eve 0.33.1 → 0.33.2

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # eve
 
+## 0.33.2
+
+### Patch Changes
+
+- 89255bd: Update `@workflow/core` to `5.0.0-beta.41` to pick up event log corruption fixes.
+
 ## 0.33.1
 
 ### Patch Changes

package/dist/src/compiled/.vendor-stamp.json

@@ -34,7 +34,7 @@
     "@vercel/oidc": "3.8.0",
     "@vercel/otel": "2.1.3",
     "@vercel/sandbox": "2.8.0",
-    "@workflow/core": "5.0.0-beta.40",
+    "@workflow/core": "5.0.0-beta.41",
     "@workflow/errors": "5.0.0-beta.16",
     "@workflow/serde": "5.0.0-beta.2",
     "@workflow/world": "5.0.0-beta.25",

package/dist/src/compiled/@workflow/core/_quickjs-wasi.d.ts

@@ -6,3 +6,6 @@
 // needed in user code, install the upstream @types and use them directly.
 
 export type ExtensionDescriptor = unknown;
+export type JSValueHandle = unknown;
+export type QuickJS = unknown;
+export type Snapshot = unknown;

package/dist/src/compiled/@workflow/core/events-consumer.d.ts

@@ -6,6 +6,15 @@ import { type Event } from '#compiled/@workflow/world/index.js';
  * in host). Any subscribe() arriving during this window cancels the check.
  */
 export declare const DEFERRED_CHECK_DELAY_MS = 100;
+/**
+ * Floor for the deferred-check delay, so a too-low override can't manufacture
+ * spurious divergence (each false positive burns a divergence-recovery retry
+ * and can escalate to a terminal `CorruptedEventLogError`).
+ *
+ * Exported so tests needing the shortest legal delay can ask for it instead of
+ * hardcoding a number this floor would silently clamp up.
+ */
+export declare const MIN_DEFERRED_CHECK_DELAY_MS = 10;
 export declare enum EventConsumerResult {
     /**
      * Callback consumed the event, but should not be removed from the callbacks list
@@ -43,18 +52,72 @@ export interface EventsConsumerOptions {
      * deserialization delays the resolve() that triggers the next subscribe().
      */
     getPromiseQueue: () => Promise<void>;
+    /**
+     * Whether no data delivery is in flight (`isDeliveryIdle` in private.ts).
+     * The unconsumed-event check waits for this before it fires: a delivery in
+     * flight means the workflow VM is mid-reaction, and an event it has not
+     * claimed yet is an event it has not reached yet.
+     *
+     * Required rather than defaulting to always-idle: always-idle is exactly the
+     * pre-gate behaviour, so a defaulted option would let a construction site opt
+     * a whole replay path back out without saying so. Tests that drive a consumer
+     * with no orchestrator context pass `() => true` to keep the pre-existing
+     * timing, and say so at the call site.
+     */
+    isDeliveryIdle: () => boolean;
 }
 export declare class EventsConsumer {
     eventIndex: number;
     readonly events: Event[];
     readonly callbacks: EventConsumerCallback[];
+    /**
+     * Events the ordered walk stepped over because nobody claimed them and their
+     * type carries no ordering claim. Each keeps the index it held in the log:
+     * consumers read {@link eventIndex} at consumption time to order their
+     * delivery against the rest of the log, and a late delivery must still make
+     * the claim its position gave it.
+     *
+     * Held in log order, drained in log order, and drained before every offer so
+     * a consumer registered after the walk passed the event still receives it.
+     */
+    private readonly parked;
+    /**
+     * Correlation ids of the {@link ONE_SHOT_EVENT_TYPES} events consumed so
+     * far, so a second resolution for one of them is recognized as unclaimable
+     * rather than parked for a consumer that cannot exist.
+     */
+    private readonly resolved;
     private onConsumedEvent?;
     private onUnconsumedEvent;
     private getPromiseQueue;
+    private isDeliveryIdle;
     private pendingUnconsumedCheck;
     private pendingUnconsumedTimeout;
     private unconsumedCheckVersion;
     constructor(events: Event[], options: EventsConsumerOptions);
+    /**
+     * The oldest event the walk stepped over that no consumer has claimed yet,
+     * if any. Parking is a bet that a consumer will be registered later, so at
+     * any point where no consumer ever will be again — the replay finishing is
+     * the definitive one — this answers which event the bet lost on.
+     */
+    get strandedEvent(): Event | undefined;
+    /**
+     * What the walk is still holding, or `undefined` when it holds nothing.
+     *
+     * Read at every point a replay stops, including the suspensions that are not
+     * settling points, so the held state reaches telemetry. A replay cannot tell
+     * a delivery awaiting a later consumer from one no consumer will ever
+     * register, so it reports rather than decides: the same `eventId` reported on
+     * suspension after suspension of one run is the shape that says the bet
+     * parking made is not going to pay off, and that shape is only visible across
+     * replays.
+     */
+    get parkedSummary(): {
+        count: number;
+        eventId: string;
+        eventType: Event['eventType'];
+    } | undefined;
     append(events: Event[]): void;
     /**
      * Registers a callback function to be called after an event has been consumed
@@ -70,13 +133,71 @@ export declare class EventsConsumer {
     private consume;
     /**
      * Offer `currentEvent` to each registered callback in turn. Returns true
-     * when a callback consumed a real (non-null) event and the drain should
-     * advance to the next event in the same synchronous pass; false otherwise
-     * (nothing consumed it, or the consumed event was the end-of-events
-     * sentinel).
+     * when a callback consumed it. Does not move {@link eventIndex}: the ordered
+     * walk and the parked drain advance differently, so each does its own.
+     */
+    private offer;
+    /**
+     * Offer everything parked, oldest first, until a pass claims nothing.
+     *
+     * Each offer runs with {@link eventIndex} moved back to the position the
+     * parked event held in the log, because that is the position its consumer
+     * will register a delivery barrier under. Restoring the walk pointer
+     * afterwards is what keeps the two pointers from interfering.
+     */
+    private drainParked;
+    /**
+     * Step the ordered walk over an event nobody claimed, holding on to it for a
+     * later consumer. Returns false when the event's type makes its position a
+     * decision record, which is the one case where nobody claiming it means the
+     * replay diverged.
+     */
+    private park;
+    private handleEndOfLog;
+    private scheduleUnconsumedCheck;
+    /**
+     * Run `fn` once no data delivery is in flight, polling the way
+     * `scheduleWhenIdle` does: let the promise queue drain, re-check a timer
+     * tick later, repeat.
+     *
+     * Without this the check is a bet that every delivery the walk is running
+     * ahead of lands inside a fixed window. Consumption is synchronous while the
+     * resolution it triggers is not: a step result hydrates in the host, resolves
+     * from a detached continuation behind `awaitEarlierDeliveries`, and only then
+     * does VM code run far enough to subscribe the next consumer. Replaying a
+     * batch of N parallel step results leaves N-1 of them on that detached path
+     * with the queue already drained, so the walk sits on the ordered event the
+     * VM is about to draw and the window is the only thing standing between a
+     * healthy run and `ReplayDivergenceError`.
+     *
+     * Shortening the window shows that mechanism directly: on identical event logs
+     * the local race repro corrupts 34 of 42 runs at a 10ms window and 0 of 114 at
+     * the 100ms default. That measures how the bet loses, not that the default
+     * loses it, and no measurement of a delivery outrunning 100ms exists either
+     * way. So read this as retiring the bet rather than as repairing an observed
+     * failure of that number: the delay is a user-settable env override, which
+     * leaves the old behaviour one configuration away from losing on any backend.
+     *
+     * Termination is `hasParkedCommittedDelivery`'s: it counts only deliveries
+     * that resolve on their own, so nothing here can gate its own retirement. A
+     * genuinely orphaned event has no delivery to wait on and reaches `fn` on the
+     * first poll.
+     *
+     * What the gate gives up: for the ordered events that still reach
+     * `onUnconsumedEvent` rather than {@link park}, this stops being the thing
+     * that catches a diverged log while a delivery is in flight. The suspension
+     * and this check now wake from the same `isDeliveryIdle` edge, and
+     * `scheduleWhenIdle` fires on the first timer tick after idle while this waits
+     * a further `getDeferredCheckDelayMs()`. So a run with a pending `sleep()`
+     * suspends first, and `onWorkflowError` drops the divergence arriving second
+     * (its `'suspended'` branch demotes to `'replay'` and surfaces nothing),
+     * leaving a later `resume()` to decline into a cold replay. Pre-gate the
+     * suspension already won that race whenever the delivery landed inside the
+     * fixed window, so what changed is that the outcome stopped depending on
+     * timing. Nothing should treat this check as the mechanism that reports
+     * divergence on a log the run is still delivering into.
      */
-    private consumeOne;
-    private handleUnconsumed;
+    private whenDeliveryIdle;
 }
 export {};
 //# sourceMappingURL=events-consumer.d.ts.map

package/dist/src/compiled/@workflow/core/index.js

@@ -1,2 +1,2 @@
-import{A as e,Bn as t,En as n,Fn as r,Gn as i,Hn as a,Jn as o,K as s,Kn as c,M as l,Rn as u,S as d,Vn as f,q as p,qn as m}from"../../_chunks/workflow/wait-until-CMX5LUWJ.js";import{i as h,u as g}from"../../_chunks/workflow/dist-CRTn4Sg8.js";import{a as _,i as v,r as y,t as b}from"../../_chunks/workflow/attribute-changes-Du5ztewf.js";import"../../_chunks/workflow/dist-CNXUKQCp.js";import{n as x}from"../../_chunks/workflow/resume-hook-CT0keOww.js";import{t as S}from"../../_chunks/workflow/sleep-BeH4B0Cd.js";function C(e){v(`createHook()`,`https://workflow-sdk.dev/docs/api-reference/workflow/create-hook`,C)}function w(e){v(`createWebhook()`,`https://workflow-sdk.dev/docs/api-reference/workflow/create-webhook`,w)}function T({schema:e}={}){function t(e){v(`defineHook().create()`,`https://workflow-sdk.dev/docs/api-reference/workflow/define-hook`,t)}return{create:t,async resume(t,n){if(!e?.[`~standard`])return await x(t,n);let r=e[`~standard`].validate(n);if(r instanceof Promise&&(r=await r),r.issues){let e=r.issues.map(e=>{let t=e.path?.map(e=>String(typeof e==`object`&&e?e.key:e)).join(`.`);return t?`  at "${t}": ${e.message}`:`  ${e.message}`});throw Error(`Hook payload did not match the defined schema:\n${e.join(`
-`)}`)}return await x(t,r.value)}}}async function E(e,t={}){let n=p.getStore(),r=n?.workflowMetadata?.workflowRunId;if(!r)throw new h(`setAttributes() must be called from a 'use workflow' or 'use step' function. Calling it from plain host code is not supported.`);let i=b(e,t);if(i.length!==0){if(n.runReadyBarrier)try{await n.runReadyBarrier}catch{}await(await u()).events.create(r,{eventType:`attr_set`,specVersion:5,eventData:{changes:i,writer:{type:`step`,stepId:n.stepMetadata.stepId,attempt:n.stepMetadata.attempt},...t.allowReservedAttributes===!0?{allowReservedAttributes:!0}:{}}})}}function D(){let e=p.getStore();return e||y(`getStepMetadata()`,`https://workflow-sdk.dev/docs/api-reference/workflow/get-step-metadata`,D),e.stepMetadata}function O(){let e=p.getStore();return e||_(`getWorkflowMetadata()`,`https://workflow-sdk.dev/docs/api-reference/workflow/get-workflow-metadata`,O),e.workflowMetadata}function k(u={}){let h=p.getStore();h||_(`getWritable()`,`https://workflow-sdk.dev/docs/api-reference/workflow/get-writable`,k);let{namespace:g}=u,v=h.workflowMetadata.workflowRunId,y=s(v,g);h.writables??=new Map;let b=h.writables,x=b.get(y);if(x)return x.writable;let S=l(e(globalThis,h.ops,v,h.encryptionKey,!0,h.runReadyBarrier),h.encryptionKey),C=new d(v,y,h.runReadyBarrier),w=t();return h.ops.push(w.promise),f(S.readable,C,w).catch(()=>{}),a(S.writable,w),Object.defineProperty(S.writable,i,{value:y,writable:!1}),Object.defineProperty(S.writable,o,{value:v,writable:!1}),h.workflowDeploymentId&&Object.defineProperty(S.writable,c,{value:h.workflowDeploymentId,writable:!1}),n(h.encryptionKey)&&Object.defineProperty(S.writable,m,{value:r(h.encryptionKey.keyPair.publicKey),writable:!1}),b.set(y,{writable:S.writable,state:w}),S.writable}export{h as FatalError,g as RetryableError,C as createHook,w as createWebhook,T as defineHook,D as getStepMetadata,O as getWorkflowMetadata,k as getWritable,E as setAttributes,S as sleep};
+import{$n as e,F as t,Jn as n,Kn as r,Mn as i,N as a,Qn as o,T as s,Vn as c,Wn as l,X as u,Y as d,Zn as f,er as p,qn as m}from"../../_chunks/workflow/wait-until-BYKVqrwc.js";import{i as h,u as g}from"../../_chunks/workflow/dist-CRTn4Sg8.js";import{a as _,i as v,r as y,t as b}from"../../_chunks/workflow/attribute-changes-6OqdYdi4.js";import{n as x}from"../../_chunks/workflow/resume-hook-BrduAuFX.js";import{t as S}from"../../_chunks/workflow/sleep-tsb2HjWK.js";function C(e){v(`createHook()`,`https://workflow-sdk.dev/docs/api-reference/workflow/create-hook`,C)}function w(e){v(`createWebhook()`,`https://workflow-sdk.dev/docs/api-reference/workflow/create-webhook`,w)}function T({schema:e}={}){function t(e){v(`defineHook().create()`,`https://workflow-sdk.dev/docs/api-reference/workflow/define-hook`,t)}return{create:t,async resume(t,n){if(!e?.[`~standard`])return await x(t,n);let r=e[`~standard`].validate(n);if(r instanceof Promise&&(r=await r),r.issues){let e=r.issues.map(e=>{let t=e.path?.map(e=>String(typeof e==`object`&&e?e.key:e)).join(`.`);return t?`  at "${t}": ${e.message}`:`  ${e.message}`});throw Error(`Hook payload did not match the defined schema:\n${e.join(`
+`)}`)}return await x(t,r.value)}}}async function E(e,t={}){let n=u.getStore(),r=n?.workflowMetadata?.workflowRunId;if(!r)throw new h(`setAttributes() must be called from a 'use workflow' or 'use step' function. Calling it from plain host code is not supported.`);let i=b(e,t);if(i.length!==0){if(n.runReadyBarrier)try{await n.runReadyBarrier}catch{}await(await l()).events.create(r,{eventType:`attr_set`,specVersion:5,eventData:{changes:i,writer:{type:`step`,stepId:n.stepMetadata.stepId,attempt:n.stepMetadata.attempt},...t.allowReservedAttributes===!0?{allowReservedAttributes:!0}:{}}})}}function D(){let e=u.getStore();return e||y(`getStepMetadata()`,`https://workflow-sdk.dev/docs/api-reference/workflow/get-step-metadata`,D),e.stepMetadata}function O(){let e=u.getStore();return e||_(`getWorkflowMetadata()`,`https://workflow-sdk.dev/docs/api-reference/workflow/get-workflow-metadata`,O),e.workflowMetadata}function k(l={}){let h=u.getStore();h||_(`getWritable()`,`https://workflow-sdk.dev/docs/api-reference/workflow/get-writable`,k);let{namespace:g}=l,v=h.workflowMetadata.workflowRunId,y=d(v,g);h.writables??=new Map;let b=h.writables,x=b.get(y);if(x)return x.writable;let S=t(a(globalThis,h.ops,v,h.encryptionKey,!0,h.runReadyBarrier),h.encryptionKey),C=new s(v,y,h.runReadyBarrier),w=r();return h.ops.push(w.promise),m(S.readable,C,w).catch(()=>{}),n(S.writable,w),Object.defineProperty(S.writable,f,{value:y,writable:!1}),Object.defineProperty(S.writable,p,{value:v,writable:!1}),h.workflowDeploymentId&&Object.defineProperty(S.writable,o,{value:h.workflowDeploymentId,writable:!1}),i(h.encryptionKey)&&Object.defineProperty(S.writable,e,{value:c(h.encryptionKey.keyPair.publicKey),writable:!1}),b.set(y,{writable:S.writable,state:w}),S.writable}export{h as FatalError,g as RetryableError,C as createHook,w as createWebhook,T as defineHook,D as getStepMetadata,O as getWorkflowMetadata,k as getWritable,E as setAttributes,S as sleep};

package/dist/src/compiled/@workflow/core/private.d.ts

@@ -2,7 +2,6 @@
  * Utils used by the bundler when transforming code
  */
 import type { WorldCapabilities } from '#compiled/@workflow/world/index.js';
-import type { CorrelationIdGenerator } from './correlation-id.js';
 import type { EventsConsumer } from './events-consumer.js';
 import type { QueueItem } from './global.js';
 import type { ReplayPayloadCache } from './replay-payload-cache.js';
@@ -49,11 +48,11 @@ export interface WorkflowOrchestratorContext {
     invocationsQueue: Map<string, QueueItem>;
     onWorkflowError: (error: Error) => void;
     /**
-     * Mints a correlation id body for one entity family. Every entity a replay
-     * creates draws from here, and the family is what keeps a disagreement about
-     * one family's count from renumbering another's.
+     * Mints the ULID body of a correlation id. Every entity a replay creates
+     * draws from this one monotonic sequence, so an id is an ordinal over the
+     * whole run and both replays of a run must draw in the same order.
      */
-    generateCorrelationId: CorrelationIdGenerator;
+    generateUlid: () => string;
     generateNanoid: () => string;
     /**
      * Sequential promise queue that ensures all event-driven promise resolutions
@@ -147,17 +146,44 @@ interface DeliveryBarrierEntry {
  * suspension point first; see the comment at that `await` for why ordering the
  * `resolve()` calls alone is not enough.
  *
- * One asymmetry: a STEP result additionally skips any earlier delivery that
- * will not resolve on its own, i.e. one blocked (directly or transitively) on
- * a buffered hook payload no consumer has claimed. Such a payload is delivered
- * only when the workflow next reads the hook, and reaching that read very
- * commonly requires the step result itself (`await stepX()` before the read).
- * Gating the step on it would stall the workflow until the barrier's idle
- * safety net fires, which then releases every delivery queued behind that
+ * What counts as "defers behind" is {@link gatesOn}, shared with
+ * {@link computeResolvesOnItsOwn} so the two cannot drift.
+ *
+ * One asymmetry: a STEP result skips any earlier delivery that is UNARMED,
+ * i.e. a buffered hook payload no consumer has claimed. Such a payload is
+ * delivered only when the workflow next reads the hook, and reaching that read
+ * very commonly requires the step result itself (`await stepX()` before the
+ * read). Gating the step on it would stall the workflow until the barrier's
+ * idle safety net fires, which then releases every delivery queued behind that
  * payload at once — losing exactly the race this ordering exists to protect.
  * Waits and hooks keep gating on unclaimed payloads: for them, waiting for the
  * claim IS the ordering guarantee (a `wait_completed` must not preempt a
  * payload the log ordered first).
+ *
+ * The skip is direct, never transitive. A step still gates on an earlier ARMED
+ * wait or hook, including one that is itself parked behind an unclaimed
+ * payload. Skipping those too would invert log order for the commonest shape
+ * there is: a workflow that creates a hook it does not read on this branch,
+ * races `step` against `sleep`, and has the log say the sleep won. The step
+ * would then overtake the wait, both branches would swap the correlation ids
+ * they draw next, and replay would diverge — see
+ * `step-delivery-ordering.test.ts`. Waiting instead is safe because the
+ * payload's own idle safety net retires it and the whole chain then delivers
+ * in log order; {@link hasParkedCommittedDelivery} deliberately reports such a
+ * step as not self-resolving so that idle stays reachable.
+ *
+ * "The whole chain then delivers in log order" rests on the PAYLOAD's safety
+ * net observing idle before the net of the wait parked behind it. If the
+ * wait's net fired first, the step's gate would open while the wait was still
+ * parked on the payload barrier and the inversion above would reappear. Within
+ * one drain window that order is structural, and carried by FIFO of the
+ * safety-net polls: nets arm via `setTimeout` in log order during synchronous
+ * consumption, each polling round re-arms through `promiseQueue.then(...)` in
+ * the order the checks ran, and each net that fires flips
+ * {@link hasParkedCommittedDelivery} back to true, re-blocking the rest until
+ * the released delivery completes. Replay — where divergence manifests —
+ * always consumes the log in one window. Do not "optimize" the net scheduling
+ * in a way that breaks that per-window FIFO.
  */
 export declare function awaitEarlierDeliveries(ctx: WorkflowOrchestratorContext, eventIndex: number | undefined, kind: DeliveryKind): Promise<void>;
 /** Handle for a registered branch-deciding delivery barrier. */
@@ -202,12 +228,39 @@ export declare function registerDeliveryBarrier(ctx: WorkflowOrchestratorContext
     armed?: boolean;
 }): DeliveryBarrier;
 /**
- * Schedule a callback to fire only after all pending data deliveries
- * (step results, hook payloads) and async deserialization have completed.
- * Uses a polling loop: setTimeout(0) → check pendingDeliveries and the
- * barrier registry → if anything is still in flight, wait for promiseQueue →
- * repeat. This handles the multi-round delivery pattern where each hook
- * payload delivery cycle appends new async work to the promiseQueue.
+ * Whether some registered branch-deciding delivery is going to reach the
+ * workflow without any further help (it is armed and not transitively parked
+ * behind an unclaimed buffered payload — see {@link resolvesOnItsOwn}) but
+ * has not been handed over yet.
+ *
+ * This is the delivery state `pendingDeliveries` cannot see. That counter
+ * covers the hydration window inside a serial `promiseQueue` slot and is
+ * released there, while the delivery's `resolve()` runs later, from a
+ * detached continuation behind {@link awaitEarlierDeliveries} — including its
+ * macrotask yield whenever the delivery had to defer. Replaying a batch of N
+ * parallel step results consumed in one drain window leaves N-1 of them
+ * parked on that yield with `pendingDeliveries` already at 0. An idle check
+ * armed during the same window (a pending `sleep()` arms one on every replay)
+ * could then observe "idle" mid-deferral and raise a `WorkflowSuspension`
+ * BEFORE the workflow's own continuations ran — a suspension carrying none of
+ * the follow-up work the batch was about to create, which the runtime
+ * dutifully schedules as nothing, leaving the run dormant until an unrelated
+ * timer fires (vercel/workflow#3183).
+ *
+ * Deliveries that do NOT resolve on their own must be excluded, not for
+ * accuracy but for termination: an unclaimed buffered hook payload is retired
+ * BY the idle safety net in {@link registerDeliveryBarrier}, so counting it
+ * here would gate its own retirement. That reasoning extends to whatever is
+ * parked behind such a payload — a wait, and a step gating on that wait — for
+ * the same reason: the whole chain moves only once the net fires, and it
+ * cannot fire while the chain is counted. Self-resolving deliveries always
+ * deliver from their own chains (see the INVARIANT on
+ * {@link registerDeliveryBarrier}) and never need that net, so waiting on
+ * them is deadlock-free.
+ */
+export declare function hasParkedCommittedDelivery(ctx: WorkflowOrchestratorContext): boolean;
+/**
+ * Whether no data delivery (step result, hook payload) is in flight right now.
  *
  * "In flight" is two distinct windows, each with its own guard:
  * `pendingDeliveries > 0` covers hydration inside the serial queue slots, and
@@ -215,6 +268,22 @@ export declare function registerDeliveryBarrier(ctx: WorkflowOrchestratorContext
  * releasing that counter and the delivery's `resolve()` actually running —
  * deliberately outside `pendingDeliveries` (see step.ts), and invisible to it.
  *
+ * Anything that decides a replay is over, or that a replay went wrong, has to
+ * consult this first: while it is false the workflow VM is mid-reaction, so
+ * what it has and has not done yet says nothing about the run. Two callers
+ * read it, for the two such decisions: {@link scheduleWhenIdle} for the
+ * suspension, and the events consumer's unconsumed-event check for divergence.
+ */
+export declare function isDeliveryIdle(ctx: WorkflowOrchestratorContext): boolean;
+/**
+ * Schedule a callback to fire only after all pending data deliveries
+ * (step results, hook payloads) and async deserialization have completed.
+ * Uses a polling loop: setTimeout(0) → check pendingDeliveries and the
+ * barrier registry → if anything is still in flight, wait for promiseQueue →
+ * repeat. This handles the multi-round delivery pattern where each hook
+ * payload delivery cycle appends new async work to the promiseQueue. What
+ * counts as in flight is {@link isDeliveryIdle}.
+ *
  * The initial `setTimeout(0)` macrotask is load-bearing and must NOT be
  * downgraded to a microtask (`queueMicrotask`/`Promise.resolve().then`).
  * `pendingDeliveries` only guards the host-side hydration window; between a

package/dist/src/compiled/@workflow/core/private.js

@@ -1 +1 @@
-import{a as e,i as t,n,r,t as i}from"../../_chunks/workflow/private-CiWVdS5v.js";export{i as awaitEarlierDeliveries,n as getStepFunction,r as registerDeliveryBarrier,t as registerStepFunction,e as scheduleWhenIdle};
+import{a as e,i as t,n,o as r,r as i,s as a,t as o}from"../../_chunks/workflow/private-tvMBynnC.js";export{o as awaitEarlierDeliveries,n as getStepFunction,i as hasParkedCommittedDelivery,t as isDeliveryIdle,e as registerDeliveryBarrier,r as registerStepFunction,a as scheduleWhenIdle};

package/dist/src/compiled/@workflow/core/runtime/constants.d.ts

@@ -12,7 +12,7 @@ export declare function getMaxQueueDeliveries(): number;
  * `maxDuration` (e.g. 800s on Vercel Pro Fluid) and `NO_INLINE_REPLAY_AFTER_MS`.
  *
  * If the non-step ("replay") time within a single invocation exceeds this
- * budget, the handler exits so the queue can retry. After
+ * budget, the handler rejects so the queue can retry. After
  * `REPLAY_TIMEOUT_MAX_RETRIES` exhausted attempts the run is failed with
  * `RUN_ERROR_CODES.REPLAY_TIMEOUT`.
  *
@@ -141,6 +141,20 @@ export declare function isOptimisticInlineStartExplicitlyDisabled(): boolean;
  * explicit `'0'` / `'false'` (case-insensitive).
  */
 export declare function isTurboEnabled(): boolean;
+/**
+ * Whether the QuickJS engine's baseline-snapshot startup optimization is
+ * enabled (default ON). When on, the engine hydrates a VM with the
+ * workflow bundle once per function instance, snapshots it, and starts
+ * every invocation by restoring the snapshot instead of re-evaluating
+ * the bundle — skipping the dominant share of VM startup (measured
+ * ~77ms → ~3ms to first suspension for a 1.3MB bundle). Bundles whose
+ * module scope consumes randomness, reads the clock, or replaces a
+ * serialization intrinsic are detected at hydrate time and
+ * automatically fall back to per-invocation fresh evaluation (see
+ * prepareBaselineSnapshot). Set WORKFLOW_QUICKJS_BASELINE_SNAPSHOT=0 to
+ * disable.
+ */
+export declare function isQuickJSBaselineSnapshotEnabled(): boolean;
 /**
  * Whether the inline loop retains a suspended workflow VM across inline steps
  * within one invocation (default ON). When on, a step-only suspension keeps

package/dist/src/compiled/@workflow/core/runtime/helpers.d.ts

@@ -122,10 +122,7 @@ export declare function insertEventByEventId(target: Event[], event: Event): voi
  *   The returned cursor can be passed back in on a subsequent call for
  *   incremental loading.
  */
-export declare function loadWorkflowRunEvents(runId: string, afterCursor?: string): Promise<{
-    events: Event[];
-    cursor: string | null;
-}>;
+export declare function loadWorkflowRunEvents(runId: string, afterCursor?: string): Promise<LoadedEventLog>;
 /**
  * The runtime's loaded event-log snapshot: the events replayed so far and the
  * cursor positioned after them. Handed to helpers that derive the precondition
@@ -144,6 +141,20 @@ export interface LoadedEventLog {
  * backward-compatible.
  */
 export declare function isPreconditionGuardEnabled(): boolean;
+/**
+ * Whether a replay refuses to run over a log with a hole in it (see
+ * {@link findEventSlotGap}). **On by default**; set
+ * `WORKFLOW_SLOT_GAP_CHECK=0` to replay across holes instead.
+ *
+ * The switch exists because the check trades one failure for another. A hole is
+ * a position claimed by a write that then failed, so most of them stand for an
+ * event that never happened and replaying past one is correct. But a hole
+ * standing for an event that *did* happen is indistinguishable from that, and
+ * replaying past that one produces a run whose result is wrong with nothing to
+ * show for it. Failing loudly is the recoverable side of the trade, and this is
+ * the way back out if a fleet turns out to carry benign holes.
+ */
+export declare function isSlotGapCheckEnabled(): boolean;
 /**
  * The `stateUpdatedAt` value to send with a replay-context event creation: the
  * *maximum* ULID time (epoch ms) over the events the runtime has loaded. Returns
@@ -169,19 +180,116 @@ export declare function isPreconditionGuardEnabled(): boolean;
  * watermark differs even when the watermarks are equal.
  */
 export declare function latestEventStateUpdatedAt(events: Event[]): number | undefined;
+/**
+ * Merge the events a bump-and-report write handed back into the log it was
+ * derived from, and answer how many of them were new.
+ *
+ * Unlike {@link appendUniqueEvents}, this re-sorts. The reported events occupy
+ * slots *below* the write that reported them, so appending them would put them
+ * after events they precede — and on a slot-numbered run the id order is the
+ * World's canonical order, so restoring it is well defined rather than a guess.
+ * A run that is not slot-numbered cannot produce this report in the first
+ * place; the sort is skipped rather than applied to ids it cannot order.
+ */
+export declare function mergeReportedEvents(target: Event[], events: readonly Event[]): number;
+/**
+ * The highest slot the loaded log occupies, or `undefined` when the run is not
+ * slot-numbered. A run keeps the id scheme it was created under, so one event
+ * settles it for the whole log.
+ *
+ * The maximum, not the count, and the two are not interchangeable even though
+ * a healthy log makes them equal. A World hands a position to the insert that
+ * occupies it, so a write that never lands leaves no hole behind and the log
+ * stays dense. What the count cannot survive is a *partial* read: a log
+ * assembled from a truncated report, or read while a concurrent write is
+ * committing, holds fewer events than its highest position. Counting those
+ * would make the next write claim to have seen less than it has, so the World
+ * would report the same events back to it on every attempt.
+ *
+ * A hole below the maximum is therefore a property of the read, not of the log,
+ * which is what lets {@link settleEventSlotGap} re-read instead of giving up.
+ */
+export declare function maxEventSlot(events: Event[]): number | undefined;
+/** A position the log skips over, described well enough to name in an error. */
+export interface EventSlotGap {
+    /** The lowest slot below the log's maximum that no event occupies. */
+    firstMissingSlot: number;
+    /** How many slots below the maximum no event occupies. */
+    missingCount: number;
+    /** The highest slot the log occupies. */
+    maxSlot: number;
+}
+/**
+ * The hole in a loaded log, or `undefined` when there is none to find.
+ *
+ * On a slot-numbered run the World allocates every position, so a log that
+ * holds `n` events below slot `n` is missing one. That matters before a replay
+ * and nowhere else: the replay reads the log as the complete record of what has
+ * happened, and an absent position is indistinguishable from an event that
+ * never occurred. The branch it would have decided gets decided the other way,
+ * and the run diverges quietly rather than failing.
+ *
+ * Order-independent, unlike the equivalent audit the World runs over a page it
+ * just read. A loaded log is assembled from listed pages plus whatever a
+ * bump-and-report write handed back, and while {@link mergeReportedEvents}
+ * restores id order, a check that can fail a healthy run should not depend on
+ * that having happened.
+ *
+ * The first slot is never counted. It belongs to `run_created`, which `start()`
+ * posts concurrently with the queue send, so a log read in that window
+ * legitimately begins at the second slot and fills in on its own. Every replay
+ * that races a run's own start would otherwise report a hole.
+ *
+ * Returns `undefined` for a log this cannot read as slots at all: an empty one,
+ * or a run numbered by ULID, where positions carry no density to check.
+ */
+export declare function findEventSlotGap(events: readonly Event[]): EventSlotGap | undefined;
+/**
+ * How many times a detected hole is re-read before the log is taken at its
+ * word, and the backoff before each re-read (doubling per attempt).
+ *
+ * A hole can be transient. The World allocates a slot inside the insert that
+ * occupies it, so two concurrent writers can collide, one retry past the other,
+ * and the higher slot commit first — leaving a window in which the lower one is
+ * genuinely absent from a strongly-consistent read and fills in a moment later.
+ * The window is one commit wide, so a short backoff clears it; anything that
+ * survives all three re-reads is a position no write will ever occupy.
+ */
+export declare const SLOT_GAP_RECHECK_ATTEMPTS = 3;
+/**
+ * Re-read a log that looks holey until the hole fills in or the re-reads run
+ * out, and return the settled log alongside the hole that survived.
+ *
+ * Reads are strongly consistent, so a hole is not an artifact of *when* the log
+ * was read — but it can be an artifact of a write that had not committed yet
+ * (see {@link SLOT_GAP_RECHECK_ATTEMPTS}). Distinguishing the two costs a
+ * re-read, which is only ever paid by a replay that already found a hole.
+ *
+ * The reload is full rather than incremental: the missing position is below the
+ * log's maximum, so a cursor-anchored read starts past it and can never see it
+ * arrive.
+ */
+export declare function settleEventSlotGap(runId: string, loaded: LoadedEventLog): Promise<{
+    log: LoadedEventLog;
+    gap: EventSlotGap | undefined;
+}>;
 /**
  * The precondition snapshot a replay-context event creation sends, describing
  * the event log the replay derived the event from.
  *
- * The three fields are one indivisible unit: the backend reads the count only
- * relative to the watermark, and returns its inline delta only relative to the
- * cursor. Passing them as a single object is what keeps them from drifting
- * apart at a call site.
+ * On a slot-numbered run this is `eventCount`, optionally with the set of
+ * correlation ids the writer is blocked on. On a ULID-numbered run it is the
+ * `stateUpdatedAt` / `stateEventCount` / `stateCursor` triple, whose three
+ * fields are one indivisible unit: the backend reads the count only relative to
+ * the watermark, and returns its inline delta only relative to the cursor.
+ * Passing them as a single object is what keeps them from drifting apart at a
+ * call site.
  */
 export interface PreconditionSnapshotParams {
     stateUpdatedAt?: number;
     stateEventCount?: number;
     stateCursor?: string;
+    eventCount?: number;
 }
 /**
  * Build the precondition snapshot to attach to a replay-context event creation.

package/dist/src/compiled/@workflow/core/runtime/quickjs-runtime.d.ts

@@ -15,7 +15,9 @@
  *
  * The VM bootstrap is deliberately split into two phases:
  *   1. Static initialization (`initWorkflowVM`) — run-independent setup:
- *      VM creation, the serde bundle, and the workflow primitives.
+ *      VM creation and the workflow primitives. (Serialization lives on
+ *      the host — see quickjs-serde.ts — so no serde code is evaluated
+ *      in the VM.)
  *   2. Per-run initialization (inline in `runQuickJSWorkflow`) — seeded
  *      PRNG/ULID host functions, workflow bundle evaluation, run metadata,
  *      workflow input, and start.
@@ -27,6 +29,7 @@
  * `node:vm` engine's replay determinism.
  */
 import type { Event, RunInput, WorkflowRun, WorldCapabilities } from '#compiled/@workflow/world/index.js';
+import { type Snapshot } from '../_quickjs-wasi.js';
 import type { DecryptionKey } from '../serialization/encryption.js';
 export interface PendingStep {
     type: 'step';
@@ -163,6 +166,37 @@ export interface QuickJSRuntimeOptions {
      */
     runInput?: RunInput;
 }
+/**
+ * Eval filename used when hydrating the baseline VM. The baseline is
+ * shared by EVERY workflow in the bundle, so the filename baked into
+ * its compiled code (and therefore into snapshot-path stack frames)
+ * must be workflow-independent — hydrating under the first caller's
+ * workflowId would break `remapErrorStack`'s filename matching for
+ * every other workflow in the bundle. Remap call sites match this
+ * constant IN ADDITION to the run's module specifier (which covers
+ * fresh-path frames).
+ */
+export declare const BASELINE_BUNDLE_FILENAME = "workflow-bundle.js";
+type BaselineEntry = {
+    state: 'ready';
+    snapshot: Snapshot;
+    /**
+     * Raw box pointer of the serde capture root created BEFORE the
+     * bundle evaluated (see captureSerdeRoot). The box lives in the
+     * snapshot's memory image at this offset; every restored VM
+     * re-adopts it so serde initialization executes no guest code
+     * after user code has run — capture-before-user-code semantics,
+     * identical to the fresh path.
+     */
+    serdeRootPtr: number;
+} | {
+    state: 'ineligible';
+    reason: string;
+};
+/** Test-only: reset the baseline cache between test cases. */
+export declare function __clearBaselineSnapshotCacheForTests(): void;
+/** Test-only: observe how a bundle was classified. */
+export declare function __peekBaselineEntryForTests(workflowCode: string): Promise<BaselineEntry | undefined>;
 /**
  * A live QuickJS workflow invocation. When the initial `result` is
  * `suspended`, the VM is kept alive so the caller can feed newly recorded
@@ -190,4 +224,5 @@ export interface QuickJSWorkflowSession {
  */
 export declare function runQuickJSWorkflow(options: QuickJSRuntimeOptions): Promise<QuickJSRuntimeResult>;
 export declare function startQuickJSWorkflow(options: QuickJSRuntimeOptions): Promise<QuickJSWorkflowSession>;
+export {};
 //# sourceMappingURL=quickjs-runtime.d.ts.map