Skip to content

workflow: make the local world's files interchangeable with the TypeScript SDK - #226

Merged
fantix merged 2 commits into
mainfrom
fantix/local-world-json-format
Aug 5, 2026
Merged

workflow: make the local world's files interchangeable with the TypeScript SDK#226
fantix merged 2 commits into
mainfrom
fantix/local-world-json-format

Conversation

@fantix

@fantix fantix commented Aug 3, 2026

Copy link
Copy Markdown
Member

The local world used to write CBOR into files named .json. TypeScript's @workflow/world-local writes real JSON, so neither side could read the other's .workflow-data tree.

Now Python writes what TS JSON.stringify(value, jsonReplacer, 2) writes:

json { "runId": "wrun_01KZ7ARFVCB83N043NCT1SG49R", "status": "running", "input": { "__type": "Uint8Array", "data": "ZGV2bFtbXV0=" }, "attributes": {}, "startedAt": "2026-08-04T21:27:02.766Z" } ​

  • two-space indent, non-ASCII unescaped
  • bytes in the {__type, data} base64 wrapper
  • datetime as toISOString(), three fractional digits
  • integral floats as plain integers
  • unset fields omitted, never null

null is the one that bites: TS types output, error and completedAt as z.undefined(), which rejects it, and its date fields use z.coerce.date(), so a null startedAt would read back as the epoch.

Three field sets differed and are now aligned: runs always carry attributes (copied forward on lifecycle transitions), hooks carry isSystem, tokens carry the eventId TS claim recovery reads back.

End-to-end Test PoC

Second commit: a real Python workflow runs end to end against a real LocalWorld, then the TS workflow CLI reads back what it wrote.

# workflow inspect run <id> --backend local --json
assert run["input"] == [{"amount": 21}]
assert run["output"] == "charged 42"

CI installs the CLI in its own step and points VERCEL_WORKFLOW_CLI at it. Locally it installs on demand and skips without node.

Breaking

Existing .workflow-data directories are unreadable in the new format and should be deleted.

@fantix
fantix requested a review from a team August 3, 2026 17:37
@vercel

vercel Bot commented Aug 3, 2026

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated (UTC)
vercel-py Ready Ready Preview Aug 5, 2026 2:27am

Request Review

@fantix
fantix force-pushed the fantix/local-world-json-format branch from b40fdaf to c93fa6f Compare August 5, 2026 02:27
@fantix
fantix merged commit feeb350 into main Aug 5, 2026
14 checks passed
@fantix
fantix deleted the fantix/local-world-json-format branch August 5, 2026 14:41
This was referenced Aug 5, 2026
This was referenced Aug 7, 2026
nsidnev added a commit that referenced this pull request Aug 7, 2026
Release Packages

vercel-internal-core
--------------------

0.1.2 - 2026-08-07
------------------

Internal
--------

- Key session service options by logical service so synchronous and asynchronous variants share configuration safely. (#242)
- Absorb `typeutils` from `vercel-queue`: the annotation predicates and runtime forward-reference resolution now live in `vercel._internal.core.typeutils`, where more than one package can reach them. (#261)

vercel-oidc
-----------

0.8.0 - 2026-08-07
------------------

Features
--------

- Add OIDC token signature verification. `vercel.oidc.verify_vercel_oidc_token` and its async twin `vercel.oidc.aio.verify_vercel_oidc_token` verify a Vercel OIDC token against the JWKS at `oidc.vercel.com`, pinning the issuer, requiring RS256, and checking the project, environment, owner, and audience claims. `vercel.oidc.extract_bearer_token` reads the credential out of request headers. Verification fails closed: when the expected project or environment cannot be resolved from the arguments or the environment, every token is rejected. (#205)
- Claims are compared for equality only. There is no project wildcard: `"*"` is an ordinary string, so a token cannot widen its own scope to every project in a team. (#205)
- The issuer is pinned to Vercel's OIDC service and is not configurable. Both the root issuer `https://oidc.vercel.com` and the team-scoped `https://oidc.vercel.com/<team>` are accepted, since Vercel mints both and one global key signs them; the JWKS URL is a constant, so a token can never influence where signing keys come from. (#205)
- `vercel.oidc.resolve_vercel_oidc_token_identity`, and its async twin, return an opaque, stable identity for a token. A token is a signature over an identity plus an expiry, so one identity is issued many tokens over time; this is what to key identity-scoped client state on. The signature, issuer and expiry are verified before anything is read, but no claim is checked and none is returned, so it is not an authorization check. (#205)
- This requires the new `verify` extra, which pulls in `pyjwt[crypto]`: (#205)
- pip install "vercel-oidc[verify]" (#205)
- The extra keeps `cryptography` off installs that do not verify tokens. (#205)

Bug Fixes
---------

- Record JWKS refetch outcomes before allowing another caller to fetch, avoiding duplicate requests under concurrency. (#242)

vercel-connect
--------------

0.1.0 - 2026-08-07
------------------

Features
--------

- Add `vercel.connect`, a Python SDK for Vercel Connect: short-lived third-party credentials brokered through the deployment's Vercel OIDC identity, with token caching, authorization flows, connector metadata, and inbound trigger verification. (#205)

vercel-internal-telemetry
-------------------------

0.7.2 - 2026-08-07
------------------

- Update dependencies.

vercel-queue
------------

0.7.3 - 2026-08-07
------------------

Internal
--------

- Take `typeutils` from `vercel._internal.core` rather than carrying a private copy. Adds a dependency on `vercel-internal-core`. (#261)

vercel-sandbox
--------------

0.4.0 - 2026-08-07
------------------

Breaking Changes
----------------

- Require synchronous credential factories when configuring `vercel.sandbox.sync`; use asynchronous factories only with the async Sandbox API. (#242)
- Replace the legacy `runtime` selector with `image` when creating sandboxes. Sandbox creation now uses API v3, defaults to `vercel/sandbox/universal:latest`, and supports custom Vercel Container Registry images. (#252)

Internal
--------

- Run Sandbox examples through the package-owned workspace Poe task. (#234)

vercel-cache
------------

0.7.2 - 2026-08-07
------------------

- Update dependencies.

vercel
------

0.9.0 - 2026-08-07
------------------

Breaking Changes
----------------

- The local workflow world now stores its `.workflow-data` files as JSON in the same format the TypeScript `@workflow/world-local` package uses, instead of CBOR. Runs, steps, hooks and events written by either SDK are now readable by the other. Existing `.workflow-data` directories are not readable in the new format and should be deleted. (#226)
- Workflow payloads now use the devalue wire format of the TypeScript `@workflow/core` package. (#243)
- Workflow steps now ride the `__wkf_workflow_*` queue as a `stepId` on the workflow invoke payload, matching the TypeScript SDK; the separate `__wkf_step_*` queue is gone. (#251)

Features
--------

- Workflow payloads can now carry native `Decimal`, `UUID`, `date`, `time`, `timedelta` and `Path`, and `@serializable` (or `register_serializable()`) is offered for custom classes. (#224)
- Add sync and async clients with typed models for managing project-level routing rules and versions. (#219)

Bug Fixes
---------

- Allow workflows on Python 3.12 and earlier to import `uuid` by safely exposing `platform.system()` while continuing to block host-specific platform inspection. (#242)
- Prevent errors when tasks waiting on steps or hooks are cancelled. (#250)
- The Vercel world now honours `VERCEL_WORKFLOW_SERVER_URL` and `WORKFLOW_VERCEL_BACKEND_URL`, which previously had no effect in Python, so a preview deployment reaches the same workflow-server as its TypeScript peers. (#248)

Internal
--------

- Use a consistent isolated event-loop lifecycle for workflow execution on Python 3.10. (#242)
- Run workflows on a dedicated event loop that advances execution when the loop becomes idle. (#242)
- Avoid invoking the workflow event loop's idle hook after the loop begins stopping. (#242)

vercel-apscheduler
------------------

0.1.0 - 2026-08-07
------------------

Features
--------

- Add the durable Redis driver for running APScheduler schedules through delayed Vercel Queue messages. (#242)
- Add Redis-backed APScheduler subscribers for Vercel Queues. The integration patches `scheduler.start()`, `scheduler.pause()`, and `scheduler.resume()` with durable, deployment-scoped lifecycle transitions and atomic single-chain fencing. Paused occurrences are skipped on resume, and interrupted successor publication is repaired on retry. Production schedules activate on the first request, and opted-in previews stop after a durable idle timeout. Jobs that do not choose a `misfire_grace_time` run their occurrences whenever the wake arrives: the stock one-second grace assumes in-process wakeup precision that queue delivery cannot meet. (#238)
- Add a Vercel Runtime Cache backend and use it by default when Redis is not configured, so schedulers run with zero infrastructure. Jobs stay defined in code; the cache document only coordinates the chain (generation, start and wake bookkeeping, lifecycle flags). Because cache entries are evictable and per-region, the queue messages remain the authority: an evicted document is rebuilt from the arriving wake, idempotency keys still fence duplicate starts, and pause/resume flags additionally ride the start topic. Scheduler identity comes from the builder-assigned subscriber id, with a declared-subscriber lookup for web processes. Under `vercel dev` the backend falls back to a per-process in-memory cache and activates on the first request like production, using a stable deployment id derived from the project directory. (#245)

Bug Fixes
---------

- Fix the Runtime Cache backend to work under `vc dev`. (#253)

vercel-celery
-------------

0.7.3 - 2026-08-07
------------------

- Update dependencies.

vercel-dramatiq
---------------

0.7.2 - 2026-08-07
------------------

- Update dependencies.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants