eve 0.22.1 → 0.22.3

package/CHANGELOG.md

@@ -1,5 +1,43 @@
 # eve
 
+## 0.22.3
+
+### Patch Changes
+
+- 8223498: Start remote authentication when a credentialed Vercel deployment returns an `UNAUTHORIZED` protection response.
+- 79df338: feat(eve): scaffold projects with bundler module resolution
+
+  `eve init` now writes a `tsconfig.json` using `"moduleResolution": "bundler"` (and `"module": "esnext"`), which matches how eve compiles authored agents and extensions. Relative imports in your agent and extension source no longer need `.js` extensions (e.g. `import extension from "../extension"`).
+
+- 173fa5d: Restore the `DISCORD_BOT_TOKEN` environment fallback for proactive Discord messages, typing indicators, and bot-authenticated requests when `discordChannel()` is configured without explicit credentials.
+- 89cd2d6: Eval assertion `count` options now accept predicates, allowing ranges such as “at least two” while preserving exact numeric counts.
+- fdf56ef: feat(eve): mounted extensions
+
+  Package eve capabilities — tools, connections, skills, instructions, hooks — as a reusable package and mount it under `agent/extensions/`, as a file (`crm.ts`) or a directory with co-located override slots that shadow the extension's own contributions. Contributions compose into the agent under a `<namespace>__` prefix. Author with `defineExtension` from `eve/extension`, taking an optional Standard-Schema `config` read via `extension.config`; `defineState` is auto-scoped to the package. `eve build` compiles the package to runnable JavaScript with type declarations and fills its `exports`, so a published extension installs and mounts with no second compiler. `eve` is a peer dependency whose declared range eve enforces at mount; an extension cannot declare a sandbox, agent config, schedules, or limits, or mount other extensions.
+
+- 89f13e0: Hardened frontmatter parsing and OpenAPI connection loading.
+
+  All frontmatter parsing now runs through a single safe-by-default helper with gray-matter's code-capable engines disabled, so a `---js` / `---javascript` fence throws instead of being `eval()`d. Previously only authored markdown (skills, schedules, instructions) was hardened; the eval YAML loader and the OpenAPI spec loader used gray-matter's defaults and would execute such a fence. This closes that path for OpenAPI specs, which are fetched over the network. Parsing untrusted frontmatter as code is now opt-in only, and a direct import of the bundled gray-matter outside the wrapper fails CI.
+
+  OpenAPI spec URLs and the resolved base URL are now required to use `https` (plain `http` is still allowed for loopback hosts during local development), so neither the spec fetch nor the credentialed operation calls run over cleartext; the spec transport is also re-checked after redirects.
+
+- aff35e2: Stop `eve dev` source snapshots from copying nested Git repositories and worktrees, preventing duplicate checkouts from inflating each development snapshot.
+- 9087496: Prevent brokered credential values from being exposed to commands running in Microsandbox. Guest Git configuration continues to use broker-managed placeholders for authenticated requests.
+- 72c58ae: Recover `eve dev <url>` authentication when Vercel Deployment Protection returns an SSO redirect or a structured protected-deployment response.
+- 87688f9: Slack outbound messages now preserve literal bare `@` tokens, including scoped package names, while explicit `<@USER_ID>` mention syntax continues to pass through unchanged.
+- c1c4ee5: Preserve query parameters passed to `eve dev` and send them on every agent request, including session POSTs and streams.
+
+## 0.22.2
+
+### Patch Changes
+
+- 4da4d86: Fixed Anthropic prompt caching placing the final cache breakpoint one message too early. Fresh tool results were billed as uncached input every turn and only entered the cache on the following request, capping the effective cache hit rate near 50%; the breakpoint now sits on the last message of each request, so agentic tool loops get near-full prefix hits.
+- 4446f96: Update the vendored Workflow SDK packages to the latest 5.0 beta releases. eve now delegates world target selection and construction to the upstream SDK instead of maintaining parallel factory and compatibility logic, and no longer disables stable Workflow Turbo mode.
+- 3da5def: Retry transient provider overload errors delivered inside model streams. Classified transient failures get at most three fresh model-call attempts, while other recoverable task-mode errors fall back to Workflow's durable step retries without multiplying retry budgets.
+- 2afed3b: Update `withEve()` to generate Vercel Build Output service routes for eve instead of the legacy Next.js rewrite setup. The generated output now uses the stable `services` field and service routes, including in hosted Vercel builds where no local `.vercel/project.json` exists, so Vercel builds the eve service without Next.js rewrites.
+- 3983d36: The Slack channel's default typing indicator for `actions.requested` now shows the action's contents instead of a generic `Running <tool>...` label: the tool name plus its most telling argument (`grep useEveAgent`, `read_file agent/agent.ts`), the subagent or remote-agent name for dispatched calls, and `+N more` for batches. The label helpers are exported from `eve/channels/slack` as `describeActionRequest` and `describeActionRequests` for use in custom handlers.
+- 15309f3: New projects created with `eve init` now use stable TypeScript 7.0.2 instead of the release candidate.
+
 ## 0.22.1
 
 ### Patch Changes

package/dist/src/chunks/{use-eve-agent-CM24ZUEI.js → use-eve-agent-Cojyfr4X.js}

@@ -238,7 +238,8 @@ function isObject(value) {
 var ClientError = class extends Error {
 	status;
 	body;
-	constructor(status, body) {
+	headers;
+	constructor(status, body, headers) {
 		let message = body || `Server returned ${status}.`;
 		try {
 			const parsed = JSON.parse(body);
@@ -248,6 +249,7 @@ var ClientError = class extends Error {
 		this.name = "ClientError";
 		this.status = status;
 		this.body = body;
+		this.headers = Object.freeze(Object.fromEntries(new Headers(headers).entries()));
 	}
 };
 
@@ -476,15 +478,17 @@ async function* readNdjsonStream(body) {
 //#region src/client/url.ts
 function createClientUrl(host, routePath, searchParams) {
 	const normalizedRoute = routePath.startsWith("/") ? routePath : `/${routePath}`;
-	const search = formatSearch(searchParams);
 	if (isAbsoluteUrl(host)) {
 		const url = new URL(host);
 		url.pathname = `${trimTrailingSlash(url.pathname)}${normalizedRoute}`;
-		url.search = search;
+		mergeSearchParams(url.searchParams, searchParams);
 		url.hash = "";
 		return url.toString();
 	}
-	return `${trimTrailingSlash(host)}${normalizedRoute}${search}`;
+	const url = new URL(host, "http://eve.local");
+	const basePath = trimTrailingSlash(url.pathname);
+	mergeSearchParams(url.searchParams, searchParams);
+	return `${basePath}${normalizedRoute}${formatSearch(url.searchParams)}`;
 }
 function isAbsoluteUrl(value) {
 	return /^[a-z][a-z\d+\-.]*:/i.test(value);
@@ -493,9 +497,13 @@ function trimTrailingSlash(value) {
 	if (value === "/") return "";
 	return value.endsWith("/") ? value.slice(0, -1) : value;
 }
+function mergeSearchParams(target, searchParams) {
+	if (searchParams === void 0) return;
+	for (const [name, value] of Object.entries(searchParams)) target.set(name, value);
+}
 function formatSearch(searchParams) {
-	if (!searchParams || Object.keys(searchParams).length === 0) return "";
-	return `?${new URLSearchParams(searchParams).toString()}`;
+	const value = searchParams.toString();
+	return value.length === 0 ? "" : `?${value}`;
 }
 
 //#endregion
@@ -536,6 +544,7 @@ async function* openStreamIterable(input) {
 async function openStreamBody(input) {
 	let lastStatus;
 	let lastBody;
+	let lastHeaders;
 	for (let attempt = 0; attempt < STREAM_OPEN_RETRY_ATTEMPTS; attempt += 1) {
 		const url = createClientUrl(input.host, createEveMessageStreamRoutePath(input.sessionId), input.startIndex > 0 ? { startIndex: String(input.startIndex) } : void 0);
 		const headers = await input.resolveHeaders();
@@ -545,15 +554,16 @@ async function openStreamBody(input) {
 			signal: input.signal ?? null
 		});
 		if (response.ok) {
-			if (!response.body) throw new ClientError(response.status, "Response body is null.");
+			if (!response.body) throw new ClientError(response.status, "Response body is null.", response.headers);
 			return response.body;
 		}
 		lastStatus = response.status;
 		lastBody = await response.text();
-		if (!STREAM_OPEN_RETRYABLE_STATUS.has(response.status)) throw new ClientError(response.status, lastBody);
+		lastHeaders = response.headers;
+		if (!STREAM_OPEN_RETRYABLE_STATUS.has(response.status)) throw new ClientError(response.status, lastBody, response.headers);
 		if (attempt < STREAM_OPEN_RETRY_ATTEMPTS - 1) await sleep$1(STREAM_OPEN_RETRY_DELAY_MS);
 	}
-	throw new ClientError(lastStatus ?? 0, lastBody ?? "Failed to open message stream.");
+	throw new ClientError(lastStatus ?? 0, lastBody ?? "Failed to open message stream.", lastHeaders);
 }
 async function sleep$1(ms) {
 	await new Promise((resolve) => setTimeout(resolve, ms));
@@ -697,6 +707,7 @@ async function postTurnWithRetry(input) {
 	const attempts = input.mustDeliver ? DELIVER_RETRY_ATTEMPTS : 1;
 	let lastStatus;
 	let lastBody;
+	let lastHeaders;
 	for (let attempt = 0; attempt < attempts; attempt += 1) {
 		const response = await fetch(input.url, {
 			body: input.body,
@@ -708,10 +719,11 @@ async function postTurnWithRetry(input) {
 		if (response.ok) return response;
 		lastStatus = response.status;
 		lastBody = await response.text();
-		if (!isRetryableDeliveryFailure(response.status, lastBody)) throw new ClientError(response.status, lastBody);
+		lastHeaders = response.headers;
+		if (!isRetryableDeliveryFailure(response.status, lastBody)) throw new ClientError(response.status, lastBody, response.headers);
 		if (attempt < attempts - 1) await sleep(DELIVER_RETRY_DELAY_MS);
 	}
-	throw new ClientError(lastStatus ?? 0, lastBody ?? "Failed to deliver session turn.");
+	throw new ClientError(lastStatus ?? 0, lastBody ?? "Failed to deliver session turn.", lastHeaders);
 }
 function isRetryableDeliveryFailure(status, body) {
 	return status === 500 && /target session was not found/i.test(body);
@@ -762,7 +774,7 @@ var Client = class {
 		const response = await fetch(url, withRedirectPolicy({ headers }, this.#redirect));
 		if (!response.ok) {
 			const body = await response.text();
-			throw new ClientError(response.status, body);
+			throw new ClientError(response.status, body, response.headers);
 		}
 		return await response.json();
 	}
@@ -770,7 +782,7 @@ var Client = class {
 		const response = await this.fetch(EVE_INFO_ROUTE_PATH);
 		if (!response.ok) {
 			const body = await response.text();
-			throw new ClientError(response.status, body);
+			throw new ClientError(response.status, body, response.headers);
 		}
 		let payload;
 		try {

package/dist/src/chunks/{use-eve-agent-CxcKypLZ.js → use-eve-agent-D-S1TPCW.js}

@@ -238,7 +238,8 @@ function isObject(value) {
 var ClientError = class extends Error {
 	status;
 	body;
-	constructor(status, body) {
+	headers;
+	constructor(status, body, headers) {
 		let message = body || `Server returned ${status}.`;
 		try {
 			const parsed = JSON.parse(body);
@@ -248,6 +249,7 @@ var ClientError = class extends Error {
 		this.name = "ClientError";
 		this.status = status;
 		this.body = body;
+		this.headers = Object.freeze(Object.fromEntries(new Headers(headers).entries()));
 	}
 };
 
@@ -476,15 +478,17 @@ async function* readNdjsonStream(body) {
 //#region src/client/url.ts
 function createClientUrl(host, routePath, searchParams) {
 	const normalizedRoute = routePath.startsWith("/") ? routePath : `/${routePath}`;
-	const search = formatSearch(searchParams);
 	if (isAbsoluteUrl(host)) {
 		const url = new URL(host);
 		url.pathname = `${trimTrailingSlash(url.pathname)}${normalizedRoute}`;
-		url.search = search;
+		mergeSearchParams(url.searchParams, searchParams);
 		url.hash = "";
 		return url.toString();
 	}
-	return `${trimTrailingSlash(host)}${normalizedRoute}${search}`;
+	const url = new URL(host, "http://eve.local");
+	const basePath = trimTrailingSlash(url.pathname);
+	mergeSearchParams(url.searchParams, searchParams);
+	return `${basePath}${normalizedRoute}${formatSearch(url.searchParams)}`;
 }
 function isAbsoluteUrl(value) {
 	return /^[a-z][a-z\d+\-.]*:/i.test(value);
@@ -493,9 +497,13 @@ function trimTrailingSlash(value) {
 	if (value === "/") return "";
 	return value.endsWith("/") ? value.slice(0, -1) : value;
 }
+function mergeSearchParams(target, searchParams) {
+	if (searchParams === void 0) return;
+	for (const [name, value] of Object.entries(searchParams)) target.set(name, value);
+}
 function formatSearch(searchParams) {
-	if (!searchParams || Object.keys(searchParams).length === 0) return "";
-	return `?${new URLSearchParams(searchParams).toString()}`;
+	const value = searchParams.toString();
+	return value.length === 0 ? "" : `?${value}`;
 }
 
 //#endregion
@@ -536,6 +544,7 @@ async function* openStreamIterable(input) {
 async function openStreamBody(input) {
 	let lastStatus;
 	let lastBody;
+	let lastHeaders;
 	for (let attempt = 0; attempt < STREAM_OPEN_RETRY_ATTEMPTS; attempt += 1) {
 		const url = createClientUrl(input.host, createEveMessageStreamRoutePath(input.sessionId), input.startIndex > 0 ? { startIndex: String(input.startIndex) } : void 0);
 		const headers = await input.resolveHeaders();
@@ -545,15 +554,16 @@ async function openStreamBody(input) {
 			signal: input.signal ?? null
 		});
 		if (response.ok) {
-			if (!response.body) throw new ClientError(response.status, "Response body is null.");
+			if (!response.body) throw new ClientError(response.status, "Response body is null.", response.headers);
 			return response.body;
 		}
 		lastStatus = response.status;
 		lastBody = await response.text();
-		if (!STREAM_OPEN_RETRYABLE_STATUS.has(response.status)) throw new ClientError(response.status, lastBody);
+		lastHeaders = response.headers;
+		if (!STREAM_OPEN_RETRYABLE_STATUS.has(response.status)) throw new ClientError(response.status, lastBody, response.headers);
 		if (attempt < STREAM_OPEN_RETRY_ATTEMPTS - 1) await sleep$1(STREAM_OPEN_RETRY_DELAY_MS);
 	}
-	throw new ClientError(lastStatus ?? 0, lastBody ?? "Failed to open message stream.");
+	throw new ClientError(lastStatus ?? 0, lastBody ?? "Failed to open message stream.", lastHeaders);
 }
 async function sleep$1(ms) {
 	await new Promise((resolve) => setTimeout(resolve, ms));
@@ -697,6 +707,7 @@ async function postTurnWithRetry(input) {
 	const attempts = input.mustDeliver ? DELIVER_RETRY_ATTEMPTS : 1;
 	let lastStatus;
 	let lastBody;
+	let lastHeaders;
 	for (let attempt = 0; attempt < attempts; attempt += 1) {
 		const response = await fetch(input.url, {
 			body: input.body,
@@ -708,10 +719,11 @@ async function postTurnWithRetry(input) {
 		if (response.ok) return response;
 		lastStatus = response.status;
 		lastBody = await response.text();
-		if (!isRetryableDeliveryFailure(response.status, lastBody)) throw new ClientError(response.status, lastBody);
+		lastHeaders = response.headers;
+		if (!isRetryableDeliveryFailure(response.status, lastBody)) throw new ClientError(response.status, lastBody, response.headers);
 		if (attempt < attempts - 1) await sleep(DELIVER_RETRY_DELAY_MS);
 	}
-	throw new ClientError(lastStatus ?? 0, lastBody ?? "Failed to deliver session turn.");
+	throw new ClientError(lastStatus ?? 0, lastBody ?? "Failed to deliver session turn.", lastHeaders);
 }
 function isRetryableDeliveryFailure(status, body) {
 	return status === 500 && /target session was not found/i.test(body);
@@ -762,7 +774,7 @@ var Client = class {
 		const response = await fetch(url, withRedirectPolicy({ headers }, this.#redirect));
 		if (!response.ok) {
 			const body = await response.text();
-			throw new ClientError(response.status, body);
+			throw new ClientError(response.status, body, response.headers);
 		}
 		return await response.json();
 	}
@@ -770,7 +782,7 @@ var Client = class {
 		const response = await this.fetch(EVE_INFO_ROUTE_PATH);
 		if (!response.ok) {
 			const body = await response.text();
-			throw new ClientError(response.status, body);
+			throw new ClientError(response.status, body, response.headers);
 		}
 		let payload;
 		try {

package/dist/src/cli/commands/init-repl.d.ts

@@ -1,20 +1,21 @@
 import { type Prompter } from "#setup/prompter.js";
+declare const positional: (prompt: string) => string[];
 declare const CODING_AGENT_REPLS: readonly [{
     readonly command: "claude";
     readonly label: "Claude Code";
-    readonly promptArgs: (prompt: string) => string[];
+    readonly promptArgs: typeof positional;
 }, {
     readonly command: "codex";
     readonly label: "Codex";
-    readonly promptArgs: (prompt: string) => string[];
+    readonly promptArgs: typeof positional;
 }, {
     readonly command: "cursor-agent";
     readonly label: "Cursor";
-    readonly promptArgs: (prompt: string) => string[];
+    readonly promptArgs: typeof positional;
 }, {
     readonly command: "droid";
     readonly label: "Droid";
-    readonly promptArgs: (prompt: string) => string[];
+    readonly promptArgs: typeof positional;
 }, {
     readonly command: "gemini";
     readonly label: "Gemini CLI";
@@ -26,7 +27,7 @@ declare const CODING_AGENT_REPLS: readonly [{
 }, {
     readonly command: "pi";
     readonly label: "Pi";
-    readonly promptArgs: (prompt: string) => string[];
+    readonly promptArgs: typeof positional;
 }];
 type CodingAgentReplDefinition = (typeof CODING_AGENT_REPLS)[number];
 /** A coding-agent REPL that can take over the terminal after `eve init`. */

package/dist/src/cli/dev/url.js

@@ -1 +1 @@
-import{InvalidArgumentError}from"#compiled/commander/index.js";import{isLocalEveServerUrl}from"#services/dev-client/local-host.js";const DEVELOPMENT_SERVER_PROTOCOLS=new Set([`http:`,`https:`]);function assertDevelopmentServerProtocol(t,r){if(!DEVELOPMENT_SERVER_PROTOCOLS.has(t.protocol))throw new InvalidArgumentError(`Expected an absolute http(s) URL, received "${r}".`)}function assertSecureRemoteProtocol(n,r){if(n.protocol===`http:`&&!isLocalEveServerUrl(n))throw new InvalidArgumentError(`Remote servers must use https://; received "${r}". Only local hosts may use http://.`)}function parseDevelopmentServerUrl(t){let n=t.trim();try{let e=new URL(n);return assertDevelopmentServerProtocol(e,t),assertSecureRemoteProtocol(e,t),e.hash=``,e.search=``,e.toString()}catch(n){throw n instanceof InvalidArgumentError?n:new InvalidArgumentError(`Expected an absolute http(s) URL, received "${t}".`)}}export{parseDevelopmentServerUrl};
+import{InvalidArgumentError}from"#compiled/commander/index.js";import{isLocalEveServerUrl}from"#services/dev-client/local-host.js";const DEVELOPMENT_SERVER_PROTOCOLS=new Set([`http:`,`https:`]);function assertDevelopmentServerProtocol(t,r){if(!DEVELOPMENT_SERVER_PROTOCOLS.has(t.protocol))throw new InvalidArgumentError(`Expected an absolute http(s) URL, received "${r}".`)}function assertSecureRemoteProtocol(n,r){if(n.protocol===`http:`&&!isLocalEveServerUrl(n))throw new InvalidArgumentError(`Remote servers must use https://; received "${r}". Only local hosts may use http://.`)}function parseDevelopmentServerUrl(t){let n=t.trim();try{let e=new URL(n);return assertDevelopmentServerProtocol(e,t),assertSecureRemoteProtocol(e,t),e.hash=``,e.toString()}catch(n){throw n instanceof InvalidArgumentError?n:new InvalidArgumentError(`Expected an absolute http(s) URL, received "${t}".`)}}export{parseDevelopmentServerUrl};

package/dist/src/client/client-error.d.ts

@@ -10,5 +10,9 @@ export declare class ClientError extends Error {
      * Raw response body text.
      */
     readonly body: string;
-    constructor(status: number, body: string);
+    /**
+     * Response headers, normalized to lowercase names.
+     */
+    readonly headers: Readonly<Record<string, string>>;
+    constructor(status: number, body: string, headers?: ConstructorParameters<typeof Headers>[0]);
 }

package/dist/src/client/client-error.js

@@ -1 +1 @@
-import{isObject}from"#shared/guards.js";var ClientError=class extends Error{status;body;constructor(e,t){let n=t||`Server returned ${e}.`;try{let e=JSON.parse(t);isObject(e)&&typeof e.error==`string`&&(n=e.error)}catch{}super(n),this.name=`ClientError`,this.status=e,this.body=t}};export{ClientError};
+import{isObject}from"#shared/guards.js";var ClientError=class extends Error{status;body;headers;constructor(e,t,n){let r=t||`Server returned ${e}.`;try{let e=JSON.parse(t);isObject(e)&&typeof e.error==`string`&&(r=e.error)}catch{}super(r),this.name=`ClientError`,this.status=e,this.body=t,this.headers=Object.freeze(Object.fromEntries(new Headers(n).entries()))}};export{ClientError};

package/dist/src/client/client.js

@@ -1 +1 @@
-import{EVE_HEALTH_ROUTE_PATH,EVE_INFO_ROUTE_PATH}from"#protocol/routes.js";import{encodeBasicCredentials}from"#internal/http/basic-auth.js";import{AgentInfoResponseError}from"#client/agent-info-error.js";import{AgentInfoResultSchema}from"#client/agent-info-schema.js";import{ClientError}from"#client/client-error.js";import{ClientSession}from"#client/session.js";import{createInitialSessionState}from"#client/session-utils.js";import{createClientUrl}from"#client/url.js";import{VERCEL_TRUSTED_OIDC_IDP_TOKEN_HEADER}from"#client/types.js";var Client=class{#e;#t;#n;#r;#i;#a;constructor(e){this.#n=e.host,this.#e=e.auth,this.#t=e.headers,this.#r=e.maxReconnectAttempts??3,this.#i=e.preserveCompletedSessions??!1,this.#a=e.redirect}async health(){let t=createClientUrl(this.#n,EVE_HEALTH_ROUTE_PATH),n=await this.#o(),r=await fetch(t,withRedirectPolicy({headers:n},this.#a));if(!r.ok){let e=await r.text();throw new ClientError(r.status,e)}return await r.json()}async info(){let e=await this.fetch(EVE_INFO_ROUTE_PATH);if(!e.ok){let t=await e.text();throw new ClientError(e.status,t)}let n;try{n=await e.json()}catch{throw new AgentInfoResponseError}let i=AgentInfoResultSchema.safeParse(n);if(!i.success)throw new AgentInfoResponseError(i.error.issues.slice(0,5).map(e=>{let t=e.path.join(`.`);return t.length===0?e.message:`${t}: ${e.message}`}));return i.data}async fetch(e,t={}){let n=createClientUrl(this.#n,e),r=await this.#o(headersInitToRecord(t.headers));return await fetch(n,withRedirectPolicy({...t,headers:r},this.#a))}session(e){let t;return t=typeof e==`string`?{continuationToken:e,streamIndex:0}:e||createInitialSessionState(),new ClientSession({host:this.#n,maxReconnectAttempts:this.#r,preserveCompletedSessions:this.#i,redirect:this.#a,resolveHeaders:e=>this.#o(e)},t)}async#o(e){let t=new Headers,[n,r]=await Promise.all([resolveHeadersValue(this.#t),this.#s()]);for(let[e,r]of Object.entries(n))t.set(e,r);if(e)for(let[n,r]of Object.entries(e))t.set(n,r);for(let[e,n]of Object.entries(r))t.set(e,n);return t}async#s(){let e=this.#e;if(!e)return{};if(`vercelOidc`in e){let t=(await resolveTokenValue(e.vercelOidc.token)).trim();return t.length===0?{}:{authorization:`Bearer ${t}`,[VERCEL_TRUSTED_OIDC_IDP_TOKEN_HEADER]:t}}if(`bearer`in e){let t=(await resolveTokenValue(e.bearer)).trim();return t.length===0?{}:{authorization:`Bearer ${t}`}}if(`basic`in e){let t=await resolveTokenValue(e.basic.password);return{authorization:`Basic ${encodeBasicCredentials(e.basic.username,t)}`}}return{}}};async function resolveTokenValue(e){return typeof e==`function`?e():e}async function resolveHeadersValue(e){return e===void 0?{}:typeof e==`function`?await e():e}function headersInitToRecord(e){return e===void 0?{}:Object.fromEntries(new Headers(e).entries())}function withRedirectPolicy(e,t){return t===void 0?e:{...e,redirect:t}}export{Client};
+import{EVE_HEALTH_ROUTE_PATH,EVE_INFO_ROUTE_PATH}from"#protocol/routes.js";import{encodeBasicCredentials}from"#internal/http/basic-auth.js";import{AgentInfoResponseError}from"#client/agent-info-error.js";import{AgentInfoResultSchema}from"#client/agent-info-schema.js";import{ClientError}from"#client/client-error.js";import{ClientSession}from"#client/session.js";import{createInitialSessionState}from"#client/session-utils.js";import{createClientUrl}from"#client/url.js";import{VERCEL_TRUSTED_OIDC_IDP_TOKEN_HEADER}from"#client/types.js";var Client=class{#e;#t;#n;#r;#i;#a;constructor(e){this.#n=e.host,this.#e=e.auth,this.#t=e.headers,this.#r=e.maxReconnectAttempts??3,this.#i=e.preserveCompletedSessions??!1,this.#a=e.redirect}async health(){let t=createClientUrl(this.#n,EVE_HEALTH_ROUTE_PATH),n=await this.#o(),r=await fetch(t,withRedirectPolicy({headers:n},this.#a));if(!r.ok){let e=await r.text();throw new ClientError(r.status,e,r.headers)}return await r.json()}async info(){let e=await this.fetch(EVE_INFO_ROUTE_PATH);if(!e.ok){let t=await e.text();throw new ClientError(e.status,t,e.headers)}let n;try{n=await e.json()}catch{throw new AgentInfoResponseError}let i=AgentInfoResultSchema.safeParse(n);if(!i.success)throw new AgentInfoResponseError(i.error.issues.slice(0,5).map(e=>{let t=e.path.join(`.`);return t.length===0?e.message:`${t}: ${e.message}`}));return i.data}async fetch(e,t={}){let n=createClientUrl(this.#n,e),r=await this.#o(headersInitToRecord(t.headers));return await fetch(n,withRedirectPolicy({...t,headers:r},this.#a))}session(e){let t;return t=typeof e==`string`?{continuationToken:e,streamIndex:0}:e||createInitialSessionState(),new ClientSession({host:this.#n,maxReconnectAttempts:this.#r,preserveCompletedSessions:this.#i,redirect:this.#a,resolveHeaders:e=>this.#o(e)},t)}async#o(e){let t=new Headers,[n,r]=await Promise.all([resolveHeadersValue(this.#t),this.#s()]);for(let[e,r]of Object.entries(n))t.set(e,r);if(e)for(let[n,r]of Object.entries(e))t.set(n,r);for(let[e,n]of Object.entries(r))t.set(e,n);return t}async#s(){let e=this.#e;if(!e)return{};if(`vercelOidc`in e){let t=(await resolveTokenValue(e.vercelOidc.token)).trim();return t.length===0?{}:{authorization:`Bearer ${t}`,[VERCEL_TRUSTED_OIDC_IDP_TOKEN_HEADER]:t}}if(`bearer`in e){let t=(await resolveTokenValue(e.bearer)).trim();return t.length===0?{}:{authorization:`Bearer ${t}`}}if(`basic`in e){let t=await resolveTokenValue(e.basic.password);return{authorization:`Basic ${encodeBasicCredentials(e.basic.username,t)}`}}return{}}};async function resolveTokenValue(e){return typeof e==`function`?e():e}async function resolveHeadersValue(e){return e===void 0?{}:typeof e==`function`?await e():e}function headersInitToRecord(e){return e===void 0?{}:Object.fromEntries(new Headers(e).entries())}function withRedirectPolicy(e,t){return t===void 0?e:{...e,redirect:t}}export{Client};

package/dist/src/client/open-stream.js

@@ -1 +1 @@
-import{createEveMessageStreamRoutePath}from"#protocol/routes.js";import{ClientError}from"#client/client-error.js";import{createClientUrl}from"#client/url.js";import{isStreamDisconnectError,readNdjsonStream}from"#client/ndjson.js";const STREAM_OPEN_RETRYABLE_STATUS=new Set([404,409,425,500,502,503,504]);async function*openStreamIterable(e){let t=e.startIndex,n=e.maxReconnectAttempts;for(;;){let a=await openStreamBody({...e,startIndex:t}),o=!1;try{for await(let e of readNdjsonStream(a))t+=1,yield e}catch(e){if(!isStreamDisconnectError(e))throw e;o=!0}if(!o||e.signal?.aborted||n<=0)return;--n}}async function openStreamBody(r){let i,o;for(let s=0;s<12;s+=1){let c=createClientUrl(r.host,createEveMessageStreamRoutePath(r.sessionId),r.startIndex>0?{startIndex:String(r.startIndex)}:void 0),l=await r.resolveHeaders(),u=await fetch(c,{headers:l,redirect:r.redirect,signal:r.signal??null});if(u.ok){if(!u.body)throw new ClientError(u.status,`Response body is null.`);return u.body}if(i=u.status,o=await u.text(),!STREAM_OPEN_RETRYABLE_STATUS.has(u.status))throw new ClientError(u.status,o);s<11&&await sleep(250)}throw new ClientError(i??0,o??`Failed to open message stream.`)}async function sleep(e){await new Promise(t=>setTimeout(t,e))}export{openStreamBody,openStreamIterable};
+import{createEveMessageStreamRoutePath}from"#protocol/routes.js";import{ClientError}from"#client/client-error.js";import{createClientUrl}from"#client/url.js";import{isStreamDisconnectError,readNdjsonStream}from"#client/ndjson.js";const STREAM_OPEN_RETRYABLE_STATUS=new Set([404,409,425,500,502,503,504]);async function*openStreamIterable(e){let t=e.startIndex,n=e.maxReconnectAttempts;for(;;){let a=await openStreamBody({...e,startIndex:t}),o=!1;try{for await(let e of readNdjsonStream(a))t+=1,yield e}catch(e){if(!isStreamDisconnectError(e))throw e;o=!0}if(!o||e.signal?.aborted||n<=0)return;--n}}async function openStreamBody(r){let i,o,s;for(let c=0;c<12;c+=1){let l=createClientUrl(r.host,createEveMessageStreamRoutePath(r.sessionId),r.startIndex>0?{startIndex:String(r.startIndex)}:void 0),u=await r.resolveHeaders(),d=await fetch(l,{headers:u,redirect:r.redirect,signal:r.signal??null});if(d.ok){if(!d.body)throw new ClientError(d.status,`Response body is null.`,d.headers);return d.body}if(i=d.status,o=await d.text(),s=d.headers,!STREAM_OPEN_RETRYABLE_STATUS.has(d.status))throw new ClientError(d.status,o,d.headers);c<11&&await sleep(250)}throw new ClientError(i??0,o??`Failed to open message stream.`,s)}async function sleep(e){await new Promise(t=>setTimeout(t,e))}export{openStreamBody,openStreamIterable};

package/dist/src/client/session.js

@@ -1 +1 @@
-import{EVE_CREATE_SESSION_ROUTE_PATH,createEveContinueSessionRoutePath}from"#protocol/routes.js";import{ClientError}from"#client/client-error.js";import{advanceSession}from"#client/session-utils.js";import{createClientUrl}from"#client/url.js";import{MessageResponse}from"#client/message-response.js";import{EVE_SESSION_ID_HEADER,isCurrentTurnBoundaryEvent}from"#protocol/message.js";import{normalizeOutputSchemaForRequest}from"#client/output-schema.js";import{isStreamDisconnectError,readNdjsonStream}from"#client/ndjson.js";import{openStreamBody,openStreamIterable}from"#client/open-stream.js";var ClientSession=class{#e;#t;constructor(e,t){this.#e=e,this.#t=t}get state(){return this.#t}async send(e){let t=normalizeSendTurnInput(e),n=this.#t,{continuationToken:r,sessionId:i}=await this.#n(t,n);return new MessageResponse({continuationToken:r,createStream:()=>this.#r(i,r,n,t),sessionId:i})}stream(e){let t=this.#t.sessionId;if(!t)throw Error(`Session has no session ID. Send a message first.`);return this.#a(t,e)}async#n(n,r){let a=r.sessionId?createEveContinueSessionRoutePath(r.sessionId):EVE_CREATE_SESSION_ROUTE_PATH,s=createClientUrl(this.#e.host,a),c=await this.#e.resolveHeaders(n.headers);c.set(`content-type`,`application/json`);let l=createHandleMessageBody({input:n,outputSchema:normalizeOutputSchemaForRequest(n.outputSchema),session:r});if(l===null)throw Error(`Session.send requires a non-empty message, inputResponses, or both.`);let u=await postTurnWithRetry({body:JSON.stringify(l),headers:c,mustDeliver:(n.inputResponses?.length??0)>0,redirect:this.#e.redirect,signal:n.signal,url:s}),d=await u.json(),f=(typeof d.sessionId==`string`?d.sessionId:void 0)??u.headers.get(EVE_SESSION_ID_HEADER)?.trim()??r.sessionId;if(!f)throw Error(`Message route did not return a session id.`);return{continuationToken:typeof d.continuationToken==`string`?d.continuationToken:void 0,sessionId:f}}async*#r(e,t,n,i){let a=[];try{let t=n.sessionId===e?n.streamIndex:0,r=this.#e.maxReconnectAttempts;for(;;){let n=await this.#i(e,t,i.signal,i.headers),o=!1;try{for await(let e of readNdjsonStream(n))if(a.push(e),t+=1,yield e,isCurrentTurnBoundaryEvent(e)){o=!0;break}}catch(e){if(!isStreamDisconnectError(e))throw e}if(o||i.signal?.aborted||r<=0)break;--r}}finally{this.#t=advanceSession({continuationToken:t,events:a,preserveCompletedSessions:this.#e.preserveCompletedSessions,sessionId:e,session:n})}}async#i(e,t,n,r){return await openStreamBody({host:this.#e.host,resolveHeaders:()=>this.#e.resolveHeaders(r),redirect:this.#e.redirect,sessionId:e,signal:n,startIndex:t})}async*#a(e,t){let n=this.#t,i=t?.startIndex??n.streamIndex,a=[];try{for await(let n of openStreamIterable({host:this.#e.host,maxReconnectAttempts:this.#e.maxReconnectAttempts,resolveHeaders:()=>this.#e.resolveHeaders(),redirect:this.#e.redirect,sessionId:e,signal:t?.signal,startIndex:i}))a.push(n),yield n}finally{this.#t=advanceSession({continuationToken:n.continuationToken,events:a,preserveCompletedSessions:this.#e.preserveCompletedSessions,session:{...n,sessionId:e,streamIndex:i},sessionId:e})}}};async function postTurnWithRetry(e){let t=e.mustDeliver?10:1,r,i;for(let a=0;a<t;a+=1){let o=await fetch(e.url,{body:e.body,headers:e.headers,method:`POST`,redirect:e.redirect,signal:e.signal??null});if(o.ok)return o;if(r=o.status,i=await o.text(),!isRetryableDeliveryFailure(o.status,i))throw new ClientError(o.status,i);a<t-1&&await sleep(200)}throw new ClientError(r??0,i??`Failed to deliver session turn.`)}function isRetryableDeliveryFailure(e,t){return e===500&&/target session was not found/i.test(t)}async function sleep(e){await new Promise(t=>setTimeout(t,e))}function normalizeSendTurnInput(e){return typeof e==`string`?{message:e}:e}function createHandleMessageBody(e){let t={};return e.input.message!==void 0&&(t.message=e.input.message),e.input.inputResponses!==void 0&&e.input.inputResponses.length>0&&(t.inputResponses=e.input.inputResponses),e.input.clientContext!==void 0&&(t.clientContext=e.input.clientContext),e.outputSchema!==void 0&&(t.outputSchema=e.outputSchema),e.session.continuationToken!==void 0&&(t.continuationToken=e.session.continuationToken),Object.keys(t).length===0||e.session.continuationToken===void 0&&t.message===void 0||e.session.continuationToken!==void 0&&t.message===void 0&&t.inputResponses===void 0?null:t}export{ClientSession};
+import{EVE_CREATE_SESSION_ROUTE_PATH,createEveContinueSessionRoutePath}from"#protocol/routes.js";import{ClientError}from"#client/client-error.js";import{advanceSession}from"#client/session-utils.js";import{createClientUrl}from"#client/url.js";import{MessageResponse}from"#client/message-response.js";import{EVE_SESSION_ID_HEADER,isCurrentTurnBoundaryEvent}from"#protocol/message.js";import{normalizeOutputSchemaForRequest}from"#client/output-schema.js";import{isStreamDisconnectError,readNdjsonStream}from"#client/ndjson.js";import{openStreamBody,openStreamIterable}from"#client/open-stream.js";var ClientSession=class{#e;#t;constructor(e,t){this.#e=e,this.#t=t}get state(){return this.#t}async send(e){let t=normalizeSendTurnInput(e),n=this.#t,{continuationToken:r,sessionId:i}=await this.#n(t,n);return new MessageResponse({continuationToken:r,createStream:()=>this.#r(i,r,n,t),sessionId:i})}stream(e){let t=this.#t.sessionId;if(!t)throw Error(`Session has no session ID. Send a message first.`);return this.#a(t,e)}async#n(n,r){let a=r.sessionId?createEveContinueSessionRoutePath(r.sessionId):EVE_CREATE_SESSION_ROUTE_PATH,s=createClientUrl(this.#e.host,a),c=await this.#e.resolveHeaders(n.headers);c.set(`content-type`,`application/json`);let l=createHandleMessageBody({input:n,outputSchema:normalizeOutputSchemaForRequest(n.outputSchema),session:r});if(l===null)throw Error(`Session.send requires a non-empty message, inputResponses, or both.`);let u=await postTurnWithRetry({body:JSON.stringify(l),headers:c,mustDeliver:(n.inputResponses?.length??0)>0,redirect:this.#e.redirect,signal:n.signal,url:s}),d=await u.json(),f=(typeof d.sessionId==`string`?d.sessionId:void 0)??u.headers.get(EVE_SESSION_ID_HEADER)?.trim()??r.sessionId;if(!f)throw Error(`Message route did not return a session id.`);return{continuationToken:typeof d.continuationToken==`string`?d.continuationToken:void 0,sessionId:f}}async*#r(e,t,n,i){let a=[];try{let t=n.sessionId===e?n.streamIndex:0,r=this.#e.maxReconnectAttempts;for(;;){let n=await this.#i(e,t,i.signal,i.headers),o=!1;try{for await(let e of readNdjsonStream(n))if(a.push(e),t+=1,yield e,isCurrentTurnBoundaryEvent(e)){o=!0;break}}catch(e){if(!isStreamDisconnectError(e))throw e}if(o||i.signal?.aborted||r<=0)break;--r}}finally{this.#t=advanceSession({continuationToken:t,events:a,preserveCompletedSessions:this.#e.preserveCompletedSessions,sessionId:e,session:n})}}async#i(e,t,n,r){return await openStreamBody({host:this.#e.host,resolveHeaders:()=>this.#e.resolveHeaders(r),redirect:this.#e.redirect,sessionId:e,signal:n,startIndex:t})}async*#a(e,t){let n=this.#t,i=t?.startIndex??n.streamIndex,a=[];try{for await(let n of openStreamIterable({host:this.#e.host,maxReconnectAttempts:this.#e.maxReconnectAttempts,resolveHeaders:()=>this.#e.resolveHeaders(),redirect:this.#e.redirect,sessionId:e,signal:t?.signal,startIndex:i}))a.push(n),yield n}finally{this.#t=advanceSession({continuationToken:n.continuationToken,events:a,preserveCompletedSessions:this.#e.preserveCompletedSessions,session:{...n,sessionId:e,streamIndex:i},sessionId:e})}}};async function postTurnWithRetry(e){let t=e.mustDeliver?10:1,r,i,a;for(let o=0;o<t;o+=1){let s=await fetch(e.url,{body:e.body,headers:e.headers,method:`POST`,redirect:e.redirect,signal:e.signal??null});if(s.ok)return s;if(r=s.status,i=await s.text(),a=s.headers,!isRetryableDeliveryFailure(s.status,i))throw new ClientError(s.status,i,s.headers);o<t-1&&await sleep(200)}throw new ClientError(r??0,i??`Failed to deliver session turn.`,a)}function isRetryableDeliveryFailure(e,t){return e===500&&/target session was not found/i.test(t)}async function sleep(e){await new Promise(t=>setTimeout(t,e))}function normalizeSendTurnInput(e){return typeof e==`string`?{message:e}:e}function createHandleMessageBody(e){let t={};return e.input.message!==void 0&&(t.message=e.input.message),e.input.inputResponses!==void 0&&e.input.inputResponses.length>0&&(t.inputResponses=e.input.inputResponses),e.input.clientContext!==void 0&&(t.clientContext=e.input.clientContext),e.outputSchema!==void 0&&(t.outputSchema=e.outputSchema),e.session.continuationToken!==void 0&&(t.continuationToken=e.session.continuationToken),Object.keys(t).length===0||e.session.continuationToken===void 0&&t.message===void 0||e.session.continuationToken!==void 0&&t.message===void 0&&t.inputResponses===void 0?null:t}export{ClientSession};

package/dist/src/client/types.d.ts

@@ -44,7 +44,8 @@ export type ClientRedirectPolicy = NonNullable<RequestInit["redirect"]>;
  */
 export interface ClientOptions {
     /**
-     * Base URL of the eve agent server.
+     * Base URL of the eve agent server. Query parameters are included on every
+     * request; request-specific parameters override parameters with the same name.
      */
     readonly host: string;
     /**

package/dist/src/client/url.js

@@ -1 +1 @@
-function createClientUrl(e,t,n){let r=t.startsWith(`/`)?t:`/${t}`,i=formatSearch(n);if(isAbsoluteUrl(e)){let t=new URL(e);return t.pathname=`${trimTrailingSlash(t.pathname)}${r}`,t.search=i,t.hash=``,t.toString()}return`${trimTrailingSlash(e)}${r}${i}`}function isAbsoluteUrl(e){return/^[a-z][a-z\d+\-.]*:/i.test(e)}function trimTrailingSlash(e){return e===`/`?``:e.endsWith(`/`)?e.slice(0,-1):e}function formatSearch(e){return!e||Object.keys(e).length===0?``:`?${new URLSearchParams(e).toString()}`}export{createClientUrl};
+function createClientUrl(e,t,n){let r=t.startsWith(`/`)?t:`/${t}`;if(isAbsoluteUrl(e)){let t=new URL(e);return t.pathname=`${trimTrailingSlash(t.pathname)}${r}`,mergeSearchParams(t.searchParams,n),t.hash=``,t.toString()}let i=new URL(e,`http://eve.local`),a=trimTrailingSlash(i.pathname);return mergeSearchParams(i.searchParams,n),`${a}${r}${formatSearch(i.searchParams)}`}function isAbsoluteUrl(e){return/^[a-z][a-z\d+\-.]*:/i.test(e)}function trimTrailingSlash(e){return e===`/`?``:e.endsWith(`/`)?e.slice(0,-1):e}function mergeSearchParams(e,t){if(t!==void 0)for(let[n,r]of Object.entries(t))e.set(n,r)}function formatSearch(e){let t=e.toString();return t.length===0?``:`?${t}`}export{createClientUrl};

package/dist/src/compiled/.vendor-stamp.json

@@ -27,12 +27,14 @@
     "@vercel/detect-agent": "1.2.3",
     "@vercel/oidc": "3.5.0",
     "@vercel/sandbox": "2.3.0",
-    "@workflow/core": "5.0.0-beta.26",
-    "@workflow/errors": "5.0.0-beta.8",
+    "@workflow/core": "5.0.0-beta.28",
+    "@workflow/errors": "5.0.0-beta.10",
     "@workflow/serde": "5.0.0-beta.2",
-    "@workflow/world": "5.0.0-beta.14",
+    "@workflow/world": "5.0.0-beta.16",
+    "@workflow/world-local": "5.0.0-beta.24",
+    "@workflow/world-vercel": "5.0.0-beta.24",
     "zod": "4.4.3",
     "zod-validation-error": "5.0.0"
   },
-  "scriptHash": "5bf2d1b5f6695983ae1a233467bb9baa93e057fdbb25283f4603c1d46d5e16bf"
+  "scriptHash": "b46518404fb685affcfcac4ee0dd5559c3e7b1b1472e79a6d8ecf043b445c792"
 }

package/dist/src/compiled/@workflow/core/create-hook.d.ts

@@ -156,8 +156,8 @@ export interface HookOptions {
      * Whether this hook can be resumed via the public webhook endpoint.
      *
      * When `true`, the hook can be triggered by sending an HTTP request to the
-     * public `/.well-known/workflow/v1/webhook/{token}` URL. This is automatically
-     * set when using `createWebhook()`.
+     * public workflow webhook URL. This is automatically set when using
+     * `createWebhook()`.
      *
      * When `false` (the default), the hook can only be resumed server-side
      * via `resumeHook()`.

package/dist/src/compiled/@workflow/core/events-consumer.d.ts

@@ -1,4 +1,4 @@
-import type { Event } from '#compiled/@workflow/world/index.js';
+import { type Event } from '#compiled/@workflow/world/index.js';
 /**
  * Delay before firing the deferred unconsumed-event check after the promise
  * queue has drained. Must be long enough for cross-VM microtask chains to

package/dist/src/compiled/@workflow/core/index.js

@@ -1,2 +1,2 @@
-import{c as e,i as t}from"../../_chunks/workflow/dist-Dxrjttr2.js";import{L as n,R as r,S as i,_n as a,bn as o,cn as s,dr as c,h as l,lr as u,on as d,sn as f,t as p,ur as m,vn as h,w as g,yn as _}from"../../_chunks/workflow/attribute-changes-zAifvEhb.js";import{n as v}from"../../_chunks/workflow/resume-hook-C15uJ2ik.js";import{t as y}from"../../_chunks/workflow/sleep-C8B-TYir.js";function b(e){m(`createHook()`,`https://workflow-sdk.dev/docs/api-reference/workflow/create-hook`,b)}function x(e){m(`createWebhook()`,`https://workflow-sdk.dev/docs/api-reference/workflow/create-webhook`,x)}function S({schema:e}={}){function t(e){m(`defineHook().create()`,`https://workflow-sdk.dev/docs/api-reference/workflow/define-hook`,t)}return{create:t,async resume(t,n){if(!e?.[`~standard`])return await v(t,n);let r=e[`~standard`].validate(n);if(r instanceof Promise&&(r=await r),r.issues){let e=r.issues.map(e=>{let t=e.path?.map(e=>String(typeof e==`object`&&e?e.key:e)).join(`.`);return t?`  at "${t}": ${e.message}`:`  ${e.message}`});throw Error(`Hook payload did not match the defined schema:\n${e.join(`
-`)}`)}return await v(t,r.value)}}}async function C(e,n={}){let i=r.getStore(),o=i?.workflowMetadata?.workflowRunId;if(!o)throw new t(`experimental_setAttributes() must be called from a 'use workflow' or 'use step' function. Calling it from plain host code is not supported.`);let s=p(e,n);if(s.length!==0){if(i.runReadyBarrier)try{await i.runReadyBarrier}catch{}await(await a()).events.create(o,{eventType:`attr_set`,specVersion:5,eventData:{changes:s,writer:{type:`step`,stepId:i.stepMetadata.stepId,attempt:i.stepMetadata.attempt},...n.allowReservedAttributes===!0?{allowReservedAttributes:!0}:{}}})}}function w(){let e=r.getStore();return e||u(`getStepMetadata()`,`https://workflow-sdk.dev/docs/api-reference/workflow/get-step-metadata`,w),e.stepMetadata}function T(){let e=r.getStore();return e||c(`getWorkflowMetadata()`,`https://workflow-sdk.dev/docs/api-reference/workflow/get-workflow-metadata`,T),e.workflowMetadata}function E(e={}){let t=r.getStore();t||c(`getWritable()`,`https://workflow-sdk.dev/docs/api-reference/workflow/get-writable`,E);let{namespace:a}=e,u=t.workflowMetadata.workflowRunId,p=n(u,a),m=t.writables??=new Map,v=m.get(p);if(v)return v.writable;let y=g(i(globalThis,t.ops,u,t.encryptionKey,!0,t.runReadyBarrier),t.encryptionKey),b=new l(u,p,t.runReadyBarrier),x=h();return t.ops.push(x.promise),_(y.readable,b,x).catch(()=>{}),o(y.writable,x),Object.defineProperty(y.writable,d,{value:p,writable:!1}),Object.defineProperty(y.writable,s,{value:u,writable:!1}),t.workflowDeploymentId&&Object.defineProperty(y.writable,f,{value:t.workflowDeploymentId,writable:!1}),m.set(p,{writable:y.writable,state:x}),y.writable}export{t as FatalError,e as RetryableError,b as createHook,x as createWebhook,S as defineHook,C as experimental_setAttributes,w as getStepMetadata,T as getWorkflowMetadata,E as getWritable,y as sleep};
+import{c as e,i as t}from"../../_chunks/workflow/dist-DpDDcpTl.js";import{C as n,Dn as r,En as i,R as a,Sn as o,T as s,Tn as c,bn as l,cn as u,h as d,ln as f,sn as p,t as m,vn as h,xn as g,z as _}from"../../_chunks/workflow/attribute-changes-BnKD8Y3m.js";import"../../_chunks/workflow/dist-DJU_7R9s.js";import{n as v}from"../../_chunks/workflow/resume-hook-DjPY9VGg.js";import{t as y}from"../../_chunks/workflow/sleep-phozDCW8.js";function b(e){i(`createHook()`,`https://workflow-sdk.dev/docs/api-reference/workflow/create-hook`,b)}function x(e){i(`createWebhook()`,`https://workflow-sdk.dev/docs/api-reference/workflow/create-webhook`,x)}function S({schema:e}={}){function t(e){i(`defineHook().create()`,`https://workflow-sdk.dev/docs/api-reference/workflow/define-hook`,t)}return{create:t,async resume(t,n){if(!e?.[`~standard`])return await v(t,n);let r=e[`~standard`].validate(n);if(r instanceof Promise&&(r=await r),r.issues){let e=r.issues.map(e=>{let t=e.path?.map(e=>String(typeof e==`object`&&e?e.key:e)).join(`.`);return t?`  at "${t}": ${e.message}`:`  ${e.message}`});throw Error(`Hook payload did not match the defined schema:\n${e.join(`
+`)}`)}return await v(t,r.value)}}}async function C(e,n={}){let r=_.getStore(),i=r?.workflowMetadata?.workflowRunId;if(!i)throw new t(`experimental_setAttributes() must be called from a 'use workflow' or 'use step' function. Calling it from plain host code is not supported.`);let a=m(e,n);if(a.length!==0){if(r.runReadyBarrier)try{await r.runReadyBarrier}catch{}await(await h()).events.create(i,{eventType:`attr_set`,specVersion:5,eventData:{changes:a,writer:{type:`step`,stepId:r.stepMetadata.stepId,attempt:r.stepMetadata.attempt},...n.allowReservedAttributes===!0?{allowReservedAttributes:!0}:{}}})}}function w(){let e=_.getStore();return e||c(`getStepMetadata()`,`https://workflow-sdk.dev/docs/api-reference/workflow/get-step-metadata`,w),e.stepMetadata}function T(){let e=_.getStore();return e||r(`getWorkflowMetadata()`,`https://workflow-sdk.dev/docs/api-reference/workflow/get-workflow-metadata`,T),e.workflowMetadata}function E(e={}){let t=_.getStore();t||r(`getWritable()`,`https://workflow-sdk.dev/docs/api-reference/workflow/get-writable`,E);let{namespace:i}=e,c=t.workflowMetadata.workflowRunId,m=a(c,i),h=t.writables??=new Map,v=h.get(m);if(v)return v.writable;let y=s(n(globalThis,t.ops,c,t.encryptionKey,!0,t.runReadyBarrier),t.encryptionKey),b=new d(c,m,t.runReadyBarrier),x=l();return t.ops.push(x.promise),g(y.readable,b,x).catch(()=>{}),o(y.writable,x),Object.defineProperty(y.writable,p,{value:m,writable:!1}),Object.defineProperty(y.writable,f,{value:c,writable:!1}),t.workflowDeploymentId&&Object.defineProperty(y.writable,u,{value:t.workflowDeploymentId,writable:!1}),h.set(m,{writable:y.writable,state:x}),y.writable}export{t as FatalError,e as RetryableError,b as createHook,x as createWebhook,S as defineHook,C as experimental_setAttributes,w as getStepMetadata,T as getWorkflowMetadata,E as getWritable,y as sleep};

package/dist/src/compiled/@workflow/core/private.js

@@ -1 +1 @@
-import{a as e}from"../../_chunks/workflow/dist-FLIfyJ4Y.js";const t=Symbol.for(`@workflow/core//registeredSteps`),n=globalThis,r=n[t]??=new Map,i=new Set([`__builtin_response_array_buffer`,`__builtin_response_json`,`__builtin_response_text`]);function a(e){let t=e.split(`//`);if(t.length!==3||t[0]!==`step`)return[];let n=t[1],r=t[2],i=new Set,a=e=>{e!==n&&i.add(e)};if(n.startsWith(`./workflows/`)){let e=n.slice(2);a(`./example/${e}`),a(`./src/${e}`)}else if(n.startsWith(`./example/workflows/`)){let e=n.slice(10);a(`./${e}`),a(`./src/${e}`)}else if(n.startsWith(`./src/workflows/`)){let e=n.slice(6);a(`./${e}`),a(`./example/${e}`)}return Array.from(i,e=>`step//${e}//${r}`)}function o(e){if(i.has(e)){for(let[t,n]of r.entries())if(t.endsWith(`//${e}`))return n}}function s(e,t){r.set(e,t),t.stepId=e}function c(e){let t=r.get(e);if(t)return t;for(let t of a(e)){let e=r.get(t);if(e)return e}let n=o(e);if(n)return n}async function l(e,t,n){if(t===void 0||!e.pendingDeliveryBarriers||e.pendingDeliveryBarriers.size===0)return;let r=[];for(let[i,a]of e.pendingDeliveryBarriers)i<t&&n.includes(a.kind)&&r.push(a.delivered);r.length>0&&await Promise.all(r)}function u(t,n,r){let i=t.pendingDeliveryBarriers;if(!i||n===void 0)return{markDelivered:()=>{}};let a=!1,{promise:o,resolve:s}=e(),c={kind:r,delivered:o};i.set(n,c);let l=()=>{a||(a=!0,i.get(n)===c&&i.delete(n),s())};return d(t,l),{markDelivered:l}}function d(e,t){let n=()=>{e.pendingDeliveries>0?e.promiseQueue.then(()=>{setTimeout(n,0)}):t()};setTimeout(n,0)}export{l as awaitEarlierDeliveries,c as getStepFunction,u as registerDeliveryBarrier,s as registerStepFunction,d as scheduleWhenIdle};
+import{c as e}from"../../_chunks/workflow/dist-CttsoN4D.js";const t=Symbol.for(`@workflow/core//registeredSteps`),n=globalThis,r=n[t]??=new Map,i=new Set([`__builtin_response_array_buffer`,`__builtin_response_json`,`__builtin_response_text`]);function a(e){let t=e.split(`//`);if(t.length!==3||t[0]!==`step`)return[];let n=t[1],r=t[2],i=new Set,a=e=>{e!==n&&i.add(e)};if(n.startsWith(`./workflows/`)){let e=n.slice(2);a(`./example/${e}`),a(`./src/${e}`)}else if(n.startsWith(`./example/workflows/`)){let e=n.slice(10);a(`./${e}`),a(`./src/${e}`)}else if(n.startsWith(`./src/workflows/`)){let e=n.slice(6);a(`./${e}`),a(`./example/${e}`)}return Array.from(i,e=>`step//${e}//${r}`)}function o(e){if(i.has(e)){for(let[t,n]of r.entries())if(t.endsWith(`//${e}`))return n}}function s(e,t){r.set(e,t),t.stepId=e}function c(e){let t=r.get(e);if(t)return t;for(let t of a(e)){let e=r.get(t);if(e)return e}let n=o(e);if(n)return n}async function l(e,t,n){if(t===void 0||!e.pendingDeliveryBarriers||e.pendingDeliveryBarriers.size===0)return;let r=[];for(let[i,a]of e.pendingDeliveryBarriers)i<t&&n.includes(a.kind)&&r.push(a.delivered);r.length>0&&await Promise.all(r)}function u(t,n,r){let i=t.pendingDeliveryBarriers;if(!i||n===void 0)return{markDelivered:()=>{}};let a=!1,{promise:o,resolve:s}=e(),c={kind:r,delivered:o};i.set(n,c);let l=()=>{a||(a=!0,i.get(n)===c&&i.delete(n),s())};return d(t,l),{markDelivered:l}}function d(e,t){let n=()=>{e.pendingDeliveries>0?e.promiseQueue.then(()=>{setTimeout(n,0)}):t()};setTimeout(n,0)}export{l as awaitEarlierDeliveries,c as getStepFunction,u as registerDeliveryBarrier,s as registerStepFunction,d as scheduleWhenIdle};

package/dist/src/compiled/@workflow/core/runtime/constants.d.ts

@@ -1,4 +1,8 @@
 export declare const MAX_QUEUE_DELIVERIES = 48;
+/**
+ * Effective max queue deliveries. Override via `WORKFLOW_MAX_QUEUE_DELIVERIES`.
+ */
+export declare function getMaxQueueDeliveries(): number;
 /**
  * Default maximum time allowed for the *replay* portion of a single workflow
  * handler invocation (in ms). This budget only covers deterministic-replay
@@ -48,6 +52,11 @@ export declare function getReplayTimeoutMs(): number;
  */
 export declare function _resetReplayTimeoutWarnCacheForTests(): void;
 export declare const REPLAY_TIMEOUT_MAX_RETRIES = 3;
+/**
+ * Effective replay-timeout retry budget. Override via
+ * `WORKFLOW_REPLAY_TIMEOUT_MAX_RETRIES`.
+ */
+export declare function getReplayTimeoutMaxRetries(): number;
 /**
  * Default maximum number of steps the owned-inline path runs inline (in
  * parallel) per suspension. The rest are queued to background handlers. Each
@@ -122,4 +131,9 @@ export declare function isOptimisticInlineStartExplicitlyDisabled(): boolean;
  */
 export declare function isTurboEnabled(): boolean;
 export declare const REPLAY_DIVERGENCE_MAX_RETRIES = 3;
+/**
+ * Effective replay-divergence recovery budget. Override via
+ * `WORKFLOW_REPLAY_DIVERGENCE_MAX_RETRIES`.
+ */
+export declare function getReplayDivergenceMaxRetries(): number;
 //# sourceMappingURL=constants.d.ts.map

package/dist/src/compiled/@workflow/core/runtime/get-world-lazy.d.ts

@@ -13,19 +13,10 @@
  *    `getWorld()` call. This is the steady-state hot path.
  * 2. `globalThis[GetWorldFnKey]` — populated by the module-load side
  *    effect at the bottom of `./world.ts`. Fires on every server bundle
- *    that reaches this file via `workflow/api` (which imports
+ *    that reaches this file via `workflow` or `workflow/api` (which import
  *    `./world-init.ts` for its side effect; see that file for the full
- *    rationale). This is the cold-start path for routes that consume
- *    `start` without any prior workflow run.
- * 3. Dynamic `import('./world.js')` — last-resort fallback for
- *    environments where neither (1) nor (2) is available (CJS test
- *    runners, scripts that import deeply into `@workflow/core` without
- *    going through `workflow/api`, future bundlers we haven't validated).
- *    The specifier is built at runtime so esbuild can't trace it into
- *    step bundles. Note: this branch is unreliable in webpack-bundled
- *    routes because webpack inlines this module into the route file and
- *    the relative path resolves against the bundle location — paths (1)
- *    and (2) cover those cases instead.
+ *    rationale). This is the cold-start path for routes that consume host
+ *    helpers without any prior workflow run.
  */
 import type { World } from '#compiled/@workflow/world/index.js';
 export declare function getWorldLazy(): Promise<World>;

package/dist/src/compiled/@workflow/core/runtime/wait-continuation.d.ts

@@ -58,8 +58,8 @@
  */
 /**
  * Maximum `delaySeconds` for a single wait-continuation message. Waits
- * longer than this are chained across multiple hops. 23 hours: VQS
- * messages have a 24h retention limit; the 1h buffer mirrors
+ * longer than this are chained across multiple hops. 23 hours leaves a 1h
+ * buffer under Vercel Queues' default 24h message TTL and mirrors
  * world-vercel's `MAX_DELAY_SECONDS`.
  */
 export declare const WAIT_CONTINUATION_MAX_DELAY_SECONDS = 82800;

package/dist/src/compiled/@workflow/core/runtime/world-compatibility.d.ts

@@ -0,0 +1,5 @@
+import type { World } from '#compiled/@workflow/world/index.js';
+type WorldSpecVersionMetadata = Pick<World, 'specVersion'>;
+export declare function assertWorldSupportsRuntimeProtocol(world: WorldSpecVersionMetadata): void;
+export {};
+//# sourceMappingURL=world-compatibility.d.ts.map