@workflow/web 5.0.0-beta.36 → 5.0.0-beta.37

package/build/server/assets/{server-build-4Pq8AwvA.js → server-build-C11Xqmwk.js}

@@ -18,7 +18,7 @@ import { createRequire as __wkfCreateRequire } from "node:module";
 if (typeof require === "undefined") {
   globalThis.require = __wkfCreateRequire(import.meta.url);
 }
-import { a as requireReact, S as ServerRouter, c as createReadableStreamFromReadable, r as reactExports, g as getDefaultExportFromCjs, R as React, b as ReactExports, w as withComponentProps, d as withErrorBoundaryProps, M as Meta, L as Links, e as ScrollRestoration, f as Scripts, O as Outlet, u as useNavigate, h as useSearchParams, i as Link$1, j as useRouteError, k as isRouteErrorResponse, l as useLocation, m as useParams } from "./app-BSsmG188.js";
+import { a as requireReact, S as ServerRouter, c as createReadableStreamFromReadable, r as reactExports, g as getDefaultExportFromCjs, R as React, b as ReactExports, w as withComponentProps, d as withErrorBoundaryProps, M as Meta, L as Links, e as ScrollRestoration, f as Scripts, O as Outlet, u as useNavigate, h as useSearchParams, i as Link$1, j as useRouteError, k as isRouteErrorResponse, l as useLocation, m as useParams } from "./app-BaJoK9ck.js";
 import require$$0$4, { PassThrough } from "node:stream";
 import require$$0 from "util";
 import require$$1 from "crypto";
@@ -33,7 +33,7 @@ import fs$1, { access, readdir, readlink, readFile, mkdir, constants as constant
 import { createRequire as createRequire$1 } from "node:module";
 import require$$3, { types as types$3, promisify, inspect } from "node:util";
 import require$$1$3, { AsyncLocalStorage } from "node:async_hooks";
-import os, { homedir } from "node:os";
+import os, { homedir, tmpdir } from "node:os";
 import { promises } from "node:fs";
 import { execFile } from "node:child_process";
 import { setTimeout as setTimeout$1 } from "node:timers/promises";
@@ -25563,7 +25563,7 @@ function useFloating(options) {
     } = {},
     transform: transform2 = true,
     whileElementsMounted,
-    open
+    open: open2
   } = options;
   const [data, setData] = reactExports.useState({
     x: 0,
@@ -25599,7 +25599,7 @@ function useFloating(options) {
   const hasWhileElementsMounted = whileElementsMounted != null;
   const whileElementsMountedRef = useLatestRef(whileElementsMounted);
   const platformRef = useLatestRef(platform2);
-  const openRef = useLatestRef(open);
+  const openRef = useLatestRef(open2);
   const update = reactExports.useCallback(() => {
     if (!referenceRef.current || !floatingRef.current) {
       return;
@@ -25630,14 +25630,14 @@ function useFloating(options) {
     });
   }, [latestMiddleware, placement, strategy, platformRef, openRef]);
   index$4(() => {
-    if (open === false && dataRef.current.isPositioned) {
+    if (open2 === false && dataRef.current.isPositioned) {
       dataRef.current.isPositioned = false;
       setData((data2) => ({
         ...data2,
         isPositioned: false
       }));
     }
-  }, [open]);
+  }, [open2]);
   const isMountedRef = reactExports.useRef(false);
   index$4(() => {
     isMountedRef.current = true;
@@ -26378,23 +26378,23 @@ var Tooltip$2 = (props) => {
   const disableHoverableContent = disableHoverableContentProp ?? providerContext.disableHoverableContent;
   const delayDuration = delayDurationProp ?? providerContext.delayDuration;
   const wasOpenDelayedRef = reactExports.useRef(false);
-  const [open, setOpen] = useControllableState$1({
+  const [open2, setOpen] = useControllableState$1({
     prop: openProp,
     defaultProp: defaultOpen ?? false,
-    onChange: (open2) => {
-      if (open2) {
+    onChange: (open22) => {
+      if (open22) {
         providerContext.onOpen();
         document.dispatchEvent(new CustomEvent(TOOLTIP_OPEN));
       } else {
         providerContext.onClose();
       }
-      onOpenChange == null ? void 0 : onOpenChange(open2);
+      onOpenChange == null ? void 0 : onOpenChange(open22);
     },
     caller: TOOLTIP_NAME
   });
   const stateAttribute = reactExports.useMemo(() => {
-    return open ? wasOpenDelayedRef.current ? "delayed-open" : "instant-open" : "closed";
-  }, [open]);
+    return open2 ? wasOpenDelayedRef.current ? "delayed-open" : "instant-open" : "closed";
+  }, [open2]);
   const handleOpen = reactExports.useCallback(() => {
     window.clearTimeout(openTimerRef.current);
     openTimerRef.current = 0;
@@ -26427,7 +26427,7 @@ var Tooltip$2 = (props) => {
     {
       scope: __scopeTooltip,
       contentId,
-      open,
+      open: open2,
       stateAttribute,
       trigger,
       onTriggerChange: setTrigger,
@@ -48196,7 +48196,14 @@ const RunCreatedEventSchema = BaseEventSchema.extend({
     input: SerializedDataSchema,
     executionContext: record(string$3(), any()).optional(),
     attributes: record(string$3(), string$3()).optional(),
-    allowReservedAttributes: literal(true).optional()
+    allowReservedAttributes: literal(true).optional(),
+    /**
+     * The run's X25519 public key (base64), stamped by SDKs that support
+     * sealed (`encp`) envelopes. Persisted onto the run entity so that
+     * cross-run writers can seal payloads to this run without holding its
+     * symmetric key. Not secret — see `WorkflowRunBaseSchema`.
+     */
+    encryptionPublicKey: string$3().optional()
   })
 });
 const RunStartedEventSchema = BaseEventSchema.extend({
@@ -48207,7 +48214,14 @@ const RunStartedEventSchema = BaseEventSchema.extend({
     workflowName: string$3().optional(),
     executionContext: record(string$3(), any()).optional(),
     attributes: record(string$3(), string$3()).optional(),
-    allowReservedAttributes: literal(true).optional()
+    allowReservedAttributes: literal(true).optional(),
+    /**
+     * Mirrors `run_created.eventData.encryptionPublicKey`. Carried here for
+     * the resilient-start path: when the `run_created` write failed, the
+     * server creates the run from this event instead, and without the key
+     * the run would silently lose its ability to receive sealed writes.
+     */
+    encryptionPublicKey: string$3().optional()
   }).optional()
 });
 const RunCompletedEventSchema = BaseEventSchema.extend({
@@ -48375,6 +48389,26 @@ const WorkflowRunBaseSchema = object$1({
    * the attributes-mvp changelog entry.
    */
   attributes: record(string$3(), string$3()).default({}),
+  /**
+   * The run's X25519 public key, base64-encoded (~44 chars).
+   *
+   * Lets any party that can read this run seal a payload *to* it without
+   * being able to read the run's data — used for cross-run writes such as a
+   * hook resumption from another deployment, or a child workflow writing into
+   * a forwarded stream. The matching private scalar is never stored: it is
+   * re-derived on demand from the deployment's own key material, so this
+   * field is not secret and its presence does not weaken the run's
+   * confidentiality.
+   *
+   * Stamped at run creation by SDKs that support sealed (`encp`) envelopes.
+   * **Presence is the writer-side gate**: a run only carries a public key if
+   * the runtime that created it could also open sealed payloads, and runs are
+   * pinned to their creating deployment. Writers therefore seal iff this
+   * field is set, and otherwise fall back to fetching the symmetric per-run
+   * key. Absent on runs created by older SDKs, and on worlds that do not
+   * implement `getEncryptionKeyForRun` (encryption disabled).
+   */
+  encryptionPublicKey: string$3().optional(),
   expiredAt: date$2().optional(),
   startedAt: date$2().optional(),
   completedAt: date$2().optional(),
@@ -48609,22 +48643,8 @@ function envNumber(name2, fallback, options = {}) {
   }
   return parsed;
 }
-const HookSchema = object$1({
-  runId: string$3(),
-  hookId: string$3(),
-  token: string$3(),
-  ownerId: string$3(),
-  projectId: string$3(),
-  environment: string$3(),
-  metadata: SerializedDataSchema.optional(),
-  createdAt: date$2(),
-  // Optional in database for backwards compatibility, defaults to 1 (legacy) when reading
-  specVersion: number$3().optional(),
-  isWebhook: boolean$3().optional(),
-  isSystem: boolean$3().optional()
-});
-const QueuePrefix = string$3().regex(/^__(?:[a-z][a-z0-9]*_)?wkf_(?:workflow|step)_$/, "Must match __wkf_{workflow|step}_ or __{namespace}_wkf_{workflow|step}_");
-const ValidQueueName = string$3().regex(/^__(?:[a-z][a-z0-9]*_)?wkf_(?:workflow|step)_.+$/, "Must be a valid queue name with a recognized prefix");
+const QueuePrefix = string$3().regex(/^__(?:[a-z][a-z0-9]*_)?wkf_workflow_$/, "Must match __wkf_workflow_ or __{namespace}_wkf_workflow_");
+const ValidQueueName = string$3().regex(/^__(?:[a-z][a-z0-9]*_)?wkf_workflow_.+$/, "Must be a valid queue name with a recognized prefix");
 const QueueNamespace = string$3().regex(/^[a-z][a-z0-9]*$/, "Must be lowercase alphanumeric, starting with a letter");
 function resolveQueueNamespace(namespace2) {
   return namespace2 ?? process.env.WORKFLOW_QUEUE_NAMESPACE ?? void 0;
@@ -48632,19 +48652,18 @@ function resolveQueueNamespace(namespace2) {
 function getQueueTopicPrefix(kind, namespace2) {
   if (namespace2 !== void 0) {
     QueueNamespace.parse(namespace2);
-    return `__${namespace2}_wkf_${kind}_`;
+    return `__${namespace2}_wkf_workflow_`;
   }
-  return `__wkf_${kind}_`;
+  return "__wkf_workflow_";
 }
 function parseQueueName(name2) {
-  const match2 = name2.match(/^(__(?:[a-z][a-z0-9]*_)?wkf_(workflow|step)_)(.+)$/);
+  const match2 = name2.match(/^(__(?:[a-z][a-z0-9]*_)?wkf_workflow_)(.+)$/);
   if (!match2) {
     throw new Error(`Invalid queue name: ${name2}`);
   }
   return {
     prefix: QueuePrefix.parse(match2[1]),
-    kind: match2[2],
-    id: match2[3]
+    id: match2[2]
   };
 }
 const MessageId = string$3().brand().describe("A stored queue message ID");
@@ -48683,23 +48702,57 @@ const WorkflowInvokePayloadSchema = object$1({
   /** Run creation data, only present on the first queue delivery from start() */
   runInput: RunInputSchema.optional()
 });
-const StepInvokePayloadSchema = object$1({
-  workflowName: string$3(),
-  workflowRunId: string$3(),
-  workflowStartedAt: number$3(),
-  stepId: string$3(),
-  traceCarrier: TraceCarrierSchema.optional(),
-  requestedAt: date$2().optional()
-});
 const HealthCheckPayloadSchema = object$1({
   __healthCheck: literal(true),
-  correlationId: string$3()
+  correlationId: string$3(),
+  /**
+   * The run id the caller is about to create, when the probe is being used to
+   * prepare a cross-deployment `start()`.
+   *
+   * The responder runs inside the target deployment, so it can derive that
+   * run's public key locally from its own key material and return it in the
+   * probe response. That lets the caller seal the workflow arguments without
+   * a separate key lookup. Absent for probes issued for other reasons (CLI
+   * health command, dashboard), in which case no key is returned.
+   */
+  runId: string$3().optional()
 });
 const QueuePayloadSchema = union([
-  WorkflowInvokePayloadSchema,
-  StepInvokePayloadSchema,
-  HealthCheckPayloadSchema
+  HealthCheckPayloadSchema,
+  WorkflowInvokePayloadSchema
 ]);
+const HookResumeContextSchema = object$1({
+  deploymentId: string$3(),
+  workflowName: string$3(),
+  // Named `runSpecVersion` to distinguish it from the hook's own `specVersion`.
+  runSpecVersion: number$3().optional(),
+  workflowCoreVersion: string$3().optional(),
+  traceCarrier: TraceCarrierSchema.optional(),
+  // The run's published X25519 public key (base64), mirrored from the run
+  // entity. Lets a resume seal (`encp`) its payload to the run without reading
+  // the run or fetching its symmetric key. Absent on runs created before
+  // sealed envelopes and on projects with encryption disabled, where the
+  // resume falls back to the symmetric per-run key.
+  encryptionPublicKey: string$3().optional()
+});
+const HookSchema = object$1({
+  runId: string$3(),
+  hookId: string$3(),
+  token: string$3(),
+  ownerId: string$3(),
+  projectId: string$3(),
+  environment: string$3(),
+  metadata: SerializedDataSchema.optional(),
+  createdAt: date$2(),
+  // Optional in database for backwards compatibility, defaults to 1 (legacy) when reading
+  specVersion: number$3().optional(),
+  isWebhook: boolean$3().optional(),
+  isSystem: boolean$3().optional(),
+  // Present when the server stored it (new hooks) or synthesized it from the
+  // run (old hooks). Absent only against an old server, where the resume path
+  // falls back to `runs.get`.
+  resumeContext: HookResumeContextSchema.optional()
+});
 async function reenqueueActiveRuns(runs, enqueue, label, namespace2) {
   const workflowQueuePrefix = getQueueTopicPrefix("workflow", resolveQueueNamespace(namespace2));
   let reenqueued = 0;
@@ -49505,19 +49558,952 @@ function stringify_primitive(thing) {
   if (type === "bigint") return `["BigInt","${thing}"]`;
   return String(thing);
 }
+function pluralize(singular, plural, count2) {
+  return count2 === 1 ? singular : plural;
+}
+function withResolvers$1() {
+  let resolve2;
+  let reject;
+  const promise2 = new Promise((_resolve, _reject) => {
+    resolve2 = _resolve;
+    reject = _reject;
+  });
+  return { promise: promise2, resolve: resolve2, reject };
+}
+function once$1(fn2) {
+  const result = {
+    get value() {
+      const value = fn2();
+      Object.defineProperty(result, "value", { value });
+      return value;
+    }
+  };
+  return result;
+}
+var ms$1;
+var hasRequiredMs;
+function requireMs() {
+  if (hasRequiredMs) return ms$1;
+  hasRequiredMs = 1;
+  var s2 = 1e3;
+  var m2 = s2 * 60;
+  var h2 = m2 * 60;
+  var d2 = h2 * 24;
+  var w2 = d2 * 7;
+  var y2 = d2 * 365.25;
+  ms$1 = function(val, options) {
+    options = options || {};
+    var type = typeof val;
+    if (type === "string" && val.length > 0) {
+      return parse2(val);
+    } else if (type === "number" && isFinite(val)) {
+      return options.long ? fmtLong(val) : fmtShort(val);
+    }
+    throw new Error(
+      "val is not a non-empty string or a valid number. val=" + JSON.stringify(val)
+    );
+  };
+  function parse2(str) {
+    str = String(str);
+    if (str.length > 100) {
+      return;
+    }
+    var match2 = /^(-?(?:\d+)?\.?\d+) *(milliseconds?|msecs?|ms|seconds?|secs?|s|minutes?|mins?|m|hours?|hrs?|h|days?|d|weeks?|w|years?|yrs?|y)?$/i.exec(
+      str
+    );
+    if (!match2) {
+      return;
+    }
+    var n = parseFloat(match2[1]);
+    var type = (match2[2] || "ms").toLowerCase();
+    switch (type) {
+      case "years":
+      case "year":
+      case "yrs":
+      case "yr":
+      case "y":
+        return n * y2;
+      case "weeks":
+      case "week":
+      case "w":
+        return n * w2;
+      case "days":
+      case "day":
+      case "d":
+        return n * d2;
+      case "hours":
+      case "hour":
+      case "hrs":
+      case "hr":
+      case "h":
+        return n * h2;
+      case "minutes":
+      case "minute":
+      case "mins":
+      case "min":
+      case "m":
+        return n * m2;
+      case "seconds":
+      case "second":
+      case "secs":
+      case "sec":
+      case "s":
+        return n * s2;
+      case "milliseconds":
+      case "millisecond":
+      case "msecs":
+      case "msec":
+      case "ms":
+        return n;
+      default:
+        return void 0;
+    }
+  }
+  function fmtShort(ms2) {
+    var msAbs = Math.abs(ms2);
+    if (msAbs >= d2) {
+      return Math.round(ms2 / d2) + "d";
+    }
+    if (msAbs >= h2) {
+      return Math.round(ms2 / h2) + "h";
+    }
+    if (msAbs >= m2) {
+      return Math.round(ms2 / m2) + "m";
+    }
+    if (msAbs >= s2) {
+      return Math.round(ms2 / s2) + "s";
+    }
+    return ms2 + "ms";
+  }
+  function fmtLong(ms2) {
+    var msAbs = Math.abs(ms2);
+    if (msAbs >= d2) {
+      return plural(ms2, msAbs, d2, "day");
+    }
+    if (msAbs >= h2) {
+      return plural(ms2, msAbs, h2, "hour");
+    }
+    if (msAbs >= m2) {
+      return plural(ms2, msAbs, m2, "minute");
+    }
+    if (msAbs >= s2) {
+      return plural(ms2, msAbs, s2, "second");
+    }
+    return ms2 + " ms";
+  }
+  function plural(ms2, msAbs, n, name2) {
+    var isPlural = msAbs >= n * 1.5;
+    return Math.round(ms2 / n) + " " + name2 + (isPlural ? "s" : "");
+  }
+  return ms$1;
+}
+var msExports = requireMs();
+const ms = /* @__PURE__ */ getDefaultExportFromCjs(msExports);
+function parseDurationToDate(param) {
+  if (typeof param === "string") {
+    const durationMs = ms(param);
+    if (typeof durationMs !== "number" || durationMs < 0) {
+      throw new Error(`Invalid duration: "${param}". Expected a valid duration string like "1s", "1m", "1h", etc.`);
+    }
+    return new Date(Date.now() + durationMs);
+  } else if (typeof param === "number") {
+    if (param < 0 || !Number.isFinite(param)) {
+      throw new Error(`Invalid duration: ${param}. Expected a non-negative finite number of milliseconds.`);
+    }
+    return new Date(Date.now() + param);
+  } else if (param instanceof Date || param && typeof param === "object" && typeof param.getTime === "function") {
+    return param instanceof Date ? param : new Date(param.getTime());
+  } else {
+    throw new Error(`Invalid duration parameter. Expected a duration string, number (milliseconds), or Date object.`);
+  }
+}
+const WORKFLOW_ROUTE_BASE = "/.well-known/workflow/v1";
+const BASE_PATH_SYMBOL = Symbol.for("@workflow/core/basePath");
+const globalConfig = globalThis;
+function getWorkflowBasePath() {
+  return globalConfig[BASE_PATH_SYMBOL] ?? "";
+}
+function createWorkflowBaseUrl(origin) {
+  new URL(origin);
+  return `${origin.replace(/[?#].*$/, "").replace(/\/+$/, "")}${getWorkflowBasePath()}`;
+}
+function createWorkflowUrl(baseUrl, route) {
+  const url2 = new URL(baseUrl);
+  url2.pathname = `${url2.pathname.replace(/\/+$/, "")}${WORKFLOW_ROUTE_BASE}/${getWorkflowRouteEndpoint(route)}`;
+  url2.search = route.type === "health" ? "__health" : "";
+  url2.hash = "";
+  return url2.toString();
+}
+function getWorkflowRouteEndpoint(route) {
+  switch (route.type) {
+    case "flow":
+    case "health":
+      return "flow";
+    case "manifest":
+      return "manifest.json";
+    case "webhook":
+      return `webhook/${encodeURIComponent(route.token)}`;
+  }
+  throw new Error(`Unsupported workflow route: ${String(route.type)}`);
+}
+function createWorkflowHealthEndpoint() {
+  return `${getWorkflowBasePath()}${WORKFLOW_ROUTE_BASE}/flow?__health`;
+}
+function isVercelDeploymentEnv(env2 = process.env) {
+  if (env2.VERCEL_DEPLOYMENT_ID) {
+    return true;
+  }
+  if (env2.VERCEL !== "1") {
+    return false;
+  }
+  return env2.VERCEL_ENV !== "development" && env2.NODE_ENV !== "development";
+}
+const BASE_URL = "https://workflow-sdk.dev/err";
+function isError(value) {
+  return typeof value === "object" && value !== null && "name" in value && "message" in value;
+}
+function appendFramedDetails(title, details) {
+  if (details.length === 0)
+    return title;
+  const lines = [title];
+  details.forEach((detail, index2) => {
+    const isLast = index2 === details.length - 1;
+    const head = isLast ? "╰▶ " : "├▶ ";
+    const cont = isLast ? "   " : "│  ";
+    const text2 = `${detail.label}: ${detail.value}`;
+    text2.split("\n").forEach((line, i) => lines.push(`${i === 0 ? head : cont}${line}`));
+  });
+  return lines.join("\n");
+}
+function buildFramedDetails(hint2, slug) {
+  const out = [];
+  if (hint2)
+    out.push({ label: "hint", value: hint2 });
+  if (slug)
+    out.push({ label: "docs", value: `${BASE_URL}/${slug}` });
+  return out;
+}
+const ERROR_SLUGS = {
+  WEBHOOK_INVALID_RESPOND_WITH_VALUE: "webhook-invalid-respond-with-value",
+  WEBHOOK_RESPONSE_NOT_SENT: "webhook-response-not-sent",
+  HOOK_CONFLICT: "hook-conflict",
+  RUNTIME_DECRYPTION_FAILED: "runtime-decryption-failed"
+};
+class WorkflowError extends Error {
+  constructor(message2, options) {
+    const msgDocs = appendFramedDetails(message2, buildFramedDetails(void 0, options == null ? void 0 : options.slug));
+    super(msgDocs, { cause: options == null ? void 0 : options.cause });
+    __publicField(this, "cause");
+    if ((options == null ? void 0 : options.cause) !== void 0) {
+      this.cause = options.cause;
+    }
+    if ((options == null ? void 0 : options.cause) instanceof Error) {
+      this.stack = `${this.stack}
+Caused by: ${options.cause.stack}`;
+    }
+  }
+  static is(value) {
+    return isError(value) && value.name === "WorkflowError";
+  }
+}
+class WorkflowWorldError extends WorkflowError {
+  constructor(message2, options) {
+    super(message2, {
+      cause: options == null ? void 0 : options.cause
+    });
+    __publicField(this, "status");
+    __publicField(this, "code");
+    __publicField(this, "url");
+    /** Retry-After value in seconds, present on 429 and 425 responses */
+    __publicField(this, "retryAfter");
+    this.name = "WorkflowWorldError";
+    this.status = options == null ? void 0 : options.status;
+    this.code = options == null ? void 0 : options.code;
+    this.url = options == null ? void 0 : options.url;
+    this.retryAfter = options == null ? void 0 : options.retryAfter;
+  }
+  static is(value) {
+    return isError(value) && value.name === "WorkflowWorldError";
+  }
+}
+class WorkflowRunFailedError extends WorkflowError {
+  constructor(runId, error2, options = {}) {
+    const message2 = error2 instanceof Error ? error2.message : typeof error2 === "string" ? error2 : error2 && typeof error2 === "object" && "message" in error2 ? String(error2.message) : "Unknown error";
+    super(`Workflow run "${runId}" failed: ${message2}`, {
+      cause: error2
+    });
+    __publicField(this, "runId");
+    /**
+     * The high-level error category (e.g. USER_ERROR, RUNTIME_ERROR) for the
+     * failed run, from the run_failed event's `errorCode` field.
+     */
+    __publicField(this, "errorCode");
+    this.name = "WorkflowRunFailedError";
+    this.runId = runId;
+    if (options.errorCode !== void 0) {
+      this.errorCode = options.errorCode;
+    }
+  }
+  static is(value) {
+    return isError(value) && value.name === "WorkflowRunFailedError";
+  }
+}
+class WorkflowRunNotCompletedError extends WorkflowError {
+  constructor(runId, status) {
+    super(`Workflow run "${runId}" has not completed`, {});
+    __publicField(this, "runId");
+    __publicField(this, "status");
+    this.name = "WorkflowRunNotCompletedError";
+    this.runId = runId;
+    this.status = status;
+  }
+  static is(value) {
+    return isError(value) && value.name === "WorkflowRunNotCompletedError";
+  }
+}
+class WorkflowRuntimeError extends WorkflowError {
+  constructor(message2, options) {
+    super(message2, {
+      ...options
+    });
+    this.name = "WorkflowRuntimeError";
+  }
+  static is(value) {
+    return isError(value) && value.name === "WorkflowRuntimeError";
+  }
+}
+class RuntimeDecryptionError extends WorkflowRuntimeError {
+  constructor(message2, options) {
+    super(message2, {
+      cause: options == null ? void 0 : options.cause,
+      slug: ERROR_SLUGS.RUNTIME_DECRYPTION_FAILED
+    });
+    this.name = "RuntimeDecryptionError";
+    if ((options == null ? void 0 : options.context) !== void 0) {
+      this.context = options.context;
+    }
+  }
+  static is(value) {
+    return isError(value) && value.name === "RuntimeDecryptionError";
+  }
+}
+class SerializationError extends WorkflowError {
+  constructor(message2, options) {
+    const body2 = appendFramedDetails(message2, buildFramedDetails(options == null ? void 0 : options.hint, void 0));
+    super(body2, { cause: options == null ? void 0 : options.cause });
+    __publicField(this, "hint");
+    /**
+     * Serialization errors are deterministic — if a step returns a non-POJO,
+     * replaying the step will always produce the same non-serializable value.
+     * Retrying is guaranteed to fail, so these errors are surfaced as fatal
+     * and skip the step-retry loop. `FatalError.is()` recognizes any error
+     * with `fatal: true` (see `packages/errors/src/index.ts`), so no other
+     * wiring is required for user-thrown SerializationErrors.
+     */
+    __publicField(this, "fatal", true);
+    this.name = "SerializationError";
+    this.hint = options == null ? void 0 : options.hint;
+  }
+  static is(value) {
+    return isError(value) && value.name === "SerializationError";
+  }
+}
+class WorkflowRunNotFoundError extends WorkflowError {
+  constructor(runId) {
+    super(`Workflow run "${runId}" not found`, {});
+    __publicField(this, "runId");
+    this.name = "WorkflowRunNotFoundError";
+    this.runId = runId;
+  }
+  static is(value) {
+    return isError(value) && value.name === "WorkflowRunNotFoundError";
+  }
+}
+class HookConflictError extends WorkflowError {
+  constructor(token, conflictingRunId) {
+    super(`Hook token "${token}" is already in use by another workflow${conflictingRunId ? ` (run "${conflictingRunId}")` : ""}`, {
+      slug: ERROR_SLUGS.HOOK_CONFLICT
+    });
+    __publicField(this, "token");
+    // TODO: Make this required once all persisted hook_conflict events and World
+    // implementations always include the active hook owner's run ID.
+    __publicField(this, "conflictingRunId");
+    this.name = "HookConflictError";
+    this.token = token;
+    if (conflictingRunId !== void 0) {
+      this.conflictingRunId = conflictingRunId;
+    }
+  }
+  static is(value) {
+    return isError(value) && value.name === "HookConflictError";
+  }
+}
+class HookNotFoundError extends WorkflowError {
+  constructor(token) {
+    super("Hook not found", {});
+    __publicField(this, "token");
+    this.name = "HookNotFoundError";
+    this.token = token;
+  }
+  static is(value) {
+    return isError(value) && value.name === "HookNotFoundError";
+  }
+}
+class EntityConflictError extends WorkflowWorldError {
+  constructor(message2) {
+    super(message2);
+    this.name = "EntityConflictError";
+  }
+  static is(value) {
+    return isError(value) && value.name === "EntityConflictError";
+  }
+}
+class RunExpiredError extends WorkflowWorldError {
+  constructor(message2) {
+    super(message2);
+    this.name = "RunExpiredError";
+  }
+  static is(value) {
+    return isError(value) && value.name === "RunExpiredError";
+  }
+}
+class TooEarlyError extends WorkflowWorldError {
+  constructor(message2, options) {
+    super(message2, { retryAfter: options == null ? void 0 : options.retryAfter });
+    this.name = "TooEarlyError";
+  }
+  static is(value) {
+    return isError(value) && value.name === "TooEarlyError";
+  }
+}
+class ThrottleError extends WorkflowWorldError {
+  constructor(message2, options) {
+    super(message2);
+    __publicField(this, "retryAfter");
+    this.name = "ThrottleError";
+    this.retryAfter = options == null ? void 0 : options.retryAfter;
+  }
+  static is(value) {
+    return isError(value) && value.name === "ThrottleError";
+  }
+}
+class PreconditionFailedError extends WorkflowWorldError {
+  constructor(message2, options) {
+    super(message2, { status: 412, retryAfter: options == null ? void 0 : options.retryAfter });
+    this.name = "PreconditionFailedError";
+  }
+  static is(value) {
+    return isError(value) && value.name === "PreconditionFailedError";
+  }
+}
+class WorkflowRunCancelledError extends WorkflowError {
+  constructor(runId) {
+    super(`Workflow run "${runId}" cancelled`, {});
+    __publicField(this, "runId");
+    this.name = "WorkflowRunCancelledError";
+    this.runId = runId;
+  }
+  static is(value) {
+    return isError(value) && value.name === "WorkflowRunCancelledError";
+  }
+}
+class RunNotSupportedError extends WorkflowError {
+  constructor(runSpecVersion, worldSpecVersion) {
+    super(`Run requires spec version ${runSpecVersion}, but world supports version ${worldSpecVersion}. Please upgrade 'workflow' package.`);
+    __publicField(this, "runSpecVersion");
+    __publicField(this, "worldSpecVersion");
+    this.name = "RunNotSupportedError";
+    this.runSpecVersion = runSpecVersion;
+    this.worldSpecVersion = worldSpecVersion;
+  }
+  static is(value) {
+    return isError(value) && value.name === "RunNotSupportedError";
+  }
+}
+class FatalError extends Error {
+  constructor(message2) {
+    super(message2);
+    __publicField(this, "fatal", true);
+    this.name = "FatalError";
+  }
+  static is(value) {
+    if (!isError(value))
+      return false;
+    if (value.name === "FatalError")
+      return true;
+    return value.fatal === true;
+  }
+}
+class RetryableError extends Error {
+  constructor(message2, options = {}) {
+    super(message2);
+    /**
+     * The Date when the step should be retried.
+     */
+    __publicField(this, "retryAfter");
+    this.name = "RetryableError";
+    if (options.retryAfter !== void 0) {
+      this.retryAfter = parseDurationToDate(options.retryAfter);
+    } else {
+      this.retryAfter = new Date(Date.now() + 1e3);
+    }
+  }
+  static is(value) {
+    return isError(value) && value.name === "RetryableError";
+  }
+}
+const VERCEL_403_ERROR_MESSAGE = "Your current vercel account does not have access to this resource. Use `vercel login` or `vercel switch` to ensure you are linked to the right account.";
+const FATAL_ERROR_KEY = Symbol.for("@workflow/errors//FatalError");
+const RETRYABLE_ERROR_KEY = Symbol.for("@workflow/errors//RetryableError");
+const HOOK_CONFLICT_ERROR_KEY = Symbol.for("@workflow/errors//HookConflictError");
+const RUNTIME_DECRYPTION_ERROR_KEY = Symbol.for("@workflow/errors//RuntimeDecryptionError");
+if (typeof globalThis !== "undefined") {
+  if (!Object.hasOwn(globalThis, FATAL_ERROR_KEY)) {
+    Object.defineProperty(globalThis, FATAL_ERROR_KEY, {
+      value: FatalError,
+      writable: false,
+      enumerable: false,
+      configurable: false
+    });
+  }
+  if (!Object.hasOwn(globalThis, RETRYABLE_ERROR_KEY)) {
+    Object.defineProperty(globalThis, RETRYABLE_ERROR_KEY, {
+      value: RetryableError,
+      writable: false,
+      enumerable: false,
+      configurable: false
+    });
+  }
+  if (!Object.hasOwn(globalThis, HOOK_CONFLICT_ERROR_KEY)) {
+    Object.defineProperty(globalThis, HOOK_CONFLICT_ERROR_KEY, {
+      value: HookConflictError,
+      writable: false,
+      enumerable: false,
+      configurable: false
+    });
+  }
+  if (!Object.hasOwn(globalThis, RUNTIME_DECRYPTION_ERROR_KEY)) {
+    Object.defineProperty(globalThis, RUNTIME_DECRYPTION_ERROR_KEY, {
+      value: RuntimeDecryptionError,
+      writable: false,
+      enumerable: false,
+      configurable: false
+    });
+  }
+}
+const NONCE_LENGTH = 12;
+const TAG_LENGTH = 128;
+const TAG_BYTES = TAG_LENGTH / 8;
+const KEY_LENGTH = 32;
+async function importKey(raw2, usages = ["encrypt", "decrypt"]) {
+  if (raw2.byteLength !== KEY_LENGTH) {
+    throw new WorkflowRuntimeError(`Encryption key must be exactly ${KEY_LENGTH} bytes, got ${raw2.byteLength}`);
+  }
+  return globalThis.crypto.subtle.importKey(
+    "raw",
+    raw2,
+    "AES-GCM",
+    false,
+    // `KeyUsage` is a DOM-lib type that's not in scope under `es2022`.
+    // The `ReadonlyArray<'encrypt' | 'decrypt'>` parameter type matches
+    // a strict subset of `KeyUsage[]`, so this cast is sound.
+    usages
+  );
+}
+async function encrypt$1(key, data, aad) {
+  const nonce = globalThis.crypto.getRandomValues(new Uint8Array(NONCE_LENGTH));
+  let ciphertext;
+  try {
+    ciphertext = await globalThis.crypto.subtle.encrypt({
+      name: "AES-GCM",
+      iv: nonce,
+      tagLength: TAG_LENGTH,
+      ...aad ? { additionalData: aad } : {}
+    }, key, data);
+  } catch (cause) {
+    throw new RuntimeDecryptionError(`AES-256-GCM encryption failed: ${cause instanceof Error ? cause.message : String(cause)}`, {
+      cause,
+      context: {
+        operation: "encrypt",
+        byteLength: data.byteLength
+      }
+    });
+  }
+  const result = new Uint8Array(NONCE_LENGTH + ciphertext.byteLength);
+  result.set(nonce, 0);
+  result.set(new Uint8Array(ciphertext), NONCE_LENGTH);
+  return result;
+}
+async function decrypt$1(key, data, aad) {
+  const minLength = NONCE_LENGTH + TAG_LENGTH / 8;
+  if (data.byteLength < minLength) {
+    throw new RuntimeDecryptionError(`Encrypted data too short: expected at least ${minLength} bytes, got ${data.byteLength}`, {
+      context: {
+        operation: "decrypt",
+        byteLength: data.byteLength
+      }
+    });
+  }
+  const nonce = data.subarray(0, NONCE_LENGTH);
+  const ciphertext = data.subarray(NONCE_LENGTH);
+  let plaintext;
+  try {
+    plaintext = await globalThis.crypto.subtle.decrypt({
+      name: "AES-GCM",
+      iv: nonce,
+      tagLength: TAG_LENGTH,
+      ...aad ? { additionalData: aad } : {}
+    }, key, ciphertext);
+  } catch (cause) {
+    const causeMsg = cause instanceof Error ? cause.message : String(cause);
+    throw new RuntimeDecryptionError(`AES-256-GCM decryption failed: ${causeMsg}`, {
+      cause,
+      context: {
+        operation: "decrypt",
+        byteLength: data.byteLength
+      }
+    });
+  }
+  return new Uint8Array(plaintext);
+}
+const X25519_KEY_LENGTH = 32;
+const CONTENT_KEY_LENGTH = 32;
+const SCALAR_INFO = "workflow/encp/x25519/v1";
+const CONTENT_KEY_INFO = "workflow/encp/aes256gcm/v1";
+const PKCS8_X25519_PREFIX = new Uint8Array([
+  48,
+  46,
+  2,
+  1,
+  0,
+  48,
+  5,
+  6,
+  3,
+  43,
+  101,
+  110,
+  4,
+  34,
+  4,
+  32
+]);
+const infoEncoder = new TextEncoder();
+function assertKeyMaterialLength(runKeyMaterial) {
+  if (runKeyMaterial.byteLength !== CONTENT_KEY_LENGTH) {
+    throw new WorkflowRuntimeError(`Run key material must be exactly ${CONTENT_KEY_LENGTH} bytes, got ${runKeyMaterial.byteLength}`);
+  }
+}
+function assertPublicKeyLength(publicKey, label) {
+  if (publicKey.byteLength !== X25519_KEY_LENGTH) {
+    throw new WorkflowRuntimeError(`${label} must be exactly ${X25519_KEY_LENGTH} bytes, got ${publicKey.byteLength}`);
+  }
+}
+async function deriveRunKeyPair(runKeyMaterial) {
+  assertKeyMaterialLength(runKeyMaterial);
+  const hkdfKey = await globalThis.crypto.subtle.importKey("raw", runKeyMaterial, "HKDF", false, ["deriveBits"]);
+  const scalarBits = await globalThis.crypto.subtle.deriveBits({
+    name: "HKDF",
+    hash: "SHA-256",
+    salt: new Uint8Array(32),
+    info: infoEncoder.encode(SCALAR_INFO)
+  }, hkdfKey, X25519_KEY_LENGTH * 8);
+  const scalar = new Uint8Array(scalarBits);
+  const publicKey = await derivePublicKeyFromScalar(scalar);
+  return { scalar, publicKey };
+}
+async function derivePublicKeyFromScalar(scalar) {
+  const privateKey = await importScalar(
+    scalar,
+    /* extractable */
+    true
+  );
+  const jwk = await globalThis.crypto.subtle.exportKey("jwk", privateKey);
+  if (!jwk.x) {
+    throw new WorkflowRuntimeError('X25519 JWK export did not include a public key component ("x")');
+  }
+  const publicKey = base64UrlToBytes(jwk.x);
+  if (publicKey.byteLength !== X25519_KEY_LENGTH) {
+    throw new WorkflowRuntimeError(`X25519 JWK export produced a ${publicKey.byteLength}-byte public key, expected ${X25519_KEY_LENGTH}`);
+  }
+  return publicKey;
+}
+async function importScalar(scalar, extractable) {
+  const pkcs8 = new Uint8Array(PKCS8_X25519_PREFIX.length + scalar.byteLength);
+  pkcs8.set(PKCS8_X25519_PREFIX, 0);
+  pkcs8.set(scalar, PKCS8_X25519_PREFIX.length);
+  return globalThis.crypto.subtle.importKey("pkcs8", pkcs8, { name: "X25519" }, extractable, ["deriveBits"]);
+}
+function importPublicKey(publicKey) {
+  return globalThis.crypto.subtle.importKey(
+    "raw",
+    publicKey,
+    { name: "X25519" },
+    /* extractable */
+    true,
+    // Public keys carry no usages for X25519 — the private key does the
+    // deriving; the public key is only ever an argument to it.
+    []
+  );
+}
+const BASE64_CHARS$1 = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
+const BASE64URL_CHARS = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_";
+function bytesToBase64(bytes) {
+  let out = "";
+  for (let i = 0; i < bytes.length; i += 3) {
+    const b0 = bytes[i];
+    const b1 = i + 1 < bytes.length ? bytes[i + 1] : 0;
+    const b2 = i + 2 < bytes.length ? bytes[i + 2] : 0;
+    out += BASE64_CHARS$1[b0 >> 2 & 63];
+    out += BASE64_CHARS$1[(b0 & 3) << 4 | b1 >> 4 & 15];
+    out += i + 1 < bytes.length ? BASE64_CHARS$1[(b1 & 15) << 2 | b2 >> 6 & 3] : "=";
+    out += i + 2 < bytes.length ? BASE64_CHARS$1[b2 & 63] : "=";
+  }
+  return out;
+}
+function base64ToBytes(value) {
+  let end = value.length;
+  while (end > 0 && value[end - 1] === "=")
+    end--;
+  const body2 = value.slice(0, end);
+  if (body2.includes("="))
+    return void 0;
+  if (body2.length % 4 === 1)
+    return void 0;
+  if (end !== value.length && value.length % 4 !== 0)
+    return void 0;
+  let accumulator = 0;
+  let bitCount = 0;
+  const bytes = [];
+  for (let i = 0; i < body2.length; i++) {
+    const index2 = BASE64_CHARS$1.indexOf(body2[i]);
+    if (index2 === -1)
+      return void 0;
+    accumulator = accumulator << 6 | index2;
+    bitCount += 6;
+    if (bitCount >= 8) {
+      bitCount -= 8;
+      bytes.push(accumulator >> bitCount & 255);
+    }
+  }
+  if (bitCount > 0 && (accumulator & (1 << bitCount) - 1) !== 0) {
+    return void 0;
+  }
+  return new Uint8Array(bytes);
+}
+function base64UrlToBytes(value) {
+  let accumulator = 0;
+  let bitCount = 0;
+  const bytes = [];
+  for (let i = 0; i < value.length; i++) {
+    const char = value[i];
+    if (char === "=")
+      break;
+    const index2 = BASE64URL_CHARS.indexOf(char);
+    if (index2 === -1) {
+      throw new WorkflowRuntimeError(`Invalid base64url character "${char}" in X25519 JWK key component`);
+    }
+    accumulator = accumulator << 6 | index2;
+    bitCount += 6;
+    if (bitCount >= 8) {
+      bitCount -= 8;
+      bytes.push(accumulator >> bitCount & 255);
+    }
+  }
+  return new Uint8Array(bytes);
+}
+async function deriveContentKey(sharedSecret, ephemeralPublicKey, recipientPublicKey, usages) {
+  const label = infoEncoder.encode(CONTENT_KEY_INFO);
+  const info = new Uint8Array(label.length + ephemeralPublicKey.length + recipientPublicKey.length);
+  info.set(label, 0);
+  info.set(ephemeralPublicKey, label.length);
+  info.set(recipientPublicKey, label.length + ephemeralPublicKey.length);
+  const hkdfKey = await globalThis.crypto.subtle.importKey("raw", sharedSecret, "HKDF", false, ["deriveBits"]);
+  const contentKeyBits = await globalThis.crypto.subtle.deriveBits({ name: "HKDF", hash: "SHA-256", salt: new Uint8Array(32), info }, hkdfKey, CONTENT_KEY_LENGTH * 8);
+  return globalThis.crypto.subtle.importKey(
+    "raw",
+    new Uint8Array(contentKeyBits),
+    "AES-GCM",
+    false,
+    // `KeyUsage` is a DOM-lib type that is not in scope under `es2022`; the
+    // parameter type is a strict subset of it, so this cast is sound.
+    usages
+  );
+}
+async function encapsulate(recipientPublicKey) {
+  assertPublicKeyLength(recipientPublicKey, "Recipient public key");
+  let recipientKey;
+  try {
+    recipientKey = await importPublicKey(recipientPublicKey);
+  } catch (cause) {
+    throw new WorkflowRuntimeError(`Invalid X25519 recipient public key: ${cause instanceof Error ? cause.message : String(cause)}`, { cause });
+  }
+  const ephemeral = await globalThis.crypto.subtle.generateKey(
+    { name: "X25519" },
+    /* extractable */
+    true,
+    ["deriveBits"]
+  );
+  const ephemeralPublicKey = new Uint8Array(await globalThis.crypto.subtle.exportKey("raw", ephemeral.publicKey));
+  let sharedSecretBits;
+  try {
+    sharedSecretBits = await globalThis.crypto.subtle.deriveBits({ name: "X25519", public: recipientKey }, ephemeral.privateKey, X25519_KEY_LENGTH * 8);
+  } catch (cause) {
+    throw new WorkflowRuntimeError("X25519 key agreement failed: the recipient public key is not a valid curve point (low-order point or corrupted key material)", { cause });
+  }
+  const contentKey = await deriveContentKey(new Uint8Array(sharedSecretBits), ephemeralPublicKey, recipientPublicKey, ["encrypt"]);
+  return { ephemeralPublicKey, contentKey };
+}
+async function decapsulate(keyPair, ephemeralPublicKey) {
+  if (ephemeralPublicKey.byteLength !== X25519_KEY_LENGTH) {
+    throw new RuntimeDecryptionError(`Sealed payload has a malformed ephemeral public key: expected ${X25519_KEY_LENGTH} bytes, got ${ephemeralPublicKey.byteLength}`, {
+      context: {
+        operation: "decrypt",
+        byteLength: ephemeralPublicKey.byteLength
+      }
+    });
+  }
+  let sharedSecretBits;
+  try {
+    const [privateKey, senderKey] = await Promise.all([
+      importScalar(
+        keyPair.scalar,
+        /* extractable */
+        false
+      ),
+      importPublicKey(ephemeralPublicKey)
+    ]);
+    sharedSecretBits = await globalThis.crypto.subtle.deriveBits({ name: "X25519", public: senderKey }, privateKey, X25519_KEY_LENGTH * 8);
+  } catch (cause) {
+    throw new RuntimeDecryptionError(`X25519 key agreement failed while opening a sealed payload: ${cause instanceof Error ? cause.message : String(cause)}`, {
+      cause,
+      context: {
+        operation: "decrypt",
+        byteLength: ephemeralPublicKey.byteLength
+      }
+    });
+  }
+  return deriveContentKey(new Uint8Array(sharedSecretBits), ephemeralPublicKey, keyPair.publicKey, ["decrypt"]);
+}
+async function seal(recipientPublicKey, data, aad) {
+  const { ephemeralPublicKey, contentKey } = await encapsulate(recipientPublicKey);
+  const encrypted = await encrypt$1(contentKey, data, aad);
+  const result = new Uint8Array(ephemeralPublicKey.byteLength + encrypted.byteLength);
+  result.set(ephemeralPublicKey, 0);
+  result.set(encrypted, ephemeralPublicKey.byteLength);
+  return result;
+}
+async function open(keyPair, sealed, aad) {
+  const minLength = X25519_KEY_LENGTH + NONCE_LENGTH + TAG_BYTES;
+  if (sealed.byteLength < minLength) {
+    throw new RuntimeDecryptionError(`Sealed payload too short: expected at least ${minLength} bytes, got ${sealed.byteLength}`, { context: { operation: "decrypt", byteLength: sealed.byteLength } });
+  }
+  const ephemeralPublicKey = sealed.subarray(0, X25519_KEY_LENGTH);
+  const encrypted = sealed.subarray(X25519_KEY_LENGTH);
+  const contentKey = await decapsulate(keyPair, ephemeralPublicKey);
+  return decrypt$1(contentKey, encrypted, aad);
+}
+function createSealSession(recipientPublicKey, aad) {
+  let encapsulation;
+  return {
+    async seal(data) {
+      encapsulation ?? (encapsulation = encapsulate(recipientPublicKey));
+      const { ephemeralPublicKey, contentKey } = await encapsulation;
+      const encrypted = await encrypt$1(contentKey, data, aad);
+      const result = new Uint8Array(ephemeralPublicKey.byteLength + encrypted.byteLength);
+      result.set(ephemeralPublicKey, 0);
+      result.set(encrypted, ephemeralPublicKey.byteLength);
+      return result;
+    }
+  };
+}
+function createOpenSession(keyPair, aad) {
+  let cachedSender;
+  let cachedKey;
+  return {
+    async open(sealed) {
+      const minLength = X25519_KEY_LENGTH + NONCE_LENGTH + TAG_BYTES;
+      if (sealed.byteLength < minLength) {
+        throw new RuntimeDecryptionError(`Sealed payload too short: expected at least ${minLength} bytes, got ${sealed.byteLength}`, { context: { operation: "decrypt", byteLength: sealed.byteLength } });
+      }
+      const ephemeralPublicKey = sealed.subarray(0, X25519_KEY_LENGTH);
+      const encrypted = sealed.subarray(X25519_KEY_LENGTH);
+      const sender2 = keyCacheId(ephemeralPublicKey);
+      if (sender2 !== cachedSender || !cachedKey) {
+        cachedSender = sender2;
+        cachedKey = decapsulate(keyPair, ephemeralPublicKey);
+      }
+      let contentKey;
+      try {
+        contentKey = await cachedKey;
+      } catch (error2) {
+        cachedSender = void 0;
+        cachedKey = void 0;
+        throw error2;
+      }
+      return decrypt$1(contentKey, encrypted, aad);
+    }
+  };
+}
+function keyCacheId(publicKey) {
+  let id2 = "";
+  for (let i = 0; i < publicKey.length; i++) {
+    id2 += publicKey[i].toString(16).padStart(2, "0");
+  }
+  return id2;
+}
+function decodeRunPublicKey(value) {
+  if (!value)
+    return void 0;
+  const bytes = base64ToBytes(value);
+  if (!bytes || bytes.byteLength !== X25519_KEY_LENGTH)
+    return void 0;
+  return bytes;
+}
+function isFormatPrefix(value) {
+  return value.length === 4 && /^[a-z0-9]{4}$/.test(value);
+}
 const SerializationFormat$1 = {
   /** devalue stringify/parse with TextEncoder/TextDecoder */
   DEVALUE_V1: "devl",
-  /** Encrypted payload (inner payload has its own format prefix after decryption) */
+  /** Encrypted payload (inner payload has its own format prefix) */
   ENCRYPTED: "encr",
-  /** Gzip-compressed payload (inner payload has its own format prefix after decompression) */
+  /**
+   * Sealed payload — asymmetrically encrypted to a run's X25519 public key
+   * (inner payload has its own format prefix).
+   *
+   * Used for *cross-run* writes (hook payloads, forwarded stream frames),
+   * where the writer holds only the recipient run's public key and therefore
+   * cannot decrypt. A run's own payloads continue to use {@link ENCRYPTED}.
+   * See `sealed-box.ts` for the construction.
+   */
+  SEALED: "encp",
+  /** Gzip-compressed payload (inner payload has its own format prefix) */
   GZIP: "gzip",
-  /** Zstandard-compressed payload (inner payload has its own format prefix after decompression) */
+  /** Zstandard-compressed payload (inner payload has its own format prefix) */
   ZSTD: "zstd"
 };
 const FORMAT_PREFIX_LENGTH$2 = 4;
-new TextEncoder();
+const formatEncoder = new TextEncoder();
 const formatDecoder$2 = new TextDecoder();
+function encodeWithFormatPrefix(format2, payload) {
+  if (!(payload instanceof Uint8Array)) {
+    return payload;
+  }
+  const prefixBytes = formatEncoder.encode(format2);
+  const result = new Uint8Array(FORMAT_PREFIX_LENGTH$2 + payload.length);
+  result.set(prefixBytes, 0);
+  result.set(payload, FORMAT_PREFIX_LENGTH$2);
+  return result;
+}
+function peekFormatPrefix$1(data) {
+  if (!(data instanceof Uint8Array) || data.length < FORMAT_PREFIX_LENGTH$2) {
+    return null;
+  }
+  const prefixBytes = data.subarray(0, FORMAT_PREFIX_LENGTH$2);
+  const str = formatDecoder$2.decode(prefixBytes);
+  return isFormatPrefix(str) ? str : null;
+}
 function decodeFormatPrefix$1(data) {
   if (!(data instanceof Uint8Array)) {
     return {
@@ -49529,12 +50515,159 @@ function decodeFormatPrefix$1(data) {
     throw new Error(`Data too short to contain format prefix: expected at least ${FORMAT_PREFIX_LENGTH$2} bytes, got ${data.length}`);
   }
   const prefixBytes = data.subarray(0, FORMAT_PREFIX_LENGTH$2);
-  const format2 = formatDecoder$2.decode(prefixBytes);
-  const knownFormats = Object.values(SerializationFormat$1);
+  const str = formatDecoder$2.decode(prefixBytes);
+  if (!isFormatPrefix(str)) {
+    throw new Error(`Invalid format prefix: "${str}". Must be 4 characters of [a-z0-9].`);
+  }
+  const payload = data.subarray(FORMAT_PREFIX_LENGTH$2);
+  return { format: str, payload };
+}
+const SEAL_TARGET_BRAND = Symbol.for("workflow.serialization.sealTarget");
+const RUN_KEYS_BRAND = Symbol.for("workflow.serialization.runKeys");
+function sealTo(recipientPublicKey, aad) {
+  return { [SEAL_TARGET_BRAND]: true, recipientPublicKey, aad };
+}
+function runPayloadKeys(aes, keyPair, aad) {
+  return { [RUN_KEYS_BRAND]: true, aes, keyPair, aad };
+}
+async function deriveRunPayloadKeys(runKeyMaterial) {
+  const [aes, keyPair] = await Promise.all([
+    importKey(runKeyMaterial),
+    deriveRunKeyPair(runKeyMaterial)
+  ]);
+  return runPayloadKeys(aes, keyPair);
+}
+function isSealTarget(value) {
+  return typeof value === "object" && value !== null && value[SEAL_TARGET_BRAND] === true;
+}
+function isRunPayloadKeys(value) {
+  return typeof value === "object" && value !== null && value[RUN_KEYS_BRAND] === true;
+}
+function aesKeyOf(key) {
+  if (!key)
+    return void 0;
+  if (isRunPayloadKeys(key))
+    return key.aes;
+  if (isSealTarget(key))
+    return void 0;
+  return key;
+}
+async function resolveEncryptionKey(key) {
+  return typeof key === "function" ? key() : key;
+}
+async function encrypt(data, key) {
+  if (!key || !(data instanceof Uint8Array))
+    return data;
+  if (isSealTarget(key)) {
+    const sealed = await seal(key.recipientPublicKey, data, key.aad);
+    return encodeWithFormatPrefix(SerializationFormat$1.SEALED, sealed);
+  }
+  const aesKey = isRunPayloadKeys(key) ? key.aes : key;
+  const encrypted = await encrypt$1(aesKey, data);
+  return encodeWithFormatPrefix(SerializationFormat$1.ENCRYPTED, encrypted);
+}
+async function openSealedEnvelope(data, key) {
+  if (!isRunPayloadKeys(key)) {
+    throw new RuntimeDecryptionError("Sealed data encountered but no run keypair is available. Opening a sealed payload requires the run's own encryption key material; a symmetric key or a seal-only target cannot decrypt it.", {
+      context: {
+        operation: "decrypt",
+        byteLength: data.byteLength,
+        formatPrefix: "encp"
+      }
+    });
+  }
+  const { payload } = decodeFormatPrefix$1(data);
+  try {
+    return await open(key.keyPair, payload, key.aad);
+  } catch (error2) {
+    if (RuntimeDecryptionError.is(error2) && error2.context) {
+      error2.context.formatPrefix = SerializationFormat$1.SEALED;
+    }
+    throw error2;
+  }
+}
+async function decrypt(data, key) {
+  if (!(data instanceof Uint8Array))
+    return data;
+  const format2 = peekFormatPrefix$1(data);
+  if (format2 === SerializationFormat$1.SEALED) {
+    return openSealedEnvelope(data, key);
+  }
+  if (format2 !== SerializationFormat$1.ENCRYPTED)
+    return data;
+  const aesKey = aesKeyOf(key);
+  if (!aesKey) {
+    throw new RuntimeDecryptionError("Encrypted data encountered but no encryption key is available. Encryption is not configured or no key was provided for this run.", {
+      context: {
+        operation: "decrypt",
+        byteLength: data.byteLength,
+        formatPrefix: "encr"
+      }
+    });
+  }
+  const { payload } = decodeFormatPrefix$1(data);
+  try {
+    return await decrypt$1(aesKey, payload);
+  } catch (error2) {
+    if (RuntimeDecryptionError.is(error2) && error2.context) {
+      error2.context.formatPrefix = format2;
+    }
+    throw error2;
+  }
+}
+const encryption = /* @__PURE__ */ Object.freeze(/* @__PURE__ */ Object.defineProperty({
+  __proto__: null,
+  aesKeyOf,
+  decrypt,
+  deriveRunPayloadKeys,
+  encrypt,
+  isRunPayloadKeys,
+  isSealTarget,
+  resolveEncryptionKey,
+  runPayloadKeys,
+  sealTo
+}, Symbol.toStringTag, { value: "Module" }));
+const SerializationFormat = {
+  /** devalue stringify/parse with TextEncoder/TextDecoder */
+  DEVALUE_V1: "devl",
+  /** Encrypted payload (inner payload has its own format prefix after decryption) */
+  ENCRYPTED: "encr",
+  /**
+   * Sealed payload — asymmetrically encrypted to a run's X25519 public key
+   * (inner payload has its own format prefix after opening).
+   *
+   * Written by cross-run writers that hold only the recipient run's public
+   * key. Opening it requires the run's private scalar rather than the
+   * symmetric per-run key, so o11y display treats it as ciphertext via
+   * {@link isEncryptedData} but {@link hydrateDataWithKey} does not attempt
+   * an AES-GCM decrypt on it.
+   */
+  SEALED: "encp",
+  /** Gzip-compressed payload (inner payload has its own format prefix after decompression) */
+  GZIP: "gzip",
+  /** Zstandard-compressed payload (inner payload has its own format prefix after decompression) */
+  ZSTD: "zstd"
+};
+const FORMAT_PREFIX_LENGTH$1 = 4;
+new TextEncoder();
+const formatDecoder$1 = new TextDecoder();
+function decodeFormatPrefix(data) {
+  if (!(data instanceof Uint8Array)) {
+    return {
+      format: SerializationFormat.DEVALUE_V1,
+      payload: new TextEncoder().encode(JSON.stringify(data))
+    };
+  }
+  if (data.length < FORMAT_PREFIX_LENGTH$1) {
+    throw new Error(`Data too short to contain format prefix: expected at least ${FORMAT_PREFIX_LENGTH$1} bytes, got ${data.length}`);
+  }
+  const prefixBytes = data.subarray(0, FORMAT_PREFIX_LENGTH$1);
+  const format2 = formatDecoder$1.decode(prefixBytes);
+  const knownFormats = Object.values(SerializationFormat);
   if (!knownFormats.includes(format2)) {
     throw new Error(`Unknown serialization format: "${format2}". Known formats: ${knownFormats.join(", ")}`);
   }
-  const payload = data.subarray(FORMAT_PREFIX_LENGTH$2);
+  const payload = data.subarray(FORMAT_PREFIX_LENGTH$1);
   return { format: format2, payload };
 }
 function isExpiredObject(data) {
@@ -49553,18 +50686,25 @@ function isExpiredStub(data) {
   return false;
 }
 function isEncryptedData(data) {
-  if (!(data instanceof Uint8Array) || data.length < FORMAT_PREFIX_LENGTH$2) {
+  if (!(data instanceof Uint8Array) || data.length < FORMAT_PREFIX_LENGTH$1) {
+    return false;
+  }
+  const prefix = formatDecoder$1.decode(data.subarray(0, FORMAT_PREFIX_LENGTH$1));
+  return prefix === SerializationFormat.ENCRYPTED || prefix === SerializationFormat.SEALED;
+}
+function isSealedData(data) {
+  if (!(data instanceof Uint8Array) || data.length < FORMAT_PREFIX_LENGTH$1) {
     return false;
   }
-  const prefix = formatDecoder$2.decode(data.subarray(0, FORMAT_PREFIX_LENGTH$2));
-  return prefix === SerializationFormat$1.ENCRYPTED;
+  const prefix = formatDecoder$1.decode(data.subarray(0, FORMAT_PREFIX_LENGTH$1));
+  return prefix === SerializationFormat.SEALED;
 }
 function isCompressedData(data) {
-  if (!(data instanceof Uint8Array) || data.length < FORMAT_PREFIX_LENGTH$2) {
+  if (!(data instanceof Uint8Array) || data.length < FORMAT_PREFIX_LENGTH$1) {
     return false;
   }
-  const prefix = formatDecoder$2.decode(data.subarray(0, FORMAT_PREFIX_LENGTH$2));
-  return prefix === SerializationFormat$1.GZIP || prefix === SerializationFormat$1.ZSTD;
+  const prefix = formatDecoder$1.decode(data.subarray(0, FORMAT_PREFIX_LENGTH$1));
+  return prefix === SerializationFormat.GZIP || prefix === SerializationFormat.ZSTD;
 }
 function getNodeZlib$2() {
   var _a3, _b2;
@@ -49577,10 +50717,10 @@ function getNodeZlib$2() {
 function decompressSyncIfAvailable(format2, payload) {
   try {
     const zlib = getNodeZlib$2();
-    if (format2 === SerializationFormat$1.GZIP && (zlib == null ? void 0 : zlib.gunzipSync)) {
+    if (format2 === SerializationFormat.GZIP && (zlib == null ? void 0 : zlib.gunzipSync)) {
       return new Uint8Array(zlib.gunzipSync(payload));
     }
-    if (format2 === SerializationFormat$1.ZSTD && (zlib == null ? void 0 : zlib.zstdDecompressSync)) {
+    if (format2 === SerializationFormat.ZSTD && (zlib == null ? void 0 : zlib.zstdDecompressSync)) {
       return new Uint8Array(zlib.zstdDecompressSync(payload));
     }
   } catch {
@@ -49592,7 +50732,7 @@ function registerZstdDecoder(decoder2) {
   zstdBrowserDecoder = decoder2;
 }
 async function decompressAsync(format2, payload) {
-  if (format2 === SerializationFormat$1.ZSTD) {
+  if (format2 === SerializationFormat.ZSTD) {
     const sync = decompressSyncIfAvailable(format2, payload);
     if (sync)
       return sync;
@@ -49629,12 +50769,12 @@ function hydrateData(value, revivers) {
     if (isEncryptedData(value)) {
       return value;
     }
-    const { format: format2, payload } = decodeFormatPrefix$1(value);
-    if (format2 === SerializationFormat$1.DEVALUE_V1) {
+    const { format: format2, payload } = decodeFormatPrefix(value);
+    if (format2 === SerializationFormat.DEVALUE_V1) {
       const str = new TextDecoder().decode(payload);
       return parse$5(str, revivers);
     }
-    if (format2 === SerializationFormat$1.GZIP || format2 === SerializationFormat$1.ZSTD) {
+    if (format2 === SerializationFormat.GZIP || format2 === SerializationFormat.ZSTD) {
       const inflated = decompressSyncIfAvailable(format2, payload);
       if (inflated === void 0) {
         return value;
@@ -49651,12 +50791,13 @@ function hydrateData(value, revivers) {
 async function hydrateDataWithKey(value, revivers, key) {
   let data = value;
   if (data instanceof Uint8Array && isEncryptedData(data) && key) {
-    const { decrypt: decrypt2 } = await Promise.resolve().then(() => encryption);
-    const { payload } = decodeFormatPrefix$1(data);
-    data = await decrypt2(key, payload);
+    const { decrypt: decrypt2, isRunPayloadKeys: isRunPayloadKeys2 } = await Promise.resolve().then(() => encryption);
+    if (!isSealedData(data) || isRunPayloadKeys2(key)) {
+      data = await decrypt2(data, key);
+    }
   }
   if (data instanceof Uint8Array && isCompressedData(data)) {
-    const { format: format2, payload } = decodeFormatPrefix$1(data);
+    const { format: format2, payload } = decodeFormatPrefix(data);
     data = await decompressAsync(format2, payload);
   }
   return hydrateData(data, revivers);
@@ -49878,8 +51019,11 @@ const serializationFormat = /* @__PURE__ */ Object.freeze(/* @__PURE__ */ Object
   ClassInstanceRef,
   RUN_REF_TYPE: RUN_REF_TYPE$1,
   STREAM_REF_TYPE: STREAM_REF_TYPE$1,
-  SerializationFormat: SerializationFormat$1,
-  decodeFormatPrefix: decodeFormatPrefix$1,
+  SerializationFormat,
+  decodeFormatPrefix,
+  decryptEnvelope: decrypt,
+  deriveRunPayloadKeys,
+  encryptEnvelope: encrypt,
   extractClassName,
   hydrateData,
   hydrateDataWithKey,
@@ -49887,9 +51031,14 @@ const serializationFormat = /* @__PURE__ */ Object.freeze(/* @__PURE__ */ Object
   isCompressedData,
   isEncryptedData,
   isExpiredStub,
+  isRunPayloadKeys,
   isRunRef: isRunRef$1,
+  isSealTarget,
+  isSealedData,
   observabilityRevivers,
   registerZstdDecoder,
+  runPayloadKeys,
+  sealTo,
   serializedClassToString,
   serializedInstanceToRef,
   serializedRunToRunRef,
@@ -50169,10 +51318,10 @@ function replaceEncryptedAndExpiredWithMarkers(resource) {
   return result;
 }
 async function hydrateResourceIOAsync(resource, key) {
-  const { hydrateDataWithKey: hydrateDataWithKey2 } = await Promise.resolve().then(() => serializationFormat);
-  const { ensureZstdDecoderRegistered } = await import("./zstd-browser-decoder-DXnLXD-w.js");
+  const { hydrateDataWithKey: hydrateDataWithKey2, deriveRunPayloadKeys: deriveRunPayloadKeys2 } = await Promise.resolve().then(() => serializationFormat);
+  const { ensureZstdDecoderRegistered } = await import("./zstd-browser-decoder-tQARkzJ5.js");
   ensureZstdDecoderRegistered();
-  const cryptoKey = key ? await Promise.resolve().then(() => encryption).then(({ importKey: importKey2 }) => importKey2(key)) : void 0;
+  const cryptoKey = key ? await deriveRunPayloadKeys2(key) : void 0;
   const revivers = getRevivers();
   async function hydrateField(value) {
     if (isEncryptedMarker$1(value)) {
@@ -51753,7 +52902,7 @@ function useCollapsibleContext(part) {
   return context;
 }
 function CollapsibleRoot({ children: children2, variant = "section", disabled = false, defaultOpen = false, onOpenChange, className }) {
-  const [open, setOpen] = reactExports.useState(defaultOpen);
+  const [open2, setOpen] = reactExports.useState(defaultOpen);
   const handleToggle = (event) => {
     if (event.target !== event.currentTarget)
       return;
@@ -51761,7 +52910,7 @@ function CollapsibleRoot({ children: children2, variant = "section", disabled =
     setOpen(next2);
     onOpenChange == null ? void 0 : onOpenChange(next2);
   };
-  const details = jsxRuntimeExports.jsx("details", { "data-slot": "collapsible", "data-state": open ? "open" : "closed", open, onToggle: disabled ? void 0 : handleToggle, className: cn$4(variant === "card" ? "group/card border-gray-alpha-400 last:border-b" : "group", className), children: jsxRuntimeExports.jsx(CollapsibleContext.Provider, { value: { variant, disabled }, children: children2 }) });
+  const details = jsxRuntimeExports.jsx("details", { "data-slot": "collapsible", "data-state": open2 ? "open" : "closed", open: open2, onToggle: disabled ? void 0 : handleToggle, className: cn$4(variant === "card" ? "group/card border-gray-alpha-400 last:border-b" : "group", className), children: jsxRuntimeExports.jsx(CollapsibleContext.Provider, { value: { variant, disabled }, children: children2 }) });
   if (variant === "card") {
     return details;
   }
@@ -52177,8 +53326,8 @@ function PrimitiveValue({ field, value, isLast }) {
   const { text: text2, cls } = describePrimitive(value);
   return jsxRuntimeExports.jsx(LeafRow, { field, isLast, children: jsxRuntimeExports.jsx("span", { className: cls, children: text2 }) });
 }
-function EmptyContainer({ field, prefix, open, close, isLast }) {
-  return jsxRuntimeExports.jsxs("div", { className: CLS.child, role: "treeitem", tabIndex: -1, children: [jsxRuntimeExports.jsx(Label$2, { field }), prefix ? jsxRuntimeExports.jsx("span", { className: CLS.className, children: prefix }) : null, jsxRuntimeExports.jsx("span", { className: CLS.punctuation, children: open }), jsxRuntimeExports.jsx("span", { className: CLS.punctuation, children: close }), jsxRuntimeExports.jsx(Comma, { isLast })] });
+function EmptyContainer({ field, prefix, open: open2, close, isLast }) {
+  return jsxRuntimeExports.jsxs("div", { className: CLS.child, role: "treeitem", tabIndex: -1, children: [jsxRuntimeExports.jsx(Label$2, { field }), prefix ? jsxRuntimeExports.jsx("span", { className: CLS.className, children: prefix }) : null, jsxRuntimeExports.jsx("span", { className: CLS.punctuation, children: open2 }), jsxRuntimeExports.jsx("span", { className: CLS.punctuation, children: close }), jsxRuntimeExports.jsx(Comma, { isLast })] });
 }
 function focusExpander(button, outerRef) {
   var _a3;
@@ -52207,13 +53356,13 @@ function moveExpanderFocus(outerRef, direction) {
   buttons[next2].tabIndex = 0;
   buttons[next2].focus();
 }
-function ExpandableContainer({ field, entries, open, close, prefix, ctx, isLast }) {
+function ExpandableContainer({ field, entries, open: open2, close, prefix, ctx, isLast }) {
   const { level, shouldExpand, outerRef } = ctx;
   const [expanded2, setExpanded] = reactExports.useState(() => shouldExpand(level));
   const rowRef = reactExports.useRef(null);
   const contentsId = reactExports.useId();
   if (entries.length === 0) {
-    return jsxRuntimeExports.jsx(EmptyContainer, { field, prefix, open, close, isLast });
+    return jsxRuntimeExports.jsx(EmptyContainer, { field, prefix, open: open2, close, isLast });
   }
   const toggle = () => {
     setExpanded((value) => !value);
@@ -52242,7 +53391,7 @@ function ExpandableContainer({ field, entries, open, close, prefix, ctx, isLast
     }
   };
   const lastIndex = entries.length - 1;
-  return jsxRuntimeExports.jsxs("div", { className: CLS.child, role: "treeitem", "aria-expanded": expanded2, "aria-controls": expanded2 ? contentsId : void 0, "data-json-expander": true, ref: rowRef, tabIndex: level === 0 ? 0 : -1, onClick, onKeyDown, children: [jsxRuntimeExports.jsx("span", { className: expanded2 ? CLS.collapseIcon : CLS.expandIcon, "aria-hidden": "true" }), field !== void 0 && jsxRuntimeExports.jsx("span", { className: CLS.clickableLabel, children: `${formatField(field)}:` }), prefix ? jsxRuntimeExports.jsx("span", { className: CLS.className, children: prefix }) : null, jsxRuntimeExports.jsx("span", { className: CLS.punctuation, children: open }), expanded2 ? jsxRuntimeExports.jsx("ul", { id: contentsId, className: CLS.childFields, role: "group", children: entries.map(([childField, childValue], index2) => jsxRuntimeExports.jsx(DataRender, { field: childField, value: childValue, isLast: index2 === lastIndex, ctx: { ...ctx, level: level + 1 } }, childField ?? index2)) }) : jsxRuntimeExports.jsx("span", { className: CLS.collapsedContent, "aria-hidden": "true" }), jsxRuntimeExports.jsx("span", { className: CLS.punctuation, children: close }), jsxRuntimeExports.jsx(Comma, { isLast })] });
+  return jsxRuntimeExports.jsxs("div", { className: CLS.child, role: "treeitem", "aria-expanded": expanded2, "aria-controls": expanded2 ? contentsId : void 0, "data-json-expander": true, ref: rowRef, tabIndex: level === 0 ? 0 : -1, onClick, onKeyDown, children: [jsxRuntimeExports.jsx("span", { className: expanded2 ? CLS.collapseIcon : CLS.expandIcon, "aria-hidden": "true" }), field !== void 0 && jsxRuntimeExports.jsx("span", { className: CLS.clickableLabel, children: `${formatField(field)}:` }), prefix ? jsxRuntimeExports.jsx("span", { className: CLS.className, children: prefix }) : null, jsxRuntimeExports.jsx("span", { className: CLS.punctuation, children: open2 }), expanded2 ? jsxRuntimeExports.jsx("ul", { id: contentsId, className: CLS.childFields, role: "group", children: entries.map(([childField, childValue], index2) => jsxRuntimeExports.jsx(DataRender, { field: childField, value: childValue, isLast: index2 === lastIndex, ctx: { ...ctx, level: level + 1 } }, childField ?? index2)) }) : jsxRuntimeExports.jsx("span", { className: CLS.collapsedContent, "aria-hidden": "true" }), jsxRuntimeExports.jsx("span", { className: CLS.punctuation, children: close }), jsxRuntimeExports.jsx(Comma, { isLast })] });
 }
 function DataRender({ field, value, isLast, ctx }) {
   if (isBytesDisplay(value)) {
@@ -53330,11 +54479,11 @@ function LoadMoreButton({ loading = false, onClick, label = "Load more", loading
 const STYLES = `.wf-menu-btn{appearance:none;-webkit-appearance:none;border:none;display:inline-flex;align-items:center;justify-content:center;height:40px;padding:0 12px;border-radius:6px;font-size:14px;font-weight:500;line-height:20px;color:var(--ds-gray-1000);background:var(--ds-background-100);box-shadow:0 0 0 1px var(--ds-gray-400);cursor:pointer;white-space:nowrap;transition:background 150ms}.wf-menu-btn:hover{background:var(--ds-gray-alpha-200)}.wf-menu-item{appearance:none;-webkit-appearance:none;border:none;display:flex;align-items:center;width:100%;height:40px;padding:0 8px;border-radius:6px;font-size:14px;color:var(--ds-gray-1000);background:transparent;cursor:pointer;transition:background 150ms}.wf-menu-item:hover{background:var(--ds-gray-alpha-100)}`;
 function MenuDropdown({ options, value, onChange }) {
   var _a3, _b2;
-  const [open, setOpen] = reactExports.useState(false);
+  const [open2, setOpen] = reactExports.useState(false);
   const ref = reactExports.useRef(null);
   const label = ((_a3 = options.find((o) => o.value === value)) == null ? void 0 : _a3.label) ?? ((_b2 = options[0]) == null ? void 0 : _b2.label) ?? "";
   reactExports.useEffect(() => {
-    if (!open)
+    if (!open2)
       return;
     function handleClickOutside(e) {
       if (ref.current && !ref.current.contains(e.target)) {
@@ -53343,12 +54492,12 @@ function MenuDropdown({ options, value, onChange }) {
     }
     document.addEventListener("mousedown", handleClickOutside);
     return () => document.removeEventListener("mousedown", handleClickOutside);
-  }, [open]);
-  return jsxRuntimeExports.jsxs("div", { ref, style: { position: "relative", flexShrink: 0 }, children: [jsxRuntimeExports.jsx("style", { dangerouslySetInnerHTML: { __html: STYLES } }), jsxRuntimeExports.jsxs("button", { type: "button", className: "wf-menu-btn", onClick: () => setOpen(!open), children: [jsxRuntimeExports.jsx("span", { children: label }), jsxRuntimeExports.jsx("svg", { width: 16, height: 16, viewBox: "0 0 16 16", fill: "none", style: {
+  }, [open2]);
+  return jsxRuntimeExports.jsxs("div", { ref, style: { position: "relative", flexShrink: 0 }, children: [jsxRuntimeExports.jsx("style", { dangerouslySetInnerHTML: { __html: STYLES } }), jsxRuntimeExports.jsxs("button", { type: "button", className: "wf-menu-btn", onClick: () => setOpen(!open2), children: [jsxRuntimeExports.jsx("span", { children: label }), jsxRuntimeExports.jsx("svg", { width: 16, height: 16, viewBox: "0 0 16 16", fill: "none", style: {
     marginLeft: 16,
     marginRight: -4,
     color: "var(--ds-gray-900)"
-  }, children: jsxRuntimeExports.jsx("path", { d: "M4.5 6L8 9.5L11.5 6", stroke: "currentColor", strokeWidth: "1.5", strokeLinecap: "round", strokeLinejoin: "round" }) })] }), open && jsxRuntimeExports.jsx("div", { style: {
+  }, children: jsxRuntimeExports.jsx("path", { d: "M4.5 6L8 9.5L11.5 6", stroke: "currentColor", strokeWidth: "1.5", strokeLinecap: "round", strokeLinejoin: "round" }) })] }), open2 && jsxRuntimeExports.jsx("div", { style: {
     position: "absolute",
     right: 0,
     top: "100%",
@@ -69725,12 +70874,12 @@ function emphasis$1(node2, _2, state, info) {
     })
   );
   const betweenHead = between.charCodeAt(0);
-  const open = encodeInfo(
+  const open2 = encodeInfo(
     info.before.charCodeAt(info.before.length - 1),
     betweenHead,
     marker2
   );
-  if (open.inside) {
+  if (open2.inside) {
     between = encodeCharacterReference(betweenHead) + between.slice(1);
   }
   const betweenTail = between.charCodeAt(between.length - 1);
@@ -69742,7 +70891,7 @@ function emphasis$1(node2, _2, state, info) {
   exit2();
   state.attentionEncodeSurroundingInfo = {
     after: close.outside,
-    before: open.outside
+    before: open2.outside
   };
   return before + between + after;
 }
@@ -70275,12 +71424,12 @@ function strong$1(node2, _2, state, info) {
     })
   );
   const betweenHead = between.charCodeAt(0);
-  const open = encodeInfo(
+  const open2 = encodeInfo(
     info.before.charCodeAt(info.before.length - 1),
     betweenHead,
     marker2
   );
-  if (open.inside) {
+  if (open2.inside) {
     between = encodeCharacterReference(betweenHead) + between.slice(1);
   }
   const betweenTail = between.charCodeAt(between.length - 1);
@@ -70292,7 +71441,7 @@ function strong$1(node2, _2, state, info) {
   exit2();
   state.attentionEncodeSurroundingInfo = {
     after: close.outside,
-    before: open.outside
+    before: open2.outside
   };
   return before + between + after;
 }
@@ -73206,7 +74355,7 @@ const attention = {
 };
 function resolveAllAttention(events2, context) {
   let index2 = -1;
-  let open;
+  let open2;
   let group;
   let text2;
   let openingSequence;
@@ -73216,16 +74365,16 @@ function resolveAllAttention(events2, context) {
   let offset2;
   while (++index2 < events2.length) {
     if (events2[index2][0] === "enter" && events2[index2][1].type === "attentionSequence" && events2[index2][1]._close) {
-      open = index2;
-      while (open--) {
-        if (events2[open][0] === "exit" && events2[open][1].type === "attentionSequence" && events2[open][1]._open && // If the markers are the same:
-        context.sliceSerialize(events2[open][1]).charCodeAt(0) === context.sliceSerialize(events2[index2][1]).charCodeAt(0)) {
-          if ((events2[open][1]._close || events2[index2][1]._open) && (events2[index2][1].end.offset - events2[index2][1].start.offset) % 3 && !((events2[open][1].end.offset - events2[open][1].start.offset + events2[index2][1].end.offset - events2[index2][1].start.offset) % 3)) {
+      open2 = index2;
+      while (open2--) {
+        if (events2[open2][0] === "exit" && events2[open2][1].type === "attentionSequence" && events2[open2][1]._open && // If the markers are the same:
+        context.sliceSerialize(events2[open2][1]).charCodeAt(0) === context.sliceSerialize(events2[index2][1]).charCodeAt(0)) {
+          if ((events2[open2][1]._close || events2[index2][1]._open) && (events2[index2][1].end.offset - events2[index2][1].start.offset) % 3 && !((events2[open2][1].end.offset - events2[open2][1].start.offset + events2[index2][1].end.offset - events2[index2][1].start.offset) % 3)) {
             continue;
           }
-          use2 = events2[open][1].end.offset - events2[open][1].start.offset > 1 && events2[index2][1].end.offset - events2[index2][1].start.offset > 1 ? 2 : 1;
+          use2 = events2[open2][1].end.offset - events2[open2][1].start.offset > 1 && events2[index2][1].end.offset - events2[index2][1].start.offset > 1 ? 2 : 1;
           const start2 = {
-            ...events2[open][1].end
+            ...events2[open2][1].end
           };
           const end = {
             ...events2[index2][1].start
@@ -73236,7 +74385,7 @@ function resolveAllAttention(events2, context) {
             type: use2 > 1 ? "strongSequence" : "emphasisSequence",
             start: start2,
             end: {
-              ...events2[open][1].end
+              ...events2[open2][1].end
             }
           };
           closingSequence = {
@@ -73249,7 +74398,7 @@ function resolveAllAttention(events2, context) {
           text2 = {
             type: use2 > 1 ? "strongText" : "emphasisText",
             start: {
-              ...events2[open][1].end
+              ...events2[open2][1].end
             },
             end: {
               ...events2[index2][1].start
@@ -73264,18 +74413,18 @@ function resolveAllAttention(events2, context) {
               ...closingSequence.end
             }
           };
-          events2[open][1].end = {
+          events2[open2][1].end = {
             ...openingSequence.start
           };
           events2[index2][1].start = {
             ...closingSequence.end
           };
           nextEvents = [];
-          if (events2[open][1].end.offset - events2[open][1].start.offset) {
-            nextEvents = push(nextEvents, [["enter", events2[open][1], context], ["exit", events2[open][1], context]]);
+          if (events2[open2][1].end.offset - events2[open2][1].start.offset) {
+            nextEvents = push(nextEvents, [["enter", events2[open2][1], context], ["exit", events2[open2][1], context]]);
           }
           nextEvents = push(nextEvents, [["enter", group, context], ["enter", openingSequence, context], ["exit", openingSequence, context], ["enter", text2, context]]);
-          nextEvents = push(nextEvents, resolveAll(context.parser.constructs.insideSpan.null, events2.slice(open + 1, index2), context));
+          nextEvents = push(nextEvents, resolveAll(context.parser.constructs.insideSpan.null, events2.slice(open2 + 1, index2), context));
           nextEvents = push(nextEvents, [["exit", text2, context], ["enter", closingSequence, context], ["exit", closingSequence, context], ["exit", group, context]]);
           if (events2[index2][1].end.offset - events2[index2][1].start.offset) {
             offset2 = 2;
@@ -73283,8 +74432,8 @@ function resolveAllAttention(events2, context) {
           } else {
             offset2 = 0;
           }
-          splice(events2, open - 1, index2 - open + 3, nextEvents);
-          index2 = open + nextEvents.length - offset2 - 2;
+          splice(events2, open2 - 1, index2 - open2 + 3, nextEvents);
+          index2 = open2 + nextEvents.length - offset2 - 2;
           break;
         }
       }
@@ -73316,10 +74465,10 @@ function tokenizeAttention(effects, ok2) {
     }
     const token = effects.exit("attentionSequence");
     const after = classifyCharacter(code2);
-    const open = !after || after === 2 && before || attentionMarkers2.includes(code2);
+    const open2 = !after || after === 2 && before || attentionMarkers2.includes(code2);
     const close = !before || before === 2 && after || attentionMarkers2.includes(previous2);
-    token._open = Boolean(marker2 === 42 ? open : open && (before || !close));
-    token._close = Boolean(marker2 === 42 ? close : close && (after || !open));
+    token._open = Boolean(marker2 === 42 ? open2 : open2 && (before || !close));
+    token._close = Boolean(marker2 === 42 ? close : close && (after || !open2));
     return ok2(code2);
   }
 }
@@ -73341,9 +74490,9 @@ function tokenizeAutolink(effects, ok2, nok) {
     effects.consume(code2);
     effects.exit("autolinkMarker");
     effects.enter("autolinkProtocol");
-    return open;
+    return open2;
   }
-  function open(code2) {
+  function open2(code2) {
     if (asciiAlpha(code2)) {
       effects.consume(code2);
       return schemeOrEmailAtext;
@@ -73555,9 +74704,9 @@ function tokenizeCharacterReference(effects, ok2, nok) {
     effects.enter("characterReferenceMarker");
     effects.consume(code2);
     effects.exit("characterReferenceMarker");
-    return open;
+    return open2;
   }
-  function open(code2) {
+  function open2(code2) {
     if (code2 === 35) {
       effects.enter("characterReferenceMarkerNumeric");
       effects.consume(code2);
@@ -74895,9 +76044,9 @@ function tokenizeHtmlFlow(effects, ok2, nok) {
     effects.enter("htmlFlow");
     effects.enter("htmlFlowData");
     effects.consume(code2);
-    return open;
+    return open2;
   }
-  function open(code2) {
+  function open2(code2) {
     if (code2 === 33) {
       effects.consume(code2);
       return declarationOpen;
@@ -75243,9 +76392,9 @@ function tokenizeHtmlText(effects, ok2, nok) {
     effects.enter("htmlText");
     effects.enter("htmlTextData");
     effects.consume(code2);
-    return open;
+    return open2;
   }
-  function open(code2) {
+  function open2(code2) {
     if (code2 === 33) {
       effects.consume(code2);
       return declarationOpen;
@@ -75569,12 +76718,12 @@ function resolveToLabelEnd(events2, context) {
   let index2 = events2.length;
   let offset2 = 0;
   let token;
-  let open;
+  let open2;
   let close;
   let media;
   while (index2--) {
     token = events2[index2][1];
-    if (open) {
+    if (open2) {
       if (token.type === "link" || token.type === "labelLink" && token._inactive) {
         break;
       }
@@ -75583,7 +76732,7 @@ function resolveToLabelEnd(events2, context) {
       }
     } else if (close) {
       if (events2[index2][0] === "enter" && (token.type === "labelImage" || token.type === "labelLink") && !token._balanced) {
-        open = index2;
+        open2 = index2;
         if (token.type !== "labelLink") {
           offset2 = 2;
           break;
@@ -75594,9 +76743,9 @@ function resolveToLabelEnd(events2, context) {
     }
   }
   const group = {
-    type: events2[open][1].type === "labelLink" ? "link" : "image",
+    type: events2[open2][1].type === "labelLink" ? "link" : "image",
     start: {
-      ...events2[open][1].start
+      ...events2[open2][1].start
     },
     end: {
       ...events2[events2.length - 1][1].end
@@ -75605,7 +76754,7 @@ function resolveToLabelEnd(events2, context) {
   const label = {
     type: "label",
     start: {
-      ...events2[open][1].start
+      ...events2[open2][1].start
     },
     end: {
       ...events2[close][1].end
@@ -75614,20 +76763,20 @@ function resolveToLabelEnd(events2, context) {
   const text2 = {
     type: "labelText",
     start: {
-      ...events2[open + offset2 + 2][1].end
+      ...events2[open2 + offset2 + 2][1].end
     },
     end: {
       ...events2[close - 2][1].start
     }
   };
   media = [["enter", group, context], ["enter", label, context]];
-  media = push(media, events2.slice(open + 1, open + offset2 + 3));
+  media = push(media, events2.slice(open2 + 1, open2 + offset2 + 3));
   media = push(media, [["enter", text2, context]]);
-  media = push(media, resolveAll(context.parser.constructs.insideSpan.null, events2.slice(open + offset2 + 4, close - 3), context));
+  media = push(media, resolveAll(context.parser.constructs.insideSpan.null, events2.slice(open2 + offset2 + 4, close - 3), context));
   media = push(media, [["exit", text2, context], events2[close - 2], events2[close - 1], ["exit", label, context]]);
   media = push(media, events2.slice(close + 1));
   media = push(media, [["exit", group, context]]);
-  splice(events2, open, events2.length, media);
+  splice(events2, open2, events2.length, media);
   return events2;
 }
 function tokenizeLabelEnd(effects, ok2, nok) {
@@ -75770,9 +76919,9 @@ function tokenizeLabelStartImage(effects, ok2, nok) {
     effects.enter("labelImageMarker");
     effects.consume(code2);
     effects.exit("labelImageMarker");
-    return open;
+    return open2;
   }
-  function open(code2) {
+  function open2(code2) {
     if (code2 === 91) {
       effects.enter("labelMarker");
       effects.consume(code2);
@@ -76372,30 +77521,30 @@ function gfmStrikethrough(options) {
     let index2 = -1;
     while (++index2 < events2.length) {
       if (events2[index2][0] === "enter" && events2[index2][1].type === "strikethroughSequenceTemporary" && events2[index2][1]._close) {
-        let open = index2;
-        while (open--) {
-          if (events2[open][0] === "exit" && events2[open][1].type === "strikethroughSequenceTemporary" && events2[open][1]._open && // If the sizes are the same:
-          events2[index2][1].end.offset - events2[index2][1].start.offset === events2[open][1].end.offset - events2[open][1].start.offset) {
+        let open2 = index2;
+        while (open2--) {
+          if (events2[open2][0] === "exit" && events2[open2][1].type === "strikethroughSequenceTemporary" && events2[open2][1]._open && // If the sizes are the same:
+          events2[index2][1].end.offset - events2[index2][1].start.offset === events2[open2][1].end.offset - events2[open2][1].start.offset) {
             events2[index2][1].type = "strikethroughSequence";
-            events2[open][1].type = "strikethroughSequence";
+            events2[open2][1].type = "strikethroughSequence";
             const strikethrough2 = {
               type: "strikethrough",
-              start: Object.assign({}, events2[open][1].start),
+              start: Object.assign({}, events2[open2][1].start),
               end: Object.assign({}, events2[index2][1].end)
             };
             const text2 = {
               type: "strikethroughText",
-              start: Object.assign({}, events2[open][1].end),
+              start: Object.assign({}, events2[open2][1].end),
               end: Object.assign({}, events2[index2][1].start)
             };
-            const nextEvents = [["enter", strikethrough2, context], ["enter", events2[open][1], context], ["exit", events2[open][1], context], ["enter", text2, context]];
+            const nextEvents = [["enter", strikethrough2, context], ["enter", events2[open2][1], context], ["exit", events2[open2][1], context], ["enter", text2, context]];
             const insideSpan2 = context.parser.constructs.insideSpan.null;
             if (insideSpan2) {
-              splice(nextEvents, nextEvents.length, 0, resolveAll(insideSpan2, events2.slice(open + 1, index2), context));
+              splice(nextEvents, nextEvents.length, 0, resolveAll(insideSpan2, events2.slice(open2 + 1, index2), context));
             }
             splice(nextEvents, nextEvents.length, 0, [["exit", text2, context], ["enter", events2[index2][1], context], ["exit", events2[index2][1], context], ["exit", strikethrough2, context]]);
-            splice(events2, open - 1, index2 - open + 3, nextEvents);
-            index2 = open + nextEvents.length - 2;
+            splice(events2, open2 - 1, index2 - open2 + 3, nextEvents);
+            index2 = open2 + nextEvents.length - 2;
             break;
           }
         }
@@ -76937,8 +78086,8 @@ function gfmTaskListItem() {
 }
 function tokenizeTasklistCheck(effects, ok2, nok) {
   const self2 = this;
-  return open;
-  function open(code2) {
+  return open2;
+  function open2(code2) {
     if (
       // Exit if there’s stuff before.
       self2.previous !== null || // Exit if not in the first content that is the first child of a list
@@ -79371,8 +80520,8 @@ function compiler(options) {
     return length;
   }
   function opener(create2, and) {
-    return open;
-    function open(token) {
+    return open2;
+    function open2(token) {
       enter.call(this, create2(token), token);
       if (and) and.call(this, token);
     }
@@ -79404,18 +80553,18 @@ function compiler(options) {
   }
   function exit2(token, onExitError) {
     const node2 = this.stack.pop();
-    const open = this.tokenStack.pop();
-    if (!open) {
+    const open2 = this.tokenStack.pop();
+    if (!open2) {
       throw new Error("Cannot close `" + token.type + "` (" + stringifyPosition({
         start: token.start,
         end: token.end
       }) + "): it’s not open");
-    } else if (open[0].type !== token.type) {
+    } else if (open2[0].type !== token.type) {
       if (onExitError) {
-        onExitError.call(this, token, open[0]);
+        onExitError.call(this, token, open2[0]);
       } else {
-        const handler = open[1] || defaultOnError;
-        handler.call(this, token, open[0]);
+        const handler = open2[1] || defaultOnError;
+        handler.call(this, token, open2[0]);
       }
     }
     node2.position.end = point(token.end);
@@ -83135,7 +84284,7 @@ var tn = f("block", "before:content-[counter(line)]", "before:inline-block", "be
 var et = ({ className: e, language: t, style: o, isIncomplete: n, ...s2 }) => jsxRuntimeExports.jsx("div", { className: f("my-4 flex w-full flex-col gap-2 rounded-xl border border-border bg-sidebar p-2", e), "data-incomplete": n || void 0, "data-language": t, "data-streamdown": "code-block", style: { contentVisibility: "auto", containIntrinsicSize: "auto 200px", ...o }, ...s2 });
 var Se = reactExports.createContext({ code: "" }), de = () => reactExports.useContext(Se);
 var ot = ({ language: e }) => jsxRuntimeExports.jsx("div", { className: "flex h-8 items-center text-muted-foreground text-xs", "data-language": e, "data-streamdown": "code-block-header", children: jsxRuntimeExports.jsx("span", { className: "ml-1 font-mono lowercase", children: e }) });
-var cn$1 = /\n+$/, dn = reactExports.lazy(() => import("./highlighted-body-B3W2YXNL-C7tx66m_.js").then((e) => ({ default: e.HighlightedCodeBlockBody }))), rt = ({ code: e, language: t, className: o, children: n, isIncomplete: s2 = false, ...r2 }) => {
+var cn$1 = /\n+$/, dn = reactExports.lazy(() => import("./highlighted-body-B3W2YXNL-DE3KXslx.js").then((e) => ({ default: e.HighlightedCodeBlockBody }))), rt = ({ code: e, language: t, className: o, children: n, isIncomplete: s2 = false, ...r2 }) => {
   let i = reactExports.useMemo(() => e.replace(cn$1, ""), [e]), c = reactExports.useMemo(() => ({ bg: "transparent", fg: "inherit", tokens: i.split(`
 `).map((a2) => [{ content: a2, color: "inherit", bgColor: "transparent", htmlStyle: {}, offset: 0 }]) }), [i]);
   return jsxRuntimeExports.jsx(Se.Provider, { value: { code: e }, children: jsxRuntimeExports.jsxs(et, { isIncomplete: s2, language: t, children: [jsxRuntimeExports.jsx(ot, { language: t }), n ? jsxRuntimeExports.jsx("div", { className: "pointer-events-none sticky top-2 z-10 -mt-10 flex h-8 items-center justify-end", children: jsxRuntimeExports.jsx("div", { className: "pointer-events-auto flex shrink-0 items-center gap-2 rounded-md border border-sidebar bg-sidebar/80 px-1.5 py-1 supports-[backdrop-filter]:bg-sidebar/70 supports-[backdrop-filter]:backdrop-blur", "data-streamdown": "code-block-actions", children: n }) }) : null, jsxRuntimeExports.jsx(reactExports.Suspense, { fallback: jsxRuntimeExports.jsx(Qe, { className: o, language: t, result: c, ...r2 }), children: jsxRuntimeExports.jsx(dn, { className: o, code: i, language: t, raw: c, ...r2 }) })] }) });
@@ -83457,7 +84606,7 @@ var Dt = ({ children: e, className: t, onDownload: o, onError: n }) => {
   }, []), jsxRuntimeExports.jsxs("div", { className: "relative", ref: i, children: [jsxRuntimeExports.jsx("button", { className: f("cursor-pointer p-1 text-muted-foreground transition-all hover:text-foreground disabled:cursor-not-allowed disabled:opacity-50", t), disabled: c, onClick: () => r2(!s2), title: "Download table", type: "button", children: e != null ? e : jsxRuntimeExports.jsx(Z, { size: 14 }) }), s2 ? jsxRuntimeExports.jsxs("div", { className: "absolute top-full right-0 z-10 mt-1 min-w-[120px] overflow-hidden rounded-md border border-border bg-background shadow-lg", children: [jsxRuntimeExports.jsx("button", { className: "w-full px-3 py-2 text-left text-sm transition-colors hover:bg-muted/40", onClick: () => a2("csv"), title: "Download table as CSV", type: "button", children: "CSV" }), jsxRuntimeExports.jsx("button", { className: "w-full px-3 py-2 text-left text-sm transition-colors hover:bg-muted/40", onClick: () => a2("markdown"), title: "Download table as Markdown", type: "button", children: "Markdown" })] }) : null] });
 };
 var Vt = ({ children: e, className: t, showControls: o, ...n }) => jsxRuntimeExports.jsxs("div", { className: "my-4 flex flex-col gap-2 rounded-lg border border-border bg-sidebar p-2", "data-streamdown": "table-wrapper", children: [o ? jsxRuntimeExports.jsxs("div", { className: "flex items-center justify-end gap-1", children: [jsxRuntimeExports.jsx(Ht, {}), jsxRuntimeExports.jsx(Dt, {})] }) : null, jsxRuntimeExports.jsx("div", { className: "border-collapse overflow-x-auto overscroll-y-auto rounded-md border border-border bg-background", children: jsxRuntimeExports.jsx("table", { className: f("w-full divide-y divide-border", t), "data-streamdown": "table", ...n, children: e }) })] });
-var Jn = reactExports.lazy(() => import("./mermaid-3ZIDBTTL-DStR4R-M.js").then((e) => ({ default: e.Mermaid }))), Kn = /language-([^\s]+)/;
+var Jn = reactExports.lazy(() => import("./mermaid-3ZIDBTTL-DjL45D7x.js").then((e) => ({ default: e.Mermaid }))), Kn = /language-([^\s]+)/;
 function ke(e, t) {
   if (!(e != null && e.position || t != null && t.position)) return true;
   if (!(e != null && e.position && (t != null && t.position))) return false;
@@ -84203,6 +85352,8 @@ const attributeToDisplayFn = {
   receivedCount: (value) => String(value),
   lastReceivedAt: localMillisecondTimeOrNull,
   disposedAt: localMillisecondTimeOrNull,
+  // Internal resume plumbing — not surfaced in the UI
+  resumeContext: (_value) => null,
   // Event details
   eventType: (value) => String(value),
   correlationId: (value) => String(value),
@@ -84308,7 +85459,11 @@ const attributeToDisplayFn = {
     if (typeof value !== "string" || value.length === 0)
       return null;
     return String(value);
-  }
+  },
+  // Internal encryption plumbing: the run's X25519 public key, used by
+  // cross-run writers to seal payloads to this run. Not actionable for users
+  // and not secret — hidden rather than rendered as 44 opaque base64 chars.
+  encryptionPublicKey: (_value) => null
 };
 const resolvableAttributes = [
   "input",
@@ -84347,8 +85502,8 @@ const loadingSectionLabels = {
 const AttributeBlock = ({ attribute, value, isLoading, inline = false, context }) => {
   const decryptCtx = reactExports.useContext(DecryptClickContext);
   const sectionOpenRef = reactExports.useRef(false);
-  const handleSectionOpenChange = reactExports.useCallback((open) => {
-    sectionOpenRef.current = open;
+  const handleSectionOpenChange = reactExports.useCallback((open2) => {
+    sectionOpenRef.current = open2;
   }, []);
   const label = loadingSectionLabels[attribute];
   if (isLoading && label && !hasDisplayContent(value)) {
@@ -84518,8 +85673,8 @@ function EventItem({ event, onLoadEventData, encryptionKey, showSeparateEventOcc
     second: "numeric"
   });
   const displayPayload = isLoading ? loadedData : mergedDisplay;
-  return jsxRuntimeExports.jsxs(CollapsibleRoot, { variant: "card", onOpenChange: canHaveData ? (open) => {
-    if (open)
+  return jsxRuntimeExports.jsxs(CollapsibleRoot, { variant: "card", onOpenChange: canHaveData ? (open2) => {
+    if (open2)
       handleExpand();
   } : void 0, children: [jsxRuntimeExports.jsx(CollapsibleTrigger, { className: "px-3 py-2", children: jsxRuntimeExports.jsxs("div", { className: "flex w-full items-center justify-between gap-3", children: [jsxRuntimeExports.jsx("span", { className: "text-gray-1000 text-label-12 font-mono", children: event.eventType }), jsxRuntimeExports.jsx("span", { className: "shrink-0 text-label-13 text-gray-900", children: displayedCreatedAtTime })] }) }), jsxRuntimeExports.jsxs(CollapsibleContent, { children: [jsxRuntimeExports.jsxs("div", { className: "flex flex-col bg-background-200 [&:has(+_*)]:border-b [&:has(+_*)]:border-gray-alpha-400", children: [showSeparateEventOccurrenceTimestamps && occurredAt && jsxRuntimeExports.jsxs("div", { className: "flex items-center justify-between gap-2 py-2 px-3", children: [jsxRuntimeExports.jsx("span", { className: "text-label-12 text-gray-900", children: "Occurred" }), jsxRuntimeExports.jsx(TimestampTooltip, { date: occurredAt, children: jsxRuntimeExports.jsx("span", { className: "max-w-[70%] truncate text-right text-label-12 font-mono", children: formatEventTimestamp(occurredAt) }) })] }), jsxRuntimeExports.jsxs("div", { className: "flex items-center justify-between gap-2 py-2 px-3", children: [jsxRuntimeExports.jsx("span", { className: "text-label-12 text-gray-900", children: "Event ID" }), jsxRuntimeExports.jsx("span", { className: "max-w-[70%] truncate text-right text-label-12 font-mono", children: event.eventId })] }), event.correlationId && jsxRuntimeExports.jsxs("div", { className: "flex items-center justify-between gap-2 py-2 px-3", children: [jsxRuntimeExports.jsx("span", { className: "text-label-12 text-gray-900", children: "Correlation ID" }), jsxRuntimeExports.jsx("span", { className: "max-w-[70%] truncate text-right text-label-12 font-mono", children: event.correlationId })] })] }), isLoading && jsxRuntimeExports.jsxs("div", { className: "p-3", children: [jsxRuntimeExports.jsx(Skeleton$2, { className: "h-4 w-[35%]" }), jsxRuntimeExports.jsx(Skeleton$2, { className: "mt-2 h-4 w-[90%]" }), jsxRuntimeExports.jsx(Skeleton$2, { className: "mt-2 h-4 w-[75%]" })] }), loadError && jsxRuntimeExports.jsx(ErrorCard, { title: "Failed to load event data", details: loadError, className: "mt-2" }), displayPayload != null && jsxRuntimeExports.jsx("div", { className: "[&>div]:border-none [&>div]:rounded-none", children: jsxRuntimeExports.jsx(EventDataBlock, { eventType: event.eventType, data: displayPayload }) })] })] });
 }
@@ -87924,15 +89079,14 @@ function NewTraceViewerContent({ trace: trace2, onLoadMore, hasMore, isLoadingMo
   }, [animateTo, clampToRoot]);
   const ZOOM_FACTOR = 0.5;
   const zoomBy = reactExports.useCallback((factor) => {
-    setViewport((prev) => {
-      const center = (prev.start + prev.end) / 2;
-      const newDuration = Math.max(MIN_VIEWPORT_MS, (prev.end - prev.start) * factor);
-      return clampToRoot({
-        start: center - newDuration / 2,
-        end: center + newDuration / 2
-      });
-    });
-  }, [setViewport, clampToRoot]);
+    const { start: start2, end } = viewportRef.current;
+    const center = (start2 + end) / 2;
+    const newDuration = Math.max(MIN_VIEWPORT_MS, (end - start2) * factor);
+    animateTo(clampToRoot({
+      start: center - newDuration / 2,
+      end: center + newDuration / 2
+    }));
+  }, [animateTo, clampToRoot]);
   const zoomIn = reactExports.useCallback(() => zoomBy(ZOOM_FACTOR), [zoomBy]);
   const zoomOut = reactExports.useCallback(() => zoomBy(1 / ZOOM_FACTOR), [zoomBy]);
   const isAtMinZoom = viewDuration >= root2.duration;
@@ -90730,8 +91884,8 @@ async function fetchStreams$1(worldEnv, runId) {
 async function fetchWorkflowsManifest$1(worldEnv) {
   return rpc("fetchWorkflowsManifest", { worldEnv });
 }
-async function runHealthCheck$1(worldEnv, endpoint, options) {
-  return rpc("runHealthCheck", { worldEnv, endpoint, options });
+async function runHealthCheck$1(worldEnv, options) {
+  return rpc("runHealthCheck", { worldEnv, options });
 }
 async function getEncryptionKeyForRun$1(worldEnv, runId) {
   return rpc("getEncryptionKeyForRun", { worldEnv, runId });
@@ -90741,37 +91895,18 @@ function HealthCheckButton() {
   const env2 = reactExports.useMemo(() => ({}), []);
   const runChecks = reactExports.useCallback(async () => {
     setIsChecking(true);
-    const endpoints = ["workflow", "step"];
-    const results = [];
     try {
-      for (const endpoint of endpoints) {
-        const response2 = await runHealthCheck$1(env2, endpoint, {
-          timeout: 3e4
-        });
-        if (response2.success) {
-          results.push({ endpoint, result: response2.data });
-        }
+      const response2 = await runHealthCheck$1(env2, { timeout: 3e4 });
+      if (!response2.success) {
+        throw new Error(response2.error.message);
       }
-      const allHealthy = results.every((r2) => r2.result.healthy);
-      const anyHealthy = results.some((r2) => r2.result.healthy);
-      if (allHealthy) {
-        const totalLatency = results.reduce(
-          (sum, r2) => sum + (r2.result.latencyMs ?? 0),
-          0
-        );
-        toast.success("All endpoints healthy", {
-          description: `Workflow and Step endpoints are responding (${totalLatency}ms total)`
-        });
-      } else if (anyHealthy) {
-        const healthy = results.filter((r2) => r2.result.healthy);
-        const unhealthy = results.filter((r2) => !r2.result.healthy);
-        toast.warning("Partial health check success", {
-          description: `${healthy.map((r2) => r2.endpoint).join(", ")} OK; ${unhealthy.map((r2) => `${r2.endpoint}: ${r2.result.error || "failed"}`).join(", ")}`
+      if (response2.data.healthy) {
+        toast.success("Workflow endpoint healthy", {
+          description: `The queue-based check completed in ${response2.data.latencyMs ?? 0}ms.`
         });
       } else {
-        const errors2 = results.map((r2) => `${r2.endpoint}: ${r2.result.error || "failed"}`).join("; ");
         toast.error("Health check failed", {
-          description: errors2
+          description: response2.data.error || "Workflow endpoint is unhealthy."
         });
       }
     } catch (error2) {
@@ -90799,7 +91934,7 @@ function HealthCheckButton() {
       }
     ) }),
     /* @__PURE__ */ jsxRuntimeExports.jsx(TooltipContent, { children: /* @__PURE__ */ jsxRuntimeExports.jsxs("p", { children: [
-      "Run a queue-based health check on workflow and step endpoints.",
+      "Run a queue-based health check on the workflow endpoint.",
       /* @__PURE__ */ jsxRuntimeExports.jsx("br", {}),
       "This bypasses Deployment Protection."
     ] }) })
@@ -90987,533 +92122,6 @@ function Logo({ className } = {}) {
     }
   );
 }
-function pluralize(singular, plural, count2) {
-  return count2 === 1 ? singular : plural;
-}
-function withResolvers$1() {
-  let resolve2;
-  let reject;
-  const promise2 = new Promise((_resolve, _reject) => {
-    resolve2 = _resolve;
-    reject = _reject;
-  });
-  return { promise: promise2, resolve: resolve2, reject };
-}
-function once$1(fn2) {
-  const result = {
-    get value() {
-      const value = fn2();
-      Object.defineProperty(result, "value", { value });
-      return value;
-    }
-  };
-  return result;
-}
-var ms$1;
-var hasRequiredMs;
-function requireMs() {
-  if (hasRequiredMs) return ms$1;
-  hasRequiredMs = 1;
-  var s2 = 1e3;
-  var m2 = s2 * 60;
-  var h2 = m2 * 60;
-  var d2 = h2 * 24;
-  var w2 = d2 * 7;
-  var y2 = d2 * 365.25;
-  ms$1 = function(val, options) {
-    options = options || {};
-    var type = typeof val;
-    if (type === "string" && val.length > 0) {
-      return parse2(val);
-    } else if (type === "number" && isFinite(val)) {
-      return options.long ? fmtLong(val) : fmtShort(val);
-    }
-    throw new Error(
-      "val is not a non-empty string or a valid number. val=" + JSON.stringify(val)
-    );
-  };
-  function parse2(str) {
-    str = String(str);
-    if (str.length > 100) {
-      return;
-    }
-    var match2 = /^(-?(?:\d+)?\.?\d+) *(milliseconds?|msecs?|ms|seconds?|secs?|s|minutes?|mins?|m|hours?|hrs?|h|days?|d|weeks?|w|years?|yrs?|y)?$/i.exec(
-      str
-    );
-    if (!match2) {
-      return;
-    }
-    var n = parseFloat(match2[1]);
-    var type = (match2[2] || "ms").toLowerCase();
-    switch (type) {
-      case "years":
-      case "year":
-      case "yrs":
-      case "yr":
-      case "y":
-        return n * y2;
-      case "weeks":
-      case "week":
-      case "w":
-        return n * w2;
-      case "days":
-      case "day":
-      case "d":
-        return n * d2;
-      case "hours":
-      case "hour":
-      case "hrs":
-      case "hr":
-      case "h":
-        return n * h2;
-      case "minutes":
-      case "minute":
-      case "mins":
-      case "min":
-      case "m":
-        return n * m2;
-      case "seconds":
-      case "second":
-      case "secs":
-      case "sec":
-      case "s":
-        return n * s2;
-      case "milliseconds":
-      case "millisecond":
-      case "msecs":
-      case "msec":
-      case "ms":
-        return n;
-      default:
-        return void 0;
-    }
-  }
-  function fmtShort(ms2) {
-    var msAbs = Math.abs(ms2);
-    if (msAbs >= d2) {
-      return Math.round(ms2 / d2) + "d";
-    }
-    if (msAbs >= h2) {
-      return Math.round(ms2 / h2) + "h";
-    }
-    if (msAbs >= m2) {
-      return Math.round(ms2 / m2) + "m";
-    }
-    if (msAbs >= s2) {
-      return Math.round(ms2 / s2) + "s";
-    }
-    return ms2 + "ms";
-  }
-  function fmtLong(ms2) {
-    var msAbs = Math.abs(ms2);
-    if (msAbs >= d2) {
-      return plural(ms2, msAbs, d2, "day");
-    }
-    if (msAbs >= h2) {
-      return plural(ms2, msAbs, h2, "hour");
-    }
-    if (msAbs >= m2) {
-      return plural(ms2, msAbs, m2, "minute");
-    }
-    if (msAbs >= s2) {
-      return plural(ms2, msAbs, s2, "second");
-    }
-    return ms2 + " ms";
-  }
-  function plural(ms2, msAbs, n, name2) {
-    var isPlural = msAbs >= n * 1.5;
-    return Math.round(ms2 / n) + " " + name2 + (isPlural ? "s" : "");
-  }
-  return ms$1;
-}
-var msExports = requireMs();
-const ms = /* @__PURE__ */ getDefaultExportFromCjs(msExports);
-function parseDurationToDate(param) {
-  if (typeof param === "string") {
-    const durationMs = ms(param);
-    if (typeof durationMs !== "number" || durationMs < 0) {
-      throw new Error(`Invalid duration: "${param}". Expected a valid duration string like "1s", "1m", "1h", etc.`);
-    }
-    return new Date(Date.now() + durationMs);
-  } else if (typeof param === "number") {
-    if (param < 0 || !Number.isFinite(param)) {
-      throw new Error(`Invalid duration: ${param}. Expected a non-negative finite number of milliseconds.`);
-    }
-    return new Date(Date.now() + param);
-  } else if (param instanceof Date || param && typeof param === "object" && typeof param.getTime === "function") {
-    return param instanceof Date ? param : new Date(param.getTime());
-  } else {
-    throw new Error(`Invalid duration parameter. Expected a duration string, number (milliseconds), or Date object.`);
-  }
-}
-const WORKFLOW_ROUTE_BASE = "/.well-known/workflow/v1";
-const BASE_PATH_SYMBOL = Symbol.for("@workflow/core/basePath");
-const globalConfig = globalThis;
-function getWorkflowBasePath() {
-  return globalConfig[BASE_PATH_SYMBOL] ?? "";
-}
-function createWorkflowBaseUrl(origin) {
-  new URL(origin);
-  return `${origin.replace(/[?#].*$/, "").replace(/\/+$/, "")}${getWorkflowBasePath()}`;
-}
-function createWorkflowUrl(baseUrl, route) {
-  const url2 = new URL(baseUrl);
-  url2.pathname = `${url2.pathname.replace(/\/+$/, "")}${WORKFLOW_ROUTE_BASE}/${getWorkflowRouteEndpoint(route)}`;
-  url2.search = route.type === "health" ? "__health" : "";
-  url2.hash = "";
-  return url2.toString();
-}
-function getWorkflowRouteEndpoint(route) {
-  switch (route.type) {
-    case "flow":
-    case "health":
-      return "flow";
-    case "step":
-      return "step";
-    case "manifest":
-      return "manifest.json";
-    case "webhook":
-      return `webhook/${encodeURIComponent(route.token)}`;
-  }
-  const exhaustive = route;
-  return exhaustive;
-}
-function createWorkflowHealthEndpoint() {
-  return `${getWorkflowBasePath()}${WORKFLOW_ROUTE_BASE}/flow?__health`;
-}
-const BASE_URL = "https://workflow-sdk.dev/err";
-function isError(value) {
-  return typeof value === "object" && value !== null && "name" in value && "message" in value;
-}
-function appendFramedDetails(title, details) {
-  if (details.length === 0)
-    return title;
-  const lines = [title];
-  details.forEach((detail, index2) => {
-    const isLast = index2 === details.length - 1;
-    const head = isLast ? "╰▶ " : "├▶ ";
-    const cont = isLast ? "   " : "│  ";
-    const text2 = `${detail.label}: ${detail.value}`;
-    text2.split("\n").forEach((line, i) => lines.push(`${i === 0 ? head : cont}${line}`));
-  });
-  return lines.join("\n");
-}
-function buildFramedDetails(hint2, slug) {
-  const out = [];
-  if (hint2)
-    out.push({ label: "hint", value: hint2 });
-  if (slug)
-    out.push({ label: "docs", value: `${BASE_URL}/${slug}` });
-  return out;
-}
-const ERROR_SLUGS = {
-  WEBHOOK_INVALID_RESPOND_WITH_VALUE: "webhook-invalid-respond-with-value",
-  WEBHOOK_RESPONSE_NOT_SENT: "webhook-response-not-sent",
-  HOOK_CONFLICT: "hook-conflict",
-  RUNTIME_DECRYPTION_FAILED: "runtime-decryption-failed"
-};
-class WorkflowError extends Error {
-  constructor(message2, options) {
-    const msgDocs = appendFramedDetails(message2, buildFramedDetails(void 0, options == null ? void 0 : options.slug));
-    super(msgDocs, { cause: options == null ? void 0 : options.cause });
-    __publicField(this, "cause");
-    if ((options == null ? void 0 : options.cause) !== void 0) {
-      this.cause = options.cause;
-    }
-    if ((options == null ? void 0 : options.cause) instanceof Error) {
-      this.stack = `${this.stack}
-Caused by: ${options.cause.stack}`;
-    }
-  }
-  static is(value) {
-    return isError(value) && value.name === "WorkflowError";
-  }
-}
-class WorkflowWorldError extends WorkflowError {
-  constructor(message2, options) {
-    super(message2, {
-      cause: options == null ? void 0 : options.cause
-    });
-    __publicField(this, "status");
-    __publicField(this, "code");
-    __publicField(this, "url");
-    /** Retry-After value in seconds, present on 429 and 425 responses */
-    __publicField(this, "retryAfter");
-    this.name = "WorkflowWorldError";
-    this.status = options == null ? void 0 : options.status;
-    this.code = options == null ? void 0 : options.code;
-    this.url = options == null ? void 0 : options.url;
-    this.retryAfter = options == null ? void 0 : options.retryAfter;
-  }
-  static is(value) {
-    return isError(value) && value.name === "WorkflowWorldError";
-  }
-}
-class WorkflowRunFailedError extends WorkflowError {
-  constructor(runId, error2, options = {}) {
-    const message2 = error2 instanceof Error ? error2.message : typeof error2 === "string" ? error2 : error2 && typeof error2 === "object" && "message" in error2 ? String(error2.message) : "Unknown error";
-    super(`Workflow run "${runId}" failed: ${message2}`, {
-      cause: error2
-    });
-    __publicField(this, "runId");
-    /**
-     * The high-level error category (e.g. USER_ERROR, RUNTIME_ERROR) for the
-     * failed run, from the run_failed event's `errorCode` field.
-     */
-    __publicField(this, "errorCode");
-    this.name = "WorkflowRunFailedError";
-    this.runId = runId;
-    if (options.errorCode !== void 0) {
-      this.errorCode = options.errorCode;
-    }
-  }
-  static is(value) {
-    return isError(value) && value.name === "WorkflowRunFailedError";
-  }
-}
-class WorkflowRunNotCompletedError extends WorkflowError {
-  constructor(runId, status) {
-    super(`Workflow run "${runId}" has not completed`, {});
-    __publicField(this, "runId");
-    __publicField(this, "status");
-    this.name = "WorkflowRunNotCompletedError";
-    this.runId = runId;
-    this.status = status;
-  }
-  static is(value) {
-    return isError(value) && value.name === "WorkflowRunNotCompletedError";
-  }
-}
-class WorkflowRuntimeError extends WorkflowError {
-  constructor(message2, options) {
-    super(message2, {
-      ...options
-    });
-    this.name = "WorkflowRuntimeError";
-  }
-  static is(value) {
-    return isError(value) && value.name === "WorkflowRuntimeError";
-  }
-}
-class RuntimeDecryptionError extends WorkflowRuntimeError {
-  constructor(message2, options) {
-    super(message2, {
-      cause: options == null ? void 0 : options.cause,
-      slug: ERROR_SLUGS.RUNTIME_DECRYPTION_FAILED
-    });
-    this.name = "RuntimeDecryptionError";
-    if ((options == null ? void 0 : options.context) !== void 0) {
-      this.context = options.context;
-    }
-  }
-  static is(value) {
-    return isError(value) && value.name === "RuntimeDecryptionError";
-  }
-}
-class SerializationError extends WorkflowError {
-  constructor(message2, options) {
-    const body2 = appendFramedDetails(message2, buildFramedDetails(options == null ? void 0 : options.hint, void 0));
-    super(body2, { cause: options == null ? void 0 : options.cause });
-    __publicField(this, "hint");
-    /**
-     * Serialization errors are deterministic — if a step returns a non-POJO,
-     * replaying the step will always produce the same non-serializable value.
-     * Retrying is guaranteed to fail, so these errors are surfaced as fatal
-     * and skip the step-retry loop. `FatalError.is()` recognizes any error
-     * with `fatal: true` (see `packages/errors/src/index.ts`), so no other
-     * wiring is required for user-thrown SerializationErrors.
-     */
-    __publicField(this, "fatal", true);
-    this.name = "SerializationError";
-    this.hint = options == null ? void 0 : options.hint;
-  }
-  static is(value) {
-    return isError(value) && value.name === "SerializationError";
-  }
-}
-class WorkflowRunNotFoundError extends WorkflowError {
-  constructor(runId) {
-    super(`Workflow run "${runId}" not found`, {});
-    __publicField(this, "runId");
-    this.name = "WorkflowRunNotFoundError";
-    this.runId = runId;
-  }
-  static is(value) {
-    return isError(value) && value.name === "WorkflowRunNotFoundError";
-  }
-}
-class HookConflictError extends WorkflowError {
-  constructor(token, conflictingRunId) {
-    super(`Hook token "${token}" is already in use by another workflow${conflictingRunId ? ` (run "${conflictingRunId}")` : ""}`, {
-      slug: ERROR_SLUGS.HOOK_CONFLICT
-    });
-    __publicField(this, "token");
-    // TODO: Make this required once all persisted hook_conflict events and World
-    // implementations always include the active hook owner's run ID.
-    __publicField(this, "conflictingRunId");
-    this.name = "HookConflictError";
-    this.token = token;
-    if (conflictingRunId !== void 0) {
-      this.conflictingRunId = conflictingRunId;
-    }
-  }
-  static is(value) {
-    return isError(value) && value.name === "HookConflictError";
-  }
-}
-class HookNotFoundError extends WorkflowError {
-  constructor(token) {
-    super("Hook not found", {});
-    __publicField(this, "token");
-    this.name = "HookNotFoundError";
-    this.token = token;
-  }
-  static is(value) {
-    return isError(value) && value.name === "HookNotFoundError";
-  }
-}
-class EntityConflictError extends WorkflowWorldError {
-  constructor(message2) {
-    super(message2);
-    this.name = "EntityConflictError";
-  }
-  static is(value) {
-    return isError(value) && value.name === "EntityConflictError";
-  }
-}
-class RunExpiredError extends WorkflowWorldError {
-  constructor(message2) {
-    super(message2);
-    this.name = "RunExpiredError";
-  }
-  static is(value) {
-    return isError(value) && value.name === "RunExpiredError";
-  }
-}
-class TooEarlyError extends WorkflowWorldError {
-  constructor(message2, options) {
-    super(message2, { retryAfter: options == null ? void 0 : options.retryAfter });
-    this.name = "TooEarlyError";
-  }
-  static is(value) {
-    return isError(value) && value.name === "TooEarlyError";
-  }
-}
-class ThrottleError extends WorkflowWorldError {
-  constructor(message2, options) {
-    super(message2);
-    __publicField(this, "retryAfter");
-    this.name = "ThrottleError";
-    this.retryAfter = options == null ? void 0 : options.retryAfter;
-  }
-  static is(value) {
-    return isError(value) && value.name === "ThrottleError";
-  }
-}
-class PreconditionFailedError extends WorkflowWorldError {
-  constructor(message2, options) {
-    super(message2, { status: 412, retryAfter: options == null ? void 0 : options.retryAfter });
-    this.name = "PreconditionFailedError";
-  }
-  static is(value) {
-    return isError(value) && value.name === "PreconditionFailedError";
-  }
-}
-class WorkflowRunCancelledError extends WorkflowError {
-  constructor(runId) {
-    super(`Workflow run "${runId}" cancelled`, {});
-    __publicField(this, "runId");
-    this.name = "WorkflowRunCancelledError";
-    this.runId = runId;
-  }
-  static is(value) {
-    return isError(value) && value.name === "WorkflowRunCancelledError";
-  }
-}
-class RunNotSupportedError extends WorkflowError {
-  constructor(runSpecVersion, worldSpecVersion) {
-    super(`Run requires spec version ${runSpecVersion}, but world supports version ${worldSpecVersion}. Please upgrade 'workflow' package.`);
-    __publicField(this, "runSpecVersion");
-    __publicField(this, "worldSpecVersion");
-    this.name = "RunNotSupportedError";
-    this.runSpecVersion = runSpecVersion;
-    this.worldSpecVersion = worldSpecVersion;
-  }
-  static is(value) {
-    return isError(value) && value.name === "RunNotSupportedError";
-  }
-}
-class FatalError extends Error {
-  constructor(message2) {
-    super(message2);
-    __publicField(this, "fatal", true);
-    this.name = "FatalError";
-  }
-  static is(value) {
-    if (!isError(value))
-      return false;
-    if (value.name === "FatalError")
-      return true;
-    return value.fatal === true;
-  }
-}
-class RetryableError extends Error {
-  constructor(message2, options = {}) {
-    super(message2);
-    /**
-     * The Date when the step should be retried.
-     */
-    __publicField(this, "retryAfter");
-    this.name = "RetryableError";
-    if (options.retryAfter !== void 0) {
-      this.retryAfter = parseDurationToDate(options.retryAfter);
-    } else {
-      this.retryAfter = new Date(Date.now() + 1e3);
-    }
-  }
-  static is(value) {
-    return isError(value) && value.name === "RetryableError";
-  }
-}
-const VERCEL_403_ERROR_MESSAGE = "Your current vercel account does not have access to this resource. Use `vercel login` or `vercel switch` to ensure you are linked to the right account.";
-const FATAL_ERROR_KEY = Symbol.for("@workflow/errors//FatalError");
-const RETRYABLE_ERROR_KEY = Symbol.for("@workflow/errors//RetryableError");
-const HOOK_CONFLICT_ERROR_KEY = Symbol.for("@workflow/errors//HookConflictError");
-const RUNTIME_DECRYPTION_ERROR_KEY = Symbol.for("@workflow/errors//RuntimeDecryptionError");
-if (typeof globalThis !== "undefined") {
-  if (!Object.hasOwn(globalThis, FATAL_ERROR_KEY)) {
-    Object.defineProperty(globalThis, FATAL_ERROR_KEY, {
-      value: FatalError,
-      writable: false,
-      enumerable: false,
-      configurable: false
-    });
-  }
-  if (!Object.hasOwn(globalThis, RETRYABLE_ERROR_KEY)) {
-    Object.defineProperty(globalThis, RETRYABLE_ERROR_KEY, {
-      value: RetryableError,
-      writable: false,
-      enumerable: false,
-      configurable: false
-    });
-  }
-  if (!Object.hasOwn(globalThis, HOOK_CONFLICT_ERROR_KEY)) {
-    Object.defineProperty(globalThis, HOOK_CONFLICT_ERROR_KEY, {
-      value: HookConflictError,
-      writable: false,
-      enumerable: false,
-      configurable: false
-    });
-  }
-  if (!Object.hasOwn(globalThis, RUNTIME_DECRYPTION_ERROR_KEY)) {
-    Object.defineProperty(globalThis, RUNTIME_DECRYPTION_ERROR_KEY, {
-      value: RuntimeDecryptionError,
-      writable: false,
-      enumerable: false,
-      configurable: false
-    });
-  }
-}
 const RETRYABLE_WORLD_ERROR_CODES = /* @__PURE__ */ new Set(["TRANSPORT", "TIMEOUT"]);
 function isRetryableWorldError(err) {
   if (ThrottleError.is(err)) {
@@ -91538,7 +92146,7 @@ const colorEnabled = (() => {
     return false;
   return Boolean((_a3 = p2.stdout) == null ? void 0 : _a3.isTTY);
 })();
-const sgr = (open, close) => (s2) => colorEnabled ? `\x1B[${open}m${s2}\x1B[${close}m` : s2;
+const sgr = (open2, close) => (s2) => colorEnabled ? `\x1B[${open2}m${s2}\x1B[${close}m` : s2;
 const chalk = {
   bold: sgr(1, 22),
   dim: sgr(2, 22),
@@ -92033,83 +92641,78 @@ createLogger("adapter");
 createLogger("build", {
   debugNamespace: "workflow:build"
 });
-const NONCE_LENGTH = 12;
-const TAG_LENGTH = 128;
-const KEY_LENGTH = 32;
-async function importKey(raw2, usages = ["encrypt", "decrypt"]) {
-  if (raw2.byteLength !== KEY_LENGTH) {
-    throw new WorkflowRuntimeError(`Encryption key must be exactly ${KEY_LENGTH} bytes, got ${raw2.byteLength}`);
+const RegisteredStepsKey = Symbol.for("@workflow/core//registeredSteps");
+const globalSymbols$1 = globalThis;
+const registeredSteps = globalSymbols$1[RegisteredStepsKey] ?? (globalSymbols$1[RegisteredStepsKey] = /* @__PURE__ */ new Map());
+const BUILTIN_RESPONSE_STEP_NAMES = /* @__PURE__ */ new Set([
+  "__builtin_response_array_buffer",
+  "__builtin_response_json",
+  "__builtin_response_text"
+]);
+function getStepIdAliasCandidates(stepId) {
+  const parts = stepId.split("//");
+  if (parts.length !== 3 || parts[0] !== "step") {
+    return [];
   }
-  return globalThis.crypto.subtle.importKey(
-    "raw",
-    raw2,
-    "AES-GCM",
-    false,
-    // `KeyUsage` is a DOM-lib type that's not in scope under `es2022`.
-    // The `ReadonlyArray<'encrypt' | 'decrypt'>` parameter type matches
-    // a strict subset of `KeyUsage[]`, so this cast is sound.
-    usages
-  );
+  const modulePath = parts[1];
+  const fnName = parts[2];
+  const modulePathAliases = /* @__PURE__ */ new Set();
+  const addAlias = (aliasModulePath) => {
+    if (aliasModulePath !== modulePath) {
+      modulePathAliases.add(aliasModulePath);
+    }
+  };
+  if (modulePath.startsWith("./workflows/")) {
+    const workflowRelativePath = modulePath.slice("./".length);
+    addAlias(`./example/${workflowRelativePath}`);
+    addAlias(`./src/${workflowRelativePath}`);
+  } else if (modulePath.startsWith("./example/workflows/")) {
+    const workflowRelativePath = modulePath.slice("./example/".length);
+    addAlias(`./${workflowRelativePath}`);
+    addAlias(`./src/${workflowRelativePath}`);
+  } else if (modulePath.startsWith("./src/workflows/")) {
+    const workflowRelativePath = modulePath.slice("./src/".length);
+    addAlias(`./${workflowRelativePath}`);
+    addAlias(`./example/${workflowRelativePath}`);
+  }
+  return Array.from(modulePathAliases, (aliasModulePath) => `step//${aliasModulePath}//${fnName}`);
 }
-async function encrypt$1(key, data) {
-  const nonce = globalThis.crypto.getRandomValues(new Uint8Array(NONCE_LENGTH));
-  let ciphertext;
-  try {
-    ciphertext = await globalThis.crypto.subtle.encrypt({ name: "AES-GCM", iv: nonce, tagLength: TAG_LENGTH }, key, data);
-  } catch (cause) {
-    throw new RuntimeDecryptionError(`AES-256-GCM encryption failed: ${cause instanceof Error ? cause.message : String(cause)}`, {
-      cause,
-      context: {
-        operation: "encrypt",
-        byteLength: data.byteLength
-      }
-    });
+function getBuiltinResponseStepAlias(stepId) {
+  if (!BUILTIN_RESPONSE_STEP_NAMES.has(stepId)) {
+    return void 0;
   }
-  const result = new Uint8Array(NONCE_LENGTH + ciphertext.byteLength);
-  result.set(nonce, 0);
-  result.set(new Uint8Array(ciphertext), NONCE_LENGTH);
-  return result;
+  for (const [registeredStepId, stepFn] of registeredSteps.entries()) {
+    if (registeredStepId.endsWith(`//${stepId}`)) {
+      return stepFn;
+    }
+  }
+  return void 0;
 }
-async function decrypt$1(key, data) {
-  const minLength = NONCE_LENGTH + TAG_LENGTH / 8;
-  if (data.byteLength < minLength) {
-    throw new RuntimeDecryptionError(`Encrypted data too short: expected at least ${minLength} bytes, got ${data.byteLength}`, {
-      context: {
-        operation: "decrypt",
-        byteLength: data.byteLength
-      }
-    });
+function getStepFunction(stepId) {
+  const directMatch = registeredSteps.get(stepId);
+  if (directMatch) {
+    return directMatch;
   }
-  const nonce = data.subarray(0, NONCE_LENGTH);
-  const ciphertext = data.subarray(NONCE_LENGTH);
-  let plaintext;
-  try {
-    plaintext = await globalThis.crypto.subtle.decrypt({ name: "AES-GCM", iv: nonce, tagLength: TAG_LENGTH }, key, ciphertext);
-  } catch (cause) {
-    const causeMsg = cause instanceof Error ? cause.message : String(cause);
-    throw new RuntimeDecryptionError(`AES-256-GCM decryption failed: ${causeMsg}`, {
-      cause,
-      context: {
-        operation: "decrypt",
-        byteLength: data.byteLength
-      }
-    });
+  for (const aliasStepId of getStepIdAliasCandidates(stepId)) {
+    const aliasMatch = registeredSteps.get(aliasStepId);
+    if (aliasMatch) {
+      return aliasMatch;
+    }
   }
-  return new Uint8Array(plaintext);
+  const builtinAliasMatch = getBuiltinResponseStepAlias(stepId);
+  if (builtinAliasMatch) {
+    return builtinAliasMatch;
+  }
+  return void 0;
 }
-const encryption = /* @__PURE__ */ Object.freeze(/* @__PURE__ */ Object.defineProperty({
-  __proto__: null,
-  decrypt: decrypt$1,
-  encrypt: encrypt$1,
-  importKey
-}, Symbol.toStringTag, { value: "Module" }));
 const STABLE_ULID = Symbol.for("WORKFLOW_STABLE_ULID");
 const STREAM_NAME_SYMBOL = Symbol.for("WORKFLOW_STREAM_NAME");
 const STREAM_TYPE_SYMBOL = Symbol.for("WORKFLOW_STREAM_TYPE");
 const STREAM_FRAMING_SYMBOL = Symbol.for("WORKFLOW_STREAM_FRAMING");
 const STREAM_SERVER_RUN_ID_SYMBOL = Symbol.for("WORKFLOW_STREAM_SERVER_RUN_ID");
 const STREAM_SERVER_DEPLOYMENT_ID_SYMBOL = Symbol.for("WORKFLOW_STREAM_SERVER_DEPLOYMENT_ID");
-const STREAM_WRITE_BATCH_SYMBOL = Symbol.for("WORKFLOW_STREAM_WRITE_BATCH");
+const STREAM_SERVER_PUBLIC_KEY_SYMBOL = Symbol.for("WORKFLOW_STREAM_SERVER_PUBLIC_KEY");
+const STREAM_DRAIN_SYMBOL = Symbol.for("WORKFLOW_STREAM_DRAIN");
 const BODY_INIT_SYMBOL = Symbol.for("BODY_INIT");
 const WEBHOOK_RESPONSE_WRITABLE = Symbol.for("WEBHOOK_RESPONSE_WRITABLE");
 const WORKFLOW_CLASS_REGISTRY = Symbol.for("workflow-class-registry");
@@ -92132,6 +92735,11 @@ const getMaxBytesPerBatch = () => envNumber("WORKFLOW_STREAM_MAX_BYTES_PER_BATCH
   integer: true,
   min: 1
 });
+const MAX_BUFFERED_BYTES = 8 * 1024 * 1024;
+const getMaxBufferedBytes = () => envNumber("WORKFLOW_STREAM_MAX_BUFFERED_BYTES", MAX_BUFFERED_BYTES, {
+  integer: true,
+  min: 1
+});
 const LOCK_POLL_INTERVAL_MS = 10;
 const getLockPollIntervalMs = () => envNumber("WORKFLOW_LOCK_POLL_INTERVAL_MS", LOCK_POLL_INTERVAL_MS, {
   integer: true,
@@ -92180,6 +92788,14 @@ function isReadableUnlockedNotClosed(readable2) {
   }
   return true;
 }
+function resolveAfterDrain(state) {
+  const barrier = state.drainBarrier;
+  if (!barrier) {
+    state.resolve();
+    return;
+  }
+  barrier().then(() => state.resolve(), (err) => state.reject(err));
+}
 function pollWritableLock(writable, state) {
   if (state.writablePollingInterval !== void 0) {
     return;
@@ -92192,9 +92808,9 @@ function pollWritableLock(writable, state) {
     }
     if (isWritableUnlockedNotClosed(writable) && state.pendingOps === 0) {
       state.doneResolved = true;
-      state.resolve();
       clearInterval(intervalId);
       state.writablePollingInterval = void 0;
+      resolveAfterDrain(state);
     }
   }, getLockPollIntervalMs());
   state.writablePollingInterval = intervalId;
@@ -92211,16 +92827,19 @@ function pollReadableLock(readable2, state) {
     }
     if (isReadableUnlockedNotClosed(readable2) && state.pendingOps === 0) {
       state.doneResolved = true;
-      state.resolve();
       clearInterval(intervalId);
       state.readablePollingInterval = void 0;
+      resolveAfterDrain(state);
     }
   }, getLockPollIntervalMs());
   state.readablePollingInterval = intervalId;
 }
 function flushablePipe(source, sink, state) {
-  const batchWrite = sink[STREAM_WRITE_BATCH_SYMBOL];
-  return typeof batchWrite === "function" ? flushablePipeCoalescing(source, sink, state, batchWrite) : flushablePipePerChunk(source, sink, state);
+  const drain = sink[STREAM_DRAIN_SYMBOL];
+  if (typeof drain === "function") {
+    state.drainBarrier = drain;
+  }
+  return flushablePipePerChunk(source, sink, state);
 }
 async function flushablePipePerChunk(source, sink, state) {
   const reader = source.getReader();
@@ -92259,124 +92878,10 @@ async function flushablePipePerChunk(source, sink, state) {
   } catch (err) {
     state.streamEnded = true;
     cancelReason = err;
-    if (!state.doneResolved) {
-      state.doneResolved = true;
-      state.reject(err);
-    }
-    throw err;
-  } finally {
-    reader.cancel(cancelReason).catch(() => {
-    });
-    reader.releaseLock();
-    writer.releaseLock();
-  }
-}
-function wake$1(ctx, which) {
-  const resolve2 = ctx[which];
-  if (resolve2) {
-    ctx[which] = null;
-    resolve2();
-  }
-}
-function nextBatchSize(ctx) {
-  let count2 = 0;
-  let bytes = 0;
-  for (const chunk of ctx.queue) {
-    if (count2 >= ctx.maxChunksPerBatch)
-      break;
-    if (count2 > 0 && bytes + chunk.byteLength > ctx.maxBytesPerBatch)
-      break;
-    count2++;
-    bytes += chunk.byteLength;
-  }
-  return count2;
-}
-async function drainBatches(ctx) {
-  while (true) {
-    if (ctx.queue.length === 0) {
-      if (ctx.sourceDone)
-        return;
-      await new Promise((resolve2) => {
-        ctx.wakeConsumer = resolve2;
+    if (state.drainBarrier) {
+      await state.drainBarrier().catch(() => {
       });
-      continue;
     }
-    const count2 = nextBatchSize(ctx);
-    const batch = ctx.queue.slice(0, count2);
-    ctx.queue = ctx.queue.slice(count2);
-    await ctx.batchWrite(batch);
-    ctx.state.pendingOps -= batch.length;
-    wake$1(ctx, "wakeProducer");
-  }
-}
-function readNextChunk(reader, writer, consumer) {
-  return Promise.race([
-    reader.read(),
-    writer.closed.then(() => {
-      throw new WorkflowRuntimeError("Writable stream closed prematurely");
-    }),
-    consumer.then(() => {
-      throw new WorkflowRuntimeError("Stream consumer ended prematurely");
-    }, (err) => {
-      throw err;
-    })
-  ]);
-}
-async function awaitBackpressureRelief(ctx, consumer, maxInflight) {
-  if (ctx.state.pendingOps < maxInflight)
-    return;
-  await Promise.race([
-    new Promise((resolve2) => {
-      ctx.wakeProducer = resolve2;
-    }),
-    consumer.then(() => void 0, () => void 0)
-  ]);
-}
-async function flushablePipeCoalescing(source, sink, state, batchWrite) {
-  const reader = source.getReader();
-  const writer = sink.getWriter();
-  const maxInflight = getMaxInflightChunks();
-  let cancelReason;
-  const ctx = {
-    state,
-    batchWrite,
-    queue: [],
-    sourceDone: false,
-    wakeConsumer: null,
-    wakeProducer: null,
-    maxChunksPerBatch: getMaxChunksPerBatch(),
-    maxBytesPerBatch: getMaxBytesPerBatch()
-  };
-  const consumer = drainBatches(ctx);
-  try {
-    while (!state.streamEnded) {
-      const readResult = await readNextChunk(reader, writer, consumer);
-      if (state.streamEnded)
-        return;
-      if (readResult.done) {
-        ctx.sourceDone = true;
-        wake$1(ctx, "wakeConsumer");
-        await consumer;
-        state.streamEnded = true;
-        await writer.close();
-        if (!state.doneResolved) {
-          state.doneResolved = true;
-          state.resolve();
-        }
-        return;
-      }
-      ctx.queue.push(readResult.value);
-      state.pendingOps++;
-      wake$1(ctx, "wakeConsumer");
-      await awaitBackpressureRelief(ctx, consumer, maxInflight);
-    }
-  } catch (err) {
-    state.streamEnded = true;
-    cancelReason = err;
-    ctx.sourceDone = true;
-    wake$1(ctx, "wakeConsumer");
-    await consumer.catch(() => {
-    });
     if (!state.doneResolved) {
       state.doneResolved = true;
       state.reject(err);
@@ -92389,70 +92894,6 @@ async function flushablePipeCoalescing(source, sink, state, batchWrite) {
     writer.releaseLock();
   }
 }
-const RegisteredStepsKey = Symbol.for("@workflow/core//registeredSteps");
-const globalSymbols$1 = globalThis;
-const registeredSteps = globalSymbols$1[RegisteredStepsKey] ?? (globalSymbols$1[RegisteredStepsKey] = /* @__PURE__ */ new Map());
-const BUILTIN_RESPONSE_STEP_NAMES = /* @__PURE__ */ new Set([
-  "__builtin_response_array_buffer",
-  "__builtin_response_json",
-  "__builtin_response_text"
-]);
-function getStepIdAliasCandidates(stepId) {
-  const parts = stepId.split("//");
-  if (parts.length !== 3 || parts[0] !== "step") {
-    return [];
-  }
-  const modulePath = parts[1];
-  const fnName = parts[2];
-  const modulePathAliases = /* @__PURE__ */ new Set();
-  const addAlias = (aliasModulePath) => {
-    if (aliasModulePath !== modulePath) {
-      modulePathAliases.add(aliasModulePath);
-    }
-  };
-  if (modulePath.startsWith("./workflows/")) {
-    const workflowRelativePath = modulePath.slice("./".length);
-    addAlias(`./example/${workflowRelativePath}`);
-    addAlias(`./src/${workflowRelativePath}`);
-  } else if (modulePath.startsWith("./example/workflows/")) {
-    const workflowRelativePath = modulePath.slice("./example/".length);
-    addAlias(`./${workflowRelativePath}`);
-    addAlias(`./src/${workflowRelativePath}`);
-  } else if (modulePath.startsWith("./src/workflows/")) {
-    const workflowRelativePath = modulePath.slice("./src/".length);
-    addAlias(`./${workflowRelativePath}`);
-    addAlias(`./example/${workflowRelativePath}`);
-  }
-  return Array.from(modulePathAliases, (aliasModulePath) => `step//${aliasModulePath}//${fnName}`);
-}
-function getBuiltinResponseStepAlias(stepId) {
-  if (!BUILTIN_RESPONSE_STEP_NAMES.has(stepId)) {
-    return void 0;
-  }
-  for (const [registeredStepId, stepFn] of registeredSteps.entries()) {
-    if (registeredStepId.endsWith(`//${stepId}`)) {
-      return stepFn;
-    }
-  }
-  return void 0;
-}
-function getStepFunction(stepId) {
-  const directMatch = registeredSteps.get(stepId);
-  if (directMatch) {
-    return directMatch;
-  }
-  for (const aliasStepId of getStepIdAliasCandidates(stepId)) {
-    const aliasMatch = registeredSteps.get(aliasStepId);
-    if (aliasMatch) {
-      return aliasMatch;
-    }
-  }
-  const builtinAliasMatch = getBuiltinResponseStepAlias(stepId);
-  if (builtinAliasMatch) {
-    return builtinAliasMatch;
-  }
-  return void 0;
-}
 function assertWorldSupportsRuntimeProtocol(world) {
   if (world.specVersion === SPEC_VERSION_CURRENT) {
     return;
@@ -92928,19 +93369,6 @@ function getStepFunctionReviver(global2 = globalThis) {
     }
   };
 }
-function isFormatPrefix(value) {
-  return value.length === 4 && /^[a-z0-9]{4}$/.test(value);
-}
-const SerializationFormat = {
-  /** devalue stringify/parse with TextEncoder/TextDecoder */
-  DEVALUE_V1: "devl",
-  /** Encrypted payload (inner payload has its own format prefix) */
-  ENCRYPTED: "encr",
-  /** Gzip-compressed payload (inner payload has its own format prefix) */
-  GZIP: "gzip",
-  /** Zstandard-compressed payload (inner payload has its own format prefix) */
-  ZSTD: "zstd"
-};
 const encoder = new TextEncoder();
 const decoder = new TextDecoder();
 function getReducersForMode(mode, global2 = globalThis, extraReducers) {
@@ -93003,7 +93431,7 @@ function getReviversForMode(mode, global2 = globalThis, extraRevivers) {
   return base;
 }
 const devalueCodec = {
-  formatPrefix: SerializationFormat.DEVALUE_V1,
+  formatPrefix: SerializationFormat$1.DEVALUE_V1,
   serialize(value, mode, options) {
     const reducers = getReducersForMode(mode, options == null ? void 0 : options.global, options == null ? void 0 : options.extraReducers);
     const str = stringify$2(value, reducers);
@@ -93019,45 +93447,6 @@ const devalueCodec = {
     return unflatten(data, revivers);
   }
 };
-const FORMAT_PREFIX_LENGTH$1 = 4;
-const formatEncoder = new TextEncoder();
-const formatDecoder$1 = new TextDecoder();
-function encodeWithFormatPrefix(format2, payload) {
-  if (!(payload instanceof Uint8Array)) {
-    return payload;
-  }
-  const prefixBytes = formatEncoder.encode(format2);
-  const result = new Uint8Array(FORMAT_PREFIX_LENGTH$1 + payload.length);
-  result.set(prefixBytes, 0);
-  result.set(payload, FORMAT_PREFIX_LENGTH$1);
-  return result;
-}
-function peekFormatPrefix$1(data) {
-  if (!(data instanceof Uint8Array) || data.length < FORMAT_PREFIX_LENGTH$1) {
-    return null;
-  }
-  const prefixBytes = data.subarray(0, FORMAT_PREFIX_LENGTH$1);
-  const str = formatDecoder$1.decode(prefixBytes);
-  return isFormatPrefix(str) ? str : null;
-}
-function decodeFormatPrefix(data) {
-  if (!(data instanceof Uint8Array)) {
-    return {
-      format: SerializationFormat.DEVALUE_V1,
-      payload: new TextEncoder().encode(JSON.stringify(data))
-    };
-  }
-  if (data.length < FORMAT_PREFIX_LENGTH$1) {
-    throw new Error(`Data too short to contain format prefix: expected at least ${FORMAT_PREFIX_LENGTH$1} bytes, got ${data.length}`);
-  }
-  const prefixBytes = data.subarray(0, FORMAT_PREFIX_LENGTH$1);
-  const str = formatDecoder$1.decode(prefixBytes);
-  if (!isFormatPrefix(str)) {
-    throw new Error(`Invalid format prefix: "${str}". Must be 4 characters of [a-z0-9].`);
-  }
-  const payload = data.subarray(FORMAT_PREFIX_LENGTH$1);
-  return { format: str, payload };
-}
 const COMPRESSION_MIN_BYTES = 1024;
 const COMPRESSION_MIN_SAVINGS_RATIO = 0.05;
 const ZSTD_LEVEL = 3;
@@ -93169,7 +93558,7 @@ async function compress(data, enabled, stats2) {
     return data;
   }
   const compressed = codec2 === "zstd" ? zstdBytes(data) : await gzipBytes(data);
-  const format2 = codec2 === "zstd" ? SerializationFormat.ZSTD : SerializationFormat.GZIP;
+  const format2 = codec2 === "zstd" ? SerializationFormat$1.ZSTD : SerializationFormat$1.GZIP;
   const wrappedLength = 4 + compressed.length;
   if (wrappedLength >= data.length * (1 - COMPRESSION_MIN_SAVINGS_RATIO)) {
     recordStats(stats2, "none", data.length, data.length);
@@ -93182,17 +93571,17 @@ async function decompress$2(data, stats2) {
   if (!(data instanceof Uint8Array))
     return data;
   const prefix = peekFormatPrefix$1(data);
-  if (prefix === SerializationFormat.ZSTD) {
-    const { payload } = decodeFormatPrefix(data);
+  if (prefix === SerializationFormat$1.ZSTD) {
+    const { payload } = decodeFormatPrefix$1(data);
     const inflated = unzstdBytes(payload);
     recordStats(stats2, "zstd", inflated.length, data.length);
     return inflated;
   }
-  if (prefix === SerializationFormat.GZIP) {
+  if (prefix === SerializationFormat$1.GZIP) {
     if (!isGzipAvailable()) {
       throw new Error("Compressed (gzip) workflow data encountered but DecompressionStream is not available in this runtime. Node.js 18+, browsers, and edge runtimes all support it.");
     }
-    const { payload } = decodeFormatPrefix(data);
+    const { payload } = decodeFormatPrefix$1(data);
     const inflated = await gunzipBytes(payload);
     recordStats(stats2, "gzip", inflated.length, data.length);
     return inflated;
@@ -93200,40 +93589,6 @@ async function decompress$2(data, stats2) {
   recordStats(stats2, "none", data.length, data.length);
   return data;
 }
-async function resolveEncryptionKey(key) {
-  return typeof key === "function" ? key() : key;
-}
-async function encrypt(data, key) {
-  if (!key || !(data instanceof Uint8Array))
-    return data;
-  const encrypted = await encrypt$1(key, data);
-  return encodeWithFormatPrefix(SerializationFormat.ENCRYPTED, encrypted);
-}
-async function decrypt(data, key) {
-  if (!(data instanceof Uint8Array))
-    return data;
-  const format2 = peekFormatPrefix$1(data);
-  if (format2 === SerializationFormat.ENCRYPTED && !key) {
-    throw new RuntimeDecryptionError("Encrypted data encountered but no encryption key is available. Encryption is not configured or no key was provided for this run.", {
-      context: {
-        operation: "decrypt",
-        byteLength: data.byteLength,
-        formatPrefix: "encr"
-      }
-    });
-  }
-  if (format2 !== SerializationFormat.ENCRYPTED)
-    return data;
-  const { payload } = decodeFormatPrefix(data);
-  try {
-    return await decrypt$1(key, payload);
-  } catch (error2) {
-    if (RuntimeDecryptionError.is(error2) && error2.context) {
-      error2.context.formatPrefix = format2;
-    }
-    throw error2;
-  }
-}
 function rethrowIfRuntimeError(error2) {
   if (RuntimeDecryptionError.is(error2)) {
     throw error2;
@@ -93257,7 +93612,7 @@ function formatSerializationError(context, error2) {
 async function serialize$3(value, encryptionKey, options) {
   try {
     const payload = devalueCodec.serialize(value, "client", options);
-    const prefixed = encodeWithFormatPrefix(SerializationFormat.DEVALUE_V1, payload);
+    const prefixed = encodeWithFormatPrefix(SerializationFormat$1.DEVALUE_V1, payload);
     const compressed = await compress(prefixed, (options == null ? void 0 : options.compression) === true, options == null ? void 0 : options.compressionStats);
     return encrypt(compressed, encryptionKey);
   } catch (error2) {
@@ -93274,8 +93629,8 @@ async function deserialize$2(data, encryptionKey, options) {
     }
     throw new Error("Cannot deserialize non-binary data without legacy support");
   }
-  const { format: format2, payload } = decodeFormatPrefix(decrypted);
-  if (format2 === SerializationFormat.DEVALUE_V1) {
+  const { format: format2, payload } = decodeFormatPrefix$1(decrypted);
+  if (format2 === SerializationFormat$1.DEVALUE_V1) {
     return devalueCodec.deserialize(payload, "client", options);
   }
   throw new Error(`Unsupported serialization format: ${format2}`);
@@ -93283,7 +93638,7 @@ async function deserialize$2(data, encryptionKey, options) {
 async function serialize$2(value, encryptionKey, options) {
   try {
     const payload = devalueCodec.serialize(value, "step", options);
-    const prefixed = encodeWithFormatPrefix(SerializationFormat.DEVALUE_V1, payload);
+    const prefixed = encodeWithFormatPrefix(SerializationFormat$1.DEVALUE_V1, payload);
     const compressed = await compress(prefixed, (options == null ? void 0 : options.compression) === true, options == null ? void 0 : options.compressionStats);
     return encrypt(compressed, encryptionKey);
   } catch (error2) {
@@ -93300,8 +93655,8 @@ async function deserialize$1(data, encryptionKey, options) {
     }
     throw new Error("Cannot deserialize non-binary data without legacy support");
   }
-  const { format: format2, payload } = decodeFormatPrefix(decrypted);
-  if (format2 === SerializationFormat.DEVALUE_V1) {
+  const { format: format2, payload } = decodeFormatPrefix$1(decrypted);
+  if (format2 === SerializationFormat$1.DEVALUE_V1) {
     return devalueCodec.deserialize(payload, "step", options);
   }
   throw new Error(`Unsupported serialization format: ${format2}`);
@@ -93313,8 +93668,8 @@ function deserialize(data, options) {
     }
     throw new Error("Cannot deserialize non-binary data without legacy support");
   }
-  const { format: format2, payload } = decodeFormatPrefix(data);
-  if (format2 === SerializationFormat.DEVALUE_V1) {
+  const { format: format2, payload } = decodeFormatPrefix$1(data);
+  if (format2 === SerializationFormat$1.DEVALUE_V1) {
     return devalueCodec.deserialize(payload, "workflow", options);
   }
   throw new Error(`Unsupported serialization format: ${format2}`);
@@ -93441,20 +93796,28 @@ async function recordCompression(stats2, operation) {
 }
 function getSerializeStream(reducers, cryptoKey) {
   const encoder2 = new TextEncoder();
-  const keyState = { resolved: false, key: void 0 };
+  const keyState = {
+    resolved: false,
+    key: void 0
+  };
+  let sealSession;
   const stream = new TransformStream({
     async transform(chunk, controller) {
       try {
         if (!keyState.resolved) {
           keyState.key = await resolveEncryptionKey(cryptoKey);
           keyState.resolved = true;
+          if (isSealTarget(keyState.key)) {
+            sealSession = createSealSession(keyState.key.recipientPublicKey, keyState.key.aad);
+          }
         }
         const serialized = stringify$2(chunk, reducers);
         const payload = encoder2.encode(serialized);
-        let prefixed = encodeWithFormatPrefix(SerializationFormat.DEVALUE_V1, payload);
-        if (keyState.key) {
-          const encrypted = await encrypt$1(keyState.key, prefixed);
-          prefixed = encodeWithFormatPrefix(SerializationFormat.ENCRYPTED, encrypted);
+        let prefixed = encodeWithFormatPrefix(SerializationFormat$1.DEVALUE_V1, payload);
+        if (sealSession) {
+          prefixed = encodeWithFormatPrefix(SerializationFormat$1.SEALED, await sealSession.seal(prefixed));
+        } else if (keyState.key) {
+          prefixed = await encrypt(prefixed, keyState.key);
         }
         const frame2 = new Uint8Array(FRAME_HEADER_SIZE$1 + prefixed.length);
         new DataView(frame2.buffer).setUint32(0, prefixed.length, false);
@@ -93475,7 +93838,11 @@ function getSerializeStream(reducers, cryptoKey) {
 function getDeserializeStream(revivers, cryptoKey) {
   const decoder2 = new TextDecoder();
   let buffer2 = new Uint8Array(0);
-  const keyState = { resolved: false, key: void 0 };
+  const keyState = {
+    resolved: false,
+    key: void 0
+  };
+  let openSession;
   function appendToBuffer(data) {
     const newBuffer = new Uint8Array(buffer2.length + data.length);
     newBuffer.set(buffer2, 0);
@@ -93486,6 +93853,9 @@ function getDeserializeStream(revivers, cryptoKey) {
     if (!keyState.resolved) {
       keyState.key = await resolveEncryptionKey(cryptoKey);
       keyState.resolved = true;
+      if (isRunPayloadKeys(keyState.key)) {
+        openSession = createOpenSession(keyState.key.keyPair, keyState.key.aad);
+      }
     }
     while (buffer2.length >= FRAME_HEADER_SIZE$1) {
       const frameLength = new DataView(buffer2.buffer, buffer2.byteOffset, buffer2.byteLength).getUint32(0, false);
@@ -93494,30 +93864,32 @@ function getDeserializeStream(revivers, cryptoKey) {
       }
       const frameData = buffer2.slice(FRAME_HEADER_SIZE$1, FRAME_HEADER_SIZE$1 + frameLength);
       buffer2 = buffer2.slice(FRAME_HEADER_SIZE$1 + frameLength);
-      let { format: format2, payload } = decodeFormatPrefix(frameData);
-      if (format2 === SerializationFormat.ENCRYPTED) {
-        if (!keyState.key) {
-          controller.error(new RuntimeDecryptionError("Encrypted stream data encountered but no encryption key is available. Encryption is not configured or no key was provided for this run.", {
+      let { format: format2, payload } = decodeFormatPrefix$1(frameData);
+      if (format2 === SerializationFormat$1.ENCRYPTED || format2 === SerializationFormat$1.SEALED) {
+        const sealed = format2 === SerializationFormat$1.SEALED;
+        const usable = sealed ? isRunPayloadKeys(keyState.key) : aesKeyOf(keyState.key) !== void 0;
+        if (!usable) {
+          controller.error(new RuntimeDecryptionError(sealed ? "Sealed stream data encountered but no run keypair is available. Opening a sealed frame requires the run's own encryption key material." : "Encrypted stream data encountered but no encryption key is available. Encryption is not configured or no key was provided for this run.", {
             context: {
               operation: "decrypt",
               byteLength: payload.byteLength,
-              formatPrefix: "encr"
+              formatPrefix: sealed ? "encp" : "encr"
             }
           }));
           return;
         }
         let decrypted;
         try {
-          decrypted = await decrypt$1(keyState.key, payload);
+          decrypted = sealed ? await openSession.open(decodeFormatPrefix$1(frameData).payload) : await decrypt(frameData, keyState.key);
         } catch (error2) {
           if (RuntimeDecryptionError.is(error2) && error2.context) {
             error2.context.formatPrefix = format2;
           }
           throw error2;
         }
-        ({ format: format2, payload } = decodeFormatPrefix(decrypted));
+        ({ format: format2, payload } = decodeFormatPrefix$1(decrypted));
       }
-      if (format2 === SerializationFormat.DEVALUE_V1) {
+      if (format2 === SerializationFormat$1.DEVALUE_V1) {
         const text2 = decoder2.decode(payload);
         controller.enqueue(parse$5(text2, revivers));
       }
@@ -93823,10 +94195,13 @@ function createReconnectingFramedStream(runId, name2, startIndex) {
     }
   });
 }
-const STREAM_FLUSH_INTERVAL_MS = 10;
-const getStreamFlushIntervalMs = () => envNumber("WORKFLOW_STREAM_FLUSH_INTERVAL_MS", STREAM_FLUSH_INTERVAL_MS, {
-  integer: true
-});
+const STREAM_FLUSH_INTERVAL_MS = 0;
+const getEnvStreamFlushIntervalMs = () => {
+  const value = envNumber("WORKFLOW_STREAM_FLUSH_INTERVAL_MS", Number.NaN, {
+    integer: true
+  });
+  return Number.isNaN(value) ? void 0 : value;
+};
 function recordStreamWriteFlush(startEpochMs, dispatchEpochMs, runId, name2, chunkCount, byteCount, rpcMs) {
   void (async () => {
     await recordElapsedSpan("workflow.stream.flush", startEpochMs, {
@@ -93888,112 +94263,190 @@ class WorkflowServerWritableStream extends WritableStream {
       }
     };
     let buffer2 = [];
+    let bufferBytes = 0;
+    let inFlightChunks = 0;
+    let inFlightBytes = 0;
     let flushTimer = null;
-    let flushPromise = null;
-    let resolvedFlushIntervalMs;
-    let batchStartAt;
-    const flush = async () => {
-      if (flushTimer) {
-        clearTimeout(flushTimer);
-        flushTimer = null;
+    let inFlight = null;
+    let sinkError;
+    let resolvedFlushIntervalMs = getEnvStreamFlushIntervalMs();
+    let flushIntervalResolution = null;
+    const maxChunksPerRequest = getMaxChunksPerBatch();
+    const maxBytesPerRequest = getMaxBytesPerBatch();
+    const maxBufferedChunks = getMaxInflightChunks();
+    const maxBufferedBytes = getMaxBufferedBytes();
+    let bufferT0;
+    let capacityWaiters = [];
+    let drainWaiters = [];
+    const rejectWaiters = (err) => {
+      const all2 = [...capacityWaiters, ...drainWaiters];
+      capacityWaiters = [];
+      drainWaiters = [];
+      for (const w2 of all2)
+        w2.reject(err);
+    };
+    const takeGroup = () => {
+      let count2 = 0;
+      let bytes = 0;
+      for (const chunk of buffer2) {
+        if (count2 >= maxChunksPerRequest)
+          break;
+        if (count2 > 0 && bytes + chunk.byteLength > maxBytesPerRequest)
+          break;
+        count2++;
+        bytes += chunk.byteLength;
       }
-      if (buffer2.length === 0)
-        return;
+      const group = buffer2.slice(0, count2);
+      buffer2 = buffer2.slice(count2);
+      bufferBytes -= bytes;
+      return { group, bytes };
+    };
+    const sendGroup = async (group, bytes, groupT0) => {
       await ensureRunReady();
-      const chunksToFlush = buffer2.slice();
-      const batchStart = batchStartAt;
-      batchStartAt = void 0;
-      const dispatchAt = Date.now();
       const world = await worldPromise;
-      if (resolvedFlushIntervalMs === void 0) {
-        resolvedFlushIntervalMs = world.streamFlushIntervalMs ?? getStreamFlushIntervalMs();
+      const dispatchAt = Date.now();
+      if (typeof world.streams.writeMulti === "function" && group.length > 1) {
+        await world.streams.writeMulti(runId, name2, group);
+      } else {
+        for (const chunk of group) {
+          await world.streams.write(runId, name2, chunk);
+        }
       }
-      const rpcStartAt = Date.now();
-      try {
-        if (typeof world.streams.writeMulti === "function" && chunksToFlush.length > 1) {
-          await world.streams.writeMulti(runId, name2, chunksToFlush);
-        } else {
-          for (const chunk of chunksToFlush) {
-            await world.streams.write(runId, name2, chunk);
-          }
+      if (groupT0 !== void 0) {
+        recordStreamWriteFlush(groupT0, dispatchAt, runId, name2, group.length, bytes, Date.now() - dispatchAt);
+      }
+    };
+    const dispatchLoop = async () => {
+      while (buffer2.length > 0) {
+        if (flushTimer) {
+          clearTimeout(flushTimer);
+          flushTimer = null;
         }
-      } catch (error2) {
-        if (batchStart !== void 0) {
-          batchStartAt = batchStartAt === void 0 ? batchStart : Math.min(batchStartAt, batchStart);
+        const groupT0 = bufferT0;
+        const groupTakenAt = Date.now();
+        const { group, bytes } = takeGroup();
+        inFlightChunks = group.length;
+        inFlightBytes = bytes;
+        bufferT0 = buffer2.length > 0 ? groupTakenAt : void 0;
+        try {
+          await sendGroup(group, bytes, groupT0);
+          inFlightChunks = 0;
+          inFlightBytes = 0;
+        } catch (error2) {
+          buffer2 = group.concat(buffer2);
+          bufferBytes += bytes;
+          inFlightChunks = 0;
+          inFlightBytes = 0;
+          bufferT0 = groupT0 !== void 0 && bufferT0 !== void 0 ? Math.min(groupT0, bufferT0) : groupT0 ?? bufferT0;
+          throw error2;
         }
-        throw error2;
-      }
-      if (batchStart !== void 0) {
-        recordStreamWriteFlush(batchStart, dispatchAt, runId, name2, chunksToFlush.length, chunksToFlush.reduce((sum, c) => sum + c.byteLength, 0), Date.now() - rpcStartAt);
+        const relieved = capacityWaiters;
+        capacityWaiters = [];
+        for (const w2 of relieved)
+          w2.resolve();
       }
-      buffer2 = [];
     };
-    let flushWaiters = [];
-    const scheduleFlush = () => {
-      if (flushTimer)
+    const startDispatch = () => {
+      if (inFlight || sinkError !== void 0 || buffer2.length === 0)
+        return;
+      inFlight = dispatchLoop().then(() => {
+        inFlight = null;
+        if (buffer2.length > 0) {
+          startDispatch();
+          return;
+        }
+        const settled = drainWaiters;
+        drainWaiters = [];
+        for (const w2 of settled)
+          w2.resolve();
+      }, (error2) => {
+        inFlight = null;
+        sinkError ?? (sinkError = error2);
+        rejectWaiters(sinkError);
+      });
+    };
+    const scheduleGroupCommit = () => {
+      if (flushTimer || inFlight)
+        return;
+      if (resolvedFlushIntervalMs === void 0) {
+        flushIntervalResolution ?? (flushIntervalResolution = Promise.resolve(worldPromise).then((world) => {
+          resolvedFlushIntervalMs = world.streamFlushIntervalMs ?? STREAM_FLUSH_INTERVAL_MS;
+        }, () => {
+          resolvedFlushIntervalMs = STREAM_FLUSH_INTERVAL_MS;
+        }).then(() => {
+          if (buffer2.length > 0)
+            scheduleGroupCommit();
+        }));
         return;
+      }
+      if (resolvedFlushIntervalMs <= 0) {
+        startDispatch();
+        return;
+      }
       flushTimer = setTimeout(() => {
         flushTimer = null;
-        const currentWaiters = flushWaiters;
-        flushWaiters = [];
-        flushPromise = flush().then(() => {
-          for (const w2 of currentWaiters)
-            w2.resolve();
-        }, (err) => {
-          for (const w2 of currentWaiters)
-            w2.reject(err);
+        startDispatch();
+      }, resolvedFlushIntervalMs);
+    };
+    const drain = async () => {
+      while (true) {
+        if (sinkError !== void 0)
+          throw sinkError;
+        if (buffer2.length === 0 && !inFlight)
+          return;
+        startDispatch();
+        await new Promise((resolve2, reject) => {
+          drainWaiters.push({ resolve: resolve2, reject });
         });
-      }, resolvedFlushIntervalMs ?? getStreamFlushIntervalMs());
+      }
     };
     super({
       async write(chunk) {
-        if (batchStartAt === void 0)
-          batchStartAt = Date.now();
-        if (flushPromise) {
-          await flushPromise;
-          flushPromise = null;
-        }
+        if (sinkError !== void 0)
+          throw sinkError;
+        if (bufferT0 === void 0)
+          bufferT0 = Date.now();
         buffer2.push(chunk);
-        scheduleFlush();
-        await new Promise((resolve2, reject) => {
-          flushWaiters.push({ resolve: resolve2, reject });
-        });
+        bufferBytes += chunk.byteLength;
+        if (buffer2.length >= maxChunksPerRequest || bufferBytes >= maxBytesPerRequest) {
+          startDispatch();
+        } else {
+          scheduleGroupCommit();
+        }
+        while (sinkError === void 0 && (buffer2.length + inFlightChunks >= maxBufferedChunks || bufferBytes + inFlightBytes >= maxBufferedBytes)) {
+          startDispatch();
+          await new Promise((resolve2, reject) => {
+            capacityWaiters.push({ resolve: resolve2, reject });
+          });
+        }
+        if (sinkError !== void 0)
+          throw sinkError;
       },
       async close() {
-        if (flushPromise) {
-          await flushPromise;
-          flushPromise = null;
-        }
-        await flush();
+        await drain();
         await ensureRunReady();
         const world = await worldPromise;
         const closeStart = Date.now();
         await world.streams.close(runId, name2);
         recordStreamClose(closeStart, runId, name2);
       },
-      abort(reason) {
+      async abort(reason) {
+        try {
+          await drain();
+        } catch {
+        }
         if (flushTimer) {
           clearTimeout(flushTimer);
           flushTimer = null;
         }
         buffer2 = [];
-        const waiters = flushWaiters;
-        flushWaiters = [];
-        const abortError = reason ?? new Error("Stream aborted");
-        for (const w2 of waiters)
-          w2.reject(abortError);
+        bufferBytes = 0;
+        sinkError ?? (sinkError = reason ?? new Error("Stream aborted"));
+        rejectWaiters(sinkError);
       }
     });
-    Object.defineProperty(this, STREAM_WRITE_BATCH_SYMBOL, {
-      value: async (chunks) => {
-        if (chunks.length === 0)
-          return;
-        if (batchStartAt === void 0)
-          batchStartAt = Date.now();
-        for (const chunk of chunks)
-          buffer2.push(chunk);
-        await flush();
-      },
+    Object.defineProperty(this, STREAM_DRAIN_SYMBOL, {
+      value: drain,
       enumerable: false,
       writable: false
     });
@@ -94137,6 +94590,10 @@ function getExternalReducers(global2 = globalThis, ops, runId, cryptoKey, framed
           name: existingName,
           runId: existingRunId
         };
+        const existingPublicKey = value[STREAM_SERVER_PUBLIC_KEY_SYMBOL];
+        if (typeof existingPublicKey === "string") {
+          descriptor.encryptionPublicKey = existingPublicKey;
+        }
         const existingDeploymentId = value[STREAM_SERVER_DEPLOYMENT_ID_SYMBOL];
         if (typeof existingDeploymentId === "string") {
           descriptor.deploymentId = existingDeploymentId;
@@ -94201,6 +94658,10 @@ function getWorkflowReducers(global2 = globalThis) {
       if (typeof foreignDeploymentId === "string") {
         s2.deploymentId = foreignDeploymentId;
       }
+      const foreignPublicKey = value[STREAM_SERVER_PUBLIC_KEY_SYMBOL];
+      if (typeof foreignPublicKey === "string") {
+        s2.encryptionPublicKey = foreignPublicKey;
+      }
       return s2;
     },
     // AbortController/AbortSignal in workflow context — just read symbols (handles).
@@ -94278,6 +94739,10 @@ function getStepReducers(global2 = globalThis, ops, runId, cryptoKey, framedByte
       const s2 = { name: name2 };
       if (typeof foreignRunId === "string")
         s2.runId = foreignRunId;
+      const foreignPublicKey = value[STREAM_SERVER_PUBLIC_KEY_SYMBOL];
+      if (typeof foreignPublicKey === "string") {
+        s2.encryptionPublicKey = foreignPublicKey;
+      }
       const foreignDeploymentId = value[STREAM_SERVER_DEPLOYMENT_ID_SYMBOL];
       if (typeof foreignDeploymentId === "string") {
         s2.deploymentId = foreignDeploymentId;
@@ -94422,7 +94887,10 @@ function getCommonRevivers(global2 = globalThis) {
     ...getCommonRevivers$1(global2)
   };
 }
-async function getForwardedWritableEncryptionKey(runId, deploymentId) {
+async function getForwardedWritableEncryptionKey(runId, deploymentId, encryptionPublicKey) {
+  const ownerPublicKey = decodeRunPublicKey(encryptionPublicKey);
+  if (ownerPublicKey)
+    return sealTo(ownerPublicKey);
   const world = await getWorldLazy();
   if (!world.getEncryptionKeyForRun)
     return void 0;
@@ -94492,7 +94960,7 @@ function getExternalRevivers(global2 = globalThis, ops, runId, cryptoKey) {
     },
     WritableStream: (value) => {
       const targetRunId = typeof value.runId === "string" ? value.runId : runId;
-      const targetKey = targetRunId === runId ? cryptoKey : getForwardedWritableEncryptionKey(targetRunId, value.deploymentId);
+      const targetKey = targetRunId === runId ? cryptoKey : getForwardedWritableEncryptionKey(targetRunId, value.deploymentId, value.encryptionPublicKey);
       const serialize2 = getSerializeStream(getExternalReducers(global2, ops, targetRunId, targetKey), targetKey);
       const serverWritable = new WorkflowServerWritableStream(targetRunId, value.name);
       const state = createFlushableState();
@@ -94514,6 +94982,12 @@ function getExternalRevivers(global2 = globalThis, ops, runId, cryptoKey) {
           writable: false
         });
       }
+      if (typeof value.encryptionPublicKey === "string") {
+        Object.defineProperty(serialize2.writable, STREAM_SERVER_PUBLIC_KEY_SYMBOL, {
+          value: value.encryptionPublicKey,
+          writable: false
+        });
+      }
       return serialize2.writable;
     },
     AbortController: (value) => reviveAbortController(value, ops, runId),
@@ -94599,6 +95073,12 @@ function getWorkflowRevivers(global2 = globalThis) {
           writable: false
         };
       }
+      if (typeof value.encryptionPublicKey === "string") {
+        descriptor[STREAM_SERVER_PUBLIC_KEY_SYMBOL] = {
+          value: value.encryptionPublicKey,
+          writable: false
+        };
+      }
       return Object.create(global2.WritableStream.prototype, descriptor);
     },
     // AbortController/AbortSignal revived inside the workflow VM. Use the
@@ -94756,7 +95236,7 @@ function getStepRevivers(global2 = globalThis, ops, runId, cryptoKey, deployment
     WritableStream: (value) => {
       const targetRunId = typeof value.runId === "string" ? value.runId : runId;
       const targetDeploymentId = typeof value.deploymentId === "string" ? value.deploymentId : targetRunId === runId ? deploymentId : void 0;
-      const targetKey = targetRunId === runId ? cryptoKey : getForwardedWritableEncryptionKey(targetRunId, targetDeploymentId);
+      const targetKey = targetRunId === runId ? cryptoKey : getForwardedWritableEncryptionKey(targetRunId, targetDeploymentId, value.encryptionPublicKey);
       const serialize2 = getSerializeStream(getStepReducers(global2, ops, targetRunId, targetKey), targetKey);
       const serverWritable = new WorkflowServerWritableStream(targetRunId, value.name);
       const state = createFlushableState();
@@ -94778,6 +95258,18 @@ function getStepRevivers(global2 = globalThis, ops, runId, cryptoKey, deployment
           writable: false
         });
       }
+      if (typeof value.encryptionPublicKey !== "string" && targetRunId === runId && isRunPayloadKeys(cryptoKey)) {
+        Object.defineProperty(serialize2.writable, STREAM_SERVER_PUBLIC_KEY_SYMBOL, {
+          value: bytesToBase64(cryptoKey.keyPair.publicKey),
+          writable: false
+        });
+      }
+      if (typeof value.encryptionPublicKey === "string") {
+        Object.defineProperty(serialize2.writable, STREAM_SERVER_PUBLIC_KEY_SYMBOL, {
+          value: value.encryptionPublicKey,
+          writable: false
+        });
+      }
       return serialize2.writable;
     },
     AbortController: (value) => reviveAbortController(value, ops, runId),
@@ -94901,8 +95393,8 @@ async function hydrateRunError(value, runId, key, ops = [], global2 = globalThis
       ...extraRevivers
     });
   }
-  const { format: format2, payload } = decodeFormatPrefix(decrypted);
-  if (format2 === SerializationFormat.DEVALUE_V1) {
+  const { format: format2, payload } = decodeFormatPrefix$1(decrypted);
+  if (format2 === SerializationFormat$1.DEVALUE_V1) {
     const str = new TextDecoder().decode(payload);
     return parse$5(str, {
       ...getExternalRevivers(global2, ops, runId, key),
@@ -94942,7 +95434,7 @@ function getStreamAndRequestRevivers(allRevivers) {
   }
   return extra;
 }
-const version$1 = "5.0.0-beta.36";
+const version$1 = "5.0.0-beta.37";
 const DEFAULT_HEALTH_CHECK_TIMEOUT = 3e4;
 const SAFE_WORKFLOW_NAME_PATTERN = /^[a-zA-Z0-9_\-./@]+$/;
 function getWorkflowQueueName(workflowName, namespace2) {
@@ -95020,17 +95512,24 @@ function parseHealthCheckResponse(chunks) {
   if (typeof r2.workflowCoreVersion === "string") {
     parsed.workflowCoreVersion = r2.workflowCoreVersion;
   }
+  if (typeof r2.encryptionPublicKey === "string") {
+    parsed.encryptionPublicKey = r2.encryptionPublicKey;
+  }
   return parsed;
 }
-async function healthCheck(world, endpoint, options) {
+async function healthCheck(world, options) {
   var _a3;
   const timeout2 = (options == null ? void 0 : options.timeout) ?? DEFAULT_HEALTH_CHECK_TIMEOUT;
   const correlationId = ((_a3 = world.createRunId) == null ? void 0 : _a3.call(world)) ?? generateId();
   const streamName = getHealthCheckStreamName(correlationId);
-  const queueName = `${getQueueTopicPrefix(endpoint, resolveQueueNamespace(options == null ? void 0 : options.namespace))}health_check`;
+  const queueName = `${getQueueTopicPrefix("workflow", resolveQueueNamespace(options == null ? void 0 : options.namespace))}health_check`;
   const startTime = Date.now();
   try {
-    await world.queue(queueName, { __healthCheck: true, correlationId }, {
+    await world.queue(queueName, {
+      __healthCheck: true,
+      correlationId,
+      ...(options == null ? void 0 : options.runId) ? { runId: options.runId } : {}
+    }, {
       // Use JSON transport so the health check works against both
       // old (JSON-only) and new (dual) deployments.
       specVersion: SPEC_VERSION_LEGACY,
@@ -95090,12 +95589,6 @@ function createWorldFromModule(mod) {
   if (typeof mod.createWorld === "function") {
     return mod.createWorld();
   }
-  if (typeof mod.createLocalWorld === "function") {
-    return mod.createLocalWorld();
-  }
-  if (typeof mod.createVercelWorld === "function") {
-    return mod.createVercelWorld();
-  }
   if (typeof mod.default === "function") {
     return mod.default();
   }
@@ -97941,22 +98434,28 @@ function requireSemver() {
 var semverExports = requireSemver();
 const semver = /* @__PURE__ */ getDefaultExportFromCjs(semverExports);
 const FORMAT_VERSION_TABLE = [
-  { format: SerializationFormat.ENCRYPTED, minVersion: "4.2.0-beta.64" },
+  { format: SerializationFormat$1.ENCRYPTED, minVersion: "4.2.0-beta.64" },
   // TODO(release): verify this matches the actual version that ships payload
   // compression. If a "Version Packages (beta)" PR merges before this change,
   // bump to the next beta. A too-low cutoff makes new producers write
   // compressed payloads to consumers that cannot decompress them; too-high
   // merely delays the optimization (safe). gzip and zstd ship together, so
   // they share a min version — a run that can read one can read both.
-  { format: SerializationFormat.GZIP, minVersion: "5.0.0-beta.18" },
-  { format: SerializationFormat.ZSTD, minVersion: "5.0.0-beta.18" }
+  { format: SerializationFormat$1.GZIP, minVersion: "5.0.0-beta.18" },
+  { format: SerializationFormat$1.ZSTD, minVersion: "5.0.0-beta.18" },
+  // TODO(release): verify this matches the actual version that ships sealed-box
+  // encryption. If a "Version Packages (beta)" PR merges before this change,
+  // bump to the next beta. Unlike the entries above, a wrong cutoff here is
+  // not a correctness hazard: producers gate `encp` on the target run carrying
+  // an `encryptionPublicKey`, not on this table (see History above).
+  { format: SerializationFormat$1.SEALED, minVersion: "5.0.0-beta.37" }
   // Future entries:
   // { format: SerializationFormat.CBOR, minVersion: '5.x.y' },
   // { format: SerializationFormat.ENCRYPTED_V2, minVersion: '5.x.y' },
 ];
 const CAPABILITY_VERSION_TABLE = [{ capability: "framedByteStreams", minVersion: "5.0.0-beta.15" }];
 const BASELINE_FORMATS = /* @__PURE__ */ new Set([
-  SerializationFormat.DEVALUE_V1
+  SerializationFormat$1.DEVALUE_V1
 ]);
 function getRunCapabilities(workflowCoreVersion) {
   if (!workflowCoreVersion || !semver.valid(workflowCoreVersion)) {
@@ -97982,18 +98481,49 @@ function getRunCapabilities(workflowCoreVersion) {
   }
   return result;
 }
-async function getHookAndRun(token) {
+function resumeContextFromRun(run2) {
+  var _a3, _b2;
+  const coreVersion = (_a3 = run2.executionContext) == null ? void 0 : _a3.workflowCoreVersion;
+  const traceCarrier = (_b2 = run2.executionContext) == null ? void 0 : _b2.traceCarrier;
+  return {
+    deploymentId: run2.deploymentId,
+    workflowName: run2.workflowName,
+    runSpecVersion: run2.specVersion,
+    workflowCoreVersion: typeof coreVersion === "string" ? coreVersion : void 0,
+    traceCarrier: traceCarrier && typeof traceCarrier === "object" ? traceCarrier : void 0,
+    encryptionPublicKey: run2.encryptionPublicKey
+  };
+}
+async function resolveHookResumeInfo(hook) {
+  if (hook.resumeContext) {
+    return { resumeContext: hook.resumeContext, source: "hook" };
+  }
+  const run2 = await (await getWorldLazy()).runs.get(hook.runId);
+  return {
+    resumeContext: resumeContextFromRun(run2),
+    source: "run_fallback",
+    run: run2
+  };
+}
+async function resolveHookEncryptionKey(hook, info) {
+  var _a3, _b2;
   const world = await getWorldLazy();
-  const hook = await world.hooks.getByToken(token);
-  const run2 = await world.runs.get(hook.runId);
-  return { hook, run: run2 };
+  const rawKey = info.run ? await ((_a3 = world.getEncryptionKeyForRun) == null ? void 0 : _a3.call(world, info.run)) : await ((_b2 = world.getEncryptionKeyForRun) == null ? void 0 : _b2.call(world, hook.runId, {
+    deploymentId: info.resumeContext.deploymentId
+  }));
+  return rawKey ? await importKey(rawKey) : void 0;
 }
 async function getHookByTokenWithKey(token) {
   var _a3, _b2;
-  const { hook, run: run2 } = await getHookAndRun(token);
-  const rawKey = await ((_b2 = (_a3 = await getWorldLazy()).getEncryptionKeyForRun) == null ? void 0 : _b2.call(_a3, run2));
-  const encryptionKey = rawKey ? await importKey(rawKey) : void 0;
+  const world = await getWorldLazy();
+  const hook = await world.hooks.getByToken(token);
+  let encryptionKey;
   if (typeof hook.metadata !== "undefined") {
+    const info = await resolveHookResumeInfo(hook);
+    const rawKey = info.run ? await ((_a3 = world.getEncryptionKeyForRun) == null ? void 0 : _a3.call(world, info.run)) : await ((_b2 = world.getEncryptionKeyForRun) == null ? void 0 : _b2.call(world, hook.runId, {
+      deploymentId: info.resumeContext.deploymentId
+    }));
+    encryptionKey = rawKey ? await deriveRunPayloadKeys(rawKey) : void 0;
     hook.metadata = await hydrateStepArguments(hook.metadata, hook.runId, encryptionKey);
   }
   return { hook, encryptionKey };
@@ -98005,41 +98535,42 @@ async function getHookByToken$1(token) {
 async function resumeHook$2(tokenOrHook, payload, encryptionKeyOverride) {
   return await waitedUntil(() => {
     return trace$2("hook.resume", async (span) => {
-      var _a3, _b2, _c2, _d2, _e2;
+      var _a3;
       const world = await getWorldLazy();
       try {
-        let hook;
-        let workflowRun;
-        if (typeof tokenOrHook === "string") {
-          const result = await getHookAndRun(tokenOrHook);
-          hook = result.hook;
-          workflowRun = result.run;
-        } else {
-          hook = tokenOrHook;
-          workflowRun = await world.runs.get(hook.runId);
-        }
+        const hook = typeof tokenOrHook === "string" ? await world.hooks.getByToken(tokenOrHook) : tokenOrHook;
+        const info = await resolveHookResumeInfo(hook);
+        const { resumeContext } = info;
         span == null ? void 0 : span.setAttributes({
           ...HookToken(hook.token),
           ...HookId(hook.hookId),
-          ...WorkflowRunId$2(hook.runId)
+          ...WorkflowRunId$2(hook.runId),
+          "workflow.hook.resume_context_source": info.source
         });
-        if (isTerminalWorkflowRunStatus(workflowRun.status)) {
+        if (info.run && isTerminalWorkflowRunStatus(info.run.status)) {
           throw new HookNotFoundError(hook.token);
         }
-        let encryptionKey = encryptionKeyOverride;
-        if (!encryptionKey) {
-          const rawKey = await ((_a3 = world.getEncryptionKeyForRun) == null ? void 0 : _a3.call(world, workflowRun));
-          encryptionKey = rawKey ? await importKey(rawKey) : void 0;
-        }
-        const rawVersion = (_b2 = workflowRun.executionContext) == null ? void 0 : _b2.workflowCoreVersion;
-        const capabilities = getRunCapabilities(typeof rawVersion === "string" ? rawVersion : void 0);
-        if (!capabilities.supportedFormats.has(SerializationFormat.ENCRYPTED)) {
-          encryptionKey = void 0;
+        const capabilities = getRunCapabilities(resumeContext.workflowCoreVersion);
+        let payloadKey;
+        const runPublicKey = encryptionKeyOverride ? (
+          // The caller already holds a key (resumeWebhook resolved one to
+          // hydrate hook metadata), so sealing would add an ECDH for no
+          // saved round trip. Reuse what it resolved.
+          void 0
+        ) : decodeRunPublicKey(resumeContext.encryptionPublicKey);
+        if (runPublicKey) {
+          payloadKey = sealTo(runPublicKey);
+        } else {
+          let encryptionKey = encryptionKeyOverride ?? await resolveHookEncryptionKey(hook, info);
+          if (!capabilities.supportedFormats.has(SerializationFormat$1.ENCRYPTED)) {
+            encryptionKey = void 0;
+          }
+          payloadKey = encryptionKey;
         }
-        const compression = (workflowRun.specVersion ?? 0) >= SPEC_VERSION_SUPPORTS_COMPRESSION && capabilities.supportedFormats.has(SerializationFormat.GZIP);
+        const compression = (resumeContext.runSpecVersion ?? 0) >= SPEC_VERSION_SUPPORTS_COMPRESSION && capabilities.supportedFormats.has(SerializationFormat$1.GZIP);
         const ops = [];
         const v1Compat = isLegacySpecVersion(hook.specVersion);
-        const dehydratedPayload = await dehydrateStepReturnValue(payload, hook.runId, encryptionKey, ops, globalThis, v1Compat, capabilities.framedByteStreams, compression);
+        const dehydratedPayload = await dehydrateStepReturnValue(payload, hook.runId, payloadKey, ops, globalThis, v1Compat, capabilities.framedByteStreams, compression);
         safeWaitUntil(Promise.all(ops), (err) => {
           if (err === void 0)
             return;
@@ -98049,29 +98580,36 @@ async function resumeHook$2(tokenOrHook, payload, encryptionKeyOverride) {
             error: err instanceof Error ? err.message : String(err)
           });
         });
-        await world.events.create(hook.runId, {
-          eventType: "hook_received",
-          specVersion: SPEC_VERSION_CURRENT,
-          correlationId: hook.hookId,
-          eventData: {
-            ...v1Compat ? {} : { token: hook.token },
-            payload: dehydratedPayload
+        try {
+          await world.events.create(hook.runId, {
+            eventType: "hook_received",
+            specVersion: SPEC_VERSION_CURRENT,
+            correlationId: hook.hookId,
+            eventData: {
+              ...v1Compat ? {} : { token: hook.token },
+              payload: dehydratedPayload
+            }
+          }, { v1Compat });
+        } catch (err) {
+          if (HookNotFoundError.is(err) || EntityConflictError.is(err) || RunExpiredError.is(err)) {
+            throw new HookNotFoundError(hook.token);
           }
-        }, { v1Compat });
+          throw err;
+        }
         span == null ? void 0 : span.setAttributes({
-          ...WorkflowName(workflowRun.workflowName)
+          ...WorkflowName(resumeContext.workflowName)
         });
-        const originLink = await linkToTraceCarrier((_c2 = workflowRun.executionContext) == null ? void 0 : _c2.traceCarrier);
+        const originLink = await linkToTraceCarrier(resumeContext.traceCarrier);
         if (originLink) {
-          (_d2 = span == null ? void 0 : span.addLink) == null ? void 0 : _d2.call(span, originLink);
+          (_a3 = span == null ? void 0 : span.addLink) == null ? void 0 : _a3.call(span, originLink);
         }
-        await world.queue(getWorkflowQueueName(workflowRun.workflowName), {
+        await world.queue(getWorkflowQueueName(resumeContext.workflowName), {
           runId: hook.runId,
-          // attach the trace carrier from the workflow run
-          traceCarrier: ((_e2 = workflowRun.executionContext) == null ? void 0 : _e2.traceCarrier) ?? void 0
+          // attach the trace carrier from the run's resume context
+          traceCarrier: resumeContext.traceCarrier ?? void 0
         }, {
-          deploymentId: workflowRun.deploymentId,
-          specVersion: workflowRun.specVersion ?? SPEC_VERSION_LEGACY
+          deploymentId: resumeContext.deploymentId,
+          specVersion: resumeContext.runSpecVersion ?? SPEC_VERSION_LEGACY
         });
         return hook;
       } catch (err) {
@@ -98200,8 +98738,10 @@ async function start$1(workflow, argsOrOptions, options) {
           deploymentId = currentDeploymentId;
         }
       }
+      const runId = `wrun_${world.createRunId ? world.createRunId(opts) : ulid$2()}`;
       let framedByteStreams;
       let targetSupportsCompression;
+      let probedRunPublicKey;
       if (deploymentId === currentDeploymentId) {
         framedByteStreams = true;
         targetSupportsCompression = true;
@@ -98209,17 +98749,18 @@ async function start$1(workflow, argsOrOptions, options) {
         framedByteStreams = false;
         targetSupportsCompression = false;
       } else {
-        const probe = await healthCheck(world, "workflow", {
+        const probe = await healthCheck(world, {
           deploymentId,
+          runId,
           timeout: CROSS_DEPLOYMENT_CAPABILITY_PROBE_TIMEOUT_MS,
           namespace: opts.namespace
         }).catch(() => void 0);
+        probedRunPublicKey = probe == null ? void 0 : probe.encryptionPublicKey;
         const capabilities = getRunCapabilities(probe == null ? void 0 : probe.workflowCoreVersion);
         framedByteStreams = capabilities.framedByteStreams;
-        targetSupportsCompression = capabilities.supportedFormats.has(SerializationFormat.GZIP);
+        targetSupportsCompression = capabilities.supportedFormats.has(SerializationFormat$1.GZIP);
       }
       const ops = [];
-      const runId = `wrun_${world.createRunId ? world.createRunId(opts) : ulid$2()}`;
       const traceCarrier = await serializeTraceCarrier();
       const specVersion = opts.specVersion ?? world.specVersion;
       const v1Compat = isLegacySpecVersion(specVersion);
@@ -98248,11 +98789,20 @@ async function start$1(workflow, argsOrOptions, options) {
       if (opts.replayedFromRunId !== void 0 && !workflowRunIdSchema.safeParse(opts.replayedFromRunId).success) {
         throw new WorkflowRuntimeError(`replayedFromRunId must be a run ID (wrun_<ulid>); received ${JSON.stringify(String(opts.replayedFromRunId).slice(0, 64))}.`);
       }
-      const rawKey = await ((_b2 = world.getEncryptionKeyForRun) == null ? void 0 : _b2.call(world, runId, {
-        ...opts,
-        deploymentId
-      }));
-      const encryptionKey = rawKey ? await importKey(rawKey) : void 0;
+      const probedPublicKey = decodeRunPublicKey(probedRunPublicKey);
+      let encryptionKey;
+      let encryptionPublicKey;
+      if (probedPublicKey) {
+        encryptionKey = sealTo(probedPublicKey);
+        encryptionPublicKey = probedRunPublicKey;
+      } else {
+        const rawKey = await ((_b2 = world.getEncryptionKeyForRun) == null ? void 0 : _b2.call(world, runId, {
+          ...opts,
+          deploymentId
+        }));
+        encryptionKey = rawKey ? await importKey(rawKey) : void 0;
+        encryptionPublicKey = rawKey ? bytesToBase64((await deriveRunKeyPair(rawKey)).publicKey) : void 0;
+      }
       const compression = targetSupportsCompression && specVersion >= SPEC_VERSION_SUPPORTS_COMPRESSION;
       const workflowArguments = await dehydrateWorkflowArguments(args, runId, encryptionKey, ops, globalThis, v1Compat, framedByteStreams, compression);
       const executionContext = {
@@ -98270,6 +98820,7 @@ async function start$1(workflow, argsOrOptions, options) {
             workflowName,
             input: workflowArguments,
             executionContext,
+            ...encryptionPublicKey ? { encryptionPublicKey } : {},
             ...attributeSeed
           }
         }, { v1Compat }),
@@ -98283,6 +98834,7 @@ async function start$1(workflow, argsOrOptions, options) {
               workflowName,
               specVersion,
               executionContext,
+              ...encryptionPublicKey ? { encryptionPublicKey } : {},
               ...attributeSeed
             }
           } : {}
@@ -98341,7 +98893,7 @@ async function recreateRunFromExisting(world, runId, options = {}) {
   try {
     const run2 = await world.runs.get(runId, { resolveData: "all" });
     const rawKey = await ((_a3 = world.getEncryptionKeyForRun) == null ? void 0 : _a3.call(world, run2));
-    const encryptionKey = rawKey ? await importKey(rawKey) : void 0;
+    const encryptionKey = rawKey ? await deriveRunPayloadKeys(rawKey) : void 0;
     const workflowArgs = normalizeWorkflowArgs(await hydrateWorkflowArguments(run2.input, runId, encryptionKey, globalThis));
     const specVersion = options.specVersion ?? run2.specVersion ?? SPEC_VERSION_LEGACY;
     const deploymentId = options.deploymentId ?? run2.deploymentId;
@@ -98632,7 +99184,7 @@ getEncryptionKey_fn = function() {
       const world = await __privateGet(this, _Run_instances, lazyWorldPromise_get);
       const run2 = await world.runs.get(this.runId);
       const rawKey = await ((_a3 = world.getEncryptionKeyForRun) == null ? void 0 : _a3.call(world, run2));
-      return rawKey ? await importKey(rawKey) : void 0;
+      return rawKey ? await deriveRunPayloadKeys(rawKey) : void 0;
     })());
   }
   return __privateGet(this, _encryptionKeyPromise);
@@ -98793,6 +99345,35 @@ async function findWorkflowDataDir(cwd) {
     shortName: getDirShortName(absoluteCwd)
   };
 }
+const REBUILD_AGAINST_VERCEL_ADVICE = "The world is selected when the app is built, not when it runs, so this reflects the build environment: when a build cannot be identified as a Vercel build (for example `vercel build` followed by `vercel deploy --prebuilt`, or a build that runs before Vercel system environment variables are available), set WORKFLOW_TARGET_WORLD=vercel in the build environment and rebuild.";
+class UnwritableDataDirError extends WorkflowWorldError {
+  constructor(dataDir, code2) {
+    super(`[workflow] The local (filesystem) world cannot create its data directory "${dataDir}" (${code2}). Workflow runs cannot be stored, so every run will fail before its first step. If this is a Vercel deployment, its filesystem is read-only and the local world cannot work there. ${REBUILD_AGAINST_VERCEL_ADVICE} Otherwise point WORKFLOW_LOCAL_DATA_DIR at a writable directory.`, { code: code2 });
+    __publicField(this, "dataDir");
+    this.name = "UnwritableDataDirError";
+    this.dataDir = dataDir;
+  }
+  static is(value) {
+    return value instanceof Error && value.name === "UnwritableDataDirError";
+  }
+}
+const UNWRITABLE_DIR_CODES = /* @__PURE__ */ new Set(["EROFS", "EACCES", "EPERM"]);
+function isUnwritableDirCode(code2) {
+  return code2 !== void 0 && UNWRITABLE_DIR_CODES.has(code2);
+}
+let warnedAboutVercelDeployment = false;
+function warnIfRunningInVercelDeployment(dataDir) {
+  if (warnedAboutVercelDeployment || !isVercelDeploymentEnv()) {
+    return;
+  }
+  const resolvedDataDir = path$3.resolve(dataDir);
+  const tmp = tmpdir();
+  if (resolvedDataDir === tmp || resolvedDataDir.startsWith(`${tmp}${path$3.sep}`)) {
+    return;
+  }
+  warnedAboutVercelDeployment = true;
+  console.warn(`[workflow] Warning: the local (filesystem) world is running inside a Vercel deployment, writing to ${resolvedDataDir}. That filesystem is read-only, so workflow runs will fail before their first step. ` + REBUILD_AGAINST_VERCEL_ADVICE);
+}
 function parsePort$2(value, radix = 10) {
   const port = parseInt(value, radix);
   if (!Number.isNaN(port) && port >= 0 && port <= 65535) {
@@ -99176,7 +99757,18 @@ async function ensureDir(dirPath) {
   try {
     await promises.mkdir(resolvedPath, { recursive: true });
     createdDirectoriesCache.add(resolvedPath);
-  } catch (_error) {
+  } catch (error2) {
+    const code2 = error2.code;
+    if (isUnwritableDirCode(code2) && !await isExistingDirectory(resolvedPath)) {
+      throw new UnwritableDataDirError(resolvedPath, code2);
+    }
+  }
+}
+async function isExistingDirectory(dirPath) {
+  try {
+    return (await promises.stat(dirPath)).isDirectory();
+  } catch {
+    return false;
   }
 }
 async function withEnsuredDirectory(dirPath, operation) {
@@ -125355,13 +125947,6 @@ function isDetachedArrayBufferQueueError(error2) {
   }
   return false;
 }
-function getQueueRoute(queueName) {
-  const { kind, prefix } = parseQueueName(queueName);
-  return {
-    pathname: kind === "workflow" ? "flow" : "step",
-    prefix
-  };
-}
 function createQueue$2(config2) {
   const httpAgent = new undiciExports.Agent({
     headersTimeout: 0,
@@ -125384,10 +125969,10 @@ function createQueue$2(config2) {
       }
     }
     const body2 = transport.serialize(message2);
-    const { pathname, prefix } = getQueueRoute(queueName);
+    const { prefix } = parseQueueName(queueName);
     const messageId = MessageId.parse(`msg_${generateId2()}`);
     const msg = message2;
-    const runId = msg.runId ?? msg.workflowRunId ?? void 0;
+    const runId = msg.runId ?? void 0;
     const stepId = msg.stepId ?? void 0;
     if (opts == null ? void 0 : opts.idempotencyKey) {
       const key = opts.idempotencyKey;
@@ -125422,12 +126007,12 @@ function createQueue$2(config2) {
           try {
             if (directHandler) {
               const req = new Request(createWorkflowUrl(resolveDirectBaseUrl(config2), {
-                type: pathname
+                type: "flow"
               }), { method: "POST", headers: headers2, body: body2 });
               response2 = await directHandler(req);
             } else {
               const baseUrl = await resolveBaseUrl$1(config2);
-              response2 = await fetch(createWorkflowUrl(baseUrl, { type: pathname }), {
+              response2 = await fetch(createWorkflowUrl(baseUrl, { type: "flow" }), {
                 method: "POST",
                 duplex: "half",
                 dispatcher: httpAgent,
@@ -126578,6 +127163,10 @@ function createEventsStorage(basedir, tag) {
                 startedAt: void 0,
                 completedAt: void 0,
                 attributes: runInputData.attributes ?? {},
+                // Must be mirrored here too: this is the path that recreates a
+                // run from the queued message, which is exactly when the key
+                // would otherwise be lost for the rest of the run's life.
+                encryptionPublicKey: runInputData.encryptionPublicKey,
                 createdAt: now2,
                 updatedAt: now2
               };
@@ -126597,7 +127186,8 @@ function createEventsStorage(basedir, tag) {
                     input: runInputData.input,
                     executionContext: runInputData.executionContext,
                     attributes: runInputData.attributes,
-                    allowReservedAttributes: runInputData.allowReservedAttributes
+                    allowReservedAttributes: runInputData.allowReservedAttributes,
+                    encryptionPublicKey: runInputData.encryptionPublicKey
                   }
                 };
                 await storeEvent(runCreatedEvent);
@@ -126734,6 +127324,7 @@ function createEventsStorage(basedir, tag) {
             startedAt: void 0,
             completedAt: void 0,
             attributes: runData.attributes ?? {},
+            encryptionPublicKey: runData.encryptionPublicKey,
             createdAt: now2,
             updatedAt: now2
           };
@@ -126762,7 +127353,8 @@ function createEventsStorage(basedir, tag) {
               completedAt: void 0,
               startedAt: currentRun.startedAt ?? now2,
               updatedAt: now2,
-              attributes: currentRun.attributes
+              attributes: currentRun.attributes,
+              encryptionPublicKey: currentRun.encryptionPublicKey
             });
           }
         } else if (data.eventType === "run_completed" && "eventData" in data) {
@@ -126783,7 +127375,8 @@ function createEventsStorage(basedir, tag) {
               error: void 0,
               completedAt: now2,
               updatedAt: now2,
-              attributes: currentRun.attributes
+              attributes: currentRun.attributes,
+              encryptionPublicKey: currentRun.encryptionPublicKey
             });
             await Promise.all([
               deleteAllHooksForRun(basedir, effectiveRunId),
@@ -126809,7 +127402,8 @@ function createEventsStorage(basedir, tag) {
               errorCode: failedData.errorCode,
               completedAt: now2,
               updatedAt: now2,
-              attributes: currentRun.attributes
+              attributes: currentRun.attributes,
+              encryptionPublicKey: currentRun.encryptionPublicKey
             });
             await Promise.all([
               deleteAllHooksForRun(basedir, effectiveRunId),
@@ -126833,7 +127427,8 @@ function createEventsStorage(basedir, tag) {
               error: void 0,
               completedAt: now2,
               updatedAt: now2,
-              attributes: currentRun.attributes
+              attributes: currentRun.attributes,
+              encryptionPublicKey: currentRun.encryptionPublicKey
             });
             await Promise.all([
               deleteAllHooksForRun(basedir, effectiveRunId),
@@ -127778,6 +128373,7 @@ function createStreamer$1(basedir, tag) {
 function createWorld$1(args) {
   const definedArgs = {};
   const mergedConfig = { ...config.value, ...definedArgs };
+  warnIfRunningInVercelDeployment(mergedConfig.dataDir);
   const tag = mergedConfig.tag;
   const queue = createQueue$2(mergedConfig);
   const { clearCache: clearStorageCache, ...storage } = createStorage$1(mergedConfig.dataDir, tag);
@@ -127817,7 +128413,7 @@ function createWorld$1(args) {
         const basedir = mergedConfig.dataDir;
         const hooksDir = path$3.join(basedir, "hooks");
         const taggedHookFiles = await listTaggedFiles(hooksDir, tag);
-        const { HookSchema: HookSchema2 } = await import("./index-Cnj8rNtV.js");
+        const { HookSchema: HookSchema2 } = await import("./index-M4Ai7vsa.js");
         await Promise.all(taggedHookFiles.map(async (hookFile) => {
           const hook = await readJSON(path$3.join(hooksDir, hookFile), HookSchema2);
           if (hook == null ? void 0 : hook.token) {
@@ -128000,8 +128596,8 @@ function requireGetVercelOidcToken() {
     }
     try {
       const [{ getTokenPayload, isExpired }, { refreshToken }] = await Promise.all([
-        await import("./token-util-D94FNaX0.js").then((n) => n.t),
-        await import("./token-CYc8-6E0.js").then((n) => n.t)
+        await import("./token-util-CiVcDWD3.js").then((n) => n.t),
+        await import("./token-Ulh8Tdgw.js").then((n) => n.t)
       ]);
       if (!token || isExpired(getTokenPayload(token), options == null ? void 0 : options.expirationBufferMs)) {
         await refreshToken(options);
@@ -128911,7 +129507,7 @@ async function instrumentedFetch(opts) {
     return response2;
   });
 }
-const version = "5.0.0-beta.32";
+const version = "5.0.0-beta.33";
 const IDEMPOTENT_METHODS = /* @__PURE__ */ new Set(["GET", "HEAD"]);
 const MAX_BODY_PARSE_RETRIES = 2;
 const BODY_PARSE_RETRY_BASE_MS = 100;
@@ -131636,10 +132232,10 @@ class Minimatch {
       }
       return filtered.join("/");
     }).join("|");
-    const [open, close] = set2.length > 1 ? ["(?:", ")"] : ["", ""];
-    re2 = "^" + open + re2 + close + "$";
+    const [open2, close] = set2.length > 1 ? ["(?:", ")"] : ["", ""];
+    re2 = "^" + open2 + re2 + close + "$";
     if (this.partial) {
-      re2 = "^(?:\\/|" + open + re2.slice(1, -1) + close + ")$";
+      re2 = "^(?:\\/|" + open2 + re2.slice(1, -1) + close + ")$";
     }
     if (this.negate)
       re2 = "^(?!" + re2 + ").+$";
@@ -131853,9 +132449,9 @@ function requirePicocolors() {
   hasRequiredPicocolors = 1;
   let p2 = process || {}, argv = p2.argv || [], env2 = p2.env || {};
   let isColorSupported = !(!!env2.NO_COLOR || argv.includes("--no-color")) && (!!env2.FORCE_COLOR || argv.includes("--color") || p2.platform === "win32" || (p2.stdout || {}).isTTY && env2.TERM !== "dumb" || !!env2.CI);
-  let formatter = (open, close, replace2 = open) => (input) => {
-    let string2 = "" + input, index2 = string2.indexOf(close, open.length);
-    return ~index2 ? open + replaceClose(string2, close, replace2, index2) + close : open + string2 + close;
+  let formatter = (open2, close, replace2 = open2) => (input) => {
+    let string2 = "" + input, index2 = string2.indexOf(close, open2.length);
+    return ~index2 ? open2 + replaceClose(string2, close, replace2, index2) + close : open2 + string2 + close;
   };
   let replaceClose = (string2, close, replace2, index2) => {
     let result = "", cursor = 0;
@@ -134289,6 +134885,9 @@ var QueueClient = class {
     setApi(this, new ApiClient({ ...options, region }));
   }
 };
+function missingDeploymentIdMessage(operation) {
+  return `${operation} requires VERCEL_DEPLOYMENT_ID, which Vercel sets in every deployment, so this process is not running inside one. The Vercel world was selected when the app was built (and compiled into the server bundles), which happens whenever the build environment looks like Vercel — including a production server started locally or in CI with an env file from \`vercel env pull\`. To run that build against the local filesystem world instead, set WORKFLOW_TARGET_WORLD=local and rebuild.`;
+}
 class CborTransport {
   constructor() {
     __publicField(this, "contentType", "application/cbor");
@@ -134381,9 +134980,6 @@ function getRunIdFromPayload(payload) {
   if ("runId" in payload && typeof payload.runId === "string") {
     return payload.runId;
   }
-  if ("workflowRunId" in payload && typeof payload.workflowRunId === "string") {
-    return payload.workflowRunId;
-  }
   return void 0;
 }
 const RUN_ID_PREFIX = "wrun_";
@@ -134418,9 +135014,6 @@ function getHeadersFromPayload(payload) {
   if ("runId" in payload && typeof payload.runId === "string") {
     headers2["x-vercel-workflow-run-id"] = payload.runId;
   }
-  if ("workflowRunId" in payload && typeof payload.workflowRunId === "string") {
-    headers2["x-vercel-workflow-run-id"] = payload.workflowRunId;
-  }
   if ("stepId" in payload && typeof payload.stepId === "string") {
     headers2["x-vercel-workflow-step-id"] = payload.stepId;
   }
@@ -134439,15 +135032,15 @@ function getPhysicalQueueName(queueName, payload) {
     loggedSequentialReplays = true;
     console.warn("[workflow] WORKFLOW_SEQUENTIAL_REPLAYS=1: routing flow messages to per-run queue topics");
   }
+  if ("__healthCheck" in payload && typeof payload.correlationId === "string") {
+    return `${queueName}_${payload.correlationId}`;
+  }
   if ("runId" in payload && typeof payload.runId === "string") {
     if ("stepId" in payload && typeof payload.stepId === "string") {
       return `${queueName}_${payload.runId}_${payload.stepId}`;
     }
     return `${queueName}_${payload.runId}`;
   }
-  if ("__healthCheck" in payload && typeof payload.correlationId === "string") {
-    return `${queueName}_${payload.correlationId}`;
-  }
   return queueName;
 }
 function createQueue$1(config2) {
@@ -134470,7 +135063,7 @@ function createQueue$1(config2) {
   const queue = async (queueName, payload, opts) => {
     const deploymentId = (opts == null ? void 0 : opts.deploymentId) ?? process.env.VERCEL_DEPLOYMENT_ID;
     if (!deploymentId) {
-      throw new Error("No deploymentId provided and VERCEL_DEPLOYMENT_ID environment variable is not set. Queue messages require a deployment ID to route correctly. Either set VERCEL_DEPLOYMENT_ID or provide deploymentId in options.");
+      throw new Error(`${missingDeploymentIdMessage("Enqueuing a workflow message")} Callers outside a deployment can instead pass an explicit deploymentId in options.`);
     }
     const useCbor = ((opts == null ? void 0 : opts.specVersion) ?? SPEC_VERSION_CURRENT) >= SPEC_VERSION_SUPPORTS_CBOR_QUEUE_TRANSPORT;
     const transport = useCbor ? cborTransport : jsonTransport;
@@ -134565,7 +135158,7 @@ function createQueue$1(config2) {
   const getDeploymentId = async () => {
     const deploymentId = process.env.VERCEL_DEPLOYMENT_ID;
     if (!deploymentId) {
-      throw new Error("VERCEL_DEPLOYMENT_ID environment variable is not set");
+      throw new Error(missingDeploymentIdMessage("Starting a workflow run"));
     }
     return deploymentId;
   };
@@ -134578,7 +135171,7 @@ function createResolveLatestDeploymentId(config2) {
   return async function resolveLatestDeploymentId() {
     const currentDeploymentId = process.env.VERCEL_DEPLOYMENT_ID;
     if (!currentDeploymentId) {
-      throw new Error("Cannot resolve latest deployment: VERCEL_DEPLOYMENT_ID environment variable is not set");
+      throw new Error(missingDeploymentIdMessage("Resolving the latest deployment for deploymentId: 'latest'"));
     }
     const token = await resolveVercelApiToken(config2);
     if (!token) {
@@ -134948,6 +135541,9 @@ function buildPostFrameMeta(input) {
   if (input.allowReservedAttributes !== void 0) {
     meta2.allowReservedAttributes = input.allowReservedAttributes;
   }
+  if (input.encryptionPublicKey !== void 0) {
+    meta2.encryptionPublicKey = input.encryptionPublicKey;
+  }
   if (input.ttfs !== void 0)
     meta2.ttfs = input.ttfs;
   if (input.stso !== void 0)
@@ -135506,6 +136102,9 @@ function splitEventDataForV4(data) {
   if (typeof eventData.allowReservedAttributes === "boolean") {
     meta2.allowReservedAttributes = eventData.allowReservedAttributes;
   }
+  if (typeof eventData.encryptionPublicKey === "string") {
+    meta2.encryptionPublicKey = eventData.encryptionPublicKey;
+  }
   if (typeof eventData.ttfs === "number") {
     meta2.ttfs = eventData.ttfs;
   }
@@ -136010,13 +136609,8 @@ function createWorld(config2) {
   var _a3, _b2;
   const projectId = ((_a3 = config2 == null ? void 0 : config2.projectConfig) == null ? void 0 : _a3.projectId) || process.env.VERCEL_PROJECT_ID;
   return {
-    // Spec v5: new runs may carry gzip-compressed payloads (compression is
-    // entirely client-side — the workflow-server stores payloads opaquely
-    // via RemoteRef and never deserializes them). Spec 5 is a superset of
-    // spec 4, so native `attr_set` events and initial run attributes still
-    // work. New runs are stamped with this version; the server must support
-    // at least it — workflow-server declared spec-5 support in
-    // vercel/workflow-server#520.
+    // Spec v5 adds client-side zstd/gzip payload compression. The server stores
+    // those payloads opaquely, and v5 remains a superset of v4 attributes.
     specVersion: SPEC_VERSION_SUPPORTS_COMPRESSION,
     capabilities: {
       // workflow-server enforces the `stateUpdatedAt` optimistic-concurrency
@@ -136037,7 +136631,11 @@ function createWorld(config2) {
     processExitTriggersQueueRedelivery: true,
     ...createQueue$1(config2),
     ...createStorage(config2),
-    analytics: createAnalytics(config2),
+    // Analytics list reads are served from an eventually-ingested store.
+    // Tooling that needs read-your-writes listings immediately after a
+    // write (e.g. deterministic e2e assertions) can force the CLI/world
+    // list paths back onto primary storage by disabling the namespace.
+    analytics: process.env.WORKFLOW_DISABLE_ANALYTICS_READS === "1" ? void 0 : createAnalytics(config2),
     ...instrumentObject("world.streams", createStreamer(config2)),
     createRunId,
     describeRun,
@@ -136815,10 +137413,10 @@ async function fetchWorkflowsManifest(_worldEnv) {
     workflows: {}
   });
 }
-async function runHealthCheck(worldEnv, endpoint, options) {
+async function runHealthCheck(worldEnv, options) {
   try {
     const world = await getWorldFromEnv(worldEnv);
-    const result = await healthCheck(world, endpoint, options);
+    const result = await healthCheck(world, options);
     return createResponse({
       ...result
     });
@@ -139392,7 +139990,7 @@ var useRovingFocusGroupScope$1 = createRovingFocusGroupScope$1();
 var [MenuProvider, useMenuContext] = createMenuContext(MENU_NAME);
 var [MenuRootProvider, useMenuRootContext] = createMenuContext(MENU_NAME);
 var Menu = (props) => {
-  const { __scopeMenu, open = false, children: children2, dir, onOpenChange, modal = true } = props;
+  const { __scopeMenu, open: open2 = false, children: children2, dir, onOpenChange, modal = true } = props;
   const popperScope = usePopperScope$1(__scopeMenu);
   const [content2, setContent] = reactExports.useState(null);
   const isUsingKeyboardRef = reactExports.useRef(false);
@@ -139416,7 +140014,7 @@ var Menu = (props) => {
     MenuProvider,
     {
       scope: __scopeMenu,
-      open,
+      open: open2,
       onOpenChange: handleOpenChange,
       content: content2,
       onContentChange: setContent,
@@ -140087,8 +140685,8 @@ var MenuSubContent = reactExports.forwardRef(
   }
 );
 MenuSubContent.displayName = SUB_CONTENT_NAME$1;
-function getOpenState(open) {
-  return open ? "open" : "closed";
+function getOpenState(open2) {
+  return open2 ? "open" : "closed";
 }
 function isIndeterminate$1(checked) {
   return checked === "indeterminate";
@@ -140174,7 +140772,7 @@ var DropdownMenu$1 = (props) => {
   } = props;
   const menuScope = useMenuScope(__scopeDropdownMenu);
   const triggerRef = reactExports.useRef(null);
-  const [open = false, setOpen] = useControllableState({
+  const [open2 = false, setOpen] = useControllableState({
     prop: openProp,
     defaultProp: defaultOpen,
     onChange: onOpenChange
@@ -140186,11 +140784,11 @@ var DropdownMenu$1 = (props) => {
       triggerId: useId(),
       triggerRef,
       contentId: useId(),
-      open,
+      open: open2,
       onOpenChange: setOpen,
       onOpenToggle: reactExports.useCallback(() => setOpen((prevOpen) => !prevOpen), [setOpen]),
       modal,
-      children: /* @__PURE__ */ jsxRuntimeExports.jsx(Root3, { ...menuScope, open, onOpenChange: setOpen, dir, modal, children: children2 })
+      children: /* @__PURE__ */ jsxRuntimeExports.jsx(Root3, { ...menuScope, open: open2, onOpenChange: setOpen, dir, modal, children: children2 })
     }
   );
 };
@@ -143501,7 +144099,7 @@ var Select$1 = (props) => {
   const [valueNode, setValueNode] = reactExports.useState(null);
   const [valueNodeHasChildren, setValueNodeHasChildren] = reactExports.useState(false);
   const direction = useDirection(dir);
-  const [open, setOpen] = useControllableState$1({
+  const [open2, setOpen] = useControllableState$1({
     prop: openProp,
     defaultProp: defaultOpen ?? false,
     onChange: onOpenChange,
@@ -143531,7 +144129,7 @@ var Select$1 = (props) => {
       contentId: useId$1(),
       value,
       onValueChange: setValue,
-      open,
+      open: open2,
       onOpenChange: setOpen,
       dir: direction,
       triggerPointerDownPosRef,
@@ -156156,7 +156754,7 @@ var Dialog$1 = (props) => {
   } = props;
   const triggerRef = reactExports.useRef(null);
   const contentRef = reactExports.useRef(null);
-  const [open, setOpen] = useControllableState$1({
+  const [open2, setOpen] = useControllableState$1({
     prop: openProp,
     defaultProp: defaultOpen ?? false,
     onChange: onOpenChange,
@@ -156171,7 +156769,7 @@ var Dialog$1 = (props) => {
       contentId: useId$1(),
       titleId: useId$1(),
       descriptionId: useId$1(),
-      open,
+      open: open2,
       onOpenChange: setOpen,
       onOpenToggle: reactExports.useCallback(() => setOpen((prevOpen) => !prevOpen), [setOpen]),
       modal,
@@ -156402,8 +157000,8 @@ var DialogClose$1 = reactExports.forwardRef(
   }
 );
 DialogClose$1.displayName = CLOSE_NAME$1;
-function getState$1(open) {
-  return open ? "open" : "closed";
+function getState$1(open2) {
+  return open2 ? "open" : "closed";
 }
 var TITLE_WARNING_NAME$1 = "DialogTitleWarning";
 var [WarningProvider$1, useWarningContext$1] = createContext2$1(TITLE_WARNING_NAME$1, {
@@ -157373,7 +157971,7 @@ var Dialog = (props) => {
   } = props;
   const triggerRef = reactExports.useRef(null);
   const contentRef = reactExports.useRef(null);
-  const [open = false, setOpen] = useControllableState({
+  const [open2 = false, setOpen] = useControllableState({
     prop: openProp,
     defaultProp: defaultOpen,
     onChange: onOpenChange
@@ -157387,7 +157985,7 @@ var Dialog = (props) => {
       contentId: useId(),
       titleId: useId(),
       descriptionId: useId(),
-      open,
+      open: open2,
       onOpenChange: setOpen,
       onOpenToggle: reactExports.useCallback(() => setOpen((prevOpen) => !prevOpen), [setOpen]),
       modal,
@@ -157617,8 +158215,8 @@ var DialogClose = reactExports.forwardRef(
   }
 );
 DialogClose.displayName = CLOSE_NAME;
-function getState(open) {
-  return open ? "open" : "closed";
+function getState(open2) {
+  return open2 ? "open" : "closed";
 }
 var TITLE_WARNING_NAME = "DialogTitleWarning";
 var [WarningProvider, useWarningContext] = createContext2(TITLE_WARNING_NAME, {
@@ -158200,9 +158798,8 @@ function useStreamReader(env2, streamId, runId, encryptionKey, runStatus) {
           if (!cryptoKey) {
             return { encrypted: true };
           }
-          const payload = frameData.slice(4);
           hydrated = hydrateData(
-            await decrypt$1(cryptoKey, payload),
+            await decrypt(frameData, cryptoKey),
             revivers
           );
         } else {
@@ -158355,7 +158952,7 @@ function useStreamReader(env2, streamId, runId, encryptionKey, runStatus) {
     };
     const readStreamData = async () => {
       try {
-        const cryptoKey = encryptionKey ? await importKey(encryptionKey) : void 0;
+        const cryptoKey = encryptionKey ? await deriveRunPayloadKeys(encryptionKey) : void 0;
         const initialChunks = [];
         const result = await fetchAndParse(initialChunks, cryptoKey);
         if (result.encrypted) {
@@ -159011,7 +159608,7 @@ const handlers = {
   resumeHook: (p2) => resumeHook$1(p2.worldEnv ?? {}, p2.token, p2.payload),
   fetchStreams: (p2) => fetchStreams(p2.worldEnv ?? {}, p2.runId),
   fetchWorkflowsManifest: (p2) => fetchWorkflowsManifest(p2.worldEnv ?? {}),
-  runHealthCheck: (p2) => runHealthCheck(p2.worldEnv ?? {}, p2.endpoint, p2.options),
+  runHealthCheck: (p2) => runHealthCheck(p2.worldEnv ?? {}, p2.options),
   getEncryptionKeyForRun: (p2) => getEncryptionKeyForRun(p2.worldEnv ?? {}, p2.runId),
   getPublicServerConfig: () => getPublicServerConfig()
 };
@@ -159149,7 +159746,7 @@ const route4 = /* @__PURE__ */ Object.freeze(/* @__PURE__ */ Object.defineProper
   __proto__: null,
   loader
 }, Symbol.toStringTag, { value: "Module" }));
-const serverManifest = { "entry": { "module": "/assets/entry.client-Q4eUIqMI.js", "imports": ["/assets/index-Q81MFBxC.js"], "css": [] }, "routes": { "root": { "id": "root", "parentId": void 0, "path": "", "index": void 0, "caseSensitive": void 0, "hasAction": true, "hasLoader": true, "hasClientAction": false, "hasClientLoader": false, "hasClientMiddleware": false, "hasDefaultExport": true, "hasErrorBoundary": true, "module": "/assets/root-BPK1T9Ck.js", "imports": ["/assets/index-Q81MFBxC.js", "/assets/mermaid-3ZIDBTTL-C_EWPx9a.js", "/assets/arrow-up-right-Dv3gGqIf.js"], "css": ["/assets/root-15oK726f.css", "/assets/mermaid-3ZIDBTTL-DDxQhcP4.css"], "clientActionModule": void 0, "clientLoaderModule": void 0, "clientMiddlewareModule": void 0, "hydrateFallbackModule": void 0 }, "routes/home": { "id": "routes/home", "parentId": "root", "path": void 0, "index": true, "caseSensitive": void 0, "hasAction": false, "hasLoader": false, "hasClientAction": false, "hasClientLoader": false, "hasClientMiddleware": false, "hasDefaultExport": true, "hasErrorBoundary": false, "module": "/assets/home-0OfTSXd1.js", "imports": ["/assets/index-Q81MFBxC.js", "/assets/workflow-graph-viewer-DrfqsDRu.js", "/assets/mermaid-3ZIDBTTL-C_EWPx9a.js", "/assets/index-STTN0-2V.js"], "css": ["/assets/workflow-graph-viewer-DnlNuQQH.css", "/assets/mermaid-3ZIDBTTL-DDxQhcP4.css"], "clientActionModule": void 0, "clientLoaderModule": void 0, "clientMiddlewareModule": void 0, "hydrateFallbackModule": void 0 }, "routes/run-detail": { "id": "routes/run-detail", "parentId": "root", "path": "run/:runId", "index": void 0, "caseSensitive": void 0, "hasAction": false, "hasLoader": false, "hasClientAction": false, "hasClientLoader": false, "hasClientMiddleware": false, "hasDefaultExport": true, "hasErrorBoundary": false, "module": "/assets/run-detail-CrqNzQ_y.js", "imports": ["/assets/index-Q81MFBxC.js", "/assets/workflow-graph-viewer-DrfqsDRu.js", "/assets/mermaid-3ZIDBTTL-C_EWPx9a.js", "/assets/arrow-up-right-Dv3gGqIf.js", "/assets/encryption-CLVP4klT.js", "/assets/index-STTN0-2V.js"], "css": ["/assets/run-detail-CWoGxu_0.css", "/assets/workflow-graph-viewer-DnlNuQQH.css", "/assets/mermaid-3ZIDBTTL-DDxQhcP4.css"], "clientActionModule": void 0, "clientLoaderModule": void 0, "clientMiddlewareModule": void 0, "hydrateFallbackModule": void 0 }, "routes/api.rpc": { "id": "routes/api.rpc", "parentId": "root", "path": "api/rpc", "index": void 0, "caseSensitive": void 0, "hasAction": true, "hasLoader": true, "hasClientAction": false, "hasClientLoader": false, "hasClientMiddleware": false, "hasDefaultExport": false, "hasErrorBoundary": false, "module": "/assets/api.rpc-l0sNRNKZ.js", "imports": [], "css": [], "clientActionModule": void 0, "clientLoaderModule": void 0, "clientMiddlewareModule": void 0, "hydrateFallbackModule": void 0 }, "routes/api.stream.$streamId": { "id": "routes/api.stream.$streamId", "parentId": "root", "path": "api/stream/:streamId", "index": void 0, "caseSensitive": void 0, "hasAction": false, "hasLoader": true, "hasClientAction": false, "hasClientLoader": false, "hasClientMiddleware": false, "hasDefaultExport": false, "hasErrorBoundary": false, "module": "/assets/api.stream._streamId-l0sNRNKZ.js", "imports": [], "css": [], "clientActionModule": void 0, "clientLoaderModule": void 0, "clientMiddlewareModule": void 0, "hydrateFallbackModule": void 0 } }, "url": "/assets/manifest-485c4078.js", "version": "485c4078", "sri": void 0 };
+const serverManifest = { "entry": { "module": "/assets/entry.client-LwI3HNYl.js", "imports": ["/assets/index-PFjW8YjQ.js"], "css": [] }, "routes": { "root": { "id": "root", "parentId": void 0, "path": "", "index": void 0, "caseSensitive": void 0, "hasAction": true, "hasLoader": true, "hasClientAction": false, "hasClientLoader": false, "hasClientMiddleware": false, "hasDefaultExport": true, "hasErrorBoundary": true, "module": "/assets/root-2ub-CsWS.js", "imports": ["/assets/index-PFjW8YjQ.js", "/assets/mermaid-3ZIDBTTL-CMP9Tato.js", "/assets/arrow-up-right-DDNPFYmg.js"], "css": ["/assets/root-15oK726f.css", "/assets/mermaid-3ZIDBTTL-DDxQhcP4.css"], "clientActionModule": void 0, "clientLoaderModule": void 0, "clientMiddlewareModule": void 0, "hydrateFallbackModule": void 0 }, "routes/home": { "id": "routes/home", "parentId": "root", "path": void 0, "index": true, "caseSensitive": void 0, "hasAction": false, "hasLoader": false, "hasClientAction": false, "hasClientLoader": false, "hasClientMiddleware": false, "hasDefaultExport": true, "hasErrorBoundary": false, "module": "/assets/home-BqvW8ODs.js", "imports": ["/assets/index-PFjW8YjQ.js", "/assets/workflow-graph-viewer-DOLwtzSv.js", "/assets/mermaid-3ZIDBTTL-CMP9Tato.js"], "css": ["/assets/workflow-graph-viewer-DnlNuQQH.css", "/assets/mermaid-3ZIDBTTL-DDxQhcP4.css"], "clientActionModule": void 0, "clientLoaderModule": void 0, "clientMiddlewareModule": void 0, "hydrateFallbackModule": void 0 }, "routes/run-detail": { "id": "routes/run-detail", "parentId": "root", "path": "run/:runId", "index": void 0, "caseSensitive": void 0, "hasAction": false, "hasLoader": false, "hasClientAction": false, "hasClientLoader": false, "hasClientMiddleware": false, "hasDefaultExport": true, "hasErrorBoundary": false, "module": "/assets/run-detail-B1PK-m7y.js", "imports": ["/assets/index-PFjW8YjQ.js", "/assets/workflow-graph-viewer-DOLwtzSv.js", "/assets/mermaid-3ZIDBTTL-CMP9Tato.js", "/assets/arrow-up-right-DDNPFYmg.js"], "css": ["/assets/run-detail-CWoGxu_0.css", "/assets/workflow-graph-viewer-DnlNuQQH.css", "/assets/mermaid-3ZIDBTTL-DDxQhcP4.css"], "clientActionModule": void 0, "clientLoaderModule": void 0, "clientMiddlewareModule": void 0, "hydrateFallbackModule": void 0 }, "routes/api.rpc": { "id": "routes/api.rpc", "parentId": "root", "path": "api/rpc", "index": void 0, "caseSensitive": void 0, "hasAction": true, "hasLoader": true, "hasClientAction": false, "hasClientLoader": false, "hasClientMiddleware": false, "hasDefaultExport": false, "hasErrorBoundary": false, "module": "/assets/api.rpc-l0sNRNKZ.js", "imports": [], "css": [], "clientActionModule": void 0, "clientLoaderModule": void 0, "clientMiddlewareModule": void 0, "hydrateFallbackModule": void 0 }, "routes/api.stream.$streamId": { "id": "routes/api.stream.$streamId", "parentId": "root", "path": "api/stream/:streamId", "index": void 0, "caseSensitive": void 0, "hasAction": false, "hasLoader": true, "hasClientAction": false, "hasClientLoader": false, "hasClientMiddleware": false, "hasDefaultExport": false, "hasErrorBoundary": false, "module": "/assets/api.stream._streamId-l0sNRNKZ.js", "imports": [], "css": [], "clientActionModule": void 0, "clientLoaderModule": void 0, "clientMiddlewareModule": void 0, "hydrateFallbackModule": void 0 } }, "url": "/assets/manifest-7f03c136.js", "version": "7f03c136", "sri": void 0 };
 const assetsBuildDirectory = "build/client";
 const basename = "/";
 const future = { "unstable_optimizeDeps": false, "unstable_subResourceIntegrity": false, "unstable_trailingSlashAwareDataRequests": false, "unstable_previewServerPrerendering": false, "v8_middleware": false, "v8_splitRouteModules": false, "v8_viteEnvironmentApi": false };
@@ -159218,7 +159815,7 @@ const serverBuild = /* @__PURE__ */ Object.freeze(/* @__PURE__ */ Object.defineP
   ssr
 }, Symbol.toStringTag, { value: "Module" }));
 export {
-  ValidQueueName as $,
+  WAIT_EVENT_TYPES as $,
   ATTRIBUTE_KEY_MAX_LENGTH as A,
   BaseEventSchema as B,
   CHILD_ENTITY_CREATION_EVENT_TYPES as C,
@@ -159228,67 +159825,66 @@ export {
   STEP_EVENT_TYPES as G,
   HookSchema as H,
   SerializedDataSchema as I,
-  StepInvokePayloadSchema as J,
-  StepSchema as K,
+  StepSchema as J,
+  StepStatusSchema as K,
   LegacySerializedDataSchemaV1 as L,
   MessageId as M,
   Nt as N,
-  StepStatusSchema as O,
+  StructuredErrorSchema as O,
   PARENT_RUN_ID_ATTRIBUTE as P,
   QueuePayloadSchema as Q,
   RESERVED_ATTRIBUTE_KEY_PREFIX as R,
   SPEC_VERSION_CURRENT as S,
-  StructuredErrorSchema as T,
-  TERMINAL_RUN_EVENT_TYPES as U,
-  TERMINAL_STEP_EVENT_TYPES as V,
-  TERMINAL_STEP_STATUSES as W,
-  TERMINAL_WORKFLOW_RUN_STATUSES as X,
-  TerminalRunEventTypeSchema as Y,
-  TerminalStepStatusSchema as Z,
-  TerminalWorkflowRunStatusSchema as _,
+  TERMINAL_RUN_EVENT_TYPES as T,
+  TERMINAL_STEP_EVENT_TYPES as U,
+  TERMINAL_STEP_STATUSES as V,
+  TERMINAL_WORKFLOW_RUN_STATUSES as W,
+  TerminalRunEventTypeSchema as X,
+  TerminalStepStatusSchema as Y,
+  TerminalWorkflowRunStatusSchema as Z,
+  ValidQueueName as _,
   ATTRIBUTE_MAX_PER_RUN as a,
-  WAIT_EVENT_TYPES as a0,
-  WaitSchema as a1,
-  WaitStatusSchema as a2,
-  WorkflowInvokePayloadSchema as a3,
-  WorkflowRunBaseSchema as a4,
-  WorkflowRunSchema as a5,
-  WorkflowRunStatusSchema as a6,
-  applyAttributeChanges as a7,
-  envNumber as a8,
-  getEventDataPayloadField as a9,
-  jsxRuntimeExports as aA,
-  Qe as aB,
-  registerZstdDecoder as aC,
-  requireTokenUtil as aD,
-  requireTokenError as aE,
-  serverBuild as aF,
-  getEventDataRefFields as aa,
-  getQueueTopicPrefix as ab,
-  isChildEntityCreationEvent as ac,
-  isChildEntityCreationEventType as ad,
-  isHookEventRequiringExistence as ae,
-  isHookLifecycleEventType as af,
-  isLegacySpecVersion as ag,
-  isStepEventType as ah,
-  isTerminalRunEventType as ai,
-  isTerminalStepEventType as aj,
-  isTerminalStepStatus as ak,
-  isTerminalWorkflowRunStatus as al,
-  isWaitEventType as am,
-  parseQueueName as an,
-  reenqueueActiveRuns as ao,
-  requiresNewerWorld as ap,
-  resolveQueueNamespace as aq,
-  stripEventDataRefs as ar,
-  ulidToDate as as,
-  validateAttributeChanges as at,
-  validateAttributeKey as au,
-  validateAttributeValue as av,
-  validateUlidTimestamp as aw,
-  workflowRunIdSchema as ax,
-  R as ay,
-  Ks as az,
+  WaitSchema as a0,
+  WaitStatusSchema as a1,
+  WorkflowInvokePayloadSchema as a2,
+  WorkflowRunBaseSchema as a3,
+  WorkflowRunSchema as a4,
+  WorkflowRunStatusSchema as a5,
+  applyAttributeChanges as a6,
+  envNumber as a7,
+  getEventDataPayloadField as a8,
+  getEventDataRefFields as a9,
+  Qe as aA,
+  registerZstdDecoder as aB,
+  requireTokenUtil as aC,
+  requireTokenError as aD,
+  serverBuild as aE,
+  getQueueTopicPrefix as aa,
+  isChildEntityCreationEvent as ab,
+  isChildEntityCreationEventType as ac,
+  isHookEventRequiringExistence as ad,
+  isHookLifecycleEventType as ae,
+  isLegacySpecVersion as af,
+  isStepEventType as ag,
+  isTerminalRunEventType as ah,
+  isTerminalStepEventType as ai,
+  isTerminalStepStatus as aj,
+  isTerminalWorkflowRunStatus as ak,
+  isWaitEventType as al,
+  parseQueueName as am,
+  reenqueueActiveRuns as an,
+  requiresNewerWorld as ao,
+  resolveQueueNamespace as ap,
+  stripEventDataRefs as aq,
+  ulidToDate as ar,
+  validateAttributeChanges as as,
+  validateAttributeKey as at,
+  validateAttributeValue as au,
+  validateUlidTimestamp as av,
+  workflowRunIdSchema as aw,
+  R as ax,
+  Ks as ay,
+  jsxRuntimeExports as az,
   ATTRIBUTE_VALUE_MAX_BYTES as b,
   AnalyticsAttributeKeySchema as c,
   AnalyticsEventSchema as d,