* Add browser-compatible AES-GCM to core and HKDF key derivation to world-vercel
* update changeset
* Move HKDF key derivation server-side: API returns per-run derived key
* Refactor encrypt/decrypt to accept CryptoKey, export importKey for callers to import once per run
* Pass WorkflowRun entity to getEncryptionKeyForRun where available (avoids redundant lookup)
* .
* Refactor handleSuspension to accept WorkflowRun, pass run entity to getEncryptionKeyForRun
* Overload getEncryptionKeyForRun: accept context for start(), fetch WorkflowRun in resume-hook
* Split changeset into per-package descriptions for world, world-vercel, and core
* Remove unnecessary Uint8Array.from() wrapper around Buffer.from()
* Use zod to parse Vercel API response
* Address peter's comment
* Bring back sitemap
* Bring back sitemap
* Add pre commit hooks for sitemap
* Add pre commit hooks for sitemap
* Fix failing queue test
* Revert queue test failure
* Add unit tests
Adds a workflow-init skill that guides users through setting up Vercel
Workflow DevKit. Auto-detects the user's framework from package.json,
then directs the agent to fetch the official getting-started guide from
useworkflow.dev. After setup, hands off to the /workflow skill.
* fix(workflow): improve error message for runtime API usage in workflow context and fix SKILL.md streaming docs
The workflow stub error now tells users to move calls to a step function or outside the workflow context. Also corrects the SKILL.md streaming section which incorrectly stated getWritable() only works in steps.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* chore: add changeset
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix(skill): address PR feedback on SKILL.md
- Remove `npx workflow start` from debugging section (args can't easily be passed via CLI)
- Mention --json and --help flags for CLI inspection
- Add reminder to check AI docs for DurableAgent details
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix(skill): fix SKILL.md debugging section CLI commands
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* other improvements
* fix(skill): address Copilot PR feedback on streaming examples
- Add missing imports and define all referenced variables
- Wrap writer.releaseLock() in finally blocks for safety
- Remove undefined `data`/`agent`/`messages` references
- Simplify examples to be self-contained and copy-pasteable
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* chore(skill): bump SKILL.md version to 1.1
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* docs: add skill version bump rule to CLAUDE.md
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
Co-authored-by: John Lindquist <johnlindquist@gmail.com>
## Summary
- Adds `World.getEncryptionKeyForRun(run)` returning `Uint8Array | undefined` as the interface for retrieving per-run encryption keys
- Updates all 8 dehydrate/hydrate serialization functions to accept `key: Uint8Array | undefined`
- Updates runtime callers, CLI, and tests to thread the key parameter through
## Summary
- Makes all 8 dehydrate/hydrate serialization functions in `@workflow/core` async (returning `Promise<...>`)
- Updates all call sites across runtime, CLI, and test code to `await` the results
- Pure mechanical refactor — no functional changes, prerequisite for encryption support
Part 1 of the end-to-end encryption PR stack.
Move `x-workflow-run-id` and `x-workflow-step-id` header injection into
`world-vercel` queue implementation so callers don't need to set them
manually. The headers are extracted from the queue payload itself.
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
The CLI's `cancelRun` in `packages/cli/src/lib/inspect/run.ts` sent `{ eventType: 'run_cancelled' }` without `specVersion`, causing the Vercel API's `/v2/runs/{id}/events` endpoint to reject the request with a 400 error. The core runtime's `cancelRun` already handled this correctly, so the fix removes the redundant CLI wrapper and calls the core implementation directly.
The bug was introduced in 4966b72 ("implement event-sourced architecture (#621)") which changed the CLI cancel from `world.runs.cancel(runId)` to `world.events.create(runId, ...)` but omitted `specVersion` from the payload. The same commit correctly included it in `Run#cancel()` in core — it was simply missed in the CLI path. A later commit (86a7930) added v1Compat branching but still never added specVersion. The final merged state in a2b688d (PR #894) still omits it.
Also adds a CLI cancel e2e test that starts a long-running workflow, cancels it via the CLI command, and verifies the run status.
* Handle 409 conflict when completing waits that were already completed
When multiple concurrent workflow invocations race to complete the same
wait, the server returns 409 (conflict) for duplicates. This change
handles the 409 gracefully in both runtime.ts (sleep elapsed check) and
runs.ts (wakeUpRun), preventing crashes and treating already-completed
waits as successful.
Also updates event-sourcing docs to reflect that waits are now
materialized as entities in storage with atomic completion guarantees.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* Point e2e tests at workflow-server preview for wait materialization branch
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* Materialize waits as entities in local and postgres worlds to prevent duplicate wait_completed events
Adds Wait type/schema to the shared world package and implements wait entity
materialization in both local (filesystem) and postgres world implementations,
matching the DynamoDB behavior. wait_created creates a wait entity with status
'waiting', and wait_completed transitions it to 'completed' with guards that
reject duplicates (409).
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* Fix waitId to use composite key for consistency with postgres world
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* Clean up wait entities on terminal run states and register waits migration
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* Clear WORKFLOW_SERVER_URL_OVERRIDE for merge
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* Update changeset for all affected packages and restore server URL override
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* Clear WORKFLOW_SERVER_URL_OVERRIDE now that server PR is merged
The server-side changes (vercel/workflow-server#265) have been merged to main
and deployed to production, so we no longer need to point at the preview URL.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
* Remove "workflow/internal/serialization" export
Was only being used in these two e2e test files and the data being passed in those tests don't rely on any specialized data types, so just use JSON there.
* Fix: Removing the `workflow/internal/serialization` export from package.json breaks 5 files in `packages/world-testing` that still import `hydrateWorkflowReturnValue` from that path.
Co-authored-by: TooTallNate <n@n8.io>
* lockfile
---------
Co-authored-by: Vercel <vercel[bot]@users.noreply.github.com>
Per TooTallNate's review on #1055: the setupWorkflowContext helper
has a circular reference where ctx.onWorkflowError is accessed via
closure before it's defined on the object. Add a clarifying comment.
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
* fix(core): detect and fatal error on orphaned/invalid events in EventsConsumer
When an event log has duplicate or invalid events (e.g., 2 wait_completed for a single wait_created), the EventsConsumer gets stuck: the orphaned event has no callback to consume it, so eventIndex never advances, blocking all subsequent events and hanging the workflow forever. This adds deferred orphaned event detection that raises a WorkflowRuntimeError instead.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* add corrupted-event-log error slug and docs page
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* add changeset for orphaned event detection
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* address PR feedback on docs and JSDoc
- Add JSDoc to EventsConsumer constructor's onUnconsumedEvent parameter
- Rewrite docs to clarify this is a SDK/server bug, not user code
- Remove cancel/programmatic retry advice; run is already marked failed
- Emphasize error is uncatchable inside workflow code
- Add steps: upgrade package, retry via dashboard/CLI, report issue on GitHub
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* address PR review: structured options, required callback, reorder docs
- Change EventsConsumer constructor to use structured EventsConsumerOptions object
- Make onUnconsumedEvent required (all callsites provide it)
- Move corrupted-event-log card to last position in errors index
- Update all callsites in tests
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix docs code sample to pass type-checking
Use correct imports (getRun from workflow/api) and declare variables
to satisfy the docs-typecheck CI job.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* add e2e test for parallel sleep (Promise.all with 10x sleep)
Adds parallelSleepWorkflow that does Promise.all with 10 concurrent
sleep('1s') calls, and an e2e test asserting it completes or fails
within a reasonable time (not hanging).
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix parallelSleep e2e test: await returnValue instead of checking status
run.status returns immediately and the workflow is still 'running'.
Use run.returnValue which polls until completion.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix parallelSleep e2e: assert parallel completion under 10s
The test verifies 10 concurrent sleep('1s') calls complete in parallel
(~1s) rather than serially (10s) or hanging indefinitely. 30s timeout
is sufficient since the workflow should finish in ~1-2s.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
Replaces the Chrome DevTools color scheme with one inspired by
Node.js util.inspect() ANSI stylizing: green strings, yellow
numbers/booleans, grey undefined, magenta dates, cyan functions,
and neutral property names. Adds an extended theme context to
color Date instances (react-inspector has no built-in theme key
for dates). Removes color-hash dependency which is no longer used.
Consolidate all ObjectInspector usage into a single DataInspector component
with shared theming, custom nodeRenderer for StreamRef/ClassInstanceRef, and
stream click context. Update all consumers (attribute-panel, events-list,
event-list-view, stream-viewer, conversation-view) to use DataInspector
instead of direct ObjectInspector or JSON.stringify. Fix class instance
hydration to create objects with dynamically-named constructors so
react-inspector shows proper class names via constructor.name.
* Use `@vercel/cli-auth` for auth token reading and OAuth refresh
Replace the manual auth.json reading logic in the CLI with the `@vercel/cli-auth` package, which handles credential storage via CredentialsStore and OAuth token refresh via the OAuth client.
Previously, the CLI would read the token from disk but had no refresh logic — if the token was expired, API calls would fail.
Now, getAuthToken() checks token expiry and automatically refreshes it using the stored refresh token before returning it.
* Remove dead logging
* [workflow o11y] rebase on latest main and keep targeted UI/builders changes
Rebase the branch intent onto latest main by preserving web-shared UI refactors and builders base-builder updates while taking main for hydration and data-fetching behavior elsewhere.
Co-authored-by: Cursor <cursoragent@cursor.com>
* [workflow o11y] align web-shared hydration revivers with main
Revert the hydration reviver delta for URL, URLSearchParams, and Headers so web-shared matches main behavior while keeping the targeted UI/builders-only scope on this branch.
Co-authored-by: Cursor <cursoragent@cursor.com>
* [workflow o11y] restore PR #1017 detail-panel decoupling
Bring the web-shared trace/detail panel files back in sync with main so PR #1017 behavior is preserved and not regressed on this branch.
Co-authored-by: Cursor <cursoragent@cursor.com>
* [workflow o11y] restore PR #1018 react-inspector sidebar updates
Bring web-shared o11y rendering files back in sync with main so ObjectInspector-based sidebar rendering and related UI behavior from PR #1018 remain intact on this branch.
Co-authored-by: Cursor <cursoragent@cursor.com>
* [workflow o11y] keep custom viewers and apply inspector rendering
Preserve the branch-specific event list and stream viewer UX while applying react-inspector rendering to payload/chunk data so complex hydrated values render correctly without reverting custom UI behavior.
Co-authored-by: Cursor <cursoragent@cursor.com>
* [workflow o11y] trace viewer UX improvements and Geist alignment
- Add live tick animation, context menu, and cancel run support from PR #984
- Decouple side panel styling to use Geist design tokens (inline styles)
- Fix sleep span detail panel showing events instead of wait entity attributes
- Fix stream viewer flickering by removing unstable object deps
- Remove Chunks/Output toggle from stream viewer, show only chunks
- Add resolve hook modal, wake-up sleep, and cancel run plumbing
- Add loading skeleton for stream viewer
Co-authored-by: Cursor <cursoragent@cursor.com>
* Bug fixes
* Bug fixes
* Bug fixes
* Bug fixes
* Bug fixes
* Bug fixes
* Bug fixes
* Bug fixes
* Bug fixes
* Bug fixes
---------
Co-authored-by: Cursor <cursoragent@cursor.com>
* Fix benchmark history continuity across metric name rename
The concurrent step benchmarks were renamed in beta.53 (dropping the
"stress test: " prefix), which broke the history API's exact-name lookup
against older gh-pages data. Add legacy alias fallbacks so charts show
continuous history across the rename boundary.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* Paginate GitHub API calls and use generic legacy name fallback
Three fixes:
- Paginate gh-pages commits (was fetching 100 of 216, missing most history)
- Paginate tags (workflow@ tags were cut off beyond page 1)
- Paginate main branch commits for commits mode
- Replace hardcoded LEGACY_METRIC_ALIASES with generic "stress test: "
prefix fallback
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* Cache benchmark history with unstable_cache and aggressive CDN TTLs
The snapshot map (200+ GitHub API fetches) is now cached via
unstable_cache for 1 hour, shared across all parameter combinations.
Tags are cached separately. Individual fetch calls use force-cache
with long revalidation periods since historical data is immutable.
CDN cache bumped from 5min to 1h with 24h stale-while-revalidate,
matching how infrequently benchmark data changes.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
* Retry 5xx errors from workflow-server in step handler
Add `withServerErrorRetry` helper that retries world calls on 5xx errors
with exponential backoff (500ms, 1s, 2s ≈ 3.5s total). Applied to all
`world.events.create` calls in the step handler so transient
workflow-server errors don't consume step attempts.
If retries are exhausted, the error is thrown to the queue for
higher-level retry without burning a step attempt.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* Address PR review comments on 5xx retry handling
- Fix misleading `maxAttempts` log field to `maxRetries` in withServerErrorRetry
- Update step-handler comment to accurately note that queue retries may
still consume step attempts since step_started has already incremented
- Add unit tests for withServerErrorRetry (7 tests covering success,
retry/backoff, exhaustion, and non-5xx passthrough)
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* Add tests for 429/5xx retry handling
Unit tests for withThrottleRetry and withServerErrorRetry helpers, plus
an e2e test that exercises the 5xx retry codepath during step execution
via run-scoped fault injection.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* Wrap VQS errors in WorkflowAPIError and add retry to queueMessage
VQS throws its own error types (InternalServerError, ConsumerDiscoveryError,
ConsumerRegistryNotConfiguredError) that don't match WorkflowAPIError.is().
Wrapping them at the world-vercel boundary enables withServerErrorRetry in
queueMessage() to automatically retry transient queue failures.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* Update changeset to include @workflow/world-vercel
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* Remove queue retry logic per review feedback
Queue retrying will be handled natively by the @vercel/queue client
instead. Reverts VQS error wrapping and withServerErrorRetry in
queueMessage().
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
Vercel Release Bot