eve 0.27.11 → 0.27.13

package/dist/src/compiled/@workflow/core/set-attributes.d.ts

@@ -1,5 +1,5 @@
-import type { ExperimentalSetAttributesOptions, SetAttributesOptions } from './workflow/set-attributes.js';
-export type { ExperimentalSetAttributesOptions, SetAttributesOptions };
+import type { SetAttributesOptions } from './workflow/set-attributes.js';
+export type { SetAttributesOptions };
 /**
  * Host-side implementation for `setAttributes`. Workflow bodies resolve
  * to `./workflow/set-attributes.ts` via the `workflow` package-exports
@@ -10,9 +10,4 @@ export type { ExperimentalSetAttributesOptions, SetAttributesOptions };
  * a clear `FatalError`.
  */
 export declare function setAttributes(attrs: Record<string, string | undefined>, options?: SetAttributesOptions): Promise<void>;
-/**
- * @deprecated The feature is no longer experimental — use
- * {@link setAttributes} instead.
- */
-export declare const experimental_setAttributes: typeof setAttributes;
 //# sourceMappingURL=set-attributes.d.ts.map

package/dist/src/compiled/@workflow/core/step/context-storage.d.ts

@@ -1,5 +1,5 @@
 import { AsyncLocalStorage } from 'node:async_hooks';
-import type { CryptoKey } from '../encryption.js';
+import type { PayloadKey } from '../serialization/encryption.js';
 import type { FlushableStreamState } from '../flushable-stream.js';
 import type { WorkflowMetadata } from '../workflow/get-workflow-metadata.js';
 import type { StepMetadata } from './get-step-metadata.js';
@@ -55,7 +55,7 @@ export type StepContext = {
      */
     preCompletionOps: Promise<void>[];
     closureVars?: Record<string, any>;
-    encryptionKey?: CryptoKey;
+    encryptionKey?: PayloadKey;
     writables?: Map<string, CachedWritable>;
     /**
      * Turbo mode only: a promise that resolves once the backgrounded

package/dist/src/compiled/@workflow/core/symbols.d.ts

@@ -31,18 +31,31 @@ export declare const STREAM_SERVER_RUN_ID_SYMBOL: unique symbol;
  */
 export declare const STREAM_SERVER_DEPLOYMENT_ID_SYMBOL: unique symbol;
 /**
- * Stamped on a `WorkflowServerWritableStream` instance to expose a batched,
- * durable write entry point: `(chunks) => Promise<void>` that flushes every
- * chunk in one `writeMulti` (falling back to sequential `write`s when the
- * world lacks `writeMulti`) and resolves only once the whole batch has
- * reached the server.
+ * Stamped alongside `STREAM_SERVER_RUN_ID_SYMBOL` with the owning run's
+ * X25519 public key (base64), when the run has one.
  *
- * `flushablePipe` feature-detects this to coalesce chunks that arrive while a
- * previous batch is still in flight into a single server write. Sinks without
- * it (plain `WritableStream`s, `TransformStream` writables on the read path)
- * fall back to the per-chunk write loop. See `flushablePipe`.
+ * This is what lets a forwarded writable be written to across a deployment
+ * boundary at zero cost. The owning run derives its own public key locally
+ * when it creates the stream, so the key travels inside the serialized
+ * descriptor; a child on another deployment can then seal frames immediately.
+ * Without it the child would have to either fetch the owning run or fetch its
+ * symmetric key from the API — the round trip this whole mechanism exists to
+ * avoid.
  */
-export declare const STREAM_WRITE_BATCH_SYMBOL: unique symbol;
+export declare const STREAM_SERVER_PUBLIC_KEY_SYMBOL: unique symbol;
+/**
+ * Stamped on a `WorkflowServerWritableStream` instance to expose its
+ * durability barrier: `() => Promise<void>` that resolves once every accepted
+ * chunk has durably reached the server (nothing buffered, nothing in flight)
+ * and rejects if any dispatch failed.
+ *
+ * The sink acks `write()` on buffer entry (group-commit batching), so
+ * durability tracking lives here instead: `flushablePipe` feature-detects
+ * this and awaits it before resolving its lock-release completion, keeping
+ * the invariant that a step cannot complete while stream data is still
+ * client-side. Sinks without it are fully durable per `write()` already.
+ */
+export declare const STREAM_DRAIN_SYMBOL: unique symbol;
 export declare const BODY_INIT_SYMBOL: unique symbol;
 export declare const WEBHOOK_RESPONSE_WRITABLE: unique symbol;
 /**

package/dist/src/compiled/@workflow/core/telemetry/semantic-conventions.d.ts

@@ -121,8 +121,8 @@ export declare const WorkflowBackstopWakesArmed: (value: number) => {
     [k: string]: number;
 };
 /** The workflow runtime route being handled */
-export declare const WorkflowRouteType: (value: "step" | "flow") => {
-    [k: string]: "step" | "flow";
+export declare const WorkflowRouteType: (value: "flow") => {
+    [k: string]: "flow";
 };
 /** Whether this route invocation reused an already-created request handler */
 export declare const WorkflowRouteHandlerCached: (value: boolean) => {
@@ -362,8 +362,8 @@ export declare const SerializationCompressed: (value: boolean) => {
     [k: string]: boolean;
 };
 /** Which compression codec applied / was present (`zstd`, `gzip`, or `none`). */
-export declare const SerializationCodec: (value: "zstd" | "gzip" | "none") => {
-    [k: string]: "zstd" | "gzip" | "none";
+export declare const SerializationCodec: (value: "gzip" | "zstd" | "none") => {
+    [k: string]: "gzip" | "zstd" | "none";
 };
 /** Logical (uncompressed, devalue-prefixed) payload size in bytes. */
 export declare const SerializationUncompressedBytes: (value: number) => {

package/dist/src/compiled/@workflow/core/version.d.ts

@@ -1,2 +1,2 @@
-export declare const version = "5.0.0-beta.36";
+export declare const version = "5.0.0-beta.37";
 //# sourceMappingURL=version.d.ts.map

package/dist/src/compiled/@workflow/core/workflow/abort-controller.d.ts

@@ -1,4 +1,4 @@
-import type { WorkflowOrchestratorContext } from '../private.js';
+import { type WorkflowOrchestratorContext } from '../private.js';
 import { ABORT_HOOK_TOKEN, ABORT_STREAM_NAME } from '../symbols.js';
 /**
  * A lightweight AbortSignal implementation for the workflow VM context.

package/dist/src/compiled/@workflow/core/workflow/index.d.ts

@@ -5,7 +5,7 @@ export { sleep } from '../sleep.js';
 export { createHook, createWebhook } from './create-hook.js';
 export { defineHook } from './define-hook.js';
 export { getWorkflowMetadata } from './get-workflow-metadata.js';
-export { experimental_setAttributes, type SetAttributesOptions, setAttributes, } from './set-attributes.js';
+export { type SetAttributesOptions, setAttributes, } from './set-attributes.js';
 export { getWritable } from './writable-stream.js';
 export declare function getStepMetadata(): StepMetadata;
 export declare function resumeHook(): void;

package/dist/src/compiled/@workflow/core/workflow/set-attributes.d.ts

@@ -20,10 +20,6 @@ export interface SetAttributesOptions {
      */
     allowReservedAttributes?: boolean;
 }
-/**
- * @deprecated Use {@link SetAttributesOptions} instead.
- */
-export type ExperimentalSetAttributesOptions = SetAttributesOptions;
 /**
  * Attach plaintext string key/value metadata to the current workflow run.
  *
@@ -69,9 +65,4 @@ export type ExperimentalSetAttributesOptions = SetAttributesOptions;
  * ```
  */
 export declare function setAttributes(attrs: Record<string, string | undefined>, options?: SetAttributesOptions): Promise<void>;
-/**
- * @deprecated The feature is no longer experimental — use
- * {@link setAttributes} instead.
- */
-export declare const experimental_setAttributes: typeof setAttributes;
 //# sourceMappingURL=set-attributes.d.ts.map

package/dist/src/compiled/@workflow/core/workflow.js

@@ -1 +1 @@
-import{An as e,On as t,fn as n,kn as r,pn as i,wn as a}from"../../_chunks/workflow/wait-until-B-1TiJji.js";import"../../_chunks/workflow/dist-B-vbuNqP.js";import{i as o}from"../../_chunks/workflow/workflow-routes-Pd-WKcx_.js";import{i as s,u as c}from"../../_chunks/workflow/dist-BeQ_csYA.js";import{c as l,i as u,o as d,r as f,t as p}from"../../_chunks/workflow/attribute-changes-B6ltn-ph.js";import{t as m}from"../../_chunks/workflow/sleep-CrgsokmG.js";import{t as h}from"../../_chunks/workflow/run-BMRZ6pA-.js";i(n,h);function g(e){let n=globalThis[t];return n||u(`createHook()`,`https://workflow-sdk.dev/docs/api-reference/workflow/create-hook`,g),n(e)}function _(e){let{respondWith:t,token:n,...r}=e??{};if(n!==void 0)throw Error("`createWebhook()` does not accept a `token` option. Webhook tokens are always randomly generated. Use `createHook()` with `resumeHook()` for deterministic token patterns.");let i;t!==void 0&&(i={respondWith:t});let a=g({...r,metadata:i,isWebhook:!0}),{url:s}=l();return a.url=o(s,{type:`webhook`,token:a.token}),a}function v(){function e(t,n){d(`defineHook().resume()`,`https://workflow-sdk.dev/docs/api-reference/workflow-api/resume-hook`,e)}return{create(e){return g(e)},resume:e}}async function y(t,n={}){let r=p(t,n);if(r.length===0)return;let i=n.allowReservedAttributes===!0,a=globalThis[e];if(!a)throw new s("setAttributes() called outside a workflow runtime context. It must be called from within a workflow body (`use workflow`).");await a(r,i?{allowReservedAttributes:!0}:{})}const b=y;function x(e={}){let{namespace:t}=e,n=globalThis[r](t);return Object.create(globalThis.WritableStream.prototype,{[a]:{value:n,writable:!1}})}function S(){f(`getStepMetadata()`,`https://workflow-sdk.dev/docs/api-reference/workflow/get-step-metadata`,S)}function C(){d(`resumeHook()`,`https://workflow-sdk.dev/docs/api-reference/workflow-api/resume-hook`,C)}export{s as FatalError,c as RetryableError,g as createHook,_ as createWebhook,v as defineHook,b as experimental_setAttributes,S as getStepMetadata,l as getWorkflowMetadata,x as getWritable,C as resumeHook,y as setAttributes,m as sleep};
+import{Fn as e,Nn as t,On as n,Pn as r,_n as i,gn as a}from"../../_chunks/workflow/wait-until-De9yESQN.js";import"../../_chunks/workflow/dist-B-vbuNqP.js";import{i as o}from"../../_chunks/workflow/workflow-routes-CwqB063q.js";import{i as s,u as c}from"../../_chunks/workflow/dist-BeQ_csYA.js";import{c as l,i as u,o as d,r as f,t as p}from"../../_chunks/workflow/attribute-changes-DeZc2RZz.js";import{t as m}from"../../_chunks/workflow/sleep-BjrUxUcs.js";import{t as h}from"../../_chunks/workflow/run-CWytxfIp.js";i(a,h);function g(e){let n=globalThis[t];return n||u(`createHook()`,`https://workflow-sdk.dev/docs/api-reference/workflow/create-hook`,g),n(e)}function _(e){let{respondWith:t,token:n,...r}=e??{};if(n!==void 0)throw Error("`createWebhook()` does not accept a `token` option. Webhook tokens are always randomly generated. Use `createHook()` with `resumeHook()` for deterministic token patterns.");let i;t!==void 0&&(i={respondWith:t});let a=g({...r,metadata:i,isWebhook:!0}),{url:s}=l();return a.url=o(s,{type:`webhook`,token:a.token}),a}function v(){function e(t,n){d(`defineHook().resume()`,`https://workflow-sdk.dev/docs/api-reference/workflow-api/resume-hook`,e)}return{create(e){return g(e)},resume:e}}async function y(t,n={}){let r=p(t,n);if(r.length===0)return;let i=n.allowReservedAttributes===!0,a=globalThis[e];if(!a)throw new s("setAttributes() called outside a workflow runtime context. It must be called from within a workflow body (`use workflow`).");await a(r,i?{allowReservedAttributes:!0}:{})}function b(e={}){let{namespace:t}=e,i=globalThis[r](t);return Object.create(globalThis.WritableStream.prototype,{[n]:{value:i,writable:!1}})}function x(){f(`getStepMetadata()`,`https://workflow-sdk.dev/docs/api-reference/workflow/get-step-metadata`,x)}function S(){d(`resumeHook()`,`https://workflow-sdk.dev/docs/api-reference/workflow-api/resume-hook`,S)}export{s as FatalError,c as RetryableError,g as createHook,_ as createWebhook,v as defineHook,x as getStepMetadata,l as getWorkflowMetadata,b as getWritable,S as resumeHook,y as setAttributes,m as sleep};

package/dist/src/compiled/@workflow/errors/index.d.ts

@@ -532,7 +532,7 @@ export declare class RunNotSupportedError extends WorkflowError {
  * Any error can opt into the non-retry behavior by setting a `fatal: true`
  * own property. This is how structured error classes that aren't direct
  * `FatalError` subclasses (e.g. context-violation errors) signal to the
- * step handler that retrying will never help — the user's code is calling
+ * step executor that retrying will never help — the user's code is calling
  * a workflow-only API from the wrong context, or similar — and burning
  * retry attempts just produces a wall of duplicated log output.
  */

package/dist/src/compiled/@workflow/world/events.d.ts

@@ -198,6 +198,7 @@ declare const RunCreatedEventSchema: z.ZodObject<{
         executionContext: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodAny>>;
         attributes: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
         allowReservedAttributes: z.ZodOptional<z.ZodLiteral<true>>;
+        encryptionPublicKey: z.ZodOptional<z.ZodString>;
     }, z.core.$strip>;
 }, z.core.$strip>;
 export declare const CreateEventSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
@@ -211,6 +212,7 @@ export declare const CreateEventSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
         executionContext: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodAny>>;
         attributes: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
         allowReservedAttributes: z.ZodOptional<z.ZodLiteral<true>>;
+        encryptionPublicKey: z.ZodOptional<z.ZodString>;
     }, z.core.$strip>;
 }, z.core.$strip>, z.ZodObject<{
     correlationId: z.ZodOptional<z.ZodString>;
@@ -223,6 +225,7 @@ export declare const CreateEventSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
         executionContext: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodAny>>;
         attributes: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
         allowReservedAttributes: z.ZodOptional<z.ZodLiteral<true>>;
+        encryptionPublicKey: z.ZodOptional<z.ZodString>;
     }, z.core.$strip>>;
 }, z.core.$strip>, z.ZodObject<{
     correlationId: z.ZodOptional<z.ZodString>;
@@ -376,6 +379,7 @@ export declare const EventSchema: z.ZodIntersection<z.ZodDiscriminatedUnion<[z.Z
         executionContext: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodAny>>;
         attributes: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
         allowReservedAttributes: z.ZodOptional<z.ZodLiteral<true>>;
+        encryptionPublicKey: z.ZodOptional<z.ZodString>;
     }, z.core.$strip>;
 }, z.core.$strip>, z.ZodObject<{
     correlationId: z.ZodOptional<z.ZodString>;
@@ -388,6 +392,7 @@ export declare const EventSchema: z.ZodIntersection<z.ZodDiscriminatedUnion<[z.Z
         executionContext: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodAny>>;
         attributes: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
         allowReservedAttributes: z.ZodOptional<z.ZodLiteral<true>>;
+        encryptionPublicKey: z.ZodOptional<z.ZodString>;
     }, z.core.$strip>>;
 }, z.core.$strip>, z.ZodObject<{
     correlationId: z.ZodOptional<z.ZodString>;

package/dist/src/compiled/@workflow/world/hooks.d.ts

@@ -1,6 +1,25 @@
 import { z } from '#compiled/zod/index.js';
 import type { SerializedData } from './serialization.js';
 import type { PaginationOptions, ResolveData } from './shared.js';
+/**
+ * Minimal, immutable slice of a hook's owning run needed to resume it —
+ * enough for encryption-key resolution, serialization/compression capability
+ * selection, queue routing, and trace linking, without fetching the full run.
+ *
+ * Persisted on new hook records (workflow-server) and also returned inline by
+ * `getByToken`, so a resume can skip the separate `runs.get`. Deliberately
+ * excludes the run's mutable state (e.g. status), inputs/outputs, attributes,
+ * and any secret — only fields that are fixed at hook-creation time.
+ */
+export declare const HookResumeContextSchema: z.ZodObject<{
+    deploymentId: z.ZodString;
+    workflowName: z.ZodString;
+    runSpecVersion: z.ZodOptional<z.ZodNumber>;
+    workflowCoreVersion: z.ZodOptional<z.ZodString>;
+    traceCarrier: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    encryptionPublicKey: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export type HookResumeContext = z.infer<typeof HookResumeContextSchema>;
 /**
  * Schema for workflow hooks.
  *
@@ -20,6 +39,14 @@ export declare const HookSchema: z.ZodObject<{
     specVersion: z.ZodOptional<z.ZodNumber>;
     isWebhook: z.ZodOptional<z.ZodBoolean>;
     isSystem: z.ZodOptional<z.ZodBoolean>;
+    resumeContext: z.ZodOptional<z.ZodObject<{
+        deploymentId: z.ZodString;
+        workflowName: z.ZodString;
+        runSpecVersion: z.ZodOptional<z.ZodNumber>;
+        workflowCoreVersion: z.ZodOptional<z.ZodString>;
+        traceCarrier: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+        encryptionPublicKey: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>>;
 }, z.core.$strip>;
 /**
  * Represents a Hook. Hooks kept by minimum retention remain readable after

package/dist/src/compiled/@workflow/world/index.d.ts

@@ -9,7 +9,7 @@ export type * from './hooks.js';
 export { HookSchema } from './hooks.js';
 export type * from './interfaces.js';
 export type * from './queue.js';
-export { getQueuePrefixKind, getQueueTopicPrefix, HealthCheckPayloadSchema, MessageId, parseQueueName, QueuePayloadSchema, QueuePrefix, RunInputSchema, resolveQueueNamespace, StepInvokePayloadSchema, ValidQueueName, WorkflowInvokePayloadSchema, } from './queue.js';
+export { getQueueTopicPrefix, HealthCheckPayloadSchema, MessageId, parseQueueName, QueuePayloadSchema, QueuePrefix, RunInputSchema, resolveQueueNamespace, ValidQueueName, WorkflowInvokePayloadSchema, } from './queue.js';
 export { reenqueueActiveRuns } from './recovery.js';
 export type * from './runs.js';
 export { isTerminalWorkflowRunStatus, TERMINAL_WORKFLOW_RUN_STATUSES, TerminalWorkflowRunStatusSchema, WorkflowRunBaseSchema, WorkflowRunSchema, WorkflowRunStatusSchema, } from './runs.js';
@@ -22,8 +22,8 @@ export type { SpecVersion } from './spec-version.js';
 export { isLegacySpecVersion, requiresNewerWorld, SPEC_VERSION_CURRENT, SPEC_VERSION_LEGACY, SPEC_VERSION_SUPPORTS_ATTRIBUTES, SPEC_VERSION_SUPPORTS_CBOR_QUEUE_TRANSPORT, SPEC_VERSION_SUPPORTS_COMPRESSION, SPEC_VERSION_SUPPORTS_EVENT_SOURCING, } from './spec-version.js';
 export type * from './steps.js';
 export { isTerminalStepStatus, StepSchema, StepStatusSchema, TERMINAL_STEP_STATUSES, TerminalStepStatusSchema, } from './steps.js';
-export { DEFAULT_TIMESTAMP_THRESHOLD_FUTURE_MS, DEFAULT_TIMESTAMP_THRESHOLD_MS, DEFAULT_TIMESTAMP_THRESHOLD_PAST_MS, ulidToDate, validateUlidTimestamp, workflowRunIdSchema, } from './ulid.js';
 export type { WorkflowRunId } from './ulid.js';
+export { DEFAULT_TIMESTAMP_THRESHOLD_FUTURE_MS, DEFAULT_TIMESTAMP_THRESHOLD_MS, DEFAULT_TIMESTAMP_THRESHOLD_PAST_MS, ulidToDate, validateUlidTimestamp, workflowRunIdSchema, } from './ulid.js';
 export type * from './waits.js';
 export { WaitSchema, WaitStatusSchema } from './waits.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/src/compiled/@workflow/world/interfaces.d.ts

@@ -8,13 +8,15 @@ import type { GetChunksOptions, PaginatedResponse, StreamChunksResponse, StreamI
 import type { GetStepParams, ListWorkflowRunStepsParams, Step, StepWithoutData } from './steps.js';
 export interface Streamer {
     /**
-     * Override the default flush interval (in milliseconds) for buffered stream writes.
-     * Chunks are accumulated in a buffer and flushed together on this interval.
+     * Number of milliseconds a stream waits for additional chunks to arrive
+     * before flushing to the underlying transport.
      *
-     * The default is 10ms, which is appropriate for HTTP-based backends where
-     * each flush is a network round-trip. For backends with sub-millisecond writes
-     * (e.g., Redis, local filesystem), a lower value (or 0 for immediate flushing) reduces
-     * end-to-end stream latency.
+     * Default `0`: the first chunk dispatches immediately, and chunks
+     * arriving while a request is in flight coalesce into the next group.
+     * Setting this to > 0 trades first-chunk latency for fewer requests.
+     *
+     * The `WORKFLOW_STREAM_FLUSH_INTERVAL_MS` environment variable, when
+     * set, overrides this option.
      *
      * Not supported by all worlds.
      */

package/dist/src/compiled/@workflow/world/queue.d.ts

@@ -1,9 +1,9 @@
 import { z } from '#compiled/zod/index.js';
-export type QueueKind = 'workflow' | 'step';
+export type QueueKind = 'workflow';
 /**
  * Pattern matching valid queue prefixes:
- * - `__wkf_workflow_` / `__wkf_step_` (default, no namespace)
- * - `__{namespace}_wkf_workflow_` / `__{namespace}_wkf_step_` (namespaced)
+ * - `__wkf_workflow_` (default, no namespace)
+ * - `__{namespace}_wkf_workflow_` (namespaced)
  *
  * Namespace must be lowercase alphanumeric starting with a letter.
  */
@@ -17,16 +17,17 @@ export type ValidQueueName = z.infer<typeof ValidQueueName>;
  */
 export declare function resolveQueueNamespace(namespace?: string): string | undefined;
 /**
- * Builds a queue topic prefix for the given kind and optional namespace.
+ * Builds the workflow queue topic prefix for an optional namespace.
+ *
+ * The literal kind argument is retained so existing workflow-only callers keep
+ * their meaning after removal of the former `'step'` variant.
  *
  * - `getQueueTopicPrefix('workflow')` → `'__wkf_workflow_'`
  * - `getQueueTopicPrefix('workflow', 'custom')` → `'__custom_wkf_workflow_'`
  */
 export declare function getQueueTopicPrefix(kind: QueueKind, namespace?: string): QueuePrefix;
-export declare function getQueuePrefixKind(prefix: QueuePrefix): QueueKind;
 export declare function parseQueueName(name: ValidQueueName): {
     prefix: QueuePrefix;
-    kind: QueueKind;
     id: string;
 };
 export declare const MessageId: z.core.$ZodBranded<z.ZodString, "MessageId", "out">;
@@ -73,26 +74,39 @@ export declare const WorkflowInvokePayloadSchema: z.ZodObject<{
         allowReservedAttributes: z.ZodOptional<z.ZodLiteral<true>>;
     }, z.core.$strip>>;
 }, z.core.$strip>;
-export declare const StepInvokePayloadSchema: z.ZodObject<{
-    workflowName: z.ZodString;
-    workflowRunId: z.ZodString;
-    workflowStartedAt: z.ZodNumber;
-    stepId: z.ZodString;
-    traceCarrier: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
-    requestedAt: z.ZodOptional<z.ZodCoercedDate<unknown>>;
-}, z.core.$strip>;
 export type WorkflowInvokePayload = z.infer<typeof WorkflowInvokePayloadSchema>;
-export type StepInvokePayload = z.infer<typeof StepInvokePayloadSchema>;
 export type HealthCheckPayload = z.infer<typeof HealthCheckPayloadSchema>;
 /**
  * Health check payload - used to verify that the queue pipeline
- * can deliver messages to workflow/step endpoints.
+ * can deliver messages to the combined workflow endpoint.
  */
 export declare const HealthCheckPayloadSchema: z.ZodObject<{
     __healthCheck: z.ZodLiteral<true>;
     correlationId: z.ZodString;
+    runId: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>;
+/**
+ * Health check MUST come first.
+ *
+ * Zod unions return the first matching member's output, and `z.object` strips
+ * keys the matching member doesn't declare. `HealthCheckPayloadSchema` carries
+ * an optional `runId`, so a probe payload also satisfies
+ * `WorkflowInvokePayloadSchema` (whose only required field is `runId`). With
+ * the invoke member first, parsing a runId-bearing probe silently dropped
+ * `__healthCheck` and `correlationId`, and the runtime — which dispatches on
+ * `__healthCheck` before falling through to the invoke schema — reinterpreted
+ * the probe as "replay this run". That made the queue handler POST
+ * `run_started` for a run that doesn't exist yet (404), fail, and retry
+ * forever, so the probe never answered and `start()` timed out.
+ *
+ * Ordering health check first is safe in the other direction: it requires
+ * `__healthCheck: true`, which an invoke payload never carries.
+ */
 export declare const QueuePayloadSchema: z.ZodUnion<readonly [z.ZodObject<{
+    __healthCheck: z.ZodLiteral<true>;
+    correlationId: z.ZodString;
+    runId: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>, z.ZodObject<{
     runId: z.ZodString;
     traceCarrier: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
     requestedAt: z.ZodOptional<z.ZodCoercedDate<unknown>>;
@@ -112,16 +126,6 @@ export declare const QueuePayloadSchema: z.ZodUnion<readonly [z.ZodObject<{
         attributes: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
         allowReservedAttributes: z.ZodOptional<z.ZodLiteral<true>>;
     }, z.core.$strip>>;
-}, z.core.$strip>, z.ZodObject<{
-    workflowName: z.ZodString;
-    workflowRunId: z.ZodString;
-    workflowStartedAt: z.ZodNumber;
-    stepId: z.ZodString;
-    traceCarrier: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
-    requestedAt: z.ZodOptional<z.ZodCoercedDate<unknown>>;
-}, z.core.$strip>, z.ZodObject<{
-    __healthCheck: z.ZodLiteral<true>;
-    correlationId: z.ZodString;
 }, z.core.$strip>]>;
 export type QueuePayload = z.infer<typeof QueuePayloadSchema>;
 export interface QueueOptions {

package/dist/src/compiled/@workflow/world/runs.d.ts

@@ -43,6 +43,7 @@ export declare const WorkflowRunBaseSchema: z.ZodObject<{
     error: z.ZodOptional<z.ZodUnion<readonly [z.ZodType<unknown, unknown, z.core.$ZodTypeInternals<unknown, unknown>>, z.ZodType<unknown, unknown, z.core.$ZodTypeInternals<unknown, unknown>>]>>;
     errorCode: z.ZodOptional<z.ZodString>;
     attributes: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodString>>;
+    encryptionPublicKey: z.ZodOptional<z.ZodString>;
     expiredAt: z.ZodOptional<z.ZodCoercedDate<unknown>>;
     startedAt: z.ZodOptional<z.ZodCoercedDate<unknown>>;
     completedAt: z.ZodOptional<z.ZodCoercedDate<unknown>>;
@@ -58,6 +59,7 @@ export declare const WorkflowRunSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
     input: z.ZodOptional<z.ZodUnion<readonly [z.ZodType<unknown, unknown, z.core.$ZodTypeInternals<unknown, unknown>>, z.ZodType<unknown, unknown, z.core.$ZodTypeInternals<unknown, unknown>>]>>;
     errorCode: z.ZodOptional<z.ZodString>;
     attributes: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodString>>;
+    encryptionPublicKey: z.ZodOptional<z.ZodString>;
     expiredAt: z.ZodOptional<z.ZodCoercedDate<unknown>>;
     startedAt: z.ZodOptional<z.ZodCoercedDate<unknown>>;
     createdAt: z.ZodCoercedDate<unknown>;
@@ -78,6 +80,7 @@ export declare const WorkflowRunSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
     input: z.ZodOptional<z.ZodUnion<readonly [z.ZodType<unknown, unknown, z.core.$ZodTypeInternals<unknown, unknown>>, z.ZodType<unknown, unknown, z.core.$ZodTypeInternals<unknown, unknown>>]>>;
     errorCode: z.ZodOptional<z.ZodString>;
     attributes: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodString>>;
+    encryptionPublicKey: z.ZodOptional<z.ZodString>;
     expiredAt: z.ZodOptional<z.ZodCoercedDate<unknown>>;
     startedAt: z.ZodOptional<z.ZodCoercedDate<unknown>>;
     createdAt: z.ZodCoercedDate<unknown>;
@@ -95,6 +98,7 @@ export declare const WorkflowRunSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
     input: z.ZodOptional<z.ZodUnion<readonly [z.ZodType<unknown, unknown, z.core.$ZodTypeInternals<unknown, unknown>>, z.ZodType<unknown, unknown, z.core.$ZodTypeInternals<unknown, unknown>>]>>;
     errorCode: z.ZodOptional<z.ZodString>;
     attributes: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodString>>;
+    encryptionPublicKey: z.ZodOptional<z.ZodString>;
     expiredAt: z.ZodOptional<z.ZodCoercedDate<unknown>>;
     startedAt: z.ZodOptional<z.ZodCoercedDate<unknown>>;
     createdAt: z.ZodCoercedDate<unknown>;
@@ -112,6 +116,7 @@ export declare const WorkflowRunSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
     input: z.ZodOptional<z.ZodUnion<readonly [z.ZodType<unknown, unknown, z.core.$ZodTypeInternals<unknown, unknown>>, z.ZodType<unknown, unknown, z.core.$ZodTypeInternals<unknown, unknown>>]>>;
     errorCode: z.ZodOptional<z.ZodString>;
     attributes: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodString>>;
+    encryptionPublicKey: z.ZodOptional<z.ZodString>;
     expiredAt: z.ZodOptional<z.ZodCoercedDate<unknown>>;
     startedAt: z.ZodOptional<z.ZodCoercedDate<unknown>>;
     createdAt: z.ZodCoercedDate<unknown>;

package/dist/src/compiled/@workflow/world/spec-version.d.ts

@@ -21,10 +21,9 @@ export declare const SPEC_VERSION_SUPPORTS_EVENT_SOURCING: SpecVersion;
 export declare const SPEC_VERSION_SUPPORTS_CBOR_QUEUE_TRANSPORT: SpecVersion;
 export declare const SPEC_VERSION_SUPPORTS_ATTRIBUTES: SpecVersion;
 /**
- * Runs at this spec version or later may contain gzip-compressed payloads
- * ('gzip' format prefix). Readers older than this version cannot decode
- * such payloads and reject the run via `requiresNewerWorld()` instead of
- * failing on individual payloads.
+ * Runs at this spec version or later may contain zstd- or gzip-compressed
+ * payloads. Readers older than this version reject the run via
+ * `requiresNewerWorld()` instead of failing on individual payloads.
  */
 export declare const SPEC_VERSION_SUPPORTS_COMPRESSION: SpecVersion;
 /**