@workflow/web 5.0.0-beta.36 → 5.0.0-beta.37

package/build/client/assets/{mermaid-3ZIDBTTL-C_EWPx9a.js → mermaid-3ZIDBTTL-CMP9Tato.js}

@@ -1,9 +1,9 @@
-const __vite__mapDeps=(i,m=__vite__mapDeps,d=(m.f||(m.f=["assets/encryption-CLVP4klT.js","assets/index-STTN0-2V.js","assets/index-Q81MFBxC.js","assets/zstd-browser-decoder-Ds2MNSdp.js","assets/highlighted-body-B3W2YXNL-C5gyMelW.js"])))=>i.map(i=>d[i]);
+const __vite__mapDeps=(i,m=__vite__mapDeps,d=(m.f||(m.f=["assets/zstd-browser-decoder-BAY5XtBl.js","assets/index-PFjW8YjQ.js","assets/highlighted-body-B3W2YXNL-CRgNr0YA.js"])))=>i.map(i=>d[i]);
 var __defProp = Object.defineProperty;
 var __defNormalProp = (obj, key, value) => key in obj ? __defProp(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
 var __publicField = (obj, key, value) => __defNormalProp(obj, typeof key !== "symbol" ? key + "" : key, value);
 var _a2, _b;
-import { r as reactExports, j as jsxRuntimeExports, p as reactDomExports, I as React, G as ReactDOM, R as ReactExports, g as getDefaultExportFromCjs } from "./index-Q81MFBxC.js";
+import { r as reactExports, j as jsxRuntimeExports, o as reactDomExports, H as React, D as ReactDOM, R as ReactExports, I as getDefaultExportFromCjs } from "./index-PFjW8YjQ.js";
 function composeEventHandlers(originalEventHandler, ourEventHandler, { checkForDefaultPrevented = true } = {}) {
   return function handleEvent(event) {
     originalEventHandler == null ? void 0 : originalEventHandler(event);
@@ -2164,7 +2164,7 @@ function useFloating(options) {
     } = {},
     transform: transform2 = true,
     whileElementsMounted,
-    open
+    open: open2
   } = options;
   const [data, setData] = reactExports.useState({
     x: 0,
@@ -2200,7 +2200,7 @@ function useFloating(options) {
   const hasWhileElementsMounted = whileElementsMounted != null;
   const whileElementsMountedRef = useLatestRef(whileElementsMounted);
   const platformRef = useLatestRef(platform2);
-  const openRef = useLatestRef(open);
+  const openRef = useLatestRef(open2);
   const update = reactExports.useCallback(() => {
     if (!referenceRef.current || !floatingRef.current) {
       return;
@@ -2231,14 +2231,14 @@ function useFloating(options) {
     });
   }, [latestMiddleware, placement, strategy, platformRef, openRef]);
   index$1(() => {
-    if (open === false && dataRef.current.isPositioned) {
+    if (open2 === false && dataRef.current.isPositioned) {
       dataRef.current.isPositioned = false;
       setData((data2) => ({
         ...data2,
         isPositioned: false
       }));
     }
-  }, [open]);
+  }, [open2]);
   const isMountedRef = reactExports.useRef(false);
   index$1(() => {
     isMountedRef.current = true;
@@ -2979,23 +2979,23 @@ var Tooltip$2 = (props) => {
   const disableHoverableContent = disableHoverableContentProp ?? providerContext.disableHoverableContent;
   const delayDuration = delayDurationProp ?? providerContext.delayDuration;
   const wasOpenDelayedRef = reactExports.useRef(false);
-  const [open, setOpen] = useControllableState({
+  const [open2, setOpen] = useControllableState({
     prop: openProp,
     defaultProp: defaultOpen ?? false,
-    onChange: (open2) => {
-      if (open2) {
+    onChange: (open22) => {
+      if (open22) {
         providerContext.onOpen();
         document.dispatchEvent(new CustomEvent(TOOLTIP_OPEN));
       } else {
         providerContext.onClose();
       }
-      onOpenChange == null ? void 0 : onOpenChange(open2);
+      onOpenChange == null ? void 0 : onOpenChange(open22);
     },
     caller: TOOLTIP_NAME
   });
   const stateAttribute = reactExports.useMemo(() => {
-    return open ? wasOpenDelayedRef.current ? "delayed-open" : "instant-open" : "closed";
-  }, [open]);
+    return open2 ? wasOpenDelayedRef.current ? "delayed-open" : "instant-open" : "closed";
+  }, [open2]);
   const handleOpen = reactExports.useCallback(() => {
     window.clearTimeout(openTimerRef.current);
     openTimerRef.current = 0;
@@ -3028,7 +3028,7 @@ var Tooltip$2 = (props) => {
     {
       scope: __scopeTooltip,
       contentId,
-      open,
+      open: open2,
       stateAttribute,
       trigger,
       onTriggerChange: setTrigger,
@@ -15172,7 +15172,14 @@ const RunCreatedEventSchema = BaseEventSchema.extend({
     input: SerializedDataSchema,
     executionContext: record(string$2(), any()).optional(),
     attributes: record(string$2(), string$2()).optional(),
-    allowReservedAttributes: literal(true).optional()
+    allowReservedAttributes: literal(true).optional(),
+    /**
+     * The run's X25519 public key (base64), stamped by SDKs that support
+     * sealed (`encp`) envelopes. Persisted onto the run entity so that
+     * cross-run writers can seal payloads to this run without holding its
+     * symmetric key. Not secret — see `WorkflowRunBaseSchema`.
+     */
+    encryptionPublicKey: string$2().optional()
   })
 });
 const RunStartedEventSchema = BaseEventSchema.extend({
@@ -15183,7 +15190,14 @@ const RunStartedEventSchema = BaseEventSchema.extend({
     workflowName: string$2().optional(),
     executionContext: record(string$2(), any()).optional(),
     attributes: record(string$2(), string$2()).optional(),
-    allowReservedAttributes: literal(true).optional()
+    allowReservedAttributes: literal(true).optional(),
+    /**
+     * Mirrors `run_created.eventData.encryptionPublicKey`. Carried here for
+     * the resilient-start path: when the `run_created` write failed, the
+     * server creates the run from this event instead, and without the key
+     * the run would silently lose its ability to receive sealed writes.
+     */
+    encryptionPublicKey: string$2().optional()
   }).optional()
 });
 const RunCompletedEventSchema = BaseEventSchema.extend({
@@ -15345,6 +15359,26 @@ const WorkflowRunBaseSchema = object({
    * the attributes-mvp changelog entry.
    */
   attributes: record(string$2(), string$2()).default({}),
+  /**
+   * The run's X25519 public key, base64-encoded (~44 chars).
+   *
+   * Lets any party that can read this run seal a payload *to* it without
+   * being able to read the run's data — used for cross-run writes such as a
+   * hook resumption from another deployment, or a child workflow writing into
+   * a forwarded stream. The matching private scalar is never stored: it is
+   * re-derived on demand from the deployment's own key material, so this
+   * field is not secret and its presence does not weaken the run's
+   * confidentiality.
+   *
+   * Stamped at run creation by SDKs that support sealed (`encp`) envelopes.
+   * **Presence is the writer-side gate**: a run only carries a public key if
+   * the runtime that created it could also open sealed payloads, and runs are
+   * pinned to their creating deployment. Writers therefore seal iff this
+   * field is set, and otherwise fall back to fetching the symmetric per-run
+   * key. Absent on runs created by older SDKs, and on worlds that do not
+   * implement `getEncryptionKeyForRun` (encryption disabled).
+   */
+  encryptionPublicKey: string$2().optional(),
   expiredAt: date().optional(),
   startedAt: date().optional(),
   completedAt: date().optional(),
@@ -15549,22 +15583,8 @@ object({
   firstSeenAt: date(),
   lastSeenAt: date()
 });
-object({
-  runId: string$2(),
-  hookId: string$2(),
-  token: string$2(),
-  ownerId: string$2(),
-  projectId: string$2(),
-  environment: string$2(),
-  metadata: SerializedDataSchema.optional(),
-  createdAt: date(),
-  // Optional in database for backwards compatibility, defaults to 1 (legacy) when reading
-  specVersion: number$3().optional(),
-  isWebhook: boolean$2().optional(),
-  isSystem: boolean$2().optional()
-});
-string$2().regex(/^__(?:[a-z][a-z0-9]*_)?wkf_(?:workflow|step)_$/, "Must match __wkf_{workflow|step}_ or __{namespace}_wkf_{workflow|step}_");
-string$2().regex(/^__(?:[a-z][a-z0-9]*_)?wkf_(?:workflow|step)_.+$/, "Must be a valid queue name with a recognized prefix");
+string$2().regex(/^__(?:[a-z][a-z0-9]*_)?wkf_workflow_$/, "Must match __wkf_workflow_ or __{namespace}_wkf_workflow_");
+string$2().regex(/^__(?:[a-z][a-z0-9]*_)?wkf_workflow_.+$/, "Must be a valid queue name with a recognized prefix");
 string$2().regex(/^[a-z][a-z0-9]*$/, "Must be lowercase alphanumeric, starting with a letter");
 string$2().brand().describe("A stored queue message ID");
 const TraceCarrierSchema = record(string$2(), string$2());
@@ -15602,23 +15622,57 @@ const WorkflowInvokePayloadSchema = object({
   /** Run creation data, only present on the first queue delivery from start() */
   runInput: RunInputSchema.optional()
 });
-const StepInvokePayloadSchema = object({
-  workflowName: string$2(),
-  workflowRunId: string$2(),
-  workflowStartedAt: number$3(),
-  stepId: string$2(),
-  traceCarrier: TraceCarrierSchema.optional(),
-  requestedAt: date().optional()
-});
 const HealthCheckPayloadSchema = object({
   __healthCheck: literal(true),
-  correlationId: string$2()
+  correlationId: string$2(),
+  /**
+   * The run id the caller is about to create, when the probe is being used to
+   * prepare a cross-deployment `start()`.
+   *
+   * The responder runs inside the target deployment, so it can derive that
+   * run's public key locally from its own key material and return it in the
+   * probe response. That lets the caller seal the workflow arguments without
+   * a separate key lookup. Absent for probes issued for other reasons (CLI
+   * health command, dashboard), in which case no key is returned.
+   */
+  runId: string$2().optional()
 });
 union([
-  WorkflowInvokePayloadSchema,
-  StepInvokePayloadSchema,
-  HealthCheckPayloadSchema
+  HealthCheckPayloadSchema,
+  WorkflowInvokePayloadSchema
 ]);
+const HookResumeContextSchema = object({
+  deploymentId: string$2(),
+  workflowName: string$2(),
+  // Named `runSpecVersion` to distinguish it from the hook's own `specVersion`.
+  runSpecVersion: number$3().optional(),
+  workflowCoreVersion: string$2().optional(),
+  traceCarrier: TraceCarrierSchema.optional(),
+  // The run's published X25519 public key (base64), mirrored from the run
+  // entity. Lets a resume seal (`encp`) its payload to the run without reading
+  // the run or fetching its symmetric key. Absent on runs created before
+  // sealed envelopes and on projects with encryption disabled, where the
+  // resume falls back to the symmetric per-run key.
+  encryptionPublicKey: string$2().optional()
+});
+object({
+  runId: string$2(),
+  hookId: string$2(),
+  token: string$2(),
+  ownerId: string$2(),
+  projectId: string$2(),
+  environment: string$2(),
+  metadata: SerializedDataSchema.optional(),
+  createdAt: date(),
+  // Optional in database for backwards compatibility, defaults to 1 (legacy) when reading
+  specVersion: number$3().optional(),
+  isWebhook: boolean$2().optional(),
+  isSystem: boolean$2().optional(),
+  // Present when the server stored it (new hooks) or synthesized it from the
+  // run (old hooks). Absent only against an old server, where the resume path
+  // falls back to `runs.get`.
+  resumeContext: HookResumeContextSchema.optional()
+});
 const zodJsonSchema = lazy(() => {
   return union([
     string$2(),
@@ -15866,11 +15920,659 @@ function unflatten(parsed, revivers) {
   }
   return hydrate(0);
 }
+var ms$1;
+var hasRequiredMs;
+function requireMs() {
+  if (hasRequiredMs) return ms$1;
+  hasRequiredMs = 1;
+  var s2 = 1e3;
+  var m2 = s2 * 60;
+  var h2 = m2 * 60;
+  var d2 = h2 * 24;
+  var w2 = d2 * 7;
+  var y2 = d2 * 365.25;
+  ms$1 = function(val, options) {
+    options = options || {};
+    var type = typeof val;
+    if (type === "string" && val.length > 0) {
+      return parse2(val);
+    } else if (type === "number" && isFinite(val)) {
+      return options.long ? fmtLong(val) : fmtShort(val);
+    }
+    throw new Error(
+      "val is not a non-empty string or a valid number. val=" + JSON.stringify(val)
+    );
+  };
+  function parse2(str) {
+    str = String(str);
+    if (str.length > 100) {
+      return;
+    }
+    var match = /^(-?(?:\d+)?\.?\d+) *(milliseconds?|msecs?|ms|seconds?|secs?|s|minutes?|mins?|m|hours?|hrs?|h|days?|d|weeks?|w|years?|yrs?|y)?$/i.exec(
+      str
+    );
+    if (!match) {
+      return;
+    }
+    var n = parseFloat(match[1]);
+    var type = (match[2] || "ms").toLowerCase();
+    switch (type) {
+      case "years":
+      case "year":
+      case "yrs":
+      case "yr":
+      case "y":
+        return n * y2;
+      case "weeks":
+      case "week":
+      case "w":
+        return n * w2;
+      case "days":
+      case "day":
+      case "d":
+        return n * d2;
+      case "hours":
+      case "hour":
+      case "hrs":
+      case "hr":
+      case "h":
+        return n * h2;
+      case "minutes":
+      case "minute":
+      case "mins":
+      case "min":
+      case "m":
+        return n * m2;
+      case "seconds":
+      case "second":
+      case "secs":
+      case "sec":
+      case "s":
+        return n * s2;
+      case "milliseconds":
+      case "millisecond":
+      case "msecs":
+      case "msec":
+      case "ms":
+        return n;
+      default:
+        return void 0;
+    }
+  }
+  function fmtShort(ms2) {
+    var msAbs = Math.abs(ms2);
+    if (msAbs >= d2) {
+      return Math.round(ms2 / d2) + "d";
+    }
+    if (msAbs >= h2) {
+      return Math.round(ms2 / h2) + "h";
+    }
+    if (msAbs >= m2) {
+      return Math.round(ms2 / m2) + "m";
+    }
+    if (msAbs >= s2) {
+      return Math.round(ms2 / s2) + "s";
+    }
+    return ms2 + "ms";
+  }
+  function fmtLong(ms2) {
+    var msAbs = Math.abs(ms2);
+    if (msAbs >= d2) {
+      return plural(ms2, msAbs, d2, "day");
+    }
+    if (msAbs >= h2) {
+      return plural(ms2, msAbs, h2, "hour");
+    }
+    if (msAbs >= m2) {
+      return plural(ms2, msAbs, m2, "minute");
+    }
+    if (msAbs >= s2) {
+      return plural(ms2, msAbs, s2, "second");
+    }
+    return ms2 + " ms";
+  }
+  function plural(ms2, msAbs, n, name2) {
+    var isPlural = msAbs >= n * 1.5;
+    return Math.round(ms2 / n) + " " + name2 + (isPlural ? "s" : "");
+  }
+  return ms$1;
+}
+var msExports = requireMs();
+const ms = /* @__PURE__ */ getDefaultExportFromCjs(msExports);
+function parseDurationToDate(param) {
+  if (typeof param === "string") {
+    const durationMs = ms(param);
+    if (typeof durationMs !== "number" || durationMs < 0) {
+      throw new Error(`Invalid duration: "${param}". Expected a valid duration string like "1s", "1m", "1h", etc.`);
+    }
+    return new Date(Date.now() + durationMs);
+  } else if (typeof param === "number") {
+    if (param < 0 || !Number.isFinite(param)) {
+      throw new Error(`Invalid duration: ${param}. Expected a non-negative finite number of milliseconds.`);
+    }
+    return new Date(Date.now() + param);
+  } else if (param instanceof Date || param && typeof param === "object" && typeof param.getTime === "function") {
+    return param instanceof Date ? param : new Date(param.getTime());
+  } else {
+    throw new Error(`Invalid duration parameter. Expected a duration string, number (milliseconds), or Date object.`);
+  }
+}
+const BASE_URL = "https://workflow-sdk.dev/err";
+function isError(value) {
+  return typeof value === "object" && value !== null && "name" in value && "message" in value;
+}
+function appendFramedDetails(title, details) {
+  if (details.length === 0)
+    return title;
+  const lines = [title];
+  details.forEach((detail, index2) => {
+    const isLast = index2 === details.length - 1;
+    const head = isLast ? "╰▶ " : "├▶ ";
+    const cont = isLast ? "   " : "│  ";
+    const text2 = `${detail.label}: ${detail.value}`;
+    text2.split("\n").forEach((line, i) => lines.push(`${i === 0 ? head : cont}${line}`));
+  });
+  return lines.join("\n");
+}
+function buildFramedDetails(hint, slug) {
+  const out = [];
+  if (slug)
+    out.push({ label: "docs", value: `${BASE_URL}/${slug}` });
+  return out;
+}
+const ERROR_SLUGS = {
+  HOOK_CONFLICT: "hook-conflict",
+  RUNTIME_DECRYPTION_FAILED: "runtime-decryption-failed"
+};
+class WorkflowError extends Error {
+  constructor(message, options) {
+    const msgDocs = appendFramedDetails(message, buildFramedDetails(void 0, options == null ? void 0 : options.slug));
+    super(msgDocs, { cause: options == null ? void 0 : options.cause });
+    __publicField(this, "cause");
+    if ((options == null ? void 0 : options.cause) !== void 0) {
+      this.cause = options.cause;
+    }
+    if ((options == null ? void 0 : options.cause) instanceof Error) {
+      this.stack = `${this.stack}
+Caused by: ${options.cause.stack}`;
+    }
+  }
+  static is(value) {
+    return isError(value) && value.name === "WorkflowError";
+  }
+}
+class WorkflowRuntimeError extends WorkflowError {
+  constructor(message, options) {
+    super(message, {
+      ...options
+    });
+    this.name = "WorkflowRuntimeError";
+  }
+  static is(value) {
+    return isError(value) && value.name === "WorkflowRuntimeError";
+  }
+}
+class RuntimeDecryptionError extends WorkflowRuntimeError {
+  constructor(message, options) {
+    super(message, {
+      cause: options == null ? void 0 : options.cause,
+      slug: ERROR_SLUGS.RUNTIME_DECRYPTION_FAILED
+    });
+    this.name = "RuntimeDecryptionError";
+    if ((options == null ? void 0 : options.context) !== void 0) {
+      this.context = options.context;
+    }
+  }
+  static is(value) {
+    return isError(value) && value.name === "RuntimeDecryptionError";
+  }
+}
+class HookConflictError extends WorkflowError {
+  constructor(token, conflictingRunId) {
+    super(`Hook token "${token}" is already in use by another workflow${conflictingRunId ? ` (run "${conflictingRunId}")` : ""}`, {
+      slug: ERROR_SLUGS.HOOK_CONFLICT
+    });
+    __publicField(this, "token");
+    // TODO: Make this required once all persisted hook_conflict events and World
+    // implementations always include the active hook owner's run ID.
+    __publicField(this, "conflictingRunId");
+    this.name = "HookConflictError";
+    this.token = token;
+    if (conflictingRunId !== void 0) {
+      this.conflictingRunId = conflictingRunId;
+    }
+  }
+  static is(value) {
+    return isError(value) && value.name === "HookConflictError";
+  }
+}
+class FatalError extends Error {
+  constructor(message) {
+    super(message);
+    __publicField(this, "fatal", true);
+    this.name = "FatalError";
+  }
+  static is(value) {
+    if (!isError(value))
+      return false;
+    if (value.name === "FatalError")
+      return true;
+    return value.fatal === true;
+  }
+}
+class RetryableError extends Error {
+  constructor(message, options = {}) {
+    super(message);
+    /**
+     * The Date when the step should be retried.
+     */
+    __publicField(this, "retryAfter");
+    this.name = "RetryableError";
+    if (options.retryAfter !== void 0) {
+      this.retryAfter = parseDurationToDate(options.retryAfter);
+    } else {
+      this.retryAfter = new Date(Date.now() + 1e3);
+    }
+  }
+  static is(value) {
+    return isError(value) && value.name === "RetryableError";
+  }
+}
+const VERCEL_403_ERROR_MESSAGE = "Your current vercel account does not have access to this resource. Use `vercel login` or `vercel switch` to ensure you are linked to the right account.";
+const FATAL_ERROR_KEY = Symbol.for("@workflow/errors//FatalError");
+const RETRYABLE_ERROR_KEY = Symbol.for("@workflow/errors//RetryableError");
+const HOOK_CONFLICT_ERROR_KEY = Symbol.for("@workflow/errors//HookConflictError");
+const RUNTIME_DECRYPTION_ERROR_KEY = Symbol.for("@workflow/errors//RuntimeDecryptionError");
+if (typeof globalThis !== "undefined") {
+  if (!Object.hasOwn(globalThis, FATAL_ERROR_KEY)) {
+    Object.defineProperty(globalThis, FATAL_ERROR_KEY, {
+      value: FatalError,
+      writable: false,
+      enumerable: false,
+      configurable: false
+    });
+  }
+  if (!Object.hasOwn(globalThis, RETRYABLE_ERROR_KEY)) {
+    Object.defineProperty(globalThis, RETRYABLE_ERROR_KEY, {
+      value: RetryableError,
+      writable: false,
+      enumerable: false,
+      configurable: false
+    });
+  }
+  if (!Object.hasOwn(globalThis, HOOK_CONFLICT_ERROR_KEY)) {
+    Object.defineProperty(globalThis, HOOK_CONFLICT_ERROR_KEY, {
+      value: HookConflictError,
+      writable: false,
+      enumerable: false,
+      configurable: false
+    });
+  }
+  if (!Object.hasOwn(globalThis, RUNTIME_DECRYPTION_ERROR_KEY)) {
+    Object.defineProperty(globalThis, RUNTIME_DECRYPTION_ERROR_KEY, {
+      value: RuntimeDecryptionError,
+      writable: false,
+      enumerable: false,
+      configurable: false
+    });
+  }
+}
+const NONCE_LENGTH = 12;
+const TAG_LENGTH = 128;
+const TAG_BYTES = TAG_LENGTH / 8;
+const KEY_LENGTH = 32;
+async function importKey(raw2, usages = ["encrypt", "decrypt"]) {
+  if (raw2.byteLength !== KEY_LENGTH) {
+    throw new WorkflowRuntimeError(`Encryption key must be exactly ${KEY_LENGTH} bytes, got ${raw2.byteLength}`);
+  }
+  return globalThis.crypto.subtle.importKey(
+    "raw",
+    raw2,
+    "AES-GCM",
+    false,
+    // `KeyUsage` is a DOM-lib type that's not in scope under `es2022`.
+    // The `ReadonlyArray<'encrypt' | 'decrypt'>` parameter type matches
+    // a strict subset of `KeyUsage[]`, so this cast is sound.
+    usages
+  );
+}
+async function decrypt$1(key, data, aad) {
+  const minLength = NONCE_LENGTH + TAG_LENGTH / 8;
+  if (data.byteLength < minLength) {
+    throw new RuntimeDecryptionError(`Encrypted data too short: expected at least ${minLength} bytes, got ${data.byteLength}`, {
+      context: {
+        operation: "decrypt",
+        byteLength: data.byteLength
+      }
+    });
+  }
+  const nonce = data.subarray(0, NONCE_LENGTH);
+  const ciphertext = data.subarray(NONCE_LENGTH);
+  let plaintext;
+  try {
+    plaintext = await globalThis.crypto.subtle.decrypt({
+      name: "AES-GCM",
+      iv: nonce,
+      tagLength: TAG_LENGTH,
+      ...aad ? { additionalData: aad } : {}
+    }, key, ciphertext);
+  } catch (cause) {
+    const causeMsg = cause instanceof Error ? cause.message : String(cause);
+    throw new RuntimeDecryptionError(`AES-256-GCM decryption failed: ${causeMsg}`, {
+      cause,
+      context: {
+        operation: "decrypt",
+        byteLength: data.byteLength
+      }
+    });
+  }
+  return new Uint8Array(plaintext);
+}
+const X25519_KEY_LENGTH = 32;
+const CONTENT_KEY_LENGTH = 32;
+const SCALAR_INFO = "workflow/encp/x25519/v1";
+const CONTENT_KEY_INFO = "workflow/encp/aes256gcm/v1";
+const PKCS8_X25519_PREFIX = new Uint8Array([
+  48,
+  46,
+  2,
+  1,
+  0,
+  48,
+  5,
+  6,
+  3,
+  43,
+  101,
+  110,
+  4,
+  34,
+  4,
+  32
+]);
+const infoEncoder = new TextEncoder();
+function assertKeyMaterialLength(runKeyMaterial) {
+  if (runKeyMaterial.byteLength !== CONTENT_KEY_LENGTH) {
+    throw new WorkflowRuntimeError(`Run key material must be exactly ${CONTENT_KEY_LENGTH} bytes, got ${runKeyMaterial.byteLength}`);
+  }
+}
+async function deriveRunKeyPair(runKeyMaterial) {
+  assertKeyMaterialLength(runKeyMaterial);
+  const hkdfKey = await globalThis.crypto.subtle.importKey("raw", runKeyMaterial, "HKDF", false, ["deriveBits"]);
+  const scalarBits = await globalThis.crypto.subtle.deriveBits({
+    name: "HKDF",
+    hash: "SHA-256",
+    salt: new Uint8Array(32),
+    info: infoEncoder.encode(SCALAR_INFO)
+  }, hkdfKey, X25519_KEY_LENGTH * 8);
+  const scalar = new Uint8Array(scalarBits);
+  const publicKey = await derivePublicKeyFromScalar(scalar);
+  return { scalar, publicKey };
+}
+async function derivePublicKeyFromScalar(scalar) {
+  const privateKey = await importScalar(
+    scalar,
+    /* extractable */
+    true
+  );
+  const jwk = await globalThis.crypto.subtle.exportKey("jwk", privateKey);
+  if (!jwk.x) {
+    throw new WorkflowRuntimeError('X25519 JWK export did not include a public key component ("x")');
+  }
+  const publicKey = base64UrlToBytes(jwk.x);
+  if (publicKey.byteLength !== X25519_KEY_LENGTH) {
+    throw new WorkflowRuntimeError(`X25519 JWK export produced a ${publicKey.byteLength}-byte public key, expected ${X25519_KEY_LENGTH}`);
+  }
+  return publicKey;
+}
+async function importScalar(scalar, extractable) {
+  const pkcs8 = new Uint8Array(PKCS8_X25519_PREFIX.length + scalar.byteLength);
+  pkcs8.set(PKCS8_X25519_PREFIX, 0);
+  pkcs8.set(scalar, PKCS8_X25519_PREFIX.length);
+  return globalThis.crypto.subtle.importKey("pkcs8", pkcs8, { name: "X25519" }, extractable, ["deriveBits"]);
+}
+function importPublicKey(publicKey) {
+  return globalThis.crypto.subtle.importKey(
+    "raw",
+    publicKey,
+    { name: "X25519" },
+    /* extractable */
+    true,
+    // Public keys carry no usages for X25519 — the private key does the
+    // deriving; the public key is only ever an argument to it.
+    []
+  );
+}
+const BASE64URL_CHARS = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_";
+function base64UrlToBytes(value) {
+  let accumulator = 0;
+  let bitCount = 0;
+  const bytes = [];
+  for (let i = 0; i < value.length; i++) {
+    const char = value[i];
+    if (char === "=")
+      break;
+    const index2 = BASE64URL_CHARS.indexOf(char);
+    if (index2 === -1) {
+      throw new WorkflowRuntimeError(`Invalid base64url character "${char}" in X25519 JWK key component`);
+    }
+    accumulator = accumulator << 6 | index2;
+    bitCount += 6;
+    if (bitCount >= 8) {
+      bitCount -= 8;
+      bytes.push(accumulator >> bitCount & 255);
+    }
+  }
+  return new Uint8Array(bytes);
+}
+async function deriveContentKey(sharedSecret, ephemeralPublicKey, recipientPublicKey, usages) {
+  const label = infoEncoder.encode(CONTENT_KEY_INFO);
+  const info = new Uint8Array(label.length + ephemeralPublicKey.length + recipientPublicKey.length);
+  info.set(label, 0);
+  info.set(ephemeralPublicKey, label.length);
+  info.set(recipientPublicKey, label.length + ephemeralPublicKey.length);
+  const hkdfKey = await globalThis.crypto.subtle.importKey("raw", sharedSecret, "HKDF", false, ["deriveBits"]);
+  const contentKeyBits = await globalThis.crypto.subtle.deriveBits({ name: "HKDF", hash: "SHA-256", salt: new Uint8Array(32), info }, hkdfKey, CONTENT_KEY_LENGTH * 8);
+  return globalThis.crypto.subtle.importKey(
+    "raw",
+    new Uint8Array(contentKeyBits),
+    "AES-GCM",
+    false,
+    // `KeyUsage` is a DOM-lib type that is not in scope under `es2022`; the
+    // parameter type is a strict subset of it, so this cast is sound.
+    usages
+  );
+}
+async function decapsulate(keyPair, ephemeralPublicKey) {
+  if (ephemeralPublicKey.byteLength !== X25519_KEY_LENGTH) {
+    throw new RuntimeDecryptionError(`Sealed payload has a malformed ephemeral public key: expected ${X25519_KEY_LENGTH} bytes, got ${ephemeralPublicKey.byteLength}`, {
+      context: {
+        operation: "decrypt",
+        byteLength: ephemeralPublicKey.byteLength
+      }
+    });
+  }
+  let sharedSecretBits;
+  try {
+    const [privateKey, senderKey] = await Promise.all([
+      importScalar(
+        keyPair.scalar,
+        /* extractable */
+        false
+      ),
+      importPublicKey(ephemeralPublicKey)
+    ]);
+    sharedSecretBits = await globalThis.crypto.subtle.deriveBits({ name: "X25519", public: senderKey }, privateKey, X25519_KEY_LENGTH * 8);
+  } catch (cause) {
+    throw new RuntimeDecryptionError(`X25519 key agreement failed while opening a sealed payload: ${cause instanceof Error ? cause.message : String(cause)}`, {
+      cause,
+      context: {
+        operation: "decrypt",
+        byteLength: ephemeralPublicKey.byteLength
+      }
+    });
+  }
+  return deriveContentKey(new Uint8Array(sharedSecretBits), ephemeralPublicKey, keyPair.publicKey, ["decrypt"]);
+}
+async function open(keyPair, sealed, aad) {
+  const minLength = X25519_KEY_LENGTH + NONCE_LENGTH + TAG_BYTES;
+  if (sealed.byteLength < minLength) {
+    throw new RuntimeDecryptionError(`Sealed payload too short: expected at least ${minLength} bytes, got ${sealed.byteLength}`, { context: { operation: "decrypt", byteLength: sealed.byteLength } });
+  }
+  const ephemeralPublicKey = sealed.subarray(0, X25519_KEY_LENGTH);
+  const encrypted = sealed.subarray(X25519_KEY_LENGTH);
+  const contentKey = await decapsulate(keyPair, ephemeralPublicKey);
+  return decrypt$1(contentKey, encrypted, aad);
+}
+function isFormatPrefix(value) {
+  return value.length === 4 && /^[a-z0-9]{4}$/.test(value);
+}
+const SerializationFormat$1 = {
+  /** devalue stringify/parse with TextEncoder/TextDecoder */
+  DEVALUE_V1: "devl",
+  /** Encrypted payload (inner payload has its own format prefix) */
+  ENCRYPTED: "encr",
+  /**
+   * Sealed payload — asymmetrically encrypted to a run's X25519 public key
+   * (inner payload has its own format prefix).
+   *
+   * Used for *cross-run* writes (hook payloads, forwarded stream frames),
+   * where the writer holds only the recipient run's public key and therefore
+   * cannot decrypt. A run's own payloads continue to use {@link ENCRYPTED}.
+   * See `sealed-box.ts` for the construction.
+   */
+  SEALED: "encp"
+};
+const FORMAT_PREFIX_LENGTH$1 = 4;
+new TextEncoder();
+const formatDecoder$1 = new TextDecoder();
+function peekFormatPrefix(data) {
+  if (!(data instanceof Uint8Array) || data.length < FORMAT_PREFIX_LENGTH$1) {
+    return null;
+  }
+  const prefixBytes = data.subarray(0, FORMAT_PREFIX_LENGTH$1);
+  const str = formatDecoder$1.decode(prefixBytes);
+  return isFormatPrefix(str) ? str : null;
+}
+function decodeFormatPrefix$1(data) {
+  if (!(data instanceof Uint8Array)) {
+    return {
+      format: SerializationFormat$1.DEVALUE_V1,
+      payload: new TextEncoder().encode(JSON.stringify(data))
+    };
+  }
+  if (data.length < FORMAT_PREFIX_LENGTH$1) {
+    throw new Error(`Data too short to contain format prefix: expected at least ${FORMAT_PREFIX_LENGTH$1} bytes, got ${data.length}`);
+  }
+  const prefixBytes = data.subarray(0, FORMAT_PREFIX_LENGTH$1);
+  const str = formatDecoder$1.decode(prefixBytes);
+  if (!isFormatPrefix(str)) {
+    throw new Error(`Invalid format prefix: "${str}". Must be 4 characters of [a-z0-9].`);
+  }
+  const payload = data.subarray(FORMAT_PREFIX_LENGTH$1);
+  return { format: str, payload };
+}
+const SEAL_TARGET_BRAND = Symbol.for("workflow.serialization.sealTarget");
+const RUN_KEYS_BRAND = Symbol.for("workflow.serialization.runKeys");
+function runPayloadKeys(aes, keyPair, aad) {
+  return { [RUN_KEYS_BRAND]: true, aes, keyPair, aad };
+}
+async function deriveRunPayloadKeys(runKeyMaterial) {
+  const [aes, keyPair] = await Promise.all([
+    importKey(runKeyMaterial),
+    deriveRunKeyPair(runKeyMaterial)
+  ]);
+  return runPayloadKeys(aes, keyPair);
+}
+function isSealTarget(value) {
+  return typeof value === "object" && value !== null && value[SEAL_TARGET_BRAND] === true;
+}
+function isRunPayloadKeys(value) {
+  return typeof value === "object" && value !== null && value[RUN_KEYS_BRAND] === true;
+}
+function aesKeyOf(key) {
+  if (!key)
+    return void 0;
+  if (isRunPayloadKeys(key))
+    return key.aes;
+  if (isSealTarget(key))
+    return void 0;
+  return key;
+}
+async function openSealedEnvelope(data, key) {
+  if (!isRunPayloadKeys(key)) {
+    throw new RuntimeDecryptionError("Sealed data encountered but no run keypair is available. Opening a sealed payload requires the run's own encryption key material; a symmetric key or a seal-only target cannot decrypt it.", {
+      context: {
+        operation: "decrypt",
+        byteLength: data.byteLength,
+        formatPrefix: "encp"
+      }
+    });
+  }
+  const { payload } = decodeFormatPrefix$1(data);
+  try {
+    return await open(key.keyPair, payload, key.aad);
+  } catch (error) {
+    if (RuntimeDecryptionError.is(error) && error.context) {
+      error.context.formatPrefix = SerializationFormat$1.SEALED;
+    }
+    throw error;
+  }
+}
+async function decrypt(data, key) {
+  if (!(data instanceof Uint8Array))
+    return data;
+  const format = peekFormatPrefix(data);
+  if (format === SerializationFormat$1.SEALED) {
+    return openSealedEnvelope(data, key);
+  }
+  if (format !== SerializationFormat$1.ENCRYPTED)
+    return data;
+  const aesKey = aesKeyOf(key);
+  if (!aesKey) {
+    throw new RuntimeDecryptionError("Encrypted data encountered but no encryption key is available. Encryption is not configured or no key was provided for this run.", {
+      context: {
+        operation: "decrypt",
+        byteLength: data.byteLength,
+        formatPrefix: "encr"
+      }
+    });
+  }
+  const { payload } = decodeFormatPrefix$1(data);
+  try {
+    return await decrypt$1(aesKey, payload);
+  } catch (error) {
+    if (RuntimeDecryptionError.is(error) && error.context) {
+      error.context.formatPrefix = format;
+    }
+    throw error;
+  }
+}
+const encryption = /* @__PURE__ */ Object.freeze(/* @__PURE__ */ Object.defineProperty({
+  __proto__: null,
+  aesKeyOf,
+  decrypt,
+  deriveRunPayloadKeys,
+  isRunPayloadKeys,
+  isSealTarget,
+  runPayloadKeys
+}, Symbol.toStringTag, { value: "Module" }));
 const SerializationFormat = {
   /** devalue stringify/parse with TextEncoder/TextDecoder */
   DEVALUE_V1: "devl",
   /** Encrypted payload (inner payload has its own format prefix after decryption) */
   ENCRYPTED: "encr",
+  /**
+   * Sealed payload — asymmetrically encrypted to a run's X25519 public key
+   * (inner payload has its own format prefix after opening).
+   *
+   * Written by cross-run writers that hold only the recipient run's public
+   * key. Opening it requires the run's private scalar rather than the
+   * symmetric per-run key, so o11y display treats it as ciphertext via
+   * {@link isEncryptedData} but {@link hydrateDataWithKey} does not attempt
+   * an AES-GCM decrypt on it.
+   */
+  SEALED: "encp",
   /** Gzip-compressed payload (inner payload has its own format prefix after decompression) */
   GZIP: "gzip",
   /** Zstandard-compressed payload (inner payload has its own format prefix after decompression) */
@@ -15918,7 +16620,14 @@ function isEncryptedData(data) {
     return false;
   }
   const prefix = formatDecoder.decode(data.subarray(0, FORMAT_PREFIX_LENGTH));
-  return prefix === SerializationFormat.ENCRYPTED;
+  return prefix === SerializationFormat.ENCRYPTED || prefix === SerializationFormat.SEALED;
+}
+function isSealedData(data) {
+  if (!(data instanceof Uint8Array) || data.length < FORMAT_PREFIX_LENGTH) {
+    return false;
+  }
+  const prefix = formatDecoder.decode(data.subarray(0, FORMAT_PREFIX_LENGTH));
+  return prefix === SerializationFormat.SEALED;
 }
 function isCompressedData(data) {
   if (!(data instanceof Uint8Array) || data.length < FORMAT_PREFIX_LENGTH) {
@@ -16012,12 +16721,13 @@ function hydrateData(value, revivers) {
 async function hydrateDataWithKey(value, revivers, key) {
   let data = value;
   if (data instanceof Uint8Array && isEncryptedData(data) && key) {
-    const { decrypt } = await __vitePreload(async () => {
-      const { decrypt: decrypt2 } = await import("./encryption-CLVP4klT.js");
-      return { decrypt: decrypt2 };
-    }, true ? __vite__mapDeps([0,1,2]) : void 0);
-    const { payload } = decodeFormatPrefix(data);
-    data = await decrypt(key, payload);
+    const { decrypt: decrypt2, isRunPayloadKeys: isRunPayloadKeys2 } = await __vitePreload(async () => {
+      const { decrypt: decrypt3, isRunPayloadKeys: isRunPayloadKeys3 } = await Promise.resolve().then(() => encryption);
+      return { decrypt: decrypt3, isRunPayloadKeys: isRunPayloadKeys3 };
+    }, true ? void 0 : void 0);
+    if (!isSealedData(data) || isRunPayloadKeys2(key)) {
+      data = await decrypt2(data, key);
+    }
   }
   if (data instanceof Uint8Array && isCompressedData(data)) {
     const { format, payload } = decodeFormatPrefix(data);
@@ -16244,6 +16954,8 @@ const serializationFormat = /* @__PURE__ */ Object.freeze(/* @__PURE__ */ Object
   STREAM_REF_TYPE: STREAM_REF_TYPE$1,
   SerializationFormat,
   decodeFormatPrefix,
+  decryptEnvelope: decrypt,
+  deriveRunPayloadKeys,
   extractClassName,
   hydrateData,
   hydrateDataWithKey,
@@ -16251,9 +16963,13 @@ const serializationFormat = /* @__PURE__ */ Object.freeze(/* @__PURE__ */ Object
   isCompressedData,
   isEncryptedData,
   isExpiredStub,
+  isRunPayloadKeys,
   isRunRef: isRunRef$1,
+  isSealTarget,
+  isSealedData,
   observabilityRevivers,
   registerZstdDecoder,
+  runPayloadKeys,
   serializedClassToString,
   serializedInstanceToRef,
   serializedRunToRunRef,
@@ -16533,19 +17249,16 @@ function replaceEncryptedAndExpiredWithMarkers(resource) {
   return result;
 }
 async function hydrateResourceIOAsync(resource, key) {
-  const { hydrateDataWithKey: hydrateDataWithKey2 } = await __vitePreload(async () => {
-    const { hydrateDataWithKey: hydrateDataWithKey3 } = await Promise.resolve().then(() => serializationFormat);
-    return { hydrateDataWithKey: hydrateDataWithKey3 };
+  const { hydrateDataWithKey: hydrateDataWithKey2, deriveRunPayloadKeys: deriveRunPayloadKeys2 } = await __vitePreload(async () => {
+    const { hydrateDataWithKey: hydrateDataWithKey3, deriveRunPayloadKeys: deriveRunPayloadKeys3 } = await Promise.resolve().then(() => serializationFormat);
+    return { hydrateDataWithKey: hydrateDataWithKey3, deriveRunPayloadKeys: deriveRunPayloadKeys3 };
   }, true ? void 0 : void 0);
   const { ensureZstdDecoderRegistered } = await __vitePreload(async () => {
-    const { ensureZstdDecoderRegistered: ensureZstdDecoderRegistered2 } = await import("./zstd-browser-decoder-Ds2MNSdp.js");
+    const { ensureZstdDecoderRegistered: ensureZstdDecoderRegistered2 } = await import("./zstd-browser-decoder-BAY5XtBl.js");
     return { ensureZstdDecoderRegistered: ensureZstdDecoderRegistered2 };
-  }, true ? __vite__mapDeps([3,2]) : void 0);
+  }, true ? __vite__mapDeps([0,1]) : void 0);
   ensureZstdDecoderRegistered();
-  const cryptoKey = key ? await __vitePreload(async () => {
-    const { importKey } = await import("./encryption-CLVP4klT.js");
-    return { importKey };
-  }, true ? __vite__mapDeps([0,1,2]) : void 0).then(({ importKey }) => importKey(key)) : void 0;
+  const cryptoKey = key ? await deriveRunPayloadKeys2(key) : void 0;
   const revivers = getRevivers();
   async function hydrateField(value) {
     if (isEncryptedMarker$1(value)) {
@@ -17689,15 +18402,15 @@ const MS_IN_SECOND$1 = 1e3;
 const MS_IN_MINUTE = 60 * MS_IN_SECOND$1;
 const MS_IN_HOUR = 60 * MS_IN_MINUTE;
 const MS_IN_DAY = 24 * MS_IN_HOUR;
-function formatDuration(ms, compact = false) {
-  if (ms === 0) {
+function formatDuration(ms2, compact = false) {
+  if (ms2 === 0) {
     return "0s";
   }
-  if (ms < MS_IN_SECOND$1) {
-    const roundedMs2 = Math.round(ms);
+  if (ms2 < MS_IN_SECOND$1) {
+    const roundedMs2 = Math.round(ms2);
     return roundedMs2 < MS_IN_SECOND$1 ? `${roundedMs2}ms` : "1s";
   }
-  const roundedMs = Math.round(ms / MS_IN_SECOND$1) * MS_IN_SECOND$1;
+  const roundedMs = Math.round(ms2 / MS_IN_SECOND$1) * MS_IN_SECOND$1;
   if (roundedMs < MS_IN_MINUTE) {
     return `${Math.floor(roundedMs / MS_IN_SECOND$1)}s`;
   }
@@ -17728,18 +18441,18 @@ function formatDuration(ms, compact = false) {
   parts.push(`${seconds}s`);
   return parts.join(" ");
 }
-function formatDurationPrecise(ms, fractionDigits = 2) {
-  if (ms === 0) {
+function formatDurationPrecise(ms2, fractionDigits = 2) {
+  if (ms2 === 0) {
     return "0s";
   }
-  if (ms < MS_IN_SECOND$1) {
-    const roundedMs = Math.round(ms);
+  if (ms2 < MS_IN_SECOND$1) {
+    const roundedMs = Math.round(ms2);
     if (roundedMs < MS_IN_SECOND$1) {
       return `${roundedMs}ms`;
     }
   }
   const granularityMs = MS_IN_SECOND$1 / 10 ** fractionDigits;
-  const normalizedMs = Math.round(ms / granularityMs) * granularityMs;
+  const normalizedMs = Math.round(ms2 / granularityMs) * granularityMs;
   if (normalizedMs < MS_IN_MINUTE) {
     return `${Number((normalizedMs / MS_IN_SECOND$1).toFixed(fractionDigits))}s`;
   }
@@ -17825,7 +18538,7 @@ function useCollapsibleContext(part) {
   return context;
 }
 function CollapsibleRoot({ children: children2, variant = "section", disabled = false, defaultOpen = false, onOpenChange, className }) {
-  const [open, setOpen] = reactExports.useState(defaultOpen);
+  const [open2, setOpen] = reactExports.useState(defaultOpen);
   const handleToggle = (event) => {
     if (event.target !== event.currentTarget)
       return;
@@ -17833,7 +18546,7 @@ function CollapsibleRoot({ children: children2, variant = "section", disabled =
     setOpen(next2);
     onOpenChange == null ? void 0 : onOpenChange(next2);
   };
-  const details = jsxRuntimeExports.jsx("details", { "data-slot": "collapsible", "data-state": open ? "open" : "closed", open, onToggle: disabled ? void 0 : handleToggle, className: cn$4(variant === "card" ? "group/card border-gray-alpha-400 last:border-b" : "group", className), children: jsxRuntimeExports.jsx(CollapsibleContext.Provider, { value: { variant, disabled }, children: children2 }) });
+  const details = jsxRuntimeExports.jsx("details", { "data-slot": "collapsible", "data-state": open2 ? "open" : "closed", open: open2, onToggle: disabled ? void 0 : handleToggle, className: cn$4(variant === "card" ? "group/card border-gray-alpha-400 last:border-b" : "group", className), children: jsxRuntimeExports.jsx(CollapsibleContext.Provider, { value: { variant, disabled }, children: children2 }) });
   if (variant === "card") {
     return details;
   }
@@ -18249,8 +18962,8 @@ function PrimitiveValue({ field, value, isLast }) {
   const { text: text2, cls } = describePrimitive(value);
   return jsxRuntimeExports.jsx(LeafRow, { field, isLast, children: jsxRuntimeExports.jsx("span", { className: cls, children: text2 }) });
 }
-function EmptyContainer({ field, prefix, open, close, isLast }) {
-  return jsxRuntimeExports.jsxs("div", { className: CLS.child, role: "treeitem", tabIndex: -1, children: [jsxRuntimeExports.jsx(Label, { field }), prefix ? jsxRuntimeExports.jsx("span", { className: CLS.className, children: prefix }) : null, jsxRuntimeExports.jsx("span", { className: CLS.punctuation, children: open }), jsxRuntimeExports.jsx("span", { className: CLS.punctuation, children: close }), jsxRuntimeExports.jsx(Comma, { isLast })] });
+function EmptyContainer({ field, prefix, open: open2, close, isLast }) {
+  return jsxRuntimeExports.jsxs("div", { className: CLS.child, role: "treeitem", tabIndex: -1, children: [jsxRuntimeExports.jsx(Label, { field }), prefix ? jsxRuntimeExports.jsx("span", { className: CLS.className, children: prefix }) : null, jsxRuntimeExports.jsx("span", { className: CLS.punctuation, children: open2 }), jsxRuntimeExports.jsx("span", { className: CLS.punctuation, children: close }), jsxRuntimeExports.jsx(Comma, { isLast })] });
 }
 function focusExpander(button, outerRef) {
   var _a3;
@@ -18279,13 +18992,13 @@ function moveExpanderFocus(outerRef, direction) {
   buttons[next2].tabIndex = 0;
   buttons[next2].focus();
 }
-function ExpandableContainer({ field, entries, open, close, prefix, ctx, isLast }) {
+function ExpandableContainer({ field, entries, open: open2, close, prefix, ctx, isLast }) {
   const { level, shouldExpand, outerRef } = ctx;
   const [expanded2, setExpanded] = reactExports.useState(() => shouldExpand(level));
   const rowRef = reactExports.useRef(null);
   const contentsId = reactExports.useId();
   if (entries.length === 0) {
-    return jsxRuntimeExports.jsx(EmptyContainer, { field, prefix, open, close, isLast });
+    return jsxRuntimeExports.jsx(EmptyContainer, { field, prefix, open: open2, close, isLast });
   }
   const toggle = () => {
     setExpanded((value) => !value);
@@ -18314,7 +19027,7 @@ function ExpandableContainer({ field, entries, open, close, prefix, ctx, isLast
     }
   };
   const lastIndex = entries.length - 1;
-  return jsxRuntimeExports.jsxs("div", { className: CLS.child, role: "treeitem", "aria-expanded": expanded2, "aria-controls": expanded2 ? contentsId : void 0, "data-json-expander": true, ref: rowRef, tabIndex: level === 0 ? 0 : -1, onClick, onKeyDown, children: [jsxRuntimeExports.jsx("span", { className: expanded2 ? CLS.collapseIcon : CLS.expandIcon, "aria-hidden": "true" }), field !== void 0 && jsxRuntimeExports.jsx("span", { className: CLS.clickableLabel, children: `${formatField(field)}:` }), prefix ? jsxRuntimeExports.jsx("span", { className: CLS.className, children: prefix }) : null, jsxRuntimeExports.jsx("span", { className: CLS.punctuation, children: open }), expanded2 ? jsxRuntimeExports.jsx("ul", { id: contentsId, className: CLS.childFields, role: "group", children: entries.map(([childField, childValue], index2) => jsxRuntimeExports.jsx(DataRender, { field: childField, value: childValue, isLast: index2 === lastIndex, ctx: { ...ctx, level: level + 1 } }, childField ?? index2)) }) : jsxRuntimeExports.jsx("span", { className: CLS.collapsedContent, "aria-hidden": "true" }), jsxRuntimeExports.jsx("span", { className: CLS.punctuation, children: close }), jsxRuntimeExports.jsx(Comma, { isLast })] });
+  return jsxRuntimeExports.jsxs("div", { className: CLS.child, role: "treeitem", "aria-expanded": expanded2, "aria-controls": expanded2 ? contentsId : void 0, "data-json-expander": true, ref: rowRef, tabIndex: level === 0 ? 0 : -1, onClick, onKeyDown, children: [jsxRuntimeExports.jsx("span", { className: expanded2 ? CLS.collapseIcon : CLS.expandIcon, "aria-hidden": "true" }), field !== void 0 && jsxRuntimeExports.jsx("span", { className: CLS.clickableLabel, children: `${formatField(field)}:` }), prefix ? jsxRuntimeExports.jsx("span", { className: CLS.className, children: prefix }) : null, jsxRuntimeExports.jsx("span", { className: CLS.punctuation, children: open2 }), expanded2 ? jsxRuntimeExports.jsx("ul", { id: contentsId, className: CLS.childFields, role: "group", children: entries.map(([childField, childValue], index2) => jsxRuntimeExports.jsx(DataRender, { field: childField, value: childValue, isLast: index2 === lastIndex, ctx: { ...ctx, level: level + 1 } }, childField ?? index2)) }) : jsxRuntimeExports.jsx("span", { className: CLS.collapsedContent, "aria-hidden": "true" }), jsxRuntimeExports.jsx("span", { className: CLS.punctuation, children: close }), jsxRuntimeExports.jsx(Comma, { isLast })] });
 }
 function DataRender({ field, value, isLast, ctx }) {
   if (isBytesDisplay(value)) {
@@ -19241,11 +19954,11 @@ const TIME_UNITS = [
 function formatTimeDifference(diff) {
   let remaining = Math.abs(diff);
   const result = [];
-  for (const { unit, ms } of TIME_UNITS) {
-    const value = Math.floor(remaining / ms);
+  for (const { unit, ms: ms2 } of TIME_UNITS) {
+    const value = Math.floor(remaining / ms2);
     if (value > 0 || result.length > 0) {
       result.push(`${value} ${unit}${value !== 1 ? "s" : ""}`);
-      remaining %= ms;
+      remaining %= ms2;
     }
     if (result.length === 3)
       break;
@@ -32551,12 +33264,12 @@ function emphasis$1(node2, _2, state, info) {
     })
   );
   const betweenHead = between.charCodeAt(0);
-  const open = encodeInfo(
+  const open2 = encodeInfo(
     info.before.charCodeAt(info.before.length - 1),
     betweenHead,
     marker2
   );
-  if (open.inside) {
+  if (open2.inside) {
     between = encodeCharacterReference(betweenHead) + between.slice(1);
   }
   const betweenTail = between.charCodeAt(between.length - 1);
@@ -32568,7 +33281,7 @@ function emphasis$1(node2, _2, state, info) {
   exit2();
   state.attentionEncodeSurroundingInfo = {
     after: close.outside,
-    before: open.outside
+    before: open2.outside
   };
   return before + between + after;
 }
@@ -33101,12 +33814,12 @@ function strong$1(node2, _2, state, info) {
     })
   );
   const betweenHead = between.charCodeAt(0);
-  const open = encodeInfo(
+  const open2 = encodeInfo(
     info.before.charCodeAt(info.before.length - 1),
     betweenHead,
     marker2
   );
-  if (open.inside) {
+  if (open2.inside) {
     between = encodeCharacterReference(betweenHead) + between.slice(1);
   }
   const betweenTail = between.charCodeAt(between.length - 1);
@@ -33118,7 +33831,7 @@ function strong$1(node2, _2, state, info) {
   exit2();
   state.attentionEncodeSurroundingInfo = {
     after: close.outside,
-    before: open.outside
+    before: open2.outside
   };
   return before + between + after;
 }
@@ -33915,7 +34628,7 @@ const attention = {
 };
 function resolveAllAttention(events, context) {
   let index2 = -1;
-  let open;
+  let open2;
   let group;
   let text2;
   let openingSequence;
@@ -33925,16 +34638,16 @@ function resolveAllAttention(events, context) {
   let offset2;
   while (++index2 < events.length) {
     if (events[index2][0] === "enter" && events[index2][1].type === "attentionSequence" && events[index2][1]._close) {
-      open = index2;
-      while (open--) {
-        if (events[open][0] === "exit" && events[open][1].type === "attentionSequence" && events[open][1]._open && // If the markers are the same:
-        context.sliceSerialize(events[open][1]).charCodeAt(0) === context.sliceSerialize(events[index2][1]).charCodeAt(0)) {
-          if ((events[open][1]._close || events[index2][1]._open) && (events[index2][1].end.offset - events[index2][1].start.offset) % 3 && !((events[open][1].end.offset - events[open][1].start.offset + events[index2][1].end.offset - events[index2][1].start.offset) % 3)) {
+      open2 = index2;
+      while (open2--) {
+        if (events[open2][0] === "exit" && events[open2][1].type === "attentionSequence" && events[open2][1]._open && // If the markers are the same:
+        context.sliceSerialize(events[open2][1]).charCodeAt(0) === context.sliceSerialize(events[index2][1]).charCodeAt(0)) {
+          if ((events[open2][1]._close || events[index2][1]._open) && (events[index2][1].end.offset - events[index2][1].start.offset) % 3 && !((events[open2][1].end.offset - events[open2][1].start.offset + events[index2][1].end.offset - events[index2][1].start.offset) % 3)) {
             continue;
           }
-          use = events[open][1].end.offset - events[open][1].start.offset > 1 && events[index2][1].end.offset - events[index2][1].start.offset > 1 ? 2 : 1;
+          use = events[open2][1].end.offset - events[open2][1].start.offset > 1 && events[index2][1].end.offset - events[index2][1].start.offset > 1 ? 2 : 1;
           const start = {
-            ...events[open][1].end
+            ...events[open2][1].end
           };
           const end = {
             ...events[index2][1].start
@@ -33945,7 +34658,7 @@ function resolveAllAttention(events, context) {
             type: use > 1 ? "strongSequence" : "emphasisSequence",
             start,
             end: {
-              ...events[open][1].end
+              ...events[open2][1].end
             }
           };
           closingSequence = {
@@ -33958,7 +34671,7 @@ function resolveAllAttention(events, context) {
           text2 = {
             type: use > 1 ? "strongText" : "emphasisText",
             start: {
-              ...events[open][1].end
+              ...events[open2][1].end
             },
             end: {
               ...events[index2][1].start
@@ -33973,18 +34686,18 @@ function resolveAllAttention(events, context) {
               ...closingSequence.end
             }
           };
-          events[open][1].end = {
+          events[open2][1].end = {
             ...openingSequence.start
           };
           events[index2][1].start = {
             ...closingSequence.end
           };
           nextEvents = [];
-          if (events[open][1].end.offset - events[open][1].start.offset) {
-            nextEvents = push(nextEvents, [["enter", events[open][1], context], ["exit", events[open][1], context]]);
+          if (events[open2][1].end.offset - events[open2][1].start.offset) {
+            nextEvents = push(nextEvents, [["enter", events[open2][1], context], ["exit", events[open2][1], context]]);
           }
           nextEvents = push(nextEvents, [["enter", group, context], ["enter", openingSequence, context], ["exit", openingSequence, context], ["enter", text2, context]]);
-          nextEvents = push(nextEvents, resolveAll(context.parser.constructs.insideSpan.null, events.slice(open + 1, index2), context));
+          nextEvents = push(nextEvents, resolveAll(context.parser.constructs.insideSpan.null, events.slice(open2 + 1, index2), context));
           nextEvents = push(nextEvents, [["exit", text2, context], ["enter", closingSequence, context], ["exit", closingSequence, context], ["exit", group, context]]);
           if (events[index2][1].end.offset - events[index2][1].start.offset) {
             offset2 = 2;
@@ -33992,8 +34705,8 @@ function resolveAllAttention(events, context) {
           } else {
             offset2 = 0;
           }
-          splice(events, open - 1, index2 - open + 3, nextEvents);
-          index2 = open + nextEvents.length - offset2 - 2;
+          splice(events, open2 - 1, index2 - open2 + 3, nextEvents);
+          index2 = open2 + nextEvents.length - offset2 - 2;
           break;
         }
       }
@@ -34025,10 +34738,10 @@ function tokenizeAttention(effects, ok2) {
     }
     const token = effects.exit("attentionSequence");
     const after = classifyCharacter(code2);
-    const open = !after || after === 2 && before || attentionMarkers2.includes(code2);
+    const open2 = !after || after === 2 && before || attentionMarkers2.includes(code2);
     const close = !before || before === 2 && after || attentionMarkers2.includes(previous2);
-    token._open = Boolean(marker2 === 42 ? open : open && (before || !close));
-    token._close = Boolean(marker2 === 42 ? close : close && (after || !open));
+    token._open = Boolean(marker2 === 42 ? open2 : open2 && (before || !close));
+    token._close = Boolean(marker2 === 42 ? close : close && (after || !open2));
     return ok2(code2);
   }
 }
@@ -34050,9 +34763,9 @@ function tokenizeAutolink(effects, ok2, nok) {
     effects.consume(code2);
     effects.exit("autolinkMarker");
     effects.enter("autolinkProtocol");
-    return open;
+    return open2;
   }
-  function open(code2) {
+  function open2(code2) {
     if (asciiAlpha(code2)) {
       effects.consume(code2);
       return schemeOrEmailAtext;
@@ -34264,9 +34977,9 @@ function tokenizeCharacterReference(effects, ok2, nok) {
     effects.enter("characterReferenceMarker");
     effects.consume(code2);
     effects.exit("characterReferenceMarker");
-    return open;
+    return open2;
   }
-  function open(code2) {
+  function open2(code2) {
     if (code2 === 35) {
       effects.enter("characterReferenceMarkerNumeric");
       effects.consume(code2);
@@ -35604,9 +36317,9 @@ function tokenizeHtmlFlow(effects, ok2, nok) {
     effects.enter("htmlFlow");
     effects.enter("htmlFlowData");
     effects.consume(code2);
-    return open;
+    return open2;
   }
-  function open(code2) {
+  function open2(code2) {
     if (code2 === 33) {
       effects.consume(code2);
       return declarationOpen;
@@ -35952,9 +36665,9 @@ function tokenizeHtmlText(effects, ok2, nok) {
     effects.enter("htmlText");
     effects.enter("htmlTextData");
     effects.consume(code2);
-    return open;
+    return open2;
   }
-  function open(code2) {
+  function open2(code2) {
     if (code2 === 33) {
       effects.consume(code2);
       return declarationOpen;
@@ -36278,12 +36991,12 @@ function resolveToLabelEnd(events, context) {
   let index2 = events.length;
   let offset2 = 0;
   let token;
-  let open;
+  let open2;
   let close;
   let media;
   while (index2--) {
     token = events[index2][1];
-    if (open) {
+    if (open2) {
       if (token.type === "link" || token.type === "labelLink" && token._inactive) {
         break;
       }
@@ -36292,7 +37005,7 @@ function resolveToLabelEnd(events, context) {
       }
     } else if (close) {
       if (events[index2][0] === "enter" && (token.type === "labelImage" || token.type === "labelLink") && !token._balanced) {
-        open = index2;
+        open2 = index2;
         if (token.type !== "labelLink") {
           offset2 = 2;
           break;
@@ -36303,9 +37016,9 @@ function resolveToLabelEnd(events, context) {
     }
   }
   const group = {
-    type: events[open][1].type === "labelLink" ? "link" : "image",
+    type: events[open2][1].type === "labelLink" ? "link" : "image",
     start: {
-      ...events[open][1].start
+      ...events[open2][1].start
     },
     end: {
       ...events[events.length - 1][1].end
@@ -36314,7 +37027,7 @@ function resolveToLabelEnd(events, context) {
   const label = {
     type: "label",
     start: {
-      ...events[open][1].start
+      ...events[open2][1].start
     },
     end: {
       ...events[close][1].end
@@ -36323,20 +37036,20 @@ function resolveToLabelEnd(events, context) {
   const text2 = {
     type: "labelText",
     start: {
-      ...events[open + offset2 + 2][1].end
+      ...events[open2 + offset2 + 2][1].end
     },
     end: {
       ...events[close - 2][1].start
     }
   };
   media = [["enter", group, context], ["enter", label, context]];
-  media = push(media, events.slice(open + 1, open + offset2 + 3));
+  media = push(media, events.slice(open2 + 1, open2 + offset2 + 3));
   media = push(media, [["enter", text2, context]]);
-  media = push(media, resolveAll(context.parser.constructs.insideSpan.null, events.slice(open + offset2 + 4, close - 3), context));
+  media = push(media, resolveAll(context.parser.constructs.insideSpan.null, events.slice(open2 + offset2 + 4, close - 3), context));
   media = push(media, [["exit", text2, context], events[close - 2], events[close - 1], ["exit", label, context]]);
   media = push(media, events.slice(close + 1));
   media = push(media, [["exit", group, context]]);
-  splice(events, open, events.length, media);
+  splice(events, open2, events.length, media);
   return events;
 }
 function tokenizeLabelEnd(effects, ok2, nok) {
@@ -36479,9 +37192,9 @@ function tokenizeLabelStartImage(effects, ok2, nok) {
     effects.enter("labelImageMarker");
     effects.consume(code2);
     effects.exit("labelImageMarker");
-    return open;
+    return open2;
   }
-  function open(code2) {
+  function open2(code2) {
     if (code2 === 91) {
       effects.enter("labelMarker");
       effects.consume(code2);
@@ -37081,30 +37794,30 @@ function gfmStrikethrough(options) {
     let index2 = -1;
     while (++index2 < events.length) {
       if (events[index2][0] === "enter" && events[index2][1].type === "strikethroughSequenceTemporary" && events[index2][1]._close) {
-        let open = index2;
-        while (open--) {
-          if (events[open][0] === "exit" && events[open][1].type === "strikethroughSequenceTemporary" && events[open][1]._open && // If the sizes are the same:
-          events[index2][1].end.offset - events[index2][1].start.offset === events[open][1].end.offset - events[open][1].start.offset) {
+        let open2 = index2;
+        while (open2--) {
+          if (events[open2][0] === "exit" && events[open2][1].type === "strikethroughSequenceTemporary" && events[open2][1]._open && // If the sizes are the same:
+          events[index2][1].end.offset - events[index2][1].start.offset === events[open2][1].end.offset - events[open2][1].start.offset) {
             events[index2][1].type = "strikethroughSequence";
-            events[open][1].type = "strikethroughSequence";
+            events[open2][1].type = "strikethroughSequence";
             const strikethrough2 = {
               type: "strikethrough",
-              start: Object.assign({}, events[open][1].start),
+              start: Object.assign({}, events[open2][1].start),
               end: Object.assign({}, events[index2][1].end)
             };
             const text2 = {
               type: "strikethroughText",
-              start: Object.assign({}, events[open][1].end),
+              start: Object.assign({}, events[open2][1].end),
               end: Object.assign({}, events[index2][1].start)
             };
-            const nextEvents = [["enter", strikethrough2, context], ["enter", events[open][1], context], ["exit", events[open][1], context], ["enter", text2, context]];
+            const nextEvents = [["enter", strikethrough2, context], ["enter", events[open2][1], context], ["exit", events[open2][1], context], ["enter", text2, context]];
             const insideSpan2 = context.parser.constructs.insideSpan.null;
             if (insideSpan2) {
-              splice(nextEvents, nextEvents.length, 0, resolveAll(insideSpan2, events.slice(open + 1, index2), context));
+              splice(nextEvents, nextEvents.length, 0, resolveAll(insideSpan2, events.slice(open2 + 1, index2), context));
             }
             splice(nextEvents, nextEvents.length, 0, [["exit", text2, context], ["enter", events[index2][1], context], ["exit", events[index2][1], context], ["exit", strikethrough2, context]]);
-            splice(events, open - 1, index2 - open + 3, nextEvents);
-            index2 = open + nextEvents.length - 2;
+            splice(events, open2 - 1, index2 - open2 + 3, nextEvents);
+            index2 = open2 + nextEvents.length - 2;
             break;
           }
         }
@@ -37646,8 +38359,8 @@ function gfmTaskListItem() {
 }
 function tokenizeTasklistCheck(effects, ok2, nok) {
   const self2 = this;
-  return open;
-  function open(code2) {
+  return open2;
+  function open2(code2) {
     if (
       // Exit if there’s stuff before.
       self2.previous !== null || // Exit if not in the first content that is the first child of a list
@@ -40080,8 +40793,8 @@ function compiler(options) {
     return length;
   }
   function opener(create2, and) {
-    return open;
-    function open(token) {
+    return open2;
+    function open2(token) {
       enter.call(this, create2(token), token);
       if (and) and.call(this, token);
     }
@@ -40113,18 +40826,18 @@ function compiler(options) {
   }
   function exit2(token, onExitError) {
     const node2 = this.stack.pop();
-    const open = this.tokenStack.pop();
-    if (!open) {
+    const open2 = this.tokenStack.pop();
+    if (!open2) {
       throw new Error("Cannot close `" + token.type + "` (" + stringifyPosition({
         start: token.start,
         end: token.end
       }) + "): it’s not open");
-    } else if (open[0].type !== token.type) {
+    } else if (open2[0].type !== token.type) {
       if (onExitError) {
-        onExitError.call(this, token, open[0]);
+        onExitError.call(this, token, open2[0]);
       } else {
-        const handler = open[1] || defaultOnError;
-        handler.call(this, token, open[0]);
+        const handler = open2[1] || defaultOnError;
+        handler.call(this, token, open2[0]);
       }
     }
     node2.position.end = point(token.end);
@@ -44100,7 +44813,7 @@ var tn = f("block", "before:content-[counter(line)]", "before:inline-block", "be
 var et = ({ className: e, language: t, style: o, isIncomplete: n, ...s2 }) => jsxRuntimeExports.jsx("div", { className: f("my-4 flex w-full flex-col gap-2 rounded-xl border border-border bg-sidebar p-2", e), "data-incomplete": n || void 0, "data-language": t, "data-streamdown": "code-block", style: { contentVisibility: "auto", containIntrinsicSize: "auto 200px", ...o }, ...s2 });
 var Se = reactExports.createContext({ code: "" }), de = () => reactExports.useContext(Se);
 var ot = ({ language: e }) => jsxRuntimeExports.jsx("div", { className: "flex h-8 items-center text-muted-foreground text-xs", "data-language": e, "data-streamdown": "code-block-header", children: jsxRuntimeExports.jsx("span", { className: "ml-1 font-mono lowercase", children: e }) });
-var cn$1 = /\n+$/, dn = reactExports.lazy(() => __vitePreload(() => import("./highlighted-body-B3W2YXNL-C5gyMelW.js"), true ? __vite__mapDeps([4,2]) : void 0).then((e) => ({ default: e.HighlightedCodeBlockBody }))), rt = ({ code: e, language: t, className: o, children: n, isIncomplete: s2 = false, ...r2 }) => {
+var cn$1 = /\n+$/, dn = reactExports.lazy(() => __vitePreload(() => import("./highlighted-body-B3W2YXNL-CRgNr0YA.js"), true ? __vite__mapDeps([2,1]) : void 0).then((e) => ({ default: e.HighlightedCodeBlockBody }))), rt = ({ code: e, language: t, className: o, children: n, isIncomplete: s2 = false, ...r2 }) => {
   let i = reactExports.useMemo(() => e.replace(cn$1, ""), [e]), c = reactExports.useMemo(() => ({ bg: "transparent", fg: "inherit", tokens: i.split(`
 `).map((a2) => [{ content: a2, color: "inherit", bgColor: "transparent", htmlStyle: {}, offset: 0 }]) }), [i]);
   return jsxRuntimeExports.jsx(Se.Provider, { value: { code: e }, children: jsxRuntimeExports.jsxs(et, { isIncomplete: s2, language: t, children: [jsxRuntimeExports.jsx(ot, { language: t }), n ? jsxRuntimeExports.jsx("div", { className: "pointer-events-none sticky top-2 z-10 -mt-10 flex h-8 items-center justify-end", children: jsxRuntimeExports.jsx("div", { className: "pointer-events-auto flex shrink-0 items-center gap-2 rounded-md border border-sidebar bg-sidebar/80 px-1.5 py-1 supports-[backdrop-filter]:bg-sidebar/70 supports-[backdrop-filter]:backdrop-blur", "data-streamdown": "code-block-actions", children: n }) }) : null, jsxRuntimeExports.jsx(reactExports.Suspense, { fallback: jsxRuntimeExports.jsx(Qe, { className: o, language: t, result: c, ...r2 }), children: jsxRuntimeExports.jsx(dn, { className: o, code: i, language: t, raw: c, ...r2 }) })] }) });
@@ -46441,8 +47154,8 @@ function computeTimeMarkers(viewDuration, offset2) {
   }
   return markers2;
 }
-function toViewportFrac(ms, viewStart, range) {
-  return Math.min(Math.max((ms - viewStart) / range, 0), 1);
+function toViewportFrac(ms2, viewStart, range) {
+  return Math.min(Math.max((ms2 - viewStart) / range, 0), 1);
 }
 function computeSpanGaps(spans, viewStart, viewEnd) {
   const range = viewEnd - viewStart;
@@ -49747,8 +50460,8 @@ async function fetchStreams(worldEnv, runId) {
 async function fetchWorkflowsManifest(worldEnv) {
   return rpc("fetchWorkflowsManifest", { worldEnv });
 }
-async function runHealthCheck(worldEnv, endpoint, options) {
-  return rpc("runHealthCheck", { worldEnv, endpoint, options });
+async function runHealthCheck(worldEnv, options) {
+  return rpc("runHealthCheck", { worldEnv, options });
 }
 async function getEncryptionKeyForRun(worldEnv, runId) {
   return rpc("getEncryptionKeyForRun", { worldEnv, runId });
@@ -49855,26 +50568,29 @@ export {
   fetchEventsByCorrelationId as b0,
   isEncryptedData as b1,
   hydrateData as b2,
-  getWebRevivers as b3,
-  LIVE_UPDATE_INTERVAL_MS as b4,
-  getEncryptionKeyForRun as b5,
-  StreamViewer as b6,
-  composeRefs as b7,
-  useFloating as b8,
-  offset as b9,
-  shift as ba,
-  limitShift as bb,
-  flip as bc,
-  size as bd,
-  arrow as be,
-  hide as bf,
-  autoUpdate as bg,
-  cancelRun as bh,
-  reenqueueRun as bi,
-  wakeUpRun as bj,
-  resumeHook as bk,
-  fetchHookToken as bl,
-  recreateRun as bm,
+  decrypt as b3,
+  deriveRunPayloadKeys as b4,
+  getWebRevivers as b5,
+  LIVE_UPDATE_INTERVAL_MS as b6,
+  getEncryptionKeyForRun as b7,
+  StreamViewer as b8,
+  composeRefs as b9,
+  useFloating as ba,
+  offset as bb,
+  shift as bc,
+  limitShift as bd,
+  flip as be,
+  size as bf,
+  arrow as bg,
+  hide as bh,
+  autoUpdate as bi,
+  VERCEL_403_ERROR_MESSAGE as bj,
+  cancelRun as bk,
+  reenqueueRun as bl,
+  wakeUpRun as bm,
+  resumeHook as bn,
+  fetchHookToken as bo,
+  recreateRun as bp,
   createLucideIcon as c,
   runHealthCheck as d,
   cn as e,