@voltro/workflow 0.81.0 → 0.82.0

package/dist/primitives-Btjhjm8P.js

@@ -0,0 +1,483 @@
+import { T as e, d as t, f as n, p as r, s as i, t as a, w as o, y as s } from "./journalEncryption--n5VDdYO.js";
+import { Activity as c, Activity as l, DurableClock as u, DurableClock as d, DurableQueue as f, DurableQueue as p, DurableRateLimiter as m, DurableRateLimiter as ee, Workflow as h, Workflow as te, WorkflowEngine as ne } from "@effect/workflow";
+import { Cause as g, Context as _, Cron as re, Duration as v, Effect as y, Either as ie, Exit as b, FiberRef as x, Option as ae, Schedule as S, Schema as C } from "effect";
+import { attachWorkflowAccess as w, resolveWorkflowAccess as oe } from "@voltro/protocol";
+//#region src/preparedExecution.ts
+var T = Symbol.for("@voltro/workflow/PreparedExecution"), E = (e, t) => {
+	Object.defineProperty(e, T, {
+		value: t,
+		enumerable: !0
+	});
+}, se = (e) => typeof e == "object" && !!e && typeof e[T] == "function", ce = (e, t, n, r) => y.suspend(() => {
+	if (n.length === 0) return y.die(/* @__PURE__ */ Error("Prepared workflow execution requires a non-empty identity"));
+	let i = e[T];
+	return typeof i == "function" ? i(t, n, r?.discard ?? !0) : y.die(/* @__PURE__ */ Error("Workflow definition has no prepared-execution capability"));
+}), le = (e) => e !== void 0 && (e.debounce !== void 0 || e.singleton !== void 0 || e.concurrency !== void 0 || e.throttle !== void 0 || e.rateLimit !== void 0 || e.batch !== void 0 || e.timeouts?.startMs !== void 0 || e.timeouts?.finishMs !== void 0), ue = (e) => e?.cancelOn !== void 0 && e.cancelOn.length > 0, de = [
+	"debounce",
+	"batch",
+	"throttle",
+	"concurrency"
+], D = (e) => {
+	if (e === void 0) return [];
+	let t = [];
+	return e.debounce !== void 0 && t.push("debounce"), e.batch !== void 0 && t.push("batch"), e.throttle !== void 0 && t.push("throttle"), e.concurrency !== void 0 && t.push("concurrency"), t;
+}, O = (e, t, n) => {
+	let r;
+	try {
+		r = v.toMillis(v.decode(e));
+	} catch {
+		throw Error(`workflow '${n}': ${t} is not a duration Effect can read (got ${JSON.stringify(e)}). Use a spelled-out unit ('15 minutes', '1 hour', '30 seconds'), a number of milliseconds, or a Duration — the abbreviated forms ('15m', '1h') are NOT accepted.`);
+	}
+	if (!Number.isFinite(r) || r <= 0) throw Error(`workflow '${n}': ${t} must be a positive finite duration, got ${String(e)}`);
+	return r;
+}, k = (e, t, n) => {
+	if (!Number.isInteger(e) || e <= 0) throw Error(`workflow '${n}': ${t} must be a positive integer, got ${String(e)}`);
+	return e;
+}, A = (e, t, n) => {
+	if (typeof e != "function") throw Error(`workflow '${n}': ${t} must be a function of the payload`);
+	return e;
+}, fe = (e) => {
+	let t = e?.ast?.propertySignatures;
+	if (!Array.isArray(t)) return !1;
+	let n = t.find((e) => e.name === "items");
+	return n !== void 0 && n.type?._tag === "TupleType";
+}, j = (t) => {
+	let { workflowName: n, control: r } = t;
+	if (r === void 0) return;
+	let i = { workflowName: n };
+	if (r.debounce !== void 0) {
+		let e = r.debounce, t = O(e.period, "debounce.period", n), a = e.timeout === void 0 ? void 0 : O(e.timeout, "debounce.timeout", n);
+		if (a !== void 0 && a < t) throw Error(`workflow '${n}': debounce.timeout (${a}ms) is shorter than debounce.period (${t}ms), so the burst can never be collapsed — the run would be admitted before the quiet period could ever elapse. Raise the timeout or lower the period.`);
+		i.debounce = {
+			key: A(e.key, "debounce.key", n),
+			periodMs: t,
+			...a === void 0 ? {} : { timeoutMs: a }
+		};
+	}
+	if (r.singleton !== void 0) {
+		let e = r.singleton;
+		if (e.mode !== "skip" && e.mode !== "cancel") throw Error(`workflow '${n}': singleton.mode must be 'skip' or 'cancel'. There is no default — 'skip' discards the incoming request and 'cancel' discards the running one, and choosing for you would silently throw away work either way.`);
+		i.singleton = {
+			key: A(e.key, "singleton.key", n),
+			mode: e.mode
+		};
+	}
+	if (r.concurrency !== void 0) {
+		let e = r.concurrency;
+		if (e.pool !== void 0 && (typeof e.pool != "string" || e.pool.trim() === "")) throw Error(`workflow '${n}': concurrency.pool must be a non-empty name — it is the identity other workflows declare to share this budget, and an empty one would silently merge every empty-named pool in the deployment into one.`);
+		i.concurrency = {
+			limit: k(e.limit, "concurrency.limit", n),
+			...e.key === void 0 ? {} : { key: A(e.key, "concurrency.key", n) },
+			...e.pool === void 0 ? {} : { pool: e.pool.trim() }
+		};
+	}
+	if (r.throttle !== void 0) {
+		let e = r.throttle;
+		i.throttle = {
+			limit: k(e.limit, "throttle.limit", n),
+			periodMs: O(e.period, "throttle.period", n),
+			...e.key === void 0 ? {} : { key: A(e.key, "throttle.key", n) }
+		};
+	}
+	if (r.rateLimit !== void 0) {
+		let e = r.rateLimit;
+		i.rateLimit = {
+			limit: k(e.limit, "rateLimit.limit", n),
+			periodMs: O(e.period, "rateLimit.period", n),
+			...e.key === void 0 ? {} : { key: A(e.key, "rateLimit.key", n) }
+		};
+	}
+	if (r.batch !== void 0) {
+		let a = r.batch;
+		if (t.payloadSchema !== void 0 && !fe(t.payloadSchema)) throw Error(`workflow '${n}': batch is declared, so the workflow's own \`payload\` must be the BATCH shape — \`Schema.Struct({ items: Schema.Array(Item) })\` — while callers start it with a SINGLE item. Declare the item's schema as \`batch.item\`. Checked here rather than at admission because a decode failure on the batching replica is a failure nobody is watching.`);
+		i.batch = {
+			...a.key === void 0 ? {} : { key: A(a.key, "batch.key", n) },
+			maxSize: k(a.maxSize, "batch.maxSize", n),
+			timeoutMs: O(a.timeout, "batch.timeout", n),
+			...a.item === void 0 ? {} : { item: r.encrypted === !0 && C.isSchema(a.item) ? e(a.item, `workflow '${n}' batch item`) : a.item }
+		};
+	}
+	if (r.priority !== void 0) {
+		if (typeof r.priority != "function") throw Error(`workflow '${n}': priority must be a function of the payload`);
+		i.priority = r.priority;
+	}
+	if (r.timeouts !== void 0) {
+		let e = r.timeouts, t = e.start === void 0 ? void 0 : O(e.start, "timeouts.start", n), a = e.finish === void 0 ? void 0 : O(e.finish, "timeouts.finish", n);
+		(t !== void 0 || a !== void 0) && (i.timeouts = {
+			...t === void 0 ? {} : { startMs: t },
+			...a === void 0 ? {} : { finishMs: a }
+		});
+	}
+	if (i.debounce !== void 0 && i.batch !== void 0) throw Error(`workflow '${n}': debounce and batch cannot both be declared. Both collect starts and admit one run, but debounce's timer RESETS on every arrival (collapse a burst, latest payload wins) while batch's does not (accumulate items until maxSize or timeout). Pick the one you mean.`);
+	if (i.throttle !== void 0 && i.rateLimit !== void 0) throw Error(`workflow '${n}': throttle and rateLimit cannot both be declared. throttle QUEUES the excess and rateLimit DROPS it; declaring both means the drop fires first and the queue is never reached. Pick whether surplus work is late or gone.`);
+	if (r.onFailure !== void 0) {
+		if (typeof r.onFailure != "string" || r.onFailure.length === 0) throw Error(`workflow '${n}': onFailure must be the NAME of another workflow. A function cannot be used — the failure may be noticed by a different replica, minutes later, after the process that held the closure is gone.`);
+		if (r.onFailure === n) throw Error(`workflow '${n}': onFailure points at itself. A workflow that fails would then start another copy of itself, which would fail, forever — one run per failure until something else breaks. Point it at a separate notifier workflow.`);
+		i.onFailure = r.onFailure;
+	}
+	if (r.encrypted === !0 && (i.encrypted = !0), r.cancelOn !== void 0) {
+		if (!Array.isArray(r.cancelOn)) throw Error(`workflow '${n}': cancelOn must be an array of { event, schema, match }`);
+		let e = r.cancelOn.map((e, t) => {
+			let r = `cancelOn[${t}]`;
+			if (typeof e?.event != "string" || e.event.length === 0) throw Error(`workflow '${n}': ${r}.event must be a non-empty event name, exactly as ctx.events.publish writes it.`);
+			if (e.schema === void 0 || typeof e.schema.ast != "object") throw Error(`workflow '${n}': ${r}.schema must be a Schema for the event payload. It is decoded before \`match\` runs, so the predicate reads the domain type rather than raw JSON.`);
+			if (typeof e.match != "function") throw Error(`workflow '${n}': ${r}.match is required. Omitting it would mean "cancel every live run of this workflow whenever '${e.event}' is published" — write \`match: () => true\` if that is what you mean, so it is visible in review.`);
+			let i = e.within === void 0 ? void 0 : O(e.within, `${r}.within`, n);
+			return {
+				event: e.event,
+				schema: e.schema,
+				match: e.match,
+				...i === void 0 ? {} : { withinMs: i },
+				reason: e.reason ?? `cancelOn:${e.event}`
+			};
+		});
+		e.length > 0 && (i.cancelOn = e);
+	}
+	if (i.timeouts?.startMs !== void 0 && D(i).length === 0) throw Error(`workflow '${n}': timeouts.start bounds how long a run may sit in the ADMISSION queue, but this workflow declares no control that can defer one (debounce, batch, throttle, concurrency). It would never fire. Use timeouts.finish to bound the run itself.`);
+	return i;
+}, pe = (e) => {
+	let t = /* @__PURE__ */ new Map();
+	for (let n of e) {
+		let e = n?.concurrency;
+		if (e?.pool === void 0) continue;
+		let r = t.get(e.pool);
+		if (r === void 0) t.set(e.pool, {
+			limit: e.limit,
+			workflows: [n.workflowName]
+		});
+		else if (r.limit !== e.limit) throw Error(`concurrency pool '${e.pool}': '${n.workflowName}' declares limit ${e.limit}, but ${r.workflows.map((e) => `'${e}'`).join(", ")} declare${r.workflows.length === 1 ? "s" : ""} limit ${r.limit}. A pool is ONE budget — every member must declare the same number, or the enforced limit would depend on which workflow's start arrived first. Align the limits, or give the workflows different pool names if they were never meant to share.`);
+		else r.workflows.push(n.workflowName);
+	}
+}, M = class extends _.Tag("@voltro/WorkflowRunRecorder")() {}, N = x.unsafeMake(void 0), P = x.unsafeMake(void 0), F = x.unsafeMake(void 0), me = y.gen(function* () {
+	let e = yield* x.get(P), t = yield* x.get(F);
+	return e === void 0 || t === void 0 ? void 0 : {
+		executionId: e,
+		step: t
+	};
+}), he = x.unsafeMake(void 0), I = x.unsafeMake(void 0), L = x.unsafeMake([]), R = () => x.get(N), ge = () => x.get(P), z = class extends _.Tag("@voltro/WorkflowStepInterceptor")() {}, B = 864e5, _e = /* @__PURE__ */ new Set([
+	"skip",
+	"buffer",
+	"cancelOther"
+]), ve = /* @__PURE__ */ new Set([
+	"skip",
+	"latest",
+	"all"
+]), V = (e, t) => {
+	if (t === void 0) return;
+	if (typeof t.timezone != "string" || t.timezone.trim() === "") throw Error(`workflow '${e}': schedule.timezone is required (e.g. "UTC", "Europe/Berlin") — never server-local, which differs between your machine and the container.`);
+	let n = re.parse(t.cron, t.timezone);
+	if (ie.isLeft(n)) throw Error(`workflow '${e}': schedule.cron "${t.cron}" (tz="${t.timezone}") is not a valid cron expression — ${String(n.left)}`);
+	let r = t.onOverlap ?? "skip";
+	if (!_e.has(r)) throw Error(`workflow '${e}': schedule.onOverlap must be 'skip' | 'buffer' | 'cancelOther', got ${JSON.stringify(r)}`);
+	let i = t.backfill ?? "skip";
+	if (!ve.has(i)) throw Error(`workflow '${e}': schedule.backfill must be 'skip' | 'latest' | 'all', got ${JSON.stringify(i)}`);
+	let a = B;
+	return t.maxRuntime !== void 0 && (a = ye(t.maxRuntime, e)), {
+		cron: t.cron,
+		timezone: t.timezone,
+		...t.payload === void 0 ? {} : { payload: t.payload },
+		onOverlap: r,
+		backfill: i,
+		maxRuntimeMs: a
+	};
+}, ye = (e, t) => {
+	let n;
+	try {
+		n = v.toMillis(v.decode(e));
+	} catch {
+		throw Error(`workflow '${t}': schedule.maxRuntime is not a duration Effect can read (got ${JSON.stringify(e)}). Use '2 hours', a number of milliseconds, or a Duration.`);
+	}
+	if (!Number.isFinite(n) || n <= 0) throw Error(`workflow '${t}': schedule.maxRuntime must be a positive finite duration`);
+	return n;
+}, H = "__voltroWorkflowSchedule", be = (e) => {
+	if (typeof e != "object" || !e) return;
+	let t = e[H];
+	return t === void 0 ? void 0 : t;
+}, xe = (e) => {
+	let t = /* @__PURE__ */ new Map();
+	for (let n of e) t.set(n.stepName, (t.get(n.stepName) ?? 0) + 1);
+	let n = /* @__PURE__ */ new Map(), r = /* @__PURE__ */ new Set(), i = (e) => !r.has(e) && (r.add(e), !0);
+	return {
+		reach: (e) => {
+			let r = (n.get(e) ?? 0) + 1;
+			n.set(e, r);
+			let a = t.get(e) ?? 0;
+			if (a !== 0 && !(r <= a) && i(`extra:${e}`)) return {
+				kind: "extra-step-occurrence",
+				stepName: e,
+				recorded: a,
+				reached: r,
+				detail: `step '${e}' was reached ${r} time(s) on this attempt but this run only ever recorded ${a} — the body may have changed how often it runs this step (a loop bound), so the journal replays a result for an iteration the code no longer means.`
+			};
+		},
+		settle: () => {
+			let e = [];
+			for (let [r, a] of t) (n.get(r) ?? 0) > 0 || i(`unreached:${r}`) && e.push({
+				kind: "unreached-step",
+				stepName: r,
+				recorded: a,
+				reached: 0,
+				detail: `step '${r}' ran on an earlier attempt of this run but the current code never reaches it — the step was renamed, removed, or moved behind a branch, so its journaled result is orphaned and any step that replaced it executed fresh.`
+			});
+			return e;
+		}
+	};
+}, U = x.unsafeMake(void 0), W = (e) => ({
+	kind: e.kind,
+	stepName: e.stepName,
+	recorded: e.recorded,
+	reached: e.reached,
+	detail: e.detail
+}), G = (e) => y.gen(function* () {
+	if (e.length === 0) return;
+	let t = yield* x.get(N), n = yield* y.serviceOption(M);
+	if (t === void 0 || n._tag !== "Some") return;
+	let r = n.value;
+	for (let n of e) yield* y.promise(() => r.recordEvent({
+		runId: t,
+		eventType: "nondeterminism-suspected",
+		payload: W(n)
+	}).then(() => void 0).catch(() => void 0));
+}), Se = (e) => {
+	if (typeof e != "object" || !e) return;
+	let t = e.retryAfterMillis;
+	if (typeof t == "number" && Number.isFinite(t) && t >= 0) return v.millis(t);
+	let n = e.retryAfter;
+	if (typeof n == "number" && Number.isFinite(n) && n >= 0) return v.seconds(n);
+}, K = (e) => v.decode(e), Ce = (e) => typeof e == "object" && e && "_tag" in e ? String(e._tag) : void 0, we = (e) => e !== void 0 && (e.maxAttempts ?? 3) > 1, Te = (e) => {
+	if (e.retryable) return e.retryable;
+	if (e.retryableErrors && e.retryableErrors.length > 0) {
+		let t = new Set(e.retryableErrors);
+		return (e) => {
+			let n = Ce(e);
+			return n !== void 0 && t.has(n);
+		};
+	}
+	return () => !0;
+}, Ee = (e) => {
+	let t = e.baseDelay ?? "200 millis", n = e.strategy ?? "exponential", r = e.maxAttempts ?? 3, i = n === "linear" ? S.linear(K(e.step ?? t)) : n === "fixed" ? S.spaced(K(t)) : S.exponential(K(t), e.factor ?? 2);
+	if (e.maxDelay !== void 0) {
+		let t = K(e.maxDelay);
+		i = S.modifyDelay(i, (e, n) => v.min(n, t));
+	}
+	(e.jitter ?? !0) === !0 && (i = S.jittered(i));
+	let a = S.intersect(i, S.recurs(Math.max(0, r - 1)));
+	return e.maxElapsed !== void 0 && (a = S.upTo(K(e.maxElapsed))(a)), a;
+}, De = (e, t) => {
+	let n = v.toMillis(K(e.baseDelay ?? "200 millis")), r = e.strategy ?? "exponential", i = r === "fixed" ? n : r === "linear" ? n + v.toMillis(K(e.step ?? e.baseDelay ?? "200 millis")) * (t - 1) : n * (e.factor ?? 2) ** (t - 1);
+	return e.maxDelay !== void 0 && (i = Math.min(i, v.toMillis(K(e.maxDelay)))), (e.jitter ?? !0) === !0 && (i *= Math.random()), i;
+}, Oe = (e, t, n, r) => y.gen(function* () {
+	let i = t.maxAttempts ?? 3, a = t.maxElapsed === void 0 ? Infinity : v.toMillis(K(t.maxElapsed)), o = yield* y.sync(() => Date.now()), s = 0;
+	for (;;) {
+		let c = yield* y.exit(e);
+		if (b.isSuccess(c)) return c.value;
+		let l = c.cause, u = g.failureOption(l), d = ae.isSome(u) ? u.value : g.squash(l);
+		s += 1;
+		let f = (yield* y.sync(() => Date.now())) - o;
+		if (s >= i || !n(d) || f >= a) return yield* y.failCause(l);
+		r?.(d);
+		let p = Se(d), m = p === void 0 ? De(t, s) : v.toMillis(p);
+		yield* y.sleep(v.millis(m));
+	}
+}), ke = (e, t, n) => {
+	if (!we(t)) return e;
+	let r = Te(t);
+	if (t.respectRetryAfter === !0) return Oe(e, t, r, n);
+	let i = Ee(t), a = n ? y.tapError(e, (e) => y.sync(() => {
+		r(e) && n(e);
+	})) : e;
+	return y.retry(a, {
+		schedule: i,
+		while: r
+	});
+}, q = Symbol.for("voltro.workflow.workerLayer"), J = Symbol.for("voltro.workflow.version"), Y = "__voltroWorkflowMessages", X = "__voltroWorkflowFlowControl", Ae = (e) => typeof e == "object" && !!e && e[q] === !0, je = (e) => typeof e == "object" && e && e[J] !== void 0 ? e[J] : {
+	version: "1",
+	compatibleWith: ["1"],
+	patches: []
+}, Z = (e) => {
+	let t = e, n = `workflow '${e.name}' defect`;
+	return Object.assign(Object.create(Object.getPrototypeOf(e)), e, {
+		toLayer: (e) => t.toLayer((t, r) => y.locally(e(t, r), a, !0).pipe(y.catchAllDefect((e) => y.die(s(e, n))))),
+		execute: (...e) => t.execute(...e).pipe(y.catchAllDefect((e) => y.die(r(e, n)))),
+		annotate: (...e) => Z(t.annotate(...e)),
+		annotateContext: (...e) => Z(t.annotateContext(...e))
+	});
+}, Me = ((t) => {
+	let r = t.encrypted === !0, i = h.make(r ? {
+		...t,
+		payload: o(t.name, t.payload),
+		...t.success === void 0 ? {} : { success: e(t.success, `workflow '${t.name}' result`) },
+		...t.error === void 0 ? {} : { error: e(t.error, `workflow '${t.name}' failure`) }
+	} : t);
+	r && n(t.name);
+	let a = t.suspendOnFailure === !0 ? i.annotate(h.SuspendOnFailure, !0) : i, s = r ? Z(a) : a;
+	E(s, (e, n, r) => y.gen(function* () {
+		let i = s.payloadSchema.make(e), a = yield* ne.WorkflowEngine;
+		return yield* y.annotateCurrentSpan({ executionId: n }), yield* a.execute(s, {
+			executionId: n,
+			payload: i,
+			discard: r,
+			suspendedRetrySchedule: t.suspendedRetrySchedule
+		});
+	}).pipe(y.withSpan(`${t.name}.execute`, { captureStackTrace: !1 })));
+	let c = String(t.version ?? "1"), l = {
+		version: c,
+		compatibleWith: (t.compatibleWith ?? [c]).map(String),
+		patches: [...t.patches ?? []]
+	}, u = {
+		signals: { ...t.messages?.signals ?? {} },
+		updates: { ...t.messages?.updates ?? {} }
+	};
+	Object.defineProperty(s, J, {
+		value: l,
+		enumerable: !1
+	}), Object.defineProperty(s, Y, {
+		value: u,
+		enumerable: !1
+	}), w(s, oe(t.name, t));
+	let d = j({
+		workflowName: t.name,
+		payloadSchema: C.isSchema(t.payload) ? t.payload : C.Struct(t.payload),
+		control: t
+	});
+	d !== void 0 && Object.defineProperty(s, X, {
+		value: d,
+		enumerable: !1
+	});
+	let f = V(t.name, t.schedule);
+	return f !== void 0 && Object.defineProperty(s, H, {
+		value: f,
+		enumerable: !1
+	}), s;
+}), Ne = (e) => {
+	if (typeof e != "object" || !e) return;
+	let t = e[X];
+	return t === void 0 ? void 0 : t;
+}, Q = ((n) => {
+	if (n.encrypted !== !0) return f.make(n);
+	t(n.name);
+	let r = C.isSchema(n.payload) ? n.payload : C.Struct(n.payload);
+	return f.make({
+		...n,
+		payload: e(r, `queue '${n.name}' payload`),
+		success: e(n.success ?? C.Void, `queue '${n.name}' result`),
+		error: e(n.error ?? C.Never, `queue '${n.name}' failure`)
+	});
+}), Pe = ((e, ...t) => y.flatMap(x.get(a), (n) => n && !i(e.name) ? y.die(/* @__PURE__ */ Error(`an encrypted workflow enqueued into durable queue '${e.name}', which is not encrypted: the queue's journal would hold the value in plaintext. Declare \`durableQueue({ …, encrypted: true })\`.`)) : f.process(e, ...t))), Fe = ((...e) => {
+	let t = f.worker(...e);
+	return Object.defineProperty(t, q, {
+		value: !0,
+		enumerable: !1
+	}), t;
+}), Ie = m.rateLimit, $ = (e) => y.gen(function* () {
+	let t = yield* N, n = yield* y.serviceOption(M), r = v.toMillis(v.decode(e.duration));
+	if (t !== void 0 && n._tag === "Some") {
+		let i = n.value, a = new Date(Date.now() + r).toISOString(), o = yield* I;
+		yield* y.promise(() => i.recordEvent({
+			runId: t,
+			eventType: "timer-set",
+			payload: {
+				name: e.name,
+				durationMs: r,
+				scheduledWakeAt: a,
+				...o === void 0 ? {} : { tenantId: o }
+			}
+		}).catch(() => {}));
+		let s = Date.now();
+		yield* u.sleep(e), yield* y.promise(() => i.recordEvent({
+			runId: t,
+			eventType: "timer-fired",
+			payload: {
+				name: e.name,
+				actualDurationMs: Date.now() - s,
+				...o === void 0 ? {} : { tenantId: o }
+			}
+		}).catch(() => {}));
+		return;
+	}
+	yield* u.sleep(e);
+}), Le = (e) => y.gen(function* () {
+	let t = (yield* c.make({
+		name: `sleepUntil:${e.name}`,
+		success: C.Number,
+		execute: y.sync(() => e.until instanceof Date ? e.until.getTime() : e.until)
+	})) - Date.now();
+	t <= 0 || (yield* $({
+		name: e.name,
+		duration: `${t} millis`
+	}));
+}), Re = (e, t, n, r) => y.gen(function* () {
+	let i = yield* N, o = yield* c.CurrentAttempt, s = yield* y.serviceOption(M), l = yield* y.serviceOption(z), u = l._tag === "Some" ? l.value.interceptor(t, {
+		runId: i ?? "unrecorded",
+		stepName: e,
+		attempt: o
+	}) : t, d, f, p = !1;
+	if (i !== void 0 && s._tag === "Some") {
+		f = s.value;
+		let t = r === void 0 ? void 0 : (({ retryable: e, ...t }) => t)(r);
+		p = yield* x.get(a);
+		try {
+			d = yield* y.promise(() => f.startStep({
+				runId: i,
+				stepName: e,
+				attempt: o,
+				stepInput: n,
+				sealed: p,
+				...t === void 0 ? {} : { retryPolicy: t }
+			}));
+		} catch {
+			d = void 0;
+		}
+	}
+	let m = Date.now();
+	return yield* y.locally(ke(u, r), F, e).pipe(y.tap((e) => d && f ? y.promise(async () => {
+		try {
+			await f.endStepSuccess({
+				stepRecordId: d,
+				sealed: p,
+				output: e,
+				durationMs: Date.now() - m
+			});
+		} catch {}
+	}) : y.void), y.tapErrorCause((e) => d && f && !g.isInterruptedOnly(e) ? y.promise(async () => {
+		try {
+			let t = g.failureOption(e), n = Array.from(g.failures(e)), r = Array.from(g.defects(e)), i = t._tag === "Some" ? t.value : r[0] ?? g.squash(e), a = i?.message ?? String(i), o = i && typeof i == "object" && "_tag" in i ? String(i._tag) : null;
+			await f.endStepFailure({
+				stepRecordId: d,
+				sealed: p,
+				errorTag: o,
+				errorMessage: a,
+				errorCause: {
+					pretty: g.pretty(e),
+					failures: n,
+					defects: r
+				},
+				durationMs: Date.now() - m
+			});
+		} catch {}
+	}) : y.void));
+}), ze = (e) => y.gen(function* () {
+	let t = yield* x.get(U);
+	if (t === void 0) return;
+	let n = t.reach(e);
+	n !== void 0 && (yield* G([n]));
+}), Be = (e, t, n) => {
+	let i = e;
+	return {
+		...e,
+		commit: () => y.zipRight(ze(t), n === void 0 ? i : y.flatMap(x.get(a), (e) => e ? n().pipe(y.catchAllDefect((e) => y.die(r(e, `step '${t}' defect`)))) : i))
+	};
+}, Ve = (t) => {
+	let { input: n, retry: r, ...i } = t, a = Re(i.name, i.execute, n, r), o = c.make({
+		...i,
+		execute: a
+	}), l, u = `step '${i.name}' defect`;
+	return Be(o, i.name, () => l ??= c.make({
+		...i,
+		success: e(i.success ?? C.Void, `step '${i.name}' result`),
+		error: e(i.error ?? C.Never, `step '${i.name}' failure`),
+		execute: a.pipe(y.catchAllDefect((e) => y.die(s(e, u))))
+	}));
+}, He = (e) => y.map(x.get(L), (t) => t.includes(e)), Ue = h.withCompensation, We = c.idempotencyKey;
+//#endregion
+export { be as A, me as B, te as C, G as D, W as E, N as F, D as G, R as H, F as I, j as J, ue as K, I as L, P as M, he as N, B as O, L as P, M as R, Me as S, xe as T, de as U, ge as V, pe as W, ce as X, E as Y, se as Z, Le as _, d as a, l as b, ee as c, Ae as d, He as f, $ as g, Ie as h, q as i, V as j, H as k, Ne as l, Fe as m, Y as n, Q as o, Pe as p, le as q, J as r, p as s, X as t, je as u, Ve as v, U as w, Ue as x, We as y, z };

package/dist/primitives.d.ts

@@ -65,7 +65,9 @@ export declare const deferringControlsOf: (control: ResolvedFlowControl | undefi
 export { durableClock }
 
 /** Define a durable queue for concurrency-controlled side work. */
-export declare const durableQueue: typeof durableQueueModule.make;
+export declare const durableQueue: typeof durableQueueModule.make & (<Options extends Parameters<typeof durableQueueModule.make>[0] & {
+    readonly encrypted?: boolean;
+}>(options: Options) => ReturnType<typeof durableQueueModule.make>);
 
 export { durableQueueModule }
 
@@ -194,7 +196,13 @@ export declare const patch: (id: string) => Effect.Effect<boolean>;
 /** The SCHEMA a payload input denotes — `Fields` lifted into a `Struct`. */
 declare type PayloadSchemaOf<P> = P extends Schema.Struct.Fields ? Schema.Struct<P> : P;
 
-/** Enqueue work and await the durable queue worker's result. */
+/**
+ * Enqueue work and await the durable queue worker's result.
+ *
+ * From inside an encrypted workflow the queue must be encrypted too — its
+ * journal would otherwise hold the workflow's data in plaintext one hop away,
+ * the same reason an encrypted workflow's `onFailure` handler must be.
+ */
 export declare const processQueue: typeof durableQueueModule.process;
 
 /** Start a durable queue worker layer with bounded concurrency.
@@ -306,7 +314,7 @@ export declare interface ResolvedFlowControl {
         readonly finishMs?: number;
     };
     readonly onFailure?: string;
-    readonly encryptSteps?: boolean;
+    readonly encrypted?: boolean;
     readonly cancelOn?: ReadonlyArray<ResolvedCancelOn>;
 }
 
@@ -508,58 +516,6 @@ export declare const validateWorkflowSchedule: (workflowName: string, declaratio
  */
 export declare const withCompensation: typeof workflowModule.withCompensation;
 
-/**
- * Define a durable workflow.
- *
- * ── `idempotencyKey` is the execution's IDENTITY, permanently ──────────────
- *
- * Read this before choosing one. It is the single most expensive
- * misunderstanding this API has produced — a downstream project lost a day and
- * shipped a design around the wrong model, and the wording they read
- * ("deduplicates concurrent invocations with the same input") is what led them
- * there. It sounds like a WINDOW: dedupe while a run is in flight. It is not.
- *
- * The key IS the execution. A second start with the same key REPLAYS the first
- * run's journaled result — forever, not just while it is running. Once the run
- * completes the key is SPENT: a later, genuinely new invocation under that key
- * is a silent no-op that returns the old output. Nothing errors and nothing
- * logs, because from the engine's point of view you asked for a run it already
- * has.
- *
- * ```ts
- * const a = yield* wf.execute({ id: 'same' })
- * const b = yield* wf.execute({ id: 'same' })   // ← does NOT run; replays `a`
- * ```
- *
- * So a key must be **unique per unit of work you want to happen**, not per
- * logical subject. `tour:${rowId}` is wrong if the tour can be re-narrated;
- * `tour:${rowId}:${updatedAt}` is right, because every edit is a new unit of
- * work with its own identity.
- *
- * ── And a flow-control key is a DIFFERENT thing ────────────────────────────
- *
- * The two get conflated, and conflating them is what makes "I need to re-arm a
- * key" feel like a missing feature. It is not missing; it is two fields:
- *
- *   • `idempotencyKey` — the execution's identity. Vary it per unit of work.
- *   • `debounce.key` / `singleton.key` / `concurrency.key` — the RESOURCE runs
- *     compete for. Keep it stable.
- *
- * "One job, fifteen minutes after the last edit, latest state wins" is then:
- *
- * ```ts
- * workflow({
- *   name: 'tourNarration',
- *   payload: TourPayload,
- *   idempotencyKey: ({ rowId, editedAt }) => `tour:${rowId}:${editedAt}`, // varies
- *   debounce: { key: (p) => `tour:${p.rowId}`, period: '15 minutes' },    // stable
- * })
- * ```
- *
- * Twenty edits mint twenty identities; exactly one is ever admitted. There is
- * no `restart: true` and no generation counter in this API because separating
- * the two keys is the mechanism those would have been.
- */
 export declare const workflow: WorkflowFn;
 
 declare type WorkflowBaseOptions = Parameters<WorkflowMake>[0];
@@ -792,27 +748,27 @@ export declare interface WorkflowFlowControl<Payload> {
      */
     readonly onFailure?: string;
     /**
-     * Encrypt this workflow's journaled step `input` / `output` / `errorCause`.
+     * Encrypt every durable copy of this workflow's data.
      *
-     * `step({ input })` is written to `_voltro_workflow_run_steps` and rendered in
-     * the dashboard — a feature, and the reason people pass rich input. For a step
-     * carrying personal data it is also a SECOND COPY, outside the `.encrypted()`
-     * boundary the governance plugin establishes for tables. An app that carefully
-     * encrypted a column and then handed the same value to a step has it in
-     * plaintext one table over.
+     * Covered: the payload, the result and a typed failure in the engine journal
+     * (`cluster_messages`, `cluster_replies`), every step's result and typed
+     * failure there, the run row (`_voltro_workflow_runs.payload` / `.output`),
+     * the step journal (`_voltro_workflow_run_steps`), a queued start's payload
+     * and a failure report's copy of the payload. The body sees the values it was
+     * given, and a run replays unchanged.
      *
-     * Reuses the cipher `governancePlugin({ fieldEncryption })` already registers,
-     * so there is ONE key and one rotation story rather than a second scheme that
-     * only workflows know about. It is therefore a BOOT ERROR to declare this
-     * without that plugin configured: silently falling back to plaintext would be
-     * the worst outcome available — the declaration reads as protection and the
-     * rows are readable.
+     * Not covered, and said here so it is not assumed: the `idempotencyKey`
+     * (hashed into the execution id, but a primary key built from free text is
+     * still that text in the engine's key column — derive it from ids), signal
+     * and update payloads, and anything a step writes elsewhere itself.
      *
-     * Only the journal is affected. The values the workflow BODY sees are
-     * unchanged, and the durable execution journal `@effect/workflow` keeps is
-     * untouched (encrypting that would break replay).
+     * Reuses the cipher `governancePlugin({ fieldEncryption })` registers — one
+     * key, one rotation story. Declaring it without that plugin configured is a
+     * BOOT ERROR: a plaintext fallback would leave the declaration reading as
+     * protection while the rows are readable. A plaintext value written before
+     * the declaration (a run already in flight) is still read.
      */
-    readonly encryptSteps?: boolean;
+    readonly encrypted?: boolean;
 }
 
 /** Where the RESOLVED flow-control declaration hangs off a definition. A

package/dist/primitives.js

@@ -1,2 +1,2 @@
-import { A as e, C as t, D as n, E as r, G as i, J as a, K as o, O as s, S as c, T as l, U as u, W as d, _ as f, a as p, b as m, c as h, d as g, f as _, g as v, h as y, i as b, j as x, k as S, l as C, m as w, n as T, o as E, p as D, q as O, r as k, s as A, t as j, u as M, v as N, w as P, x as F, y as I } from "./primitives-BJBn8tiH.js";
+import { A as e, C as t, D as n, E as r, G as i, J as a, K as o, O as s, S as c, T as l, U as u, W as d, _ as f, a as p, b as m, c as h, d as g, f as _, g as v, h as y, i as b, j as x, k as S, l as C, m as w, n as T, o as E, p as D, q as O, r as k, s as A, t as j, u as M, v as N, w as P, x as F, y as I } from "./primitives-Btjhjm8P.js";
 export { P as CurrentWorkflowReplayShape, s as DEFAULT_WORKFLOW_SCHEDULE_MAX_RUNTIME_MS, u as DEFERRING_CONTROLS, j as WorkflowFlowControlProperty, T as WorkflowMessagesProperty, S as WorkflowScheduleProperty, k as WorkflowVersionTypeId, b as WorkflowWorkerLayerTypeId, d as assertConsistentPools, i as deferringControlsOf, p as durableClock, E as durableQueue, A as durableQueueModule, h as durableRateLimiterModule, C as getWorkflowFlowControl, e as getWorkflowSchedule, M as getWorkflowVersionMetadata, o as hasCancelOn, O as hasFlowControl, g as isWorkflowWorkerLayer, l as makeReplayShapeTracker, r as nondeterminismEventPayload, _ as patch, D as processQueue, w as queueWorker, y as rateLimit, n as reportNondeterminism, v as sleep, f as sleepUntil, N as step, I as stepIdempotencyKey, m as stepModule, a as validateFlowControl, x as validateWorkflowSchedule, F as withCompensation, c as workflow, t as workflowModule };