAdmissionSubmissionFailure: (tx: Pick<DataStore, "query
 
 export declare const noteIntentAttempt: (store: AdmissionDataStore, intent: PendingIntent, error: string, now: number) => Promise<void>;
 
+/** An error message as stored, opened (see {@link sealErrorText}). */
+export declare const openErrorText: (stored: string | null | undefined) => string | null;
+
+/** The inverse of {@link sealEventPayload}, tolerant like every read path. */
+export declare const openEventPayload: <P>(payload: P) => P;
+
+/** The inverse of {@link sealJournalValue}; a plaintext value passes through. */
+export declare const openJournalValue: (stored: unknown, what: string, binding?: FieldBinding) => unknown;
+
+/**
+ * A stored payload with its sealed field values opened — what an authorised
+ * reader (the app's live run rows, `listRuns`, the dashboard, a failure
+ * handler) receives. At-rest protection is the point; hiding the value from the
+ * caller the access rules already let in is not. A plaintext payload returns
+ * unchanged.
+ */
+export declare const openPayloadFields: (payload: unknown, what: string) => unknown;
+
+/**
+ * A stored workflow row — a run, a step or a run event — with every sealed
+ * value opened, for a reader the access rules already let in: the live rows
+ * pushed to subscribers, the client's read built-ins, the inspect surface.
+ *
+ * ONE function for every reader, because a reader that opened one column and
+ * not the next is how a feature ends up "encrypted" in one view and garbage in
+ * another. Tolerant throughout: a value that will not open (no cipher here, a
+ * rotated key) stays as stored rather than failing the whole read.
+ */
+export declare const openWorkflowRow: <R>(row: R) => R;
+
 /**
  * Park a `start(name, payload, { at })` as a DURABLE pending row.
  *
@@ -2244,7 +2290,13 @@ export declare const pooledConcurrencyKey: (pool: string | undefined, rawKey: st
  * This records intent, not engine acceptance, and does not release capacity. */
 export declare const prepareAdmissionSubmissionExecutionInTransaction: (tx: Pick<DataStore, "query" | "update">, id: string, proposedExecutionId: string) => Promise<AdmissionSubmission>;
 
-/** Enqueue work and await the durable queue worker's result. */
+/**
+ * Enqueue work and await the durable queue worker's result.
+ *
+ * From inside an encrypted workflow the queue must be encrypted too — its
+ * journal would otherwise hold the workflow's data in plaintext one hop away,
+ * the same reason an encrypted workflow's `onFailure` handler must be.
+ */
 export declare const processQueue: typeof durableQueueModule.process;
 
 /**
@@ -2321,6 +2373,51 @@ export declare const readWorkflowControlInTransaction: (tx: Pick<Store, "query">
 /** Strict read: a damaged record is not an absent report. */
 export declare const readWorkflowFailureRecord: (tx: Pick<DataStore, "query">, id: string) => Promise<WorkflowFailureRecord | undefined>;
 
+/** Read an accepted command before observing the journal again. Its captured
+ * replies remain authoritative after reset or body entry. This grants no new
+ * dispatch permission: dispatch must still recheck the resident generation. */
+declare const readWorkflowRestartCommandInTransaction: (tx: AdmissionDataStore, input: {
+    readonly id: string;
+    readonly runId: string;
+    readonly workflowName: string;
+    readonly tenantId: string | null;
+    readonly selection: WorkflowRestartSelection;
+}) => Promise<{
+    readonly id: string;
+    readonly tenantId: string | null;
+    readonly token: string;
+    readonly generation: string;
+    readonly runId: string;
+    readonly requestedAt: Date;
+    readonly executionId: string;
+    readonly workflowName: string;
+    readonly selection: {
+        readonly kind: "failed-steps";
+    } | {
+        readonly kind: "from-step";
+        readonly stepName: string;
+    };
+    readonly dispatchAttempts: number;
+    readonly enteredGeneration: string | null;
+    readonly ledgerId: string;
+    readonly eviction: {
+        readonly runId: string;
+        readonly executionId: string;
+    } | null;
+    readonly delivery: {
+        readonly requestId: string;
+        readonly restartToken: string | null;
+    };
+    readonly replies: readonly {
+        readonly requestId: string;
+        readonly replyId: string;
+    }[];
+} | undefined>;
+
+/** Read-only reconciliation. No observation of engine replies, admission,
+ * journal reset, or dispatch is performed. Internal ownership data stays here. */
+export declare const readWorkflowRestartObservationInTransaction: (tx: AdmissionDataStore, target: WorkflowRestartTarget) => Promise<WorkflowRestartObservation>;
+
 /** Strict lookup shared by receipt owners; a malformed receipt is not absent. */
 export declare const readWorkflowStartReceipt: (store: Pick<DataStore, "query">, id: string) => Promise<WorkflowStartReceipt | undefined>;
 
@@ -2663,7 +2760,7 @@ export declare interface ResolvedFlowControl {
         readonly finishMs?: number;
     };
     readonly onFailure?: string;
-    readonly encryptSteps?: boolean;
+    readonly encrypted?: boolean;
     readonly cancelOn?: ReadonlyArray<ResolvedCancelOn>;
 }
 
@@ -2714,6 +2811,20 @@ export declare const resumeWorkflow: (store: AdmissionDataStore, workflowName: s
  * the terminal classification and retry history are reset. */
 export declare const retryDeadLetterIntent: (store: AdmissionDataStore, intentId: string, now: number) => Promise<boolean>;
 
+/**
+ * Seal a JSON-safe value for a framework table. `undefined` / `null` stay as
+ * they are — there is nothing in them to hide, and a nullable column must keep
+ * reading as empty.
+ */
+export declare const sealJournalValue: (value: unknown, what: string, binding?: FieldBinding) => unknown;
+
+declare const Selection: Schema.Union<[Schema.Struct<{
+    kind: Schema.Literal<["failed-steps"]>;
+}>, Schema.Struct<{
+    kind: Schema.Literal<["from-step"]>;
+    stepName: Schema.filter<typeof Schema.NonEmptyString>;
+}>]>;
+
 export declare const sendWorkflowSignal: (input: {
     readonly store: WorkflowMessageStore;
     readonly recorder: WorkflowRunRecorderService;
@@ -2744,6 +2855,14 @@ export declare const serialiseWorkflowRowForWire: (row: Record<string, unknown>)
  */
 export declare const setSuspendSignalHintMs: (ms: number | undefined) => void;
 
+/**
+ * Register the cipher encrypted workflows use — a cipher, or a function that
+ * returns the current one. The boot paths pass the field-cipher registry's
+ * getter, so the key `governancePlugin({ fieldEncryption })` registers is the
+ * one used, including after it is set. `undefined` clears it.
+ */
+export declare const setWorkflowJournalCipher: (cipher: FieldCipher | (() => FieldCipher | undefined) | undefined) => void;
+
 export declare interface ShardLockHolder {
     readonly shardId: string;
     readonly mode: 'advisory' | 'row';
@@ -2925,6 +3044,10 @@ export declare type StallReason =
 
 export declare const step: <R, Success extends Schema.Schema.Any = typeof Schema.Void, Error extends Schema.Schema.All = typeof Schema.Never>(options: StepOptions<R, Success, Error>) => ReturnType<typeof stepModule.make<R, Success, Error>>;
 
+/** The address the step journal's values are sealed to (`encrypted` via the
+ *  recorder's `encryptStepPayload`). ONE definition, shared with the CLI. */
+export declare const STEP_JOURNAL_BINDING: FieldBinding;
+
 /**
  * Derive a deterministic idempotency key for the current workflow run,
  * scoped to `name`. Call it inside a `step()` so a retried external
@@ -3160,8 +3283,8 @@ export declare const takeAdmittedSubmissionInTransaction: (tx: AdmissionDataStor
         readonly stoppedAt: number | null;
     };
     readonly payload: unknown;
-    readonly executionId: string | null;
     readonly runId: string | null;
+    readonly executionId: string | null;
     readonly failureId: string | null;
     readonly workflowName: string;
     readonly dispatchAttempts: number;
@@ -3171,8 +3294,8 @@ export declare const takeAdmittedSubmissionInTransaction: (tx: AdmissionDataStor
     readonly receiptsBound: boolean;
     readonly preparedExecutionId: string | null;
     readonly eviction: {
-        readonly executionId: string;
         readonly runId: string;
+        readonly executionId: string;
     } | null;
 }>;
 
@@ -3193,6 +3316,13 @@ declare const Target: Schema.Struct<{
 
 export declare const truncateWorkflowValue: (value: unknown, bytes?: number) => unknown;
 
+/**
+ * A stored value opened for an authorised reader, or left as stored when it
+ * cannot be (no cipher, or sealed for another place). For read paths that must
+ * not turn an unreadable value into a failed read of everything around it.
+ */
+export declare const tryOpenJournalValue: (stored: unknown, what: string) => unknown;
+
 export declare interface UnreadMessage extends ClusterMessageState {
     /** How long ago the last runner read it. */
     readonly unreadForMs: number;
@@ -3326,59 +3456,76 @@ export declare const withAdmissionTransaction: <A>(store: Pick<DataStore, "inser
  */
 export declare const withCompensation: typeof workflowModule.withCompensation;
 
+/** Resident withdrawal boundary used by the authorized Inspect host. A reservation wins even
+ * before its first dispatch attempt; this never cancels accepted engine work.
+ * The caller must hold the physical resident admission transaction throughout. */
+export declare const withdrawWorkflowRestartInTransaction: (tx: AdmissionDataStore, input: Parameters<typeof readWorkflowRestartCommandInTransaction>[1] & {
+    readonly now: number;
+}) => Promise<{
+    kind: "withdrawn";
+    withdrawal: {
+        readonly id: string;
+        readonly tenantId: string | null;
+        readonly runId: string;
+        readonly workflowName: string;
+        readonly selection: {
+            readonly kind: "failed-steps";
+        } | {
+            readonly kind: "from-step";
+            readonly stepName: string;
+        };
+        readonly withdrawnAt: Date;
+    };
+    reused: boolean;
+    request?: never;
+} | {
+    kind: "reserved";
+    request: {
+        readonly id: string;
+        readonly tenantId: string | null;
+        readonly token: string;
+        readonly generation: string;
+        readonly runId: string;
+        readonly requestedAt: Date;
+        readonly executionId: string;
+        readonly workflowName: string;
+        readonly selection: {
+            readonly kind: "failed-steps";
+        } | {
+            readonly kind: "from-step";
+            readonly stepName: string;
+        };
+        readonly dispatchAttempts: number;
+        readonly enteredGeneration: string | null;
+        readonly ledgerId: string;
+        readonly eviction: {
+            readonly runId: string;
+            readonly executionId: string;
+        } | null;
+        readonly delivery: {
+            readonly requestId: string;
+            readonly restartToken: string | null;
+        };
+        readonly replies: readonly {
+            readonly requestId: string;
+            readonly replyId: string;
+        }[];
+    };
+    withdrawal?: never;
+    reused?: never;
+}>;
+
+export declare const workflow: WorkflowFn;
+
 /**
- * Define a durable workflow.
- *
- * ── `idempotencyKey` is the execution's IDENTITY, permanently ──────────────
- *
- * Read this before choosing one. It is the single most expensive
- * misunderstanding this API has produced — a downstream project lost a day and
- * shipped a design around the wrong model, and the wording they read
- * ("deduplicates concurrent invocations with the same input") is what led them
- * there. It sounds like a WINDOW: dedupe while a run is in flight. It is not.
- *
- * The key IS the execution. A second start with the same key REPLAYS the first
- * run's journaled result — forever, not just while it is running. Once the run
- * completes the key is SPENT: a later, genuinely new invocation under that key
- * is a silent no-op that returns the old output. Nothing errors and nothing
- * logs, because from the engine's point of view you asked for a run it already
- * has.
- *
- * ```ts
- * const a = yield* wf.execute({ id: 'same' })
- * const b = yield* wf.execute({ id: 'same' })   // ← does NOT run; replays `a`
- * ```
- *
- * So a key must be **unique per unit of work you want to happen**, not per
- * logical subject. `tour:${rowId}` is wrong if the tour can be re-narrated;
- * `tour:${rowId}:${updatedAt}` is right, because every edit is a new unit of
- * work with its own identity.
- *
- * ── And a flow-control key is a DIFFERENT thing ────────────────────────────
- *
- * The two get conflated, and conflating them is what makes "I need to re-arm a
- * key" feel like a missing feature. It is not missing; it is two fields:
- *
- *   • `idempotencyKey` — the execution's identity. Vary it per unit of work.
- *   • `debounce.key` / `singleton.key` / `concurrency.key` — the RESOURCE runs
- *     compete for. Keep it stable.
- *
- * "One job, fifteen minutes after the last edit, latest state wins" is then:
- *
- * ```ts
- * workflow({
- *   name: 'tourNarration',
- *   payload: TourPayload,
- *   idempotencyKey: ({ rowId, editedAt }) => `tour:${rowId}:${editedAt}`, // varies
- *   debounce: { key: (p) => `tour:${p.rowId}`, period: '15 minutes' },    // stable
- * })
- * ```
- *
- * Twenty edits mint twenty identities; exactly one is ever admitted. There is
- * no `restart: true` and no generation counter in this API because separating
- * the two keys is the mechanism those would have been.
+ * The address every sealed workflow value is bound to. ONE address for the
+ * engine journal and the framework's own tables: the same value travels
+ * between them (a run row's payload is the journal's encoding of it, a failure
+ * report copies it), and a per-table binding would refuse the copy. What the
+ * GCM tag still refuses is a value moved into an `.encrypted()` column or the
+ * step journal, whose addresses differ.
  */
-export declare const workflow: WorkflowFn;
+export declare const WORKFLOW_JOURNAL_BINDING: FieldBinding;
 
 declare type WorkflowBaseOptions = Parameters<WorkflowMake>[0];
 
@@ -3715,27 +3862,27 @@ export declare interface WorkflowFlowControl<Payload> {
      */
     readonly onFailure?: string;
     /**
-     * Encrypt this workflow's journaled step `input` / `output` / `errorCause`.
+     * Encrypt every durable copy of this workflow's data.
      *
-     * `step({ input })` is written to `_voltro_workflow_run_steps` and rendered in
-     * the dashboard — a feature, and the reason people pass rich input. For a step
-     * carrying personal data it is also a SECOND COPY, outside the `.encrypted()`
-     * boundary the governance plugin establishes for tables. An app that carefully
-     * encrypted a column and then handed the same value to a step has it in
-     * plaintext one table over.
+     * Covered: the payload, the result and a typed failure in the engine journal
+     * (`cluster_messages`, `cluster_replies`), every step's result and typed
+     * failure there, the run row (`_voltro_workflow_runs.payload` / `.output`),
+     * the step journal (`_voltro_workflow_run_steps`), a queued start's payload
+     * and a failure report's copy of the payload. The body sees the values it was
+     * given, and a run replays unchanged.
      *
-     * Reuses the cipher `governancePlugin({ fieldEncryption })` already registers,
-     * so there is ONE key and one rotation story rather than a second scheme that
-     * only workflows know about. It is therefore a BOOT ERROR to declare this
-     * without that plugin configured: silently falling back to plaintext would be
-     * the worst outcome available — the declaration reads as protection and the
-     * rows are readable.
+     * Not covered, and said here so it is not assumed: the `idempotencyKey`
+     * (hashed into the execution id, but a primary key built from free text is
+     * still that text in the engine's key column — derive it from ids), signal
+     * and update payloads, and anything a step writes elsewhere itself.
      *
-     * Only the journal is affected. The values the workflow BODY sees are
-     * unchanged, and the durable execution journal `@effect/workflow` keeps is
-     * untouched (encrypting that would break replay).
+     * Reuses the cipher `governancePlugin({ fieldEncryption })` registers — one
+     * key, one rotation story. Declaring it without that plugin configured is a
+     * BOOT ERROR: a plaintext fallback would leave the declaration reading as
+     * protection while the rows are readable. A plaintext value written before
+     * the declaration (a run already in flight) is still read.
      */
-    readonly encryptSteps?: boolean;
+    readonly encrypted?: boolean;
 }
 
 /** Where the RESOLVED flow-control declaration hangs off a definition. A
@@ -3917,12 +4064,19 @@ export declare const workflowRestartRequestsTable: Table<"_voltro_workflow_resta
     readonly tenantId: ColumnBuilder<string | null, "text", boolean>;
     readonly delivery: ColumnBuilder<unknown, "json", boolean>;
     readonly replies: ColumnBuilder<unknown, "json", boolean>;
+    readonly selection: ColumnBuilder<unknown, "json", boolean>;
     readonly eviction: ColumnBuilder<unknown, "json", boolean>;
     readonly requestedAt: ColumnBuilder<Date, "timestamp", boolean>;
     readonly dispatchAttempts: ColumnBuilder<number, "integer", true>;
     readonly enteredGeneration: ColumnBuilder<string | null, "text", boolean>;
 }>, false, never>;
 
+declare type WorkflowRestartSelection = typeof Selection.Type;
+
+/** Durable negative authority. Never expire while delayed commands can reuse an
+ * identity. Acceptance and reservation require the same resident admission lock. */
+export declare const workflowRestartWithdrawalsTable: SchemaTable;
+
 export declare interface WorkflowRunCompletion {
     readonly owner: WorkflowRunGeneration;
     readonly now: number;
@@ -3954,7 +4108,7 @@ export declare interface WorkflowRunCompletion {
  */
 export declare type WorkflowRunEventType = 'run-started' | 'run-suspended' | 'run-resumed'
 /** Emitted when an operator re-drives a terminally-FAILED run from its
-*  durable journal (`voltro workflows redrive` / `ctx.workflows.redrive`).
+*  durable journal (`voltro workflows restart` / `ctx.workflows.restart`).
 *  `payload` carries `{ reason, activitiesReset }` — how many failed step
 *  attempts were reset so they re-execute (completed steps replay). Distinct
 *  from `run-resumed`, which continues a *suspended* run. */
@@ -4061,26 +4215,6 @@ export declare interface WorkflowRunRecorderOptions {
      *  per run at a TERMINAL outcome (succeeded/failed), never on suspend. Absent →
      *  no metrics, zero overhead. */
     readonly recordRun?: (outcome: WorkflowRunOutcome) => void;
-    /**
-     * Encrypt the `input` / `output` / `errorCause` a step journals.
-     *
-     * `step({ input })` is written to `_voltro_workflow_run_steps` and shown in
-     * the dashboard, which is a feature and the reason people pass rich input. For
-     * a step carrying personal data it is also a SECOND COPY, outside the
-     * `.encrypted()` boundary the governance plugin establishes for tables — so an
-     * app that carefully encrypted a column then handed the same value to a step
-     * has it in plaintext one table over.
-     *
-     * Supplied by the CLI from the cipher `governancePlugin({ fieldEncryption })`
-     * already registers, so there is ONE key and one rotation story rather than a
-     * second scheme for workflows. Absent → plaintext, exactly as before.
-     *
-     * Encryption happens on the WRITE and decryption on the inspect read, so the
-     * dashboard is unchanged for a viewer who is allowed to see it and the value
-     * at rest is not. A ciphertext that cannot be decrypted renders as a marker
-     * rather than as garbage — see `inspectWorkflow`.
-     */
-    readonly encryptStepPayload?: (value: unknown) => unknown;
     /**
      * How much this recorder writes per STEP — `'full'` (default) or `'coarse'`.
      *
@@ -4117,6 +4251,10 @@ export declare interface WorkflowRunRecorderService {
         readonly runId: string;
         readonly stepName: string;
         readonly attempt: number;
+        /** The step runs inside an `encrypted: true` workflow: a recorder that
+         *  persists the step's values seals them (`sealJournalValue`, bound to
+         *  `STEP_JOURNAL_BINDING`). Absent or false: store them as they are. */
+        readonly sealed?: boolean;
         /** User-declared structured input recorded into
          *  `_voltro_workflow_run_steps.input`. The recorder truncates large
          *  payloads — pass whatever the step needs to make sense in
@@ -4133,11 +4271,15 @@ export declare interface WorkflowRunRecorderService {
     }) => Promise<string | undefined>;
     readonly endStepSuccess: (input: {
         readonly stepRecordId: string;
+        /** As on `startStep`. */
+        readonly sealed?: boolean;
         readonly output: unknown;
         readonly durationMs: number;
     }) => Promise<void>;
     readonly endStepFailure: (input: {
         readonly stepRecordId: string;
+        /** As on `startStep`. */
+        readonly sealed?: boolean;
         readonly errorTag: string | null;
         readonly errorMessage: string;
         /** Structured Cause record — pretty form +