eve 0.27.11 → 0.27.13

package/dist/src/compiled/@workflow/core/flushable-stream.d.ts

@@ -1,4 +1,10 @@
 import { type PromiseWithResolvers } from './_workflow-utils.js';
+/**
+ * A durability barrier a sink may expose under {@link STREAM_DRAIN_SYMBOL}:
+ * resolves once every chunk the sink has accepted is durably written, rejects
+ * if any server write failed. See `WorkflowServerWritableStream`.
+ */
+type DrainBarrier = () => Promise<void>;
 /**
  * Flow-control knob: upper bound on chunks read-but-not-yet-durably-written
  * while coalescing. Once this many chunks are outstanding the producer stops
@@ -12,6 +18,7 @@ import { type PromiseWithResolvers } from './_workflow-utils.js';
  * limit — batch sizing enforces that independently.
  */
 export declare const MAX_INFLIGHT_CHUNKS = 1000;
+export declare const getMaxInflightChunks: () => number;
 /**
  * Wire limit: maximum number of chunks in a single coalesced `writeMulti`.
  * The server enforces a per-multi-write chunk cap (1,000 today); a batch is
@@ -19,6 +26,7 @@ export declare const MAX_INFLIGHT_CHUNKS = 1000;
  * the backpressure knob above. Override: `WORKFLOW_STREAM_MAX_CHUNKS_PER_BATCH`.
  */
 export declare const MAX_CHUNKS_PER_BATCH = 1000;
+export declare const getMaxChunksPerBatch: () => number;
 /**
  * Wire limit: maximum cumulative bytes in a single coalesced `writeMulti`.
  * Chunk *count* alone is not enough — 1,000 small chunks are ~100KB but 1,000
@@ -28,6 +36,16 @@ export declare const MAX_CHUNKS_PER_BATCH = 1000;
  * out alone). Default 1 MiB. Override: `WORKFLOW_STREAM_MAX_BYTES_PER_BATCH`.
  */
 export declare const MAX_BYTES_PER_BATCH: number;
+export declare const getMaxBytesPerBatch: () => number;
+/**
+ * Buffer bound (bytes) for the server writable's group-commit buffer — the
+ * byte-denominated counterpart of {@link MAX_INFLIGHT_CHUNKS}. `write()`
+ * blocks once this much data is buffered-but-not-durable, so a fast producer
+ * of large chunks can't grow client memory without bound. Default 8 MiB
+ * (eight request-sized groups). Override: `WORKFLOW_STREAM_MAX_BUFFERED_BYTES`.
+ */
+export declare const MAX_BUFFERED_BYTES: number;
+export declare const getMaxBufferedBytes: () => number;
 /**
  * Polling interval (in ms) for lock release detection.
  *
@@ -72,6 +90,13 @@ export interface FlushableStreamState extends PromiseWithResolvers<void> {
     writablePollingInterval?: ReturnType<typeof setInterval>;
     /** Interval ID for readable lock polling (if active) */
     readablePollingInterval?: ReturnType<typeof setInterval>;
+    /**
+     * Durability barrier of the pipe's sink, when it acks writes on buffer
+     * entry (see {@link STREAM_DRAIN_SYMBOL}). Lock-release completion awaits
+     * this before resolving so `pendingOps === 0` (fast, buffered acks) can't
+     * complete a step while data is still client-side.
+     */
+    drainBarrier?: DrainBarrier;
 }
 export declare function createFlushableState(): FlushableStreamState;
 /**
@@ -108,4 +133,5 @@ export declare function pollReadableLock(readable: ReadableStream, state: Flusha
  * @returns Promise that resolves when stream ends (not when done promise resolves)
  */
 export declare function flushablePipe(source: ReadableStream, sink: WritableStream, state: FlushableStreamState): Promise<void>;
+export {};
 //# sourceMappingURL=flushable-stream.d.ts.map

package/dist/src/compiled/@workflow/core/index.d.ts

@@ -12,7 +12,7 @@
 export { FatalError, RetryableError, type RetryableErrorOptions, } from '#compiled/@workflow/errors/index.js';
 export { createHook, createWebhook, type Hook, type HookOptions, type RequestWithResponse, type Webhook, type WebhookOptions, } from './create-hook.js';
 export { defineHook, type TypedHook } from './define-hook.js';
-export { experimental_setAttributes, type SetAttributesOptions, setAttributes, } from './set-attributes.js';
+export { type SetAttributesOptions, setAttributes, } from './set-attributes.js';
 export { sleep } from './sleep.js';
 export { getStepMetadata, type StepMetadata, } from './step/get-step-metadata.js';
 export { getWorkflowMetadata, type WorkflowMetadata, } from './step/get-workflow-metadata.js';

package/dist/src/compiled/@workflow/core/index.js

@@ -1,2 +1,2 @@
-import{D as e,En as t,H as n,T as r,Tn as i,V as a,_ as o,_n as s,bn as c,wn as l,xn as u,yn as d}from"../../_chunks/workflow/wait-until-B-1TiJji.js";import{i as f,u as p}from"../../_chunks/workflow/dist-BeQ_csYA.js";import{a as m,i as h,r as g,t as _}from"../../_chunks/workflow/attribute-changes-B6ltn-ph.js";import"../../_chunks/workflow/dist-D7ANgxe0.js";import{n as v}from"../../_chunks/workflow/resume-hook-D2AqAGjq.js";import{t as y}from"../../_chunks/workflow/sleep-CrgsokmG.js";function b(e){h(`createHook()`,`https://workflow-sdk.dev/docs/api-reference/workflow/create-hook`,b)}function x(e){h(`createWebhook()`,`https://workflow-sdk.dev/docs/api-reference/workflow/create-webhook`,x)}function S({schema:e}={}){function t(e){h(`defineHook().create()`,`https://workflow-sdk.dev/docs/api-reference/workflow/define-hook`,t)}return{create:t,async resume(t,n){if(!e?.[`~standard`])return await v(t,n);let r=e[`~standard`].validate(n);if(r instanceof Promise&&(r=await r),r.issues){let e=r.issues.map(e=>{let t=e.path?.map(e=>String(typeof e==`object`&&e?e.key:e)).join(`.`);return t?`  at "${t}": ${e.message}`:`  ${e.message}`});throw Error(`Hook payload did not match the defined schema:\n${e.join(`
-`)}`)}return await v(t,r.value)}}}async function C(e,t={}){let r=n.getStore(),i=r?.workflowMetadata?.workflowRunId;if(!i)throw new f(`setAttributes() must be called from a 'use workflow' or 'use step' function. Calling it from plain host code is not supported.`);let a=_(e,t);if(a.length!==0){if(r.runReadyBarrier)try{await r.runReadyBarrier}catch{}await(await s()).events.create(i,{eventType:`attr_set`,specVersion:5,eventData:{changes:a,writer:{type:`step`,stepId:r.stepMetadata.stepId,attempt:r.stepMetadata.attempt},...t.allowReservedAttributes===!0?{allowReservedAttributes:!0}:{}}})}}const w=C;function T(){let e=n.getStore();return e||g(`getStepMetadata()`,`https://workflow-sdk.dev/docs/api-reference/workflow/get-step-metadata`,T),e.stepMetadata}function E(){let e=n.getStore();return e||m(`getWorkflowMetadata()`,`https://workflow-sdk.dev/docs/api-reference/workflow/get-workflow-metadata`,E),e.workflowMetadata}function D(s={}){let f=n.getStore();f||m(`getWritable()`,`https://workflow-sdk.dev/docs/api-reference/workflow/get-writable`,D);let{namespace:p}=s,h=f.workflowMetadata.workflowRunId,g=a(h,p),_=f.writables??=new Map,v=_.get(g);if(v)return v.writable;let y=e(r(globalThis,f.ops,h,f.encryptionKey,!0,f.runReadyBarrier),f.encryptionKey),b=new o(h,g,f.runReadyBarrier),x=d();return f.ops.push(x.promise),c(y.readable,b,x).catch(()=>{}),u(y.writable,x),Object.defineProperty(y.writable,l,{value:g,writable:!1}),Object.defineProperty(y.writable,t,{value:h,writable:!1}),f.workflowDeploymentId&&Object.defineProperty(y.writable,i,{value:f.workflowDeploymentId,writable:!1}),_.set(g,{writable:y.writable,state:x}),y.writable}export{f as FatalError,p as RetryableError,b as createHook,x as createWebhook,S as defineHook,w as experimental_setAttributes,T as getStepMetadata,E as getWorkflowMetadata,D as getWritable,C as setAttributes,y as sleep};
+import{An as e,Cn as t,E as n,H as r,O as i,On as a,Rn as o,Tn as s,U as c,jn as l,kn as u,pn as d,v as f,wn as p,xn as m}from"../../_chunks/workflow/wait-until-De9yESQN.js";import{i as h,u as g}from"../../_chunks/workflow/dist-BeQ_csYA.js";import{a as _,i as v,r as y,t as b}from"../../_chunks/workflow/attribute-changes-DeZc2RZz.js";import"../../_chunks/workflow/dist-WjtNsOyf.js";import{n as x}from"../../_chunks/workflow/resume-hook-ip1hbn1b.js";import{t as S}from"../../_chunks/workflow/sleep-BjrUxUcs.js";function C(e){v(`createHook()`,`https://workflow-sdk.dev/docs/api-reference/workflow/create-hook`,C)}function w(e){v(`createWebhook()`,`https://workflow-sdk.dev/docs/api-reference/workflow/create-webhook`,w)}function T({schema:e}={}){function t(e){v(`defineHook().create()`,`https://workflow-sdk.dev/docs/api-reference/workflow/define-hook`,t)}return{create:t,async resume(t,n){if(!e?.[`~standard`])return await x(t,n);let r=e[`~standard`].validate(n);if(r instanceof Promise&&(r=await r),r.issues){let e=r.issues.map(e=>{let t=e.path?.map(e=>String(typeof e==`object`&&e?e.key:e)).join(`.`);return t?`  at "${t}": ${e.message}`:`  ${e.message}`});throw Error(`Hook payload did not match the defined schema:\n${e.join(`
+`)}`)}return await x(t,r.value)}}}async function E(e,t={}){let n=c.getStore(),r=n?.workflowMetadata?.workflowRunId;if(!r)throw new h(`setAttributes() must be called from a 'use workflow' or 'use step' function. Calling it from plain host code is not supported.`);let i=b(e,t);if(i.length!==0){if(n.runReadyBarrier)try{await n.runReadyBarrier}catch{}await(await m()).events.create(r,{eventType:`attr_set`,specVersion:5,eventData:{changes:i,writer:{type:`step`,stepId:n.stepMetadata.stepId,attempt:n.stepMetadata.attempt},...t.allowReservedAttributes===!0?{allowReservedAttributes:!0}:{}}})}}function D(){let e=c.getStore();return e||y(`getStepMetadata()`,`https://workflow-sdk.dev/docs/api-reference/workflow/get-step-metadata`,D),e.stepMetadata}function O(){let e=c.getStore();return e||_(`getWorkflowMetadata()`,`https://workflow-sdk.dev/docs/api-reference/workflow/get-workflow-metadata`,O),e.workflowMetadata}function k(m={}){let h=c.getStore();h||_(`getWritable()`,`https://workflow-sdk.dev/docs/api-reference/workflow/get-writable`,k);let{namespace:g}=m,v=h.workflowMetadata.workflowRunId,y=r(v,g),b=h.writables??=new Map,x=b.get(y);if(x)return x.writable;let S=i(n(globalThis,h.ops,v,h.encryptionKey,!0,h.runReadyBarrier),h.encryptionKey),C=new f(v,y,h.runReadyBarrier),w=t();return h.ops.push(w.promise),p(S.readable,C,w).catch(()=>{}),s(S.writable,w),Object.defineProperty(S.writable,a,{value:y,writable:!1}),Object.defineProperty(S.writable,l,{value:v,writable:!1}),h.workflowDeploymentId&&Object.defineProperty(S.writable,u,{value:h.workflowDeploymentId,writable:!1}),d(h.encryptionKey)&&Object.defineProperty(S.writable,e,{value:o(h.encryptionKey.keyPair.publicKey),writable:!1}),b.set(y,{writable:S.writable,state:w}),S.writable}export{h as FatalError,g as RetryableError,C as createHook,w as createWebhook,T as defineHook,D as getStepMetadata,O as getWorkflowMetadata,k as getWritable,E as setAttributes,S as sleep};

package/dist/src/compiled/@workflow/core/private.d.ts

@@ -2,7 +2,7 @@
  * Utils used by the bundler when transforming code
  */
 import type { WorldCapabilities } from '#compiled/@workflow/world/index.js';
-import type { CryptoKey } from './encryption.js';
+import type { PayloadKey } from './serialization/encryption.js';
 import type { EventsConsumer } from './events-consumer.js';
 import type { QueueItem } from './global.js';
 import type { ReplayPayloadCache } from './replay-payload-cache.js';
@@ -27,7 +27,7 @@ export declare function registerStepFunction(stepId: string, stepFn: StepFunctio
 export declare function getStepFunction(stepId: string): StepFunction | undefined;
 export interface WorkflowOrchestratorContext {
     runId: string;
-    encryptionKey: CryptoKey | undefined;
+    encryptionKey: PayloadKey | undefined;
     worldCapabilities?: WorldCapabilities;
     globalThis: typeof globalThis;
     eventsConsumer: EventsConsumer;
@@ -57,26 +57,33 @@ export interface WorkflowOrchestratorContext {
     pendingDeliveries: number;
     /**
      * Ordered registry of in-flight "branch-deciding" deliveries — the
-     * resolutions a workflow typically `Promise.race`s on: buffered hook
-     * payloads (`hook_received`) and wait completions (`wait_completed`).
-     * Keyed by the delivery's position (index) in the consumed event log.
+     * resolutions a workflow typically `Promise.race`s on, or awaits from
+     * independent concurrent branches: hook payloads (`hook_received`), wait
+     * completions (`wait_completed`), and step results (`step_completed` /
+     * `step_failed`). Keyed by the delivery's position (index) in the consumed
+     * event log.
      *
-     * The problem: a buffered hook payload is observed via the async hook
-     * iterator (`yield await this`), costing extra microtask hops, while a
-     * `wait_completed` resolves with fewer hops — and a reused sleep can
-     * resolve in an entirely earlier loop iteration. Either way, the
-     * resolution that the committed event log ordered first can lose a
-     * `Promise.race` to a faster- or already-resolved competitor, diverging
-     * from the log and surfacing as `CorruptedEventLogError`.
+     * The problem: each of these resolutions reaches workflow code after a
+     * different, workload-dependent number of microtask hops. A buffered hook
+     * payload is observed via the async hook iterator (`yield await this`),
+     * costing extra hops; a `wait_completed` resolves with fewer, and a reused
+     * sleep can resolve in an entirely earlier loop iteration; a step result is
+     * gated on hydration whose cost varies between replays of the SAME
+     * invocation — the first replay pays the full decrypt/decompress/revive,
+     * while later replays sharing the invocation's `ReplayPayloadCache`
+     * memo-hit small primitive results and resolve in one or two hops. Either
+     * way, the resolution that the committed event log ordered first can lose a
+     * `Promise.race` (or a `useStep` ULID allocation) to a faster- or
+     * already-resolved competitor, diverging from the log and surfacing as
+     * `CorruptedEventLogError`.
      *
      * The fix is a strict, deterministic delivery order anchored on
      * event-log position: a delivery does not resolve to the workflow until
-     * every earlier-in-log delivery of the OPPOSITE kind has been delivered.
-     * (Opposite kind only: sequential same-kind hook payloads must not block
-     * one another, and a wait need not wait behind a later wait.) Because the
+     * every relevant earlier-in-log delivery has been delivered. Because the
      * gate is "the earlier delivery resolved", not "won a timing race", the
      * outcome is independent of microtask hops, hydration/decryption time,
-     * and `Promise.race` argument order.
+     * and `Promise.race` argument order. Which earlier kinds a delivery defers
+     * behind is spelled out on {@link awaitEarlierDeliveries}.
      *
      * Index is used rather than the `eventId` string because `eventId` is an
      * opaque, world-assigned value not guaranteed to sort in creation order
@@ -93,45 +100,81 @@ export interface WorkflowOrchestratorContext {
     replayPayloadCache: ReplayPayloadCache;
 }
 /** The kind of branch-deciding delivery a barrier represents. */
-export type DeliveryKind = 'hook' | 'wait';
+export type DeliveryKind = 'hook' | 'wait' | 'step';
 interface DeliveryBarrierEntry {
     kind: DeliveryKind;
     /** Resolves once this delivery has resolved to the workflow. */
     delivered: Promise<void>;
+    /**
+     * Whether this delivery is committed to reaching the workflow without any
+     * further action by workflow code. True for wait completions and step
+     * results, which always resolve from their own chain, and for a hook payload
+     * that already had a waiting consumer when it was consumed.
+     *
+     * False for a BUFFERED hook payload no consumer has claimed yet: it is
+     * delivered by `claim()`, i.e. whenever the workflow next reads the hook —
+     * which may be causally *after* a later-in-log delivery. `arm()` flips it
+     * once a consumer takes the payload.
+     */
+    armed: boolean;
 }
 /**
- * Awaits, in strict event-log order, every still-registered delivery whose
- * index is earlier than `eventIndex` AND whose kind is in `deferBehindKinds`,
- * so that this resolution is handed to the workflow only after all relevant
- * earlier-in-log deliveries have been. This is what keeps a `Promise.race`
- * deterministic and aligned with the committed event log, independent of
- * microtask-hop counts, hydration time, or race-argument order.
+ * Awaits, in strict event-log order, every still-registered delivery that is
+ * earlier in the log than `eventIndex` and that a delivery of `kind` defers
+ * behind (see {@link DEFER_BEHIND}), so that this resolution is handed to the
+ * workflow only after all relevant earlier-in-log deliveries have been. This
+ * is what keeps a `Promise.race` — or the ULID a follow-up `useStep` draws on
+ * a concurrent branch — deterministic and aligned with the committed event
+ * log, independent of microtask-hop counts, hydration time, or race-argument
+ * order. When this delivery does have to wait, it also yields a macrotask
+ * afterwards so the earlier delivery's consumer can run to its own next
+ * suspension point first; see the comment at that `await` for why ordering the
+ * `resolve()` calls alone is not enough.
  *
- * `deferBehindKinds` is the opposite kind(s): a hook defers behind earlier
- * WAITS (not earlier hooks — those are sequential same-entity payloads), a
- * wait defers behind earlier HOOKS.
+ * One asymmetry: a STEP result additionally skips any earlier delivery that
+ * will not resolve on its own, i.e. one blocked (directly or transitively) on
+ * a buffered hook payload no consumer has claimed. Such a payload is delivered
+ * only when the workflow next reads the hook, and reaching that read very
+ * commonly requires the step result itself (`await stepX()` before the read).
+ * Gating the step on it would stall the workflow until the barrier's idle
+ * safety net fires, which then releases every delivery queued behind that
+ * payload at once — losing exactly the race this ordering exists to protect.
+ * Waits and hooks keep gating on unclaimed payloads: for them, waiting for the
+ * claim IS the ordering guarantee (a `wait_completed` must not preempt a
+ * payload the log ordered first).
  */
-export declare function awaitEarlierDeliveries(ctx: WorkflowOrchestratorContext, eventIndex: number | undefined, deferBehindKinds: readonly DeliveryKind[]): Promise<void>;
+export declare function awaitEarlierDeliveries(ctx: WorkflowOrchestratorContext, eventIndex: number | undefined, kind: DeliveryKind): Promise<void>;
 /** Handle for a registered branch-deciding delivery barrier. */
 export interface DeliveryBarrier {
     /**
      * Mark this delivery as delivered to the workflow. Resolves its
-     * `delivered` promise so any later-in-log opposite-kind delivery gated on
-     * it (via {@link awaitEarlierDeliveries}) may proceed, and removes it from
-     * the registry. Idempotent.
+     * `delivered` promise so any later-in-log delivery gated on it (via
+     * {@link awaitEarlierDeliveries}) may proceed, and removes it from the
+     * registry. Idempotent.
      */
     markDelivered: () => void;
+    /**
+     * Mark this delivery as committed to happening, for a barrier registered
+     * unarmed (a buffered hook payload) once a consumer has claimed it. From
+     * then on a later step result may be ordered behind it. Idempotent.
+     */
+    arm: () => void;
 }
 /**
  * Register a branch-deciding delivery at its event-log index so that later
- * opposite-kind deliveries can be ordered strictly after it. Returns an inert
- * handle when `pendingDeliveryBarriers` is not initialized.
+ * deliveries can be ordered strictly after it. Returns an inert handle when
+ * `pendingDeliveryBarriers` is not initialized.
+ *
+ * Pass `armed: false` for a delivery whose resolution waits on workflow code
+ * asking for it (a buffered hook payload); call `arm()` when it does.
  *
  * To guarantee a later delivery gated on this one can never hang when this
  * delivery is abandoned (the workflow took a different branch or is
  * suspending and never observes it), the barrier auto-resolves at idle.
  */
-export declare function registerDeliveryBarrier(ctx: WorkflowOrchestratorContext, eventIndex: number | undefined, kind: DeliveryKind): DeliveryBarrier;
+export declare function registerDeliveryBarrier(ctx: WorkflowOrchestratorContext, eventIndex: number | undefined, kind: DeliveryKind, options?: {
+    armed?: boolean;
+}): DeliveryBarrier;
 /**
  * Schedule a callback to fire only after all pending data deliveries
  * (step results, hook payloads) and async deserialization have completed.

package/dist/src/compiled/@workflow/core/private.js

@@ -1 +1 @@
-import{a as e,i as t,n,r,t as i}from"../../_chunks/workflow/private-DolBHKOQ.js";export{i as awaitEarlierDeliveries,n as getStepFunction,r as registerDeliveryBarrier,t as registerStepFunction,e as scheduleWhenIdle};
+import{a as e,i as t,n,r,t as i}from"../../_chunks/workflow/private-Cre8uYkA.js";export{i as awaitEarlierDeliveries,n as getStepFunction,r as registerDeliveryBarrier,t as registerStepFunction,e as scheduleWhenIdle};

package/dist/src/compiled/@workflow/core/replay-payload-cache.d.ts

@@ -1,5 +1,5 @@
 import type { Event, WorkflowRun } from '#compiled/@workflow/world/index.js';
-import type { CryptoKey } from './encryption.js';
+import type { PayloadKey } from './serialization/encryption.js';
 import { type PreparedReplayPayload, type ReplayPayloadPreparer } from './serialization.js';
 type ReplayPayloadField = 'result' | 'error' | 'payload';
 /**
@@ -19,7 +19,8 @@ export declare class ReplayPayloadCache {
     private readonly preparer;
     private readonly preparedPayloads;
     private readonly primitiveStepResults;
-    constructor(encryptionKey: CryptoKey | undefined, preparer?: ReplayPayloadPreparer);
+    private nextUnscannedEventIndex;
+    constructor(encryptionKey: PayloadKey | undefined, preparer?: ReplayPayloadPreparer);
     /**
      * Start every missing binary preparation before workflow execution. Failures
      * are intentionally retained: the ordered event consumer must observe the

package/dist/src/compiled/@workflow/core/runtime/count-step-started-events.d.ts

@@ -0,0 +1,52 @@
+import type { Event } from '#compiled/@workflow/world/index.js';
+/**
+ * Scope for {@link countStepStartedEvents}:
+ * - `{ type: 'ownedBy', messageId }` counts only starts whose
+ *   `eventData.ownerMessageId` matches — i.e. attempts performed by that
+ *   owning queue message (inline lazy starts and owned-recovery re-stamps).
+ * - `{ type: 'totalAttempts' }` estimates the step's genuine attempt total
+ *   across its whole lifecycle: unstamped (bare) starts — which only real
+ *   queue-dispatched background deliveries write — plus the starts of the
+ *   single most-started owner. A genuine lifecycle has at most one inline
+ *   owner phase (ownership is claimed atomically at step creation and
+ *   lapses permanently at `step_retrying` or on any bare start), so taking
+ *   the max over owners counts that phase's real attempts while invocations
+ *   racing on the same batch — which stamp their own one-off message IDs —
+ *   contribute at most their single largest count instead of accumulating.
+ */
+export type StepStartScope = {
+    type: 'ownedBy';
+    messageId: string;
+} | {
+    type: 'totalAttempts';
+};
+/**
+ * Number of `step_started` events already recorded for a step, used as the
+ * authoritative attempt count for the maxRetries ceiling (the only bound for
+ * steps that time out without writing a `step_failed`).
+ *
+ * IMPORTANT: the raw (unscoped) count is NOT a reliable attempt number.
+ * Concurrent invocations racing on the same pending batch (stale replays,
+ * wake replays, a step message dispatched by a replay that lost the
+ * create-claim race, ...) can each write a `step_started` for the same
+ * logical attempt — worlds without an atomic start guard (world-local) let
+ * all of them through. Counting those duplicates as "attempts" made the
+ * maxRetries ceiling fire on healthy runs and fail them with a false
+ * "exceeded max retries" (see workflow#3069).
+ *
+ * Callers therefore scope the count to the starts their ceiling is actually
+ * about via `scope`:
+ * - the inline owned-recovery ceiling counts only THIS message's starts
+ *   (`ownedBy`) — each real (re)delivery of the owning message stamps its
+ *   `ownerMessageId` on the start it writes, while racing invocations stamp
+ *   their own IDs (or none), so they no longer inflate the count;
+ * - the background-step ceiling counts the lifecycle attempt total
+ *   (`totalAttempts`: bare starts plus the largest single owner's starts) —
+ *   so a step that exhausted part of its budget under inline ownership
+ *   before transitioning to queued/bare retries still trips the combined
+ *   ceiling, while racers' one-off stamped duplicates don't accumulate, and
+ *   throttle/too-early redeliveries (which write no start at all) stay
+ *   excluded as before.
+ */
+export declare function countStepStartedEvents(events: Event[] | null | undefined, stepId: string, scope?: StepStartScope): number;
+//# sourceMappingURL=count-step-started-events.d.ts.map

package/dist/src/compiled/@workflow/core/runtime/helpers.d.ts

@@ -1,5 +1,5 @@
 import type { Event, HealthCheckPayload, ValidQueueName, WorkflowRun, World } from '#compiled/@workflow/world/index.js';
-import { type CryptoKey } from '../encryption.js';
+import { type PayloadKey } from '../serialization/encryption.js';
 /**
  * Validates a workflow name and returns the corresponding queue name.
  * Ensures the workflow name only contains safe characters before
@@ -25,6 +25,15 @@ export interface HealthCheckResult {
      * or a non-JSON plain-text health response.
      */
     workflowCoreVersion?: string;
+    /**
+     * The target run's X25519 public key (base64), returned only when the probe
+     * carried a `runId` and the responding deployment has encryption enabled.
+     *
+     * Lets a cross-deployment `start()` seal the workflow arguments using a
+     * response it was already waiting on, instead of making a separate
+     * key-lookup request.
+     */
+    encryptionPublicKey?: string;
 }
 /**
  * Checks if the given message is a health check payload.
@@ -36,15 +45,20 @@ export declare function parseHealthCheckPayload(message: unknown): HealthCheckPa
  * The caller can listen to this stream to get the health check response.
  *
  * @param healthCheck - The parsed health check payload
- * @param endpoint - Which endpoint is responding ('workflow' or 'step')
  */
-export declare function handleHealthCheckMessage(healthCheck: HealthCheckPayload, endpoint: 'workflow' | 'step', worldSpecVersion?: number): Promise<void>;
-export type HealthCheckEndpoint = 'workflow' | 'step';
+export declare function handleHealthCheckMessage(healthCheck: HealthCheckPayload, worldSpecVersion?: number): Promise<void>;
 export interface HealthCheckOptions {
     /** Timeout in milliseconds to wait for health check response. Default: 30000 (30s) */
     timeout?: number;
     /** Deployment ID to send the health check to. Falls back to process.env.VERCEL_DEPLOYMENT_ID. */
     deploymentId?: string;
+    /**
+     * The run id the caller is about to create. When set, the responding
+     * deployment derives that run's public key locally and returns it as
+     * `encryptionPublicKey`, letting a cross-deployment `start()` seal the
+     * workflow arguments without a separate key lookup.
+     */
+    runId?: string;
     /**
      * Queue namespace of the target deployment (e.g. `'eve'` for topics like
      * `__eve_wkf_workflow_*`). Falls back to `WORKFLOW_QUEUE_NAMESPACE` in the
@@ -56,7 +70,14 @@ export interface HealthCheckOptions {
      */
     namespace?: string;
 }
-export declare function healthCheck(world: World, endpoint: HealthCheckEndpoint, options?: HealthCheckOptions): Promise<HealthCheckResult>;
+export declare function healthCheck(world: World, options?: HealthCheckOptions): Promise<HealthCheckResult>;
+/**
+ * Appends events whose IDs are not already present in `target`.
+ *
+ * Pass the IDs currently present in `target` when appending repeatedly to the
+ * same array. The set is updated alongside `target`.
+ */
+export declare function appendUniqueEvents(target: Event[], events: readonly Event[], targetIds?: Set<string>): void;
 /**
  * Loads workflow run events by iterating through all pages of paginated
  * results. Events are returned in chronological (ascending) order for
@@ -147,13 +168,21 @@ export declare function getQueueOverhead(message: {
     [k: string]: number;
 } | undefined;
 /**
- * Returns a memoized accessor for the per-run AES-256 encryption key.
+ * Returns a memoized accessor for a run's full encryption capability.
+ *
+ * The first call resolves the run's key material via
+ * `world.getEncryptionKeyForRun` (which may do HKDF derivation locally on
+ * Vercel, or a network fetch from external contexts) and derives a
+ * {@link PayloadKey} from it; subsequent calls await the same cached promise.
+ * If the world doesn't support encryption or the run has no key configured,
+ * the cached value is `undefined`.
  *
- * The first call resolves the key via `world.getEncryptionKeyForRun` (which
- * may do HKDF derivation locally on Vercel, or a network fetch from
- * external contexts) and imports it as a `CryptoKey`; subsequent calls
- * await the same cached promise. If the world doesn't support encryption
- * or the run has no key configured, the cached value is `undefined`.
+ * The resolved value is deliberately the *full* capability — the symmetric AES
+ * key plus the run's X25519 keypair — not just a `CryptoKey`. A run reading
+ * its own event log can encounter sealed (`encp`) payloads that another run
+ * wrote to it (a cross-deployment hook resumption, say), and opening those
+ * needs the keypair. Resolving only the symmetric key would leave those
+ * payloads unopenable and wedge the run.
  *
  * Used by step / workflow handlers to defer the (potentially expensive)
  * key fetch until the first code path that actually needs it — typically
@@ -168,5 +197,5 @@ export declare function getQueueOverhead(message: {
  * outer try/catch to log and surface the issue; the queue's redelivery
  * semantics will retry the key fetch on the next attempt.
  */
-export declare function memoizeEncryptionKey(world: World, runOrId: WorkflowRun | string): () => Promise<CryptoKey | undefined>;
+export declare function memoizeEncryptionKey(world: World, runOrId: WorkflowRun | string): () => Promise<PayloadKey | undefined>;
 //# sourceMappingURL=helpers.d.ts.map

package/dist/src/compiled/@workflow/core/runtime/resume-hook.d.ts

@@ -1,5 +1,5 @@
 import { type Hook } from '#compiled/@workflow/world/index.js';
-import { type CryptoKey } from '../encryption.js';
+import { type PayloadKey } from '../serialization.js';
 /**
  * Get the hook by token to find the associated workflow run,
  * and hydrate the `metadata` property if it was set from within
@@ -40,7 +40,7 @@ export declare function getHookByToken(token: string): Promise<Hook>;
  * }
  * ```
  */
-export declare function resumeHook<T = any>(tokenOrHook: string | Hook, payload: T, encryptionKeyOverride?: CryptoKey): Promise<Hook>;
+export declare function resumeHook<T = any>(tokenOrHook: string | Hook, payload: T, encryptionKeyOverride?: PayloadKey): Promise<Hook>;
 /**
  * Resumes a webhook by sending a {@link https://developer.mozilla.org/en-US/docs/Web/API/Request | Request}
  * object to a hook identified by its token.

package/dist/src/compiled/@workflow/core/runtime/step-executor.d.ts

@@ -1,5 +1,5 @@
 import type { Event, SerializedData, World } from '#compiled/@workflow/world/index.js';
-import type { CryptoKey } from '../encryption.js';
+import type { PayloadKey } from '../serialization/encryption.js';
 import { type StepLatencyTracking } from './step-latency.js';
 export declare const DEFAULT_STEP_MAX_RETRIES = 3;
 export interface StepExecutorParams {
@@ -13,11 +13,11 @@ export interface StepExecutorParams {
     rootRunId?: string;
     stepId: string;
     stepName: string;
-    encryptionKey?: CryptoKey;
+    encryptionKey?: PayloadKey;
     /**
      * The workflow run's specVersion, used to gate payload compression.
-     * Step outputs/errors are only gzip-compressed when the run is marked
-     * as possibly containing compressed payloads (specVersion >= 5).
+     * Step outputs/errors are only compressed when the run is marked as
+     * compression-capable (specVersion >= 5).
      */
     runSpecVersion?: number;
     /**
@@ -36,9 +36,10 @@ export interface StepExecutorParams {
      * Inline step ownership: the queue message ID of the invocation this
      * executeStep call runs in (from the queue handler's meta). When set, the
      * `step_started` this call sends is stamped with it — on the lazy paths
-     * (where `lazyStepInput` is present) and on the owned-recovery bare start
-     * (where it is not; the re-stamp keeps a recovered step readable as owned
-     * by this message, since ownership derives from the LATEST start). Wake
+     * (where `lazyStepInput` is present) and on the owned-recovery
+     * payload-less start (where it is not; the re-stamp keeps a recovered
+     * step readable as owned by this message, since ownership derives from
+     * the LATEST start — so a recovery start is never bare). Wake
      * replays that observe an actively-owned step suppress the immediate
      * requeue and enqueue a delayed backstop instead. Omitted on the
      * background-step path, whose bare start intentionally clears ownership
@@ -166,7 +167,7 @@ export type StepExecutionResult = {
  * runs the step function, creates step_completed/step_failed/step_retrying events.
  *
  * Does NOT queue workflow continuation messages — the caller decides what to do next.
- * Used by both the V1 step handler and the V2 combined handler.
+ * Used by the combined workflow handler for step execution.
  */
 export declare function executeStep(params: StepExecutorParams): Promise<StepExecutionResult>;
 //# sourceMappingURL=step-executor.d.ts.map

package/dist/src/compiled/@workflow/core/runtime/world.d.ts

@@ -1,19 +1,14 @@
 import type { World } from '#compiled/@workflow/world/index.js';
 export type WorldFactoryModule = {
     createWorld?: () => World | Promise<World>;
-    /** @deprecated World packages should export `createWorld()` instead. */
-    createLocalWorld?: () => World | Promise<World>;
-    /** @deprecated World packages should export `createWorld()` instead. */
-    createVercelWorld?: () => World | Promise<World>;
     default?: (() => World | Promise<World>) | World;
 };
 /**
  * Create a World instance from a world factory module. Shared by
  * `createWorld()` (for the statically injected target world module) and
  * tooling that loads a world module dynamically (e.g. the Nitro dev
- * handler and `@workflow/world-testing`). Legacy world-specific factory
- * names are still accepted for compatibility, but world packages should
- * export `createWorld()`.
+ * handler and `@workflow/world-testing`). World packages should export
+ * `createWorld()`.
  */
 export declare function createWorldFromModule(mod: WorldFactoryModule): World | Promise<World>;
 /**

package/dist/src/compiled/@workflow/core/runtime.d.ts

@@ -1,7 +1,7 @@
 import { type Event, type WorkflowRun } from '#compiled/@workflow/world/index.js';
 export type { Event, WorkflowRun };
 export { WorkflowSuspension } from './global.js';
-export { type HealthCheckEndpoint, type HealthCheckOptions, type HealthCheckResult, healthCheck, } from './runtime/helpers.js';
+export { type HealthCheckOptions, type HealthCheckResult, healthCheck, } from './runtime/helpers.js';
 export { getHookByToken, resumeHook, resumeWebhook, } from './runtime/resume-hook.js';
 export { getRun, Run, type WorkflowReadableStream, type WorkflowReadableStreamOptions, } from './runtime/run.js';
 export { type CancelRunOptions, cancelRun, listStreams, type ReadStreamOptions, type RecreateRunOptions, type ReenqueueRunOptions, readStream, recreateRunFromExisting, reenqueueRun, type StopSleepOptions, type StopSleepResult, wakeUpRun, } from './runtime/runs.js';