@workflow/core 5.0.0-beta.5 → 5.0.0-beta.51

package/dist/runtime/get-world-lazy.js

@@ -9,48 +9,38 @@
  *
  * Resolution order, in priority:
  *
- * 1. `globalThis[WorldCacheKey]` — populated by a successful prior
+ * 1. `globalThis[WorldCacheKey]`: populated by a successful prior
  *    `getWorld()` call. This is the steady-state hot path.
- * 2. `globalThis[GetWorldFnKey]` — populated by the module-load side
+ * 2. `globalThis[GetWorldFnKey]`: populated by the module-load side
  *    effect at the bottom of `./world.ts`. Fires on every server bundle
- *    that reaches this file via `workflow/api` (which imports
+ *    that reaches this file via `workflow` or `workflow/api` (which import
  *    `./world-init.ts` for its side effect; see that file for the full
- *    rationale). This is the cold-start path for routes that consume
- *    `start` without any prior workflow run.
- * 3. Dynamic `import('./world.js')` — last-resort fallback for
- *    environments where neither (1) nor (2) is available (CJS test
- *    runners, scripts that import deeply into `@workflow/core` without
- *    going through `workflow/api`, future bundlers we haven't validated).
- *    The specifier is built at runtime so esbuild can't trace it into
- *    step bundles. Note: this branch is unreliable in webpack-bundled
- *    routes because webpack inlines this module into the route file and
- *    the relative path resolves against the bundle location — paths (1)
- *    and (2) cover those cases instead.
+ *    rationale). This is the cold-start path for routes that consume host
+ *    helpers without any prior workflow run.
  */
+import { assertWorldSupportsRuntimeProtocol } from './world-compatibility.js';
 const WorldCacheKey = Symbol.for('@workflow/world//cache');
 const WorldCachePromiseKey = Symbol.for('@workflow/world//cachePromise');
 const GetWorldFnKey = Symbol.for('@workflow/world//getWorldFn');
 export async function getWorldLazy() {
     const g = globalThis;
-    if (g[WorldCacheKey])
+    if (g[WorldCacheKey]) {
+        assertWorldSupportsRuntimeProtocol(g[WorldCacheKey]);
         return g[WorldCacheKey];
+    }
     if (g[WorldCachePromiseKey]) {
         g[WorldCacheKey] = await g[WorldCachePromiseKey];
+        assertWorldSupportsRuntimeProtocol(g[WorldCacheKey]);
         return g[WorldCacheKey];
     }
-    // If world.ts is statically present in this bundle, it has registered
-    // getWorld on globalThis at module load. Prefer that over the dynamic
-    // import fallback, which doesn't survive Next.js inlining get-world-lazy
-    // into a route bundle (the relative './world.js' resolves against the
-    // bundled location, where no sibling world.js exists).
+    // world-init statically imports world.ts in host bundles, which registers
+    // getWorld on globalThis at module load.
     const getWorldFn = g[GetWorldFnKey];
-    if (getWorldFn)
-        return getWorldFn();
-    // Last resort: dynamic import for environments where world.ts wasn't
-    // bundled but is reachable as a sibling module on disk. The specifier is
-    // built at runtime so esbuild can't trace it into the step bundle.
-    const worldPath = ['./world', 'js'].join('.');
-    const { getWorld } = await import(worldPath);
-    return getWorld();
+    if (getWorldFn) {
+        const world = await getWorldFn();
+        assertWorldSupportsRuntimeProtocol(world);
+        return world;
+    }
+    throw new Error('Workflow world runtime was not initialized. Import from the host workflow entrypoints (`workflow`, `workflow/api`, or `workflow/runtime`) so @workflow/core/runtime/world-init can register getWorld before getWorldLazy() is used.');
 }
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiZ2V0LXdvcmxkLWxhenkuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zcmMvcnVudGltZS9nZXQtd29ybGQtbGF6eS50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQTs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7OztHQTRCRztBQUlILE1BQU0sYUFBYSxHQUFHLE1BQU0sQ0FBQyxHQUFHLENBQUMsd0JBQXdCLENBQUMsQ0FBQztBQUMzRCxNQUFNLG9CQUFvQixHQUFHLE1BQU0sQ0FBQyxHQUFHLENBQUMsK0JBQStCLENBQUMsQ0FBQztBQUN6RSxNQUFNLGFBQWEsR0FBRyxNQUFNLENBQUMsR0FBRyxDQUFDLDZCQUE2QixDQUFDLENBQUM7QUFFaEUsTUFBTSxDQUFDLEtBQUssVUFBVSxZQUFZO0lBQ2hDLE1BQU0sQ0FBQyxHQUFHLFVBQWlCLENBQUM7SUFDNUIsSUFBSSxDQUFDLENBQUMsYUFBYSxDQUFDO1FBQUUsT0FBTyxDQUFDLENBQUMsYUFBYSxDQUFDLENBQUM7SUFDOUMsSUFBSSxDQUFDLENBQUMsb0JBQW9CLENBQUMsRUFBRSxDQUFDO1FBQzVCLENBQUMsQ0FBQyxhQUFhLENBQUMsR0FBRyxNQUFNLENBQUMsQ0FBQyxvQkFBb0IsQ0FBQyxDQUFDO1FBQ2pELE9BQU8sQ0FBQyxDQUFDLGFBQWEsQ0FBQyxDQUFDO0lBQzFCLENBQUM7SUFDRCxzRUFBc0U7SUFDdEUsc0VBQXNFO0lBQ3RFLHlFQUF5RTtJQUN6RSxzRUFBc0U7SUFDdEUsdURBQXVEO0lBQ3ZELE1BQU0sVUFBVSxHQUFHLENBQUMsQ0FBQyxhQUFhLENBQXVDLENBQUM7SUFDMUUsSUFBSSxVQUFVO1FBQUUsT0FBTyxVQUFVLEVBQUUsQ0FBQztJQUNwQyxxRUFBcUU7SUFDckUseUVBQXlFO0lBQ3pFLG1FQUFtRTtJQUNuRSxNQUFNLFNBQVMsR0FBRyxDQUFDLFNBQVMsRUFBRSxJQUFJLENBQUMsQ0FBQyxJQUFJLENBQUMsR0FBRyxDQUFDLENBQUM7SUFDOUMsTUFBTSxFQUFFLFFBQVEsRUFBRSxHQUFHLE1BQU0sTUFBTSxDQUFDLFNBQVMsQ0FBQyxDQUFDO0lBQzdDLE9BQU8sUUFBUSxFQUFFLENBQUM7QUFDcEIsQ0FBQyIsInNvdXJjZXNDb250ZW50IjpbIi8qKlxuICogTGF6eSBhY2Nlc3NvciBmb3IgdGhlIFdvcmxkIHNpbmdsZXRvbiB2aWEgZ2xvYmFsVGhpcyBzeW1ib2xzLlxuICpcbiAqIFRoaXMgbW9kdWxlIGV4aXN0cyB0byBicmVhayB0aGUgc3RhdGljIGltcG9ydCBjaGFpbiBmcm9tIHN0ZXAtc2lkZVxuICogbW9kdWxlcyAoc2VyaWFsaXphdGlvbiwgcnVuLCBoZWxwZXJzLCBzdGFydCkgdG8gd29ybGQudHMuIFdpdGhvdXQgaXQsXG4gKiBlc2J1aWxkIGJ1bmRsZXMgd29ybGQudHMgKGFuZCBpdHMgdHJhbnNpdGl2ZSBkZXBzOiB3b3JsZC1sb2NhbCxcbiAqIHdvcmxkLXZlcmNlbCwgcHJvY2Vzcy5jd2QoKSwgZXRjLikgaW50byB0aGUgc3RlcCByZWdpc3RyYXRpb25zIGJ1bmRsZSxcbiAqIHdoaWNoIHRyaWdnZXJzIFR1cmJvcGFjayBORlQgdHJhY2luZyBlcnJvcnMgaW4gdGhlIFYyIGNvbWJpbmVkIGZsb3cgcm91dGUuXG4gKlxuICogUmVzb2x1dGlvbiBvcmRlciwgaW4gcHJpb3JpdHk6XG4gKlxuICogMS4gYGdsb2JhbFRoaXNbV29ybGRDYWNoZUtleV1gIOKAlCBwb3B1bGF0ZWQgYnkgYSBzdWNjZXNzZnVsIHByaW9yXG4gKiAgICBgZ2V0V29ybGQoKWAgY2FsbC4gVGhpcyBpcyB0aGUgc3RlYWR5LXN0YXRlIGhvdCBwYXRoLlxuICogMi4gYGdsb2JhbFRoaXNbR2V0V29ybGRGbktleV1gIOKAlCBwb3B1bGF0ZWQgYnkgdGhlIG1vZHVsZS1sb2FkIHNpZGVcbiAqICAgIGVmZmVjdCBhdCB0aGUgYm90dG9tIG9mIGAuL3dvcmxkLnRzYC4gRmlyZXMgb24gZXZlcnkgc2VydmVyIGJ1bmRsZVxuICogICAgdGhhdCByZWFjaGVzIHRoaXMgZmlsZSB2aWEgYHdvcmtmbG93L2FwaWAgKHdoaWNoIGltcG9ydHNcbiAqICAgIGAuL3dvcmxkLWluaXQudHNgIGZvciBpdHMgc2lkZSBlZmZlY3Q7IHNlZSB0aGF0IGZpbGUgZm9yIHRoZSBmdWxsXG4gKiAgICByYXRpb25hbGUpLiBUaGlzIGlzIHRoZSBjb2xkLXN0YXJ0IHBhdGggZm9yIHJvdXRlcyB0aGF0IGNvbnN1bWVcbiAqICAgIGBzdGFydGAgd2l0aG91dCBhbnkgcHJpb3Igd29ya2Zsb3cgcnVuLlxuICogMy4gRHluYW1pYyBgaW1wb3J0KCcuL3dvcmxkLmpzJylgIOKAlCBsYXN0LXJlc29ydCBmYWxsYmFjayBmb3JcbiAqICAgIGVudmlyb25tZW50cyB3aGVyZSBuZWl0aGVyICgxKSBub3IgKDIpIGlzIGF2YWlsYWJsZSAoQ0pTIHRlc3RcbiAqICAgIHJ1bm5lcnMsIHNjcmlwdHMgdGhhdCBpbXBvcnQgZGVlcGx5IGludG8gYEB3b3JrZmxvdy9jb3JlYCB3aXRob3V0XG4gKiAgICBnb2luZyB0aHJvdWdoIGB3b3JrZmxvdy9hcGlgLCBmdXR1cmUgYnVuZGxlcnMgd2UgaGF2ZW4ndCB2YWxpZGF0ZWQpLlxuICogICAgVGhlIHNwZWNpZmllciBpcyBidWlsdCBhdCBydW50aW1lIHNvIGVzYnVpbGQgY2FuJ3QgdHJhY2UgaXQgaW50b1xuICogICAgc3RlcCBidW5kbGVzLiBOb3RlOiB0aGlzIGJyYW5jaCBpcyB1bnJlbGlhYmxlIGluIHdlYnBhY2stYnVuZGxlZFxuICogICAgcm91dGVzIGJlY2F1c2Ugd2VicGFjayBpbmxpbmVzIHRoaXMgbW9kdWxlIGludG8gdGhlIHJvdXRlIGZpbGUgYW5kXG4gKiAgICB0aGUgcmVsYXRpdmUgcGF0aCByZXNvbHZlcyBhZ2FpbnN0IHRoZSBidW5kbGUgbG9jYXRpb24g4oCUIHBhdGhzICgxKVxuICogICAgYW5kICgyKSBjb3ZlciB0aG9zZSBjYXNlcyBpbnN0ZWFkLlxuICovXG5cbmltcG9ydCB0eXBlIHsgV29ybGQgfSBmcm9tICdAd29ya2Zsb3cvd29ybGQnO1xuXG5jb25zdCBXb3JsZENhY2hlS2V5ID0gU3ltYm9sLmZvcignQHdvcmtmbG93L3dvcmxkLy9jYWNoZScpO1xuY29uc3QgV29ybGRDYWNoZVByb21pc2VLZXkgPSBTeW1ib2wuZm9yKCdAd29ya2Zsb3cvd29ybGQvL2NhY2hlUHJvbWlzZScpO1xuY29uc3QgR2V0V29ybGRGbktleSA9IFN5bWJvbC5mb3IoJ0B3b3JrZmxvdy93b3JsZC8vZ2V0V29ybGRGbicpO1xuXG5leHBvcnQgYXN5bmMgZnVuY3Rpb24gZ2V0V29ybGRMYXp5KCk6IFByb21pc2U8V29ybGQ+IHtcbiAgY29uc3QgZyA9IGdsb2JhbFRoaXMgYXMgYW55O1xuICBpZiAoZ1tXb3JsZENhY2hlS2V5XSkgcmV0dXJuIGdbV29ybGRDYWNoZUtleV07XG4gIGlmIChnW1dvcmxkQ2FjaGVQcm9taXNlS2V5XSkge1xuICAgIGdbV29ybGRDYWNoZUtleV0gPSBhd2FpdCBnW1dvcmxkQ2FjaGVQcm9taXNlS2V5XTtcbiAgICByZXR1cm4gZ1tXb3JsZENhY2hlS2V5XTtcbiAgfVxuICAvLyBJZiB3b3JsZC50cyBpcyBzdGF0aWNhbGx5IHByZXNlbnQgaW4gdGhpcyBidW5kbGUsIGl0IGhhcyByZWdpc3RlcmVkXG4gIC8vIGdldFdvcmxkIG9uIGdsb2JhbFRoaXMgYXQgbW9kdWxlIGxvYWQuIFByZWZlciB0aGF0IG92ZXIgdGhlIGR5bmFtaWNcbiAgLy8gaW1wb3J0IGZhbGxiYWNrLCB3aGljaCBkb2Vzbid0IHN1cnZpdmUgTmV4dC5qcyBpbmxpbmluZyBnZXQtd29ybGQtbGF6eVxuICAvLyBpbnRvIGEgcm91dGUgYnVuZGxlICh0aGUgcmVsYXRpdmUgJy4vd29ybGQuanMnIHJlc29sdmVzIGFnYWluc3QgdGhlXG4gIC8vIGJ1bmRsZWQgbG9jYXRpb24sIHdoZXJlIG5vIHNpYmxpbmcgd29ybGQuanMgZXhpc3RzKS5cbiAgY29uc3QgZ2V0V29ybGRGbiA9IGdbR2V0V29ybGRGbktleV0gYXMgKCgpID0+IFByb21pc2U8V29ybGQ+KSB8IHVuZGVmaW5lZDtcbiAgaWYgKGdldFdvcmxkRm4pIHJldHVybiBnZXRXb3JsZEZuKCk7XG4gIC8vIExhc3QgcmVzb3J0OiBkeW5hbWljIGltcG9ydCBmb3IgZW52aXJvbm1lbnRzIHdoZXJlIHdvcmxkLnRzIHdhc24ndFxuICAvLyBidW5kbGVkIGJ1dCBpcyByZWFjaGFibGUgYXMgYSBzaWJsaW5nIG1vZHVsZSBvbiBkaXNrLiBUaGUgc3BlY2lmaWVyIGlzXG4gIC8vIGJ1aWx0IGF0IHJ1bnRpbWUgc28gZXNidWlsZCBjYW4ndCB0cmFjZSBpdCBpbnRvIHRoZSBzdGVwIGJ1bmRsZS5cbiAgY29uc3Qgd29ybGRQYXRoID0gWycuL3dvcmxkJywgJ2pzJ10uam9pbignLicpO1xuICBjb25zdCB7IGdldFdvcmxkIH0gPSBhd2FpdCBpbXBvcnQod29ybGRQYXRoKTtcbiAgcmV0dXJuIGdldFdvcmxkKCk7XG59XG4iXX0=
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiZ2V0LXdvcmxkLWxhenkuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zcmMvcnVudGltZS9nZXQtd29ybGQtbGF6eS50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQTs7Ozs7Ozs7Ozs7Ozs7Ozs7OztHQW1CRztBQUdILE9BQU8sRUFBRSxrQ0FBa0MsRUFBRSxNQUFNLDBCQUEwQixDQUFDO0FBRTlFLE1BQU0sYUFBYSxHQUFHLE1BQU0sQ0FBQyxHQUFHLENBQUMsd0JBQXdCLENBQUMsQ0FBQztBQUMzRCxNQUFNLG9CQUFvQixHQUFHLE1BQU0sQ0FBQyxHQUFHLENBQUMsK0JBQStCLENBQUMsQ0FBQztBQUN6RSxNQUFNLGFBQWEsR0FBRyxNQUFNLENBQUMsR0FBRyxDQUFDLDZCQUE2QixDQUFDLENBQUM7QUFRaEUsTUFBTSxDQUFDLEtBQUssVUFBVSxZQUFZO0lBQ2hDLE1BQU0sQ0FBQyxHQUFHLFVBQThCLENBQUM7SUFDekMsSUFBSSxDQUFDLENBQUMsYUFBYSxDQUFDLEVBQUUsQ0FBQztRQUNyQixrQ0FBa0MsQ0FBQyxDQUFDLENBQUMsYUFBYSxDQUFDLENBQUMsQ0FBQztRQUNyRCxPQUFPLENBQUMsQ0FBQyxhQUFhLENBQUMsQ0FBQztJQUMxQixDQUFDO0lBQ0QsSUFBSSxDQUFDLENBQUMsb0JBQW9CLENBQUMsRUFBRSxDQUFDO1FBQzVCLENBQUMsQ0FBQyxhQUFhLENBQUMsR0FBRyxNQUFNLENBQUMsQ0FBQyxvQkFBb0IsQ0FBQyxDQUFDO1FBQ2pELGtDQUFrQyxDQUFDLENBQUMsQ0FBQyxhQUFhLENBQUMsQ0FBQyxDQUFDO1FBQ3JELE9BQU8sQ0FBQyxDQUFDLGFBQWEsQ0FBQyxDQUFDO0lBQzFCLENBQUM7SUFDRCwwRUFBMEU7SUFDMUUseUNBQXlDO0lBQ3pDLE1BQU0sVUFBVSxHQUFHLENBQUMsQ0FBQyxhQUFhLENBQUMsQ0FBQztJQUNwQyxJQUFJLFVBQVUsRUFBRSxDQUFDO1FBQ2YsTUFBTSxLQUFLLEdBQUcsTUFBTSxVQUFVLEVBQUUsQ0FBQztRQUNqQyxrQ0FBa0MsQ0FBQyxLQUFLLENBQUMsQ0FBQztRQUMxQyxPQUFPLEtBQUssQ0FBQztJQUNmLENBQUM7SUFDRCxNQUFNLElBQUksS0FBSyxDQUNiLHFPQUFxTyxDQUN0TyxDQUFDO0FBQ0osQ0FBQyIsInNvdXJjZXNDb250ZW50IjpbIi8qKlxuICogTGF6eSBhY2Nlc3NvciBmb3IgdGhlIFdvcmxkIHNpbmdsZXRvbiB2aWEgZ2xvYmFsVGhpcyBzeW1ib2xzLlxuICpcbiAqIFRoaXMgbW9kdWxlIGV4aXN0cyB0byBicmVhayB0aGUgc3RhdGljIGltcG9ydCBjaGFpbiBmcm9tIHN0ZXAtc2lkZVxuICogbW9kdWxlcyAoc2VyaWFsaXphdGlvbiwgcnVuLCBoZWxwZXJzLCBzdGFydCkgdG8gd29ybGQudHMuIFdpdGhvdXQgaXQsXG4gKiBlc2J1aWxkIGJ1bmRsZXMgd29ybGQudHMgKGFuZCBpdHMgdHJhbnNpdGl2ZSBkZXBzOiB3b3JsZC1sb2NhbCxcbiAqIHdvcmxkLXZlcmNlbCwgcHJvY2Vzcy5jd2QoKSwgZXRjLikgaW50byB0aGUgc3RlcCByZWdpc3RyYXRpb25zIGJ1bmRsZSxcbiAqIHdoaWNoIHRyaWdnZXJzIFR1cmJvcGFjayBORlQgdHJhY2luZyBlcnJvcnMgaW4gdGhlIFYyIGNvbWJpbmVkIGZsb3cgcm91dGUuXG4gKlxuICogUmVzb2x1dGlvbiBvcmRlciwgaW4gcHJpb3JpdHk6XG4gKlxuICogMS4gYGdsb2JhbFRoaXNbV29ybGRDYWNoZUtleV1gOiBwb3B1bGF0ZWQgYnkgYSBzdWNjZXNzZnVsIHByaW9yXG4gKiAgICBgZ2V0V29ybGQoKWAgY2FsbC4gVGhpcyBpcyB0aGUgc3RlYWR5LXN0YXRlIGhvdCBwYXRoLlxuICogMi4gYGdsb2JhbFRoaXNbR2V0V29ybGRGbktleV1gOiBwb3B1bGF0ZWQgYnkgdGhlIG1vZHVsZS1sb2FkIHNpZGVcbiAqICAgIGVmZmVjdCBhdCB0aGUgYm90dG9tIG9mIGAuL3dvcmxkLnRzYC4gRmlyZXMgb24gZXZlcnkgc2VydmVyIGJ1bmRsZVxuICogICAgdGhhdCByZWFjaGVzIHRoaXMgZmlsZSB2aWEgYHdvcmtmbG93YCBvciBgd29ya2Zsb3cvYXBpYCAod2hpY2ggaW1wb3J0XG4gKiAgICBgLi93b3JsZC1pbml0LnRzYCBmb3IgaXRzIHNpZGUgZWZmZWN0OyBzZWUgdGhhdCBmaWxlIGZvciB0aGUgZnVsbFxuICogICAgcmF0aW9uYWxlKS4gVGhpcyBpcyB0aGUgY29sZC1zdGFydCBwYXRoIGZvciByb3V0ZXMgdGhhdCBjb25zdW1lIGhvc3RcbiAqICAgIGhlbHBlcnMgd2l0aG91dCBhbnkgcHJpb3Igd29ya2Zsb3cgcnVuLlxuICovXG5cbmltcG9ydCB0eXBlIHsgV29ybGQgfSBmcm9tICdAd29ya2Zsb3cvd29ybGQnO1xuaW1wb3J0IHsgYXNzZXJ0V29ybGRTdXBwb3J0c1J1bnRpbWVQcm90b2NvbCB9IGZyb20gJy4vd29ybGQtY29tcGF0aWJpbGl0eS5qcyc7XG5cbmNvbnN0IFdvcmxkQ2FjaGVLZXkgPSBTeW1ib2wuZm9yKCdAd29ya2Zsb3cvd29ybGQvL2NhY2hlJyk7XG5jb25zdCBXb3JsZENhY2hlUHJvbWlzZUtleSA9IFN5bWJvbC5mb3IoJ0B3b3JrZmxvdy93b3JsZC8vY2FjaGVQcm9taXNlJyk7XG5jb25zdCBHZXRXb3JsZEZuS2V5ID0gU3ltYm9sLmZvcignQHdvcmtmbG93L3dvcmxkLy9nZXRXb3JsZEZuJyk7XG5cbnR5cGUgR2xvYmFsV29ybGRDYWNoZSA9IHR5cGVvZiBnbG9iYWxUaGlzICYge1xuICBbV29ybGRDYWNoZUtleV0/OiBXb3JsZDtcbiAgW1dvcmxkQ2FjaGVQcm9taXNlS2V5XT86IFByb21pc2U8V29ybGQ+O1xuICBbR2V0V29ybGRGbktleV0/OiAoKSA9PiBQcm9taXNlPFdvcmxkPjtcbn07XG5cbmV4cG9ydCBhc3luYyBmdW5jdGlvbiBnZXRXb3JsZExhenkoKTogUHJvbWlzZTxXb3JsZD4ge1xuICBjb25zdCBnID0gZ2xvYmFsVGhpcyBhcyBHbG9iYWxXb3JsZENhY2hlO1xuICBpZiAoZ1tXb3JsZENhY2hlS2V5XSkge1xuICAgIGFzc2VydFdvcmxkU3VwcG9ydHNSdW50aW1lUHJvdG9jb2woZ1tXb3JsZENhY2hlS2V5XSk7XG4gICAgcmV0dXJuIGdbV29ybGRDYWNoZUtleV07XG4gIH1cbiAgaWYgKGdbV29ybGRDYWNoZVByb21pc2VLZXldKSB7XG4gICAgZ1tXb3JsZENhY2hlS2V5XSA9IGF3YWl0IGdbV29ybGRDYWNoZVByb21pc2VLZXldO1xuICAgIGFzc2VydFdvcmxkU3VwcG9ydHNSdW50aW1lUHJvdG9jb2woZ1tXb3JsZENhY2hlS2V5XSk7XG4gICAgcmV0dXJuIGdbV29ybGRDYWNoZUtleV07XG4gIH1cbiAgLy8gd29ybGQtaW5pdCBzdGF0aWNhbGx5IGltcG9ydHMgd29ybGQudHMgaW4gaG9zdCBidW5kbGVzLCB3aGljaCByZWdpc3RlcnNcbiAgLy8gZ2V0V29ybGQgb24gZ2xvYmFsVGhpcyBhdCBtb2R1bGUgbG9hZC5cbiAgY29uc3QgZ2V0V29ybGRGbiA9IGdbR2V0V29ybGRGbktleV07XG4gIGlmIChnZXRXb3JsZEZuKSB7XG4gICAgY29uc3Qgd29ybGQgPSBhd2FpdCBnZXRXb3JsZEZuKCk7XG4gICAgYXNzZXJ0V29ybGRTdXBwb3J0c1J1bnRpbWVQcm90b2NvbCh3b3JsZCk7XG4gICAgcmV0dXJuIHdvcmxkO1xuICB9XG4gIHRocm93IG5ldyBFcnJvcihcbiAgICAnV29ya2Zsb3cgd29ybGQgcnVudGltZSB3YXMgbm90IGluaXRpYWxpemVkLiBJbXBvcnQgZnJvbSB0aGUgaG9zdCB3b3JrZmxvdyBlbnRyeXBvaW50cyAoYHdvcmtmbG93YCwgYHdvcmtmbG93L2FwaWAsIG9yIGB3b3JrZmxvdy9ydW50aW1lYCkgc28gQHdvcmtmbG93L2NvcmUvcnVudGltZS93b3JsZC1pbml0IGNhbiByZWdpc3RlciBnZXRXb3JsZCBiZWZvcmUgZ2V0V29ybGRMYXp5KCkgaXMgdXNlZC4nXG4gICk7XG59XG4iXX0=

package/dist/runtime/helpers.d.ts

@@ -1,11 +1,11 @@
-import type { Event, HealthCheckPayload, ValidQueueName, WorkflowRun, World } from '@workflow/world';
-import { type CryptoKey } from '../encryption.js';
+import type { CreateEventParams, CreateEventRequest, Event, EventResult, HealthCheckPayload, RunDispatchContext, ValidQueueName, WorkflowRun, World } from '@workflow/world';
+import { type PayloadKey } from '../serialization/encryption.js';
 /**
  * Validates a workflow name and returns the corresponding queue name.
  * Ensures the workflow name only contains safe characters before
  * interpolating it into the queue name string.
  */
-export declare function getWorkflowQueueName(workflowName: string): ValidQueueName;
+export declare function getWorkflowQueueName(workflowName: string, namespace?: string): ValidQueueName;
 /**
  * Result of a health check operation.
  */
@@ -17,6 +17,35 @@ export interface HealthCheckResult {
     latencyMs?: number;
     /** Spec version of the responding deployment */
     specVersion?: number;
+    /**
+     * `@workflow/core` version of the responding deployment, used for
+     * capability detection (see `getRunCapabilities`). Omitted when the
+     * responding deployment did not provide the field as a string:
+     * for example, an older `@workflow/core` that predates this field,
+     * or a non-JSON plain-text health response.
+     */
+    workflowCoreVersion?: string;
+    /**
+     * The target run's X25519 public key (base64), returned only when the probe
+     * carried a `runId` and the responding deployment has encryption enabled.
+     *
+     * Lets a cross-deployment `start()` seal the workflow arguments using a
+     * response it was already waiting on, instead of making a separate
+     * key-lookup request.
+     */
+    encryptionPublicKey?: string;
+    /**
+     * The responding deployment's `HOOK_RESUME_INPUT_VERSION`: the protocol
+     * version at which the *consumer* (queue-message target) materializes the
+     * `hook_received` event from `hookInput` on replay. A cross-deployment
+     * `start()` stamps the *target's* value (not the caller's) into the new
+     * run's `executionContext.hookResumeInputVersion`. Current producers write
+     * the event durably before publishing the wake and do not read the marker;
+     * OLDER producers still gate their lazy path on it, so it keeps being
+     * stamped. Omitted when the responding deployment predates this field,
+     * which fails that gate closed.
+     */
+    hookResumeInputVersion?: number;
 }
 /**
  * Checks if the given message is a health check payload.
@@ -28,17 +57,62 @@ export declare function parseHealthCheckPayload(message: unknown): HealthCheckPa
  * The caller can listen to this stream to get the health check response.
  *
  * @param healthCheck - The parsed health check payload
- * @param endpoint - Which endpoint is responding ('workflow' or 'step')
  */
-export declare function handleHealthCheckMessage(healthCheck: HealthCheckPayload, endpoint: 'workflow' | 'step', worldSpecVersion?: number): Promise<void>;
-export type HealthCheckEndpoint = 'workflow' | 'step';
+export declare function handleHealthCheckMessage(healthCheck: HealthCheckPayload, worldSpecVersion?: number): Promise<void>;
 export interface HealthCheckOptions {
     /** Timeout in milliseconds to wait for health check response. Default: 30000 (30s) */
     timeout?: number;
     /** Deployment ID to send the health check to. Falls back to process.env.VERCEL_DEPLOYMENT_ID. */
     deploymentId?: string;
+    /**
+     * The run id the caller is about to create. When set, the responding
+     * deployment derives that run's public key locally and returns it as
+     * `encryptionPublicKey`, letting a cross-deployment `start()` seal the
+     * workflow arguments without a separate key lookup.
+     */
+    runId?: string;
+    /**
+     * Queue namespace of the target deployment (e.g. `'eve'` for topics like
+     * `__eve_wkf_workflow_*`). Falls back to `WORKFLOW_QUEUE_NAMESPACE` in the
+     * calling process. Cross-context callers (e.g. the observability
+     * dashboard) must pass the target deployment's namespace explicitly:
+     * the env fallback resolves in the caller's process, and a message
+     * published to a mismatched topic has no consumer, so the check would
+     * always time out.
+     */
+    namespace?: string;
 }
-export declare function healthCheck(world: World, endpoint: HealthCheckEndpoint, options?: HealthCheckOptions): Promise<HealthCheckResult>;
+export declare function healthCheck(world: World, options?: HealthCheckOptions): Promise<HealthCheckResult>;
+/**
+ * Appends events whose IDs are not already present in `target`.
+ *
+ * Pass the IDs currently present in `target` when appending repeatedly to the
+ * same array. The set is updated alongside `target`.
+ *
+ * Events are appended in the order the World returned them, and are not
+ * re-sorted. Every append source is already in canonical order relative to the
+ * tail (a cursor-delimited page, or a write-response delta), so receipt order is
+ * the order to keep, and re-sorting here would only cost a pass over the log.
+ * Nothing downstream may assume the tail is the newest event. See
+ * {@link maxEventSlot}.
+ */
+export declare function appendUniqueEvents(target: Event[], events: readonly Event[], targetIds?: Set<string>): void;
+/**
+ * Inserts `event` into `target` at the position that keeps `target` ordered by
+ * ascending `eventId`, or no-ops if an event with the same `eventId` is already
+ * present (idempotent).
+ *
+ * `preloadedEvents` is loaded `sortOrder: 'asc'` and is never re-sorted
+ * client-side, so a `hook_received` spliced in by the lazy-resume consumer must
+ * land in `eventId` order: a plain `push` would place a late-committing
+ * earlier event after events that sort before it, corrupting replay.
+ *
+ * Lexicographic string order is the log's order: a slot id is a fixed-width
+ * zero-padded position, so comparing the strings compares the positions. This
+ * needs no parse of its own for that reason, and the comparison is exact rather
+ * than a reconstruction.
+ */
+export declare function insertEventByEventId(target: Event[], event: Event): void;
 /**
  * Loads workflow run events by iterating through all pages of paginated
  * results. Events are returned in chronological (ascending) order for
@@ -50,19 +124,342 @@ export declare function healthCheck(world: World, endpoint: HealthCheckEndpoint,
  *   The returned cursor can be passed back in on a subsequent call for
  *   incremental loading.
  */
-export declare function loadWorkflowRunEvents(runId: string, afterCursor?: string): Promise<{
+export declare function loadWorkflowRunEvents(runId: string, afterCursor?: string): Promise<LoadedEventLog>;
+/**
+ * The runtime's loaded event-log snapshot: the events replayed so far and the
+ * cursor positioned after them. Handed to helpers that derive the precondition
+ * snapshot from it; they do not mutate it.
+ */
+export interface LoadedEventLog {
     events: Event[];
     cursor: string | null;
+}
+/**
+ * Extend a loaded log with a page that continues it — a listed page, or the
+ * inline delta a write handed back — and move its read position with it.
+ *
+ * The cursor is only advanced when the page carries one, so a source with no
+ * position of its own (a skipped-slot report) cannot walk the read position
+ * past events it did not carry. Appending does not re-sort; see
+ * {@link appendUniqueEvents} for why receipt order is the order to keep.
+ */
+export declare function appendEventLog(log: LoadedEventLog, appended: {
+    events: readonly Event[];
+    cursor?: string | null;
+}): void;
+/**
+ * Whether a replay refuses to run over a log with a hole in it (see
+ * {@link findEventSlotGap}). **On by default**; set
+ * `WORKFLOW_SLOT_GAP_CHECK=0` to replay across holes instead.
+ *
+ * A World that allocates a position at the moment it commits leaves no hole
+ * behind when a write fails, so density is a property the log has by
+ * construction rather than one this check maintains. What the check is for is
+ * the reads and the Worlds where that does not hold, and by the time it runs
+ * the benign explanations are spent: a position missing because a concurrent
+ * commit is not visible yet clears on a re-read, which is what
+ * {@link settleEventSlotGap} does first.
+ *
+ * What is left is a hole that persists, and its two causes are
+ * indistinguishable from the log. Either a World allocated the position outside
+ * the commit and lost the write, in which case nothing happened there and
+ * replaying past it is correct, or an event that did happen is missing, in
+ * which case replaying past it decides a branch on absence and produces a wrong
+ * result with nothing to show for it. Failing is the recoverable side of that
+ * trade, and this is the way back out if a fleet turns out to carry holes of
+ * the first kind.
+ */
+export declare function isSlotGapCheckEnabled(): boolean;
+/**
+ * Merge the events a bump-and-report write handed back into the log it was
+ * derived from, and answer how many of them were new.
+ *
+ * Unlike {@link appendUniqueEvents}, this re-sorts. The reported events occupy
+ * slots *below* the write that reported them, so appending them would put them
+ * after events they precede. Sorting by id restores the World's canonical order
+ * rather than guessing at it: a slot id is that order, written down.
+ */
+export declare function mergeReportedEvents(target: Event[], events: readonly Event[]): number;
+/** What {@link absorbSkippedSlotReport} did with a write's report. */
+export interface SkippedSlotReport {
+    /** How many of the reported events were new to the log. Zero if dropped. */
+    added: number;
+    /** How many events the report offered, whether or not they were taken. */
+    offered: number;
+    /** The report was truncated, so it was dropped whole instead of merged. */
+    truncated: boolean;
+}
+/**
+ * Apply a write's skipped-slot report to the log it was derived from, deciding
+ * whether the report may be taken at all.
+ *
+ * Every replay-context write can come back carrying the events on the slots it
+ * skipped over, and every caller wants the same thing from them: fold them in
+ * so the writes that follow name a position above them, and so the replay
+ * resuming from this log sees them without a reload.
+ *
+ * The one policy is that a **truncated report is dropped whole**. It covers a
+ * span of positions but carries only some of the events on them, so merging it
+ * would raise the log's highest position past a position whose event is
+ * missing. Later writes read that maximum to say what they have seen, so each
+ * would claim a position it never saw, and the World only reports the span a
+ * write skips: it would never send the missing one. Dropping costs one more
+ * round of the same events on the next write and keeps the log a prefix of the
+ * truth, which the note above {@link mergeReportedEvents} explains is always an
+ * available answer.
+ *
+ * Callers that log do so from the returned counts; the decision is not theirs
+ * to re-derive.
+ */
+export declare function absorbSkippedSlotReport(target: Event[], result: {
+    events?: readonly Event[];
+    hasMore?: boolean;
+}): SkippedSlotReport;
+/**
+ * The highest slot the loaded log occupies, or `undefined` for an empty log.
+ *
+ * The maximum, not the count, and the two are not interchangeable even though
+ * a healthy log makes them equal. A World hands a position to the insert that
+ * occupies it, so a write that never lands leaves no hole behind and the log
+ * stays dense. What the count cannot survive is a *partial* read: a log
+ * assembled from a truncated report, or read while a concurrent write is
+ * committing, holds fewer events than its highest position. Counting those
+ * would make the next write claim to have seen less than it has, so the World
+ * would report the same events back to it on every attempt.
+ *
+ * A hole below the maximum is therefore a property of the read, not of the log,
+ * which is what lets {@link settleEventSlotGap} re-read instead of giving up.
+ *
+ * @throws if any event id carries no slot. Every World the runtime replays
+ * against numbers events by slot, so an id that does not is a broken log rather
+ * than an older one, and a maximum derived by skipping it would understate the
+ * log to every write that reads it.
+ */
+export declare function maxEventSlot(events: readonly Event[]): number | undefined;
+/** A position the log skips over, described well enough to name in an error. */
+export interface EventSlotGap {
+    /** The lowest slot below the log's maximum that no event occupies. */
+    firstMissingSlot: number;
+    /** How many slots below the maximum no event occupies. */
+    missingCount: number;
+    /** The highest slot the log occupies. */
+    maxSlot: number;
+}
+/**
+ * The hole in a loaded log, or `undefined` when there is none to find.
+ *
+ * The World allocates every position, so a log that holds `n` events below slot
+ * `n` is missing one. That matters before a replay
+ * and nowhere else: the replay reads the log as the complete record of what has
+ * happened, and an absent position is indistinguishable from an event that
+ * never occurred. The branch it would have decided gets decided the other way,
+ * and the run diverges quietly rather than failing.
+ *
+ * Order-independent, unlike the equivalent audit the World runs over a page it
+ * just read. A loaded log is assembled from listed pages plus whatever a
+ * bump-and-report write handed back, and while {@link mergeReportedEvents}
+ * restores id order, a check that can fail a healthy run should not depend on
+ * that having happened.
+ *
+ * The first slot is never counted. It belongs to `run_created`, which `start()`
+ * posts concurrently with the queue send, so a log read in that window
+ * legitimately begins at the second slot and fills in on its own. Every replay
+ * that races a run's own start would otherwise report a hole.
+ *
+ * Returns `undefined` for an empty log, which has no density to check.
+ *
+ * @throws if any event id carries no slot, for the reason {@link maxEventSlot}
+ * gives.
+ */
+export declare function findEventSlotGap(events: readonly Event[]): EventSlotGap | undefined;
+/**
+ * How many times a detected hole is re-read before the log is taken at its
+ * word, and the backoff before each re-read (doubling per attempt).
+ *
+ * A hole can be transient. The World allocates a slot inside the insert that
+ * occupies it, so two concurrent writers can collide, one retry past the other,
+ * and the higher slot commit first, leaving a window in which the lower one is
+ * genuinely absent from a strongly-consistent read and fills in a moment later.
+ * The window is one commit wide, so a short backoff clears it; anything that
+ * survives all three re-reads is a position no write will ever occupy.
+ */
+export declare const SLOT_GAP_RECHECK_ATTEMPTS = 3;
+/**
+ * Re-read a log that looks holey until the hole fills in or the re-reads run
+ * out, and return the settled log alongside the hole that survived.
+ *
+ * Reads are strongly consistent, so a hole is not an artifact of *when* the log
+ * was read, but it can be an artifact of a write that had not committed yet
+ * (see {@link SLOT_GAP_RECHECK_ATTEMPTS}). Distinguishing the two costs a
+ * re-read, which is only ever paid by a replay that already found a hole.
+ *
+ * The reload is full rather than incremental: the missing position is below the
+ * log's maximum, so a cursor-anchored read starts past it and can never see it
+ * arrive.
+ */
+export declare function settleEventSlotGap(runId: string, loaded: LoadedEventLog): Promise<{
+    log: LoadedEventLog;
+    gap: EventSlotGap | undefined;
 }>;
+/**
+ * How much of its run's log a replay-context event creation had loaded when it
+ * decided to write, as the highest slot that log occupies.
+ *
+ * One integer says it because the World keeps its positions dense: a writer
+ * that names slot N is claiming to hold every event from 1 to N and nothing
+ * above. The World answers by numbering the write above whatever the log has
+ * actually reached and handing back the events on the slots in between: the
+ * ones this writer decided without.
+ *
+ * Density is the World's invariant, not a claim about this particular read. A
+ * reader that is short of a position it holds no event for names a lower N,
+ * which understates what it has seen and only costs it a wider report. Naming
+ * a position it cannot account for is the direction that is unsafe, which is
+ * why {@link slotSnapshotParams} takes the maximum rather than the count.
+ *
+ * Its own object rather than a bare number so a call site cannot half-send it,
+ * and so the empty case spreads to nothing.
+ */
+export interface SlotSnapshotParams {
+    eventCount?: number;
+}
+/**
+ * Build the slot snapshot to attach to a replay-context event creation.
+ *
+ * Empty for an empty log, which is the state a `run_created` write is issued
+ * from: there is no position held yet to name.
+ *
+ * ## Who names a position
+ *
+ * A World can hand events back on a write's success response through two
+ * params (`CreateEventParams` in `@workflow/world`): `eventCount`, which is
+ * answered with the events on the positions the write skipped over (the
+ * skipped-slot report), and `sinceCursor`, which is answered with everything
+ * after that cursor (the inline delta). Both exist to save the writer a
+ * reload. So the rule for which writes send them is not about the event type;
+ * it is about whether **the process that writes holds a loaded log it will
+ * keep deciding from**, its own next writes or the replay it resumes. A writer
+ * with no log has nothing to merge a page into, and whoever decides next is a
+ * fresh replay that loads the log anyway.
+ *
+ * Three gates, all of which must pass for a page to come back:
+ *
+ * 1. The writer names a position. Only the replay loop's `createEvent` seam
+ *    (runtime.ts) and the suspension handler's `createGuarded` do; the QuickJS
+ *    engine's `createEvent` (quickjs-entrypoint.ts) follows the same rule. Raw
+ *    `world.events.create` calls send nothing.
+ * 2. The World reads a page for that event type. A World may decline for types
+ *    whose writer never holds a log (step executor writes, run-terminal
+ *    writes), whatever the client sent.
+ * 3. There is something to hand back: the report only when the write landed
+ *    more than one position above `eventCount`; the delta always.
+ *
+ * | Event | Writer | Sends | Why |
+ * |---|---|---|---|
+ * | `run_created` | `start()` | nothing | no log exists yet |
+ * | `run_started` | replay loop, first write of a delivery | `eventCount` when a log is loaded; no cursor, the `run_started` preload owns the response fields | the preload already returns the full log |
+ * | `step_created`, `wait_created`, `hook_disposed`, `attr_set` | suspension handler (`createGuarded`) | `eventCount` | the handler keeps writing from, and resumes replay from, this log |
+ * | `step_created` | queue-consumer re-ensure (raw) | nothing | runs from a queue message, no log |
+ * | `hook_created` | suspension handler (node), `dispatchPendingOps` (QuickJS) | `eventCount` + `sinceCursor` (only when the suspension creates exactly one hook) | the delta is how an already-received hook resolves without a re-invocation; two creates against one cursor would give two deltas of which only the first could be taken |
+ * | `hook_received` | replay loop lazy resume; handler in-suspension resume | `eventCount` (preload owns the cursor fields) | both replay from the log right after |
+ * | `hook_received` | webhook / `resumeHook` (raw) | nothing | out-of-band, enqueues a delivery that loads the log |
+ * | `wait_completed` | replay loop timer path | `eventCount` | the loop keeps replaying from the log |
+ * | `wait_completed` | `runs.*` out-of-band (raw) | nothing | no log |
+ * | `step_started`, `step_retrying` | step executor | nothing | no log; the next decision is a replay that reloads or receives the delta below |
+ * | `step_completed`, `step_failed` | step executor | `sinceCursor` only, outside turbo, single inline step | this is where the inline execution loop gets its log back; in turbo or from a queued delivery a fresh replay loads it anyway |
+ * | `step_failed` | suspension handler, unserializable input | `eventCount` | the handler holds a log; rare, and follows a `step_created` that drew the page |
+ * | `attr_set` | `setAttributes()` API (raw) | nothing | out-of-band |
+ * | `run_completed`, `run_failed`, `run_cancelled` | replay loop, replay budget, `runs.cancel` | `eventCount` where the node loop's seam stamps it (the QuickJS engine sends nothing); never `sinceCursor` (`deltaRequestCursor` excludes terminal types) | terminal: nothing replays the log afterwards, so a World reads no page for them |
+ *
+ * Batched writes (`events.createBatch`) are outside all of this: a batch carries
+ * no per-event position and gets no page. The user-facing version of this table
+ * is in `docs/content/docs/v5/how-it-works/event-sourcing.mdx`; keep the two in
+ * step.
+ *
+ * The maximum rather than the length, for the reason {@link maxEventSlot}
+ * gives: a partially-read log holds fewer events than its highest position, and
+ * counting those would make the write claim to have seen less than it has, so
+ * the World would report the same events back on every attempt.
+ */
+export declare function slotSnapshotParams(events: readonly Event[]): SlotSnapshotParams;
+/**
+ * The events a rejecting World attached to a `PreconditionFailedError`, when it
+ * returned the ones the client's snapshot was missing inline.
+ *
+ * Returns `null` for anything else: no details, a World that did not implement
+ * this, or a payload that does not narrow cleanly. Callers fall back to
+ * reloading the event log, which is always correct; this is untrusted-shaped
+ * data on a failure path, so nothing here is repaired.
+ *
+ * `runId` is the caller's run. Every event must belong to it: the delta is
+ * merged straight into the replay's log, and one foreign event there is a
+ * corrupt log rather than a corrected one: the replay would consume a
+ * correlation id for an event that does not exist on this run.
+ */
+export declare function preconditionEventDelta(error: unknown, runId: string): {
+    events: Event[];
+    cursor: string | null;
+} | null;
+/** Creates one event on a bound run, carrying replay-recovery telemetry. */
+export type EventCreator = (data: CreateEventRequest, params?: CreateEventParams) => Promise<EventResult>;
 /**
  * Wraps a request/response handler and adds a health check "mode"
  * based on the presence of a `__health` query parameter.
  */
 export declare function withHealthCheck(handler: (req: Request) => Promise<Response>, worldSpecVersion?: number): (req: Request) => Promise<Response>;
+/**
+ * The lineage root of a loaded run: its `$rootRunId` attribute, or its own id
+ * when it is itself a root.
+ */
+export declare function rootRunIdFrom(attributes: Record<string, string> | undefined, runId: string): string;
+/**
+ * The immutable run identity a step-execution message carries so its consumer
+ * can start the step without a blocking `runs.get` — see
+ * `RunDispatchContextSchema` in @workflow/world. Built at dispatch time from
+ * the run row the producer already holds.
+ */
+export declare function runDispatchContext(run: Pick<WorkflowRun, 'runId' | 'deploymentId' | 'specVersion' | 'startedAt' | 'attributes'>): RunDispatchContext;
+/**
+ * Idempotency key for a step's background-dispatch queue message, scoped to
+ * the step's IDENTITY, correlation id plus (hashed) step name, rather than
+ * the bare correlation id.
+ *
+ * The scoping matters for resilient step dispatch under the precondition
+ * guard: a guard-rejected `step_created` leaves its (revoked) step message in
+ * flight, and the corrected replay may re-derive the same correlation id for
+ * a DIFFERENT step. Under a bare-correlationId key the corrected replay's
+ * dispatch would silently dedupe against the revoked in-flight message,
+ * which then resolves `skipped` against the re-created entity (the server's
+ * stepName fence rejects its bare start), and the legitimate step would
+ * never be executed. Scoping by step name keeps every dedup property that
+ * matters (crash recovery re-dispatch, concurrent handlers, the delayed
+ * retry sharing the suspension re-dispatch's key: all name the same step)
+ * while letting the corrected schedule's dispatch through.
+ *
+ * Every producer of a step-dispatch (or step-retry) message must use this
+ * key. Cross-version mixing is not a concern: queue messages are pinned to
+ * the deployment that produced them, so one run never sees two key schemes.
+ */
+export declare function stepDispatchIdempotencyKey(correlationId: string, stepName: string): string;
 /**
  * Queues a message to the specified queue with tracing.
  */
 export declare function queueMessage(world: World, ...args: Parameters<typeof world.queue>): Promise<void>;
+/**
+ * Publishes several messages to one logical queue, using the World's batch
+ * send when it has one and falling back to concurrent single sends when it
+ * does not.
+ *
+ * Rejects if ANY message failed to publish, because every caller so far wants
+ * all-or-nothing: the recovery is to fail the delivery and let redelivery
+ * republish the whole set, deduped by the per-message `idempotencyKey`. That
+ * means a partial batch can leave some messages already out — which is
+ * exactly why the keys are required rather than advisory.
+ */
+export declare function queueMessages(world: World, queueName: Parameters<typeof world.queue>[0], messages: readonly {
+    message: Parameters<typeof world.queue>[1];
+    opts?: Parameters<typeof world.queue>[2];
+}[]): Promise<void>;
 /**
  * Calculates the queue overhead time in milliseconds for a given message.
  */
@@ -72,26 +469,15 @@ export declare function getQueueOverhead(message: {
     [k: string]: number;
 } | undefined;
 /**
- * Returns a memoized accessor for the per-run AES-256 encryption key.
- *
- * The first call resolves the key via `world.getEncryptionKeyForRun` (which
- * may do HKDF derivation locally on Vercel, or a network fetch from
- * external contexts) and imports it as a `CryptoKey`; subsequent calls
- * await the same cached promise. If the world doesn't support encryption
- * or the run has no key configured, the cached value is `undefined`.
- *
- * Used by step / workflow handlers to defer the (potentially expensive)
- * key fetch until the first code path that actually needs it — typically
- * input hydration on the success path, or error dehydration on a failure
- * path. Both paths can race-call the accessor without triggering duplicate
- * fetches.
- *
- * Errors thrown by `getEncryptionKeyForRun` propagate to every caller
- * (the cached promise rejects). This is intentional: when encryption is
- * configured, we never want to silently fall back to plaintext
- * serialization. A propagated error in an event-emission path leaves the
- * outer try/catch to log and surface the issue; the queue's redelivery
- * semantics will retry the key fetch on the next attempt.
+ * Resolve the run's full payload-encryption capability. This includes the
+ * symmetric key and X25519 keypair needed to open cross-run sealed payloads.
+ * Missing world support or key material resolves to `undefined`; lookup and
+ * derivation failures propagate rather than silently falling back to plaintext.
+ */
+export declare function resolveRunEncryptionKey(world: World, runOrId: WorkflowRun | string, context?: Record<string, unknown>): Promise<PayloadKey | undefined>;
+/**
+ * Return a lazy, memoized accessor around {@link resolveRunEncryptionKey}.
+ * Concurrent callers share the same promise, including its rejection.
  */
-export declare function memoizeEncryptionKey(world: World, runOrId: WorkflowRun | string): () => Promise<CryptoKey | undefined>;
+export declare function memoizeEncryptionKey(world: World, runOrId: WorkflowRun | string): () => Promise<PayloadKey | undefined>;
 //# sourceMappingURL=helpers.d.ts.map

package/dist/runtime/helpers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"helpers.d.ts","sourceRoot":"","sources":["../../src/runtime/helpers.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,KAAK,EACL,kBAAkB,EAClB,cAAc,EACd,WAAW,EACX,KAAK,EACN,MAAM,iBAAiB,CAAC;AAQzB,OAAO,EAAE,KAAK,SAAS,EAAa,MAAM,kBAAkB,CAAC;AAiB7D;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,YAAY,EAAE,MAAM,GAAG,cAAc,CAOzE;AAWD;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,OAAO,CAAC;IACjB,2CAA2C;IAC3C,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,iDAAiD;IACjD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,gDAAgD;IAChD,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED;;;GAGG;AACH,wBAAgB,uBAAuB,CACrC,OAAO,EAAE,OAAO,GACf,kBAAkB,GAAG,SAAS,CAMhC;AAYD;;;;;;GAMG;AACH,wBAAsB,wBAAwB,CAC5C,WAAW,EAAE,kBAAkB,EAC/B,QAAQ,EAAE,UAAU,GAAG,MAAM,EAC7B,gBAAgB,CAAC,EAAE,MAAM,GACxB,OAAO,CAAC,IAAI,CAAC,CAgBf;AAED,MAAM,MAAM,mBAAmB,GAAG,UAAU,GAAG,MAAM,CAAC;AAEtD,MAAM,WAAW,kBAAkB;IACjC,sFAAsF;IACtF,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,iGAAiG;IACjG,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAoGD,wBAAsB,WAAW,CAC/B,KAAK,EAAE,KAAK,EACZ,QAAQ,EAAE,mBAAmB,EAC7B,OAAO,CAAC,EAAE,kBAAkB,GAC3B,OAAO,CAAC,iBAAiB,CAAC,CA2E5B;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,qBAAqB,CACzC,KAAK,EAAE,MAAM,EACb,WAAW,CAAC,EAAE,MAAM,GACnB,OAAO,CAAC;IAAE,MAAM,EAAE,KAAK,EAAE,CAAC;IAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,CAAC,CA6DrD;AAYD;;;GAGG;AACH,wBAAgB,eAAe,CAC7B,OAAO,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,EAC5C,gBAAgB,CAAC,EAAE,MAAM,GACxB,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CA8BrC;AAED;;GAEG;AACH,wBAAsB,YAAY,CAChC,KAAK,EAAE,KAAK,EACZ,GAAG,IAAI,EAAE,UAAU,CAAC,OAAO,KAAK,CAAC,KAAK,CAAC,iBA0BxC;AAED;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE;IAAE,WAAW,CAAC,EAAE,IAAI,CAAA;CAAE;;cAS/D;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,oBAAoB,CAClC,KAAK,EAAE,KAAK,EACZ,OAAO,EAAE,WAAW,GAAG,MAAM,GAC5B,MAAM,OAAO,CAAC,SAAS,GAAG,SAAS,CAAC,CAiBtC"}
+{"version":3,"file":"helpers.d.ts","sourceRoot":"","sources":["../../src/runtime/helpers.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EACV,iBAAiB,EACjB,kBAAkB,EAClB,KAAK,EACL,WAAW,EACX,kBAAkB,EAClB,kBAAkB,EAClB,cAAc,EACd,WAAW,EACX,KAAK,EACN,MAAM,iBAAiB,CAAC;AAezB,OAAO,EAEL,KAAK,UAAU,EAChB,MAAM,gCAAgC,CAAC;AAgBxC;;;;GAIG;AACH,wBAAgB,oBAAoB,CAClC,YAAY,EAAE,MAAM,EACpB,SAAS,CAAC,EAAE,MAAM,GACjB,cAAc,CAWhB;AAWD;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,OAAO,CAAC;IACjB,2CAA2C;IAC3C,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,iDAAiD;IACjD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,gDAAgD;IAChD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;;;OAMG;IACH,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B;;;;;;;OAOG;IACH,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B;;;;;;;;;;OAUG;IACH,sBAAsB,CAAC,EAAE,MAAM,CAAC;CACjC;AAED;;;GAGG;AACH,wBAAgB,uBAAuB,CACrC,OAAO,EAAE,OAAO,GACf,kBAAkB,GAAG,SAAS,CAMhC;AAYD;;;;;GAKG;AACH,wBAAsB,wBAAwB,CAC5C,WAAW,EAAE,kBAAkB,EAC/B,gBAAgB,CAAC,EAAE,MAAM,GACxB,OAAO,CAAC,IAAI,CAAC,CAmDf;AAED,MAAM,WAAW,kBAAkB;IACjC,sFAAsF;IACtF,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,iGAAiG;IACjG,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;;OAKG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;;;;;;OAQG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AA2ID,wBAAsB,WAAW,CAC/B,KAAK,EAAE,KAAK,EACZ,OAAO,CAAC,EAAE,kBAAkB,GAC3B,OAAO,CAAC,iBAAiB,CAAC,CAyF5B;AA0BD;;;;;;;;;;;;GAYG;AACH,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,KAAK,EAAE,EACf,MAAM,EAAE,SAAS,KAAK,EAAE,EACxB,SAAS,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,GACtB,IAAI,CAaN;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,KAAK,GAAG,IAAI,CAiBxE;AAmCD;;;;;;;;;;GAUG;AACH,wBAAsB,qBAAqB,CACzC,KAAK,EAAE,MAAM,EACb,WAAW,CAAC,EAAE,MAAM,GACnB,OAAO,CAAC,cAAc,CAAC,CAuGzB;AAED;;;;GAIG;AACH,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,KAAK,EAAE,CAAC;IAChB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB;AAED;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAC5B,GAAG,EAAE,cAAc,EACnB,QAAQ,EAAE;IAAE,MAAM,EAAE,SAAS,KAAK,EAAE,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,GAC7D,IAAI,CAGN;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,qBAAqB,IAAI,OAAO,CAE/C;AA0BD;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,KAAK,EAAE,EACf,MAAM,EAAE,SAAS,KAAK,EAAE,GACvB,MAAM,CAUR;AAED,sEAAsE;AACtE,MAAM,WAAW,iBAAiB;IAChC,4EAA4E;IAC5E,KAAK,EAAE,MAAM,CAAC;IACd,0EAA0E;IAC1E,OAAO,EAAE,MAAM,CAAC;IAChB,2EAA2E;IAC3E,SAAS,EAAE,OAAO,CAAC;CACpB;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,uBAAuB,CACrC,MAAM,EAAE,KAAK,EAAE,EACf,MAAM,EAAE;IAAE,MAAM,CAAC,EAAE,SAAS,KAAK,EAAE,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,GACvD,iBAAiB,CAanB;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,YAAY,CAAC,MAAM,EAAE,SAAS,KAAK,EAAE,GAAG,MAAM,GAAG,SAAS,CASzE;AAED,gFAAgF;AAChF,MAAM,WAAW,YAAY;IAC3B,sEAAsE;IACtE,gBAAgB,EAAE,MAAM,CAAC;IACzB,0DAA0D;IAC1D,YAAY,EAAE,MAAM,CAAC;IACrB,yCAAyC;IACzC,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,SAAS,KAAK,EAAE,GACvB,YAAY,GAAG,SAAS,CAkC1B;AAED;;;;;;;;;;GAUG;AACH,eAAO,MAAM,yBAAyB,IAAI,CAAC;AAG3C;;;;;;;;;;;;GAYG;AACH,wBAAsB,kBAAkB,CACtC,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,cAAc,GACrB,OAAO,CAAC;IAAE,GAAG,EAAE,cAAc,CAAC;IAAC,GAAG,EAAE,YAAY,GAAG,SAAS,CAAA;CAAE,CAAC,CAejE;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,WAAW,kBAAkB;IACjC,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyDG;AACH,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,SAAS,KAAK,EAAE,GACvB,kBAAkB,CAGpB;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,sBAAsB,CACpC,KAAK,EAAE,OAAO,EACd,KAAK,EAAE,MAAM,GACZ;IAAE,MAAM,EAAE,KAAK,EAAE,CAAC;IAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,GAAG,IAAI,CA0BnD;AAED,4EAA4E;AAC5E,MAAM,MAAM,YAAY,GAAG,CACzB,IAAI,EAAE,kBAAkB,EACxB,MAAM,CAAC,EAAE,iBAAiB,KACvB,OAAO,CAAC,WAAW,CAAC,CAAC;AAY1B;;;GAGG;AACH,wBAAgB,eAAe,CAC7B,OAAO,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,EAC5C,gBAAgB,CAAC,EAAE,MAAM,GACxB,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CA8BrC;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAC3B,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,EAC9C,KAAK,EAAE,MAAM,GACZ,MAAM,CAER;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAChC,GAAG,EAAE,IAAI,CACP,WAAW,EACX,OAAO,GAAG,cAAc,GAAG,aAAa,GAAG,WAAW,GAAG,YAAY,CACtE,GACA,kBAAkB,CAOpB;AAaD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,0BAA0B,CACxC,aAAa,EAAE,MAAM,EACrB,QAAQ,EAAE,MAAM,GACf,MAAM,CAER;AAED;;GAEG;AACH,wBAAsB,YAAY,CAChC,KAAK,EAAE,KAAK,EACZ,GAAG,IAAI,EAAE,UAAU,CAAC,OAAO,KAAK,CAAC,KAAK,CAAC,iBA0BxC;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,aAAa,CACjC,KAAK,EAAE,KAAK,EACZ,SAAS,EAAE,UAAU,CAAC,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAC5C,QAAQ,EAAE,SAAS;IACjB,OAAO,EAAE,UAAU,CAAC,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3C,IAAI,CAAC,EAAE,UAAU,CAAC,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;CAC1C,EAAE,GACF,OAAO,CAAC,IAAI,CAAC,CA8Df;AAED;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE;IAAE,WAAW,CAAC,EAAE,IAAI,CAAA;CAAE;;cAS/D;AAED;;;;;GAKG;AACH,wBAAsB,uBAAuB,CAC3C,KAAK,EAAE,KAAK,EACZ,OAAO,EAAE,WAAW,GAAG,MAAM,EAC7B,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAChC,OAAO,CAAC,UAAU,GAAG,SAAS,CAAC,CAMjC;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAClC,KAAK,EAAE,KAAK,EACZ,OAAO,EAAE,WAAW,GAAG,MAAM,GAC5B,MAAM,OAAO,CAAC,UAAU,GAAG,SAAS,CAAC,CAQvC"}