workflow@5.0.0-beta.37

@workflow/core@5.0.0-beta.37

• #3128 7959acc @NathanColosimo - BREAKING CHANGE: Remove the deprecated experimental_setAttributes and ExperimentalSetAttributesOptions aliases; use setAttributes and SetAttributesOptions instead.
• #3112 4ada27d @NathanColosimo - Remove deprecated world-specific factory aliases in favor of createWorld.
• #3061 62d570e @NathanColosimo - Remove the retired step route runtime and make queue health checks target the combined flow handler.
• #3045 d813fb8 @NathanColosimo - Deterministic sandbox hardening: crypto.subtle.digest in workflow functions now computes synchronously via node:crypto (byte-identical values, deterministic timing under replay); Atomics.waitAsync, async WebAssembly compilation, WeakRef, and FinalizationRegistry are no longer exposed (wall-clock timing and GC observation cannot be replayed).
• #3098 8a95d36 @TooTallNate - Carry the owning run's public key in forwarded WritableStream descriptors, so a run writing into another run's stream seals frames with no run fetch and no key-API round trip.
• #3146 e8bc7d6 @TooTallNate - Let observability tooling decrypt sealed (encp) payloads: key resolution now yields the run's full key capability, and hydrateDataWithKey dispatches on the envelope format.
• #3094 7a65030 @TooTallNate - Teach the serialization layer to read and write encp sealed envelopes via a PayloadKey union, so a cross-run writer can encrypt with only a public key. Existing symmetric call sites are unaffected.
• #3096 0b1ca15 @TooTallNate - resumeHook() now seals its payload to the target run's published public key when one is present, removing the cross-deployment run-key API round trip from hook resumption. Readers resolve the full key capability so they can open sealed payloads.
• #3095 b4ba79e @TooTallNate - Derive each run's X25519 public key at start() and stamp it on the run, so cross-run writers can seal payloads to the run without fetching its symmetric key.
• #3093 4ba223a @TooTallNate - Add the encp sealed-box encryption primitive: X25519 keypairs derived from the existing per-run key material, letting cross-run writers encrypt with only a public key. Not yet wired into any write path.
• #3099 a86035f @TooTallNate - The cross-deployment capability probe now returns the target run's public key, letting start() seal workflow arguments without a separate key-lookup request.
• #3111 8c12358 @NathanColosimo - Clarify runtime invariants and compression behavior.
• #3155 b8bcded @TooTallNate - Seal forwarded writes to streams taken with getWritable() in a workflow body, which previously fell back to fetching the owner's symmetric key because the workflow VM has no key material to publish on the handle.
• #3125 d24c91c @karthikscale3 - Hooks can carry an optional resumeContext; when present, resumeHook/resumeWebhook resume from it directly instead of fetching the full run, saving a round trip per resume. When the context also carries the run's encryptionPublicKey, the resume seals its payload (encp) directly to that key, so a default webhook resume needs neither a run read nor a run-key lookup. These two optimizations fall back independently: it fetches the full run when the context is absent, and uses symmetric encryption when no usable public key is available.
• #3069 fd05393 @TooTallNate - Fix a false "exceeded max retries" run failure: the retry-ceiling guard counted duplicate step_started events written by invocations racing on the same pending batch as real attempts. The owned-recovery ceiling now counts only the owning message's own starts, and the background-step ceiling counts only bare (queue-delivered) starts.
• #3088 fc81f45 @karthikscale3 - Stream writes dispatch the first chunk of an idle stream immediately (flush window default 0 instead of 10ms). Fast producers keep full batching via in-flight accumulation; set streamFlushIntervalMs (World option) or WORKFLOW_STREAM_FLUSH_INTERVAL_MS (env, takes precedence) above 0 to opt into a windowed leading edge.
• #3131 d7553c4 @NathanColosimo - Avoid rescanning already prewarmed replay payloads during inline replays.
• #3110 5d17c60 @NathanColosimo - Consolidate runtime event merging logic.
• #3139 2941b1c @pranaygp - Deliver step results, wait completions, hook payloads and aborts in strict event-log order relative to one another, preventing replay divergence (CORRUPTED_EVENT_LOG) when a step completion is adjacent in the log to a wait_completed, hook_received or abort that a concurrent branch is awaiting.
• #3078 b610c46 @karthikscale3 - Stream write batching now lives in the server writable itself (group commit), so raw ReadableStreams piped across workflow/step boundaries batch the same as getWritable() instead of sending one request per chunk.

@workflow/cli@5.0.0-beta.37

• #3061 62d570e @NathanColosimo - Remove the standalone step URL API and stale generated route artifacts while keeping step registrations inside the combined flow output.
• #3146 e8bc7d6 @TooTallNate - Let observability tooling decrypt sealed (encp) payloads: key resolution now yields the run's full key capability, and hydrateDataWithKey dispatches on the envelope format.

@workflow/world@5.0.0-beta.23

• #3061 62d570e @NathanColosimo - Remove legacy step queue topics and payloads now that queued steps use the workflow topic and combined flow handler.
• #3095 b4ba79e @TooTallNate - Persist and transport the new optional encryptionPublicKey field on workflow runs, carried on run_created (and run_started for resilient start).
• #3099 a86035f @TooTallNate - The cross-deployment capability probe now returns the target run's public key, letting start() seal workflow arguments without a separate key-lookup request.
• #3111 8c12358 @NathanColosimo - Clarify runtime invariants and compression behavior.
• #3125 d24c91c @karthikscale3 - Hooks can carry an optional resumeContext; when present, resumeHook/resumeWebhook resume from it directly instead of fetching the full run, saving a round trip per resume. When the context also carries the run's encryptionPublicKey, the resume seals its payload (encp) directly to that key, so a default webhook resume needs neither a run read nor a run-key lookup. These two optimizations fall back independently: it fetches the full run when the context is absent, and uses symmetric encryption when no usable public key is available.
• #3088 fc81f45 @karthikscale3 - Stream writes dispatch the first chunk of an idle stream immediately (flush window default 0 instead of 10ms). Fast producers keep full batching via in-flight accumulation; set streamFlushIntervalMs (World option) or WORKFLOW_STREAM_FLUSH_INTERVAL_MS (env, takes precedence) above 0 to opt into a windowed leading edge.

@workflow/world-local@5.0.0-beta.31

• #3112 4ada27d @NathanColosimo - Remove deprecated world-specific factory aliases in favor of createWorld.
• #3061 62d570e @NathanColosimo - Remove legacy step queue topics and payloads now that queued steps use the workflow topic and combined flow handler.
• #3095 b4ba79e @TooTallNate - Persist and transport the new optional encryptionPublicKey field on workflow runs, carried on run_created (and run_started for resilient start).
• #3144 49276f2 @VaguelySerious - Warn when the Local World starts inside a Vercel deployment, and fail with an actionable error instead of a confusing ENOENT when its data directory cannot be created on a read-only filesystem.

@workflow/world-postgres@5.0.0-beta.29

• #3061 62d570e @NathanColosimo - Remove legacy step queue topics and payloads now that queued steps use the workflow topic and combined flow handler.
• #3095 b4ba79e @TooTallNate - Add an encryption_public_key column to workflow_runs (migration 0016) to store each run's X25519 public key.
• #3064 cdb3db4 @joeyhotz - On shutdown, abort stalled workflow and step HTTP deliveries after Graphile Worker's grace period so their Postgres job rows are unlocked through normal failure handling instead of waiting for stale-lock recovery; aborted deliveries still consume an attempt and retry only when budget remains. Add opt-in application-managed shutdown through applicationManagedShutdown or WORKFLOW_POSTGRES_APPLICATION_MANAGED_SHUTDOWN=1 so applications can await world.close() before closing their HTTP server and caller-owned pool.
• #3125 d24c91c @karthikscale3 - Hooks can carry an optional resumeContext; when present, resumeHook/resumeWebhook resume from it directly instead of fetching the full run, saving a round trip per resume. When the context also carries the run's encryptionPublicKey, the resume seals its payload (encp) directly to that key, so a default webhook resume needs neither a run read nor a run-key lookup. These two optimizations fall back independently: it fetches the full run when the context is absent, and uses symmetric encryption when no usable public key is available.

@workflow/world-vercel@5.0.0-beta.33

• #3112 4ada27d @NathanColosimo - Remove deprecated world-specific factory aliases in favor of createWorld.
• #3061 62d570e @NathanColosimo - Remove legacy step queue topics and payloads now that queued steps use the workflow topic and combined flow handler.
• #3095 b4ba79e @TooTallNate - Persist and transport the new optional encryptionPublicKey field on workflow runs, carried on run_created (and run_started for resilient start).
• #3099 a86035f @TooTallNate - The cross-deployment capability probe now returns the target run's public key, letting start() seal workflow arguments without a separate key-lookup request.
• #3111 8c12358 @NathanColosimo - Clarify runtime invariants and compression behavior.
• #3062 313a074 @karthikscale3 - Add WORKFLOW_DISABLE_ANALYTICS_READS=1 to opt the world's analytics read namespace off, forcing workflow inspect list paths onto strongly consistent primary storage. Intended for tests and tooling that read entities immediately after writing them, where the analytics store's asynchronous ingestion can return stale pages.
• #3144 49276f2 @VaguelySerious - Explain how to fix a build targeting the Vercel World that runs outside a Vercel deployment, where VERCEL_DEPLOYMENT_ID is missing.

@workflow/world-testing@5.0.0-beta.37

• #3055 6670e08 @VaguelySerious - Fix flaky Local World tests caused by concurrent test servers sharing one data directory and re-enqueuing each other's in-flight runs on startup
• #3061 62d570e @NathanColosimo - Remove the standalone step URL API and stale generated route artifacts while keeping step registrations inside the combined flow output.

@workflow/web@5.0.0-beta.37

• #3146 e8bc7d6 @TooTallNate - Let observability tooling decrypt sealed (encp) payloads: key resolution now yields the run's full key capability, and hydrateDataWithKey dispatches on the envelope format.
• #3061 62d570e @NathanColosimo - Check only the combined workflow endpoint in the observability health check.

@workflow/web-shared@5.0.0-beta.37

• #3061 62d570e @NathanColosimo - Check only the combined workflow endpoint in the observability health check.
• #3146 e8bc7d6 @TooTallNate - Let observability tooling decrypt sealed (encp) payloads: key resolution now yields the run's full key capability, and hydrateDataWithKey dispatches on the envelope format.
• #3095 b4ba79e @TooTallNate - Hide the run's encryptionPublicKey in the attribute panel — internal encryption plumbing, not user-facing.
• #3125 d24c91c @karthikscale3 - Hooks can carry an optional resumeContext; when present, resumeHook/resumeWebhook resume from it directly instead of fetching the full run, saving a round trip per resume. When the context also carries the run's encryptionPublicKey, the resume seals its payload (encp) directly to that key, so a default webhook resume needs neither a run read nor a run-key lookup. These two optimizations fall back independently: it fetches the full run when the context is absent, and uses symmetric encryption when no usable public key is available.
• #3060 45a56a3 @mitul-s - Animate the new trace viewer's zoom controls consistently with span focus.

@workflow/builders@5.0.0-beta.37

• #3054 cfe7570 @VaguelySerious - Add a discoverWorkflowsInNodeModules option (and WORKFLOW_DISCOVER_NODE_MODULES env var) to stop workflow discovery from descending into node_modules, skipping the cost of scanning third-party dependencies for workflow/step/serde code.
• #3052 b406a04 @copilot-swe-agent - Hoist the shouldFollowImportsFromFile check out of processImportSpecifier so it is computed once per file instead of once per import specifier.
• #3061 62d570e @NathanColosimo - Remove the standalone step URL API and stale generated route artifacts while keeping step registrations inside the combined flow output.

@workflow/next@5.0.0-beta.37

• #3071 f11e9fe @TooTallNate - Update next devDependency to 16.2.11 to address CVE-2026-64641
• #3085 3069b49 @VaguelySerious - Dev watcher now respects .gitignore and a WORKFLOW_DEV_WATCH_IGNORED_PATHS env var, avoiding EMFILE: too many open files on large monorepos.
• #3144 49276f2 @VaguelySerious - Select the Vercel World for builds that target Vercel without a deployment ID, such as vercel build followed by vercel deploy --prebuilt, and apply workflows.local.port whenever the Local World is the target.
• #3061 62d570e @NathanColosimo - Remove the standalone step URL API and stale generated route artifacts while keeping step registrations inside the combined flow output.

@workflow/nitro@5.0.0-beta.37

• #3061 62d570e @NathanColosimo - Remove the standalone step URL API and stale generated route artifacts while keeping step registrations inside the combined flow output.

@workflow/sveltekit@5.0.0-beta.37

• #3166 0d6ec43 @TooTallNate - The generated webhook route now passes the incoming request directly to its handler instead of copying it into a new Request, so the request body is no longer read before the handler runs.

@workflow/astro@5.0.0-beta.37

• #3166 0d6ec43 @TooTallNate - The generated webhook route now passes the incoming request directly to its handler instead of copying it into a new Request, so the request body is no longer read before the handler runs.

@workflow/errors@5.0.0-beta.13

• #3061 62d570e @NathanColosimo - Remove the retired step route runtime and make queue health checks target the combined flow handler.

@workflow/utils@5.0.0-beta.7

• #3061 62d570e @NathanColosimo - Remove the standalone step URL API and stale generated route artifacts while keeping step registrations inside the combined flow output.
• #3144 49276f2 @VaguelySerious - Select the Vercel World for builds that target Vercel without a deployment ID, such as vercel build followed by vercel deploy --prebuilt, and apply workflows.local.port whenever the Local World is the target.