Update dependency @workflow/world to v5.0.1

[renovate]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
@workflow/world (source)	4.5.0 → 5.0.1
@workflow/world (source)	5.0.0-beta.39 → 5.0.1

---

Release Notes

vercel/workflow (@​workflow/world)

v5.0.1

Compare Source

Patch Changes

• #​3251 b79ad01 Thanks @​TooTallNate! - Add experimental threshold-based VM-memory snapshotting to the QuickJS engine via WORKFLOW_SNAPSHOT_THRESHOLD (or per-run executionContext.snapshotThreshold). Once the configured number of events has been processed since the last snapshot, suspensions persist a compressed, encrypted VM snapshot, which is later used for resumption. Runs without an encryption key are only snapshotted with WORKFLOW_SNAPSHOT_ALLOW_UNENCRYPTED=1

• #​3250 2084d35 Thanks @​TooTallNate! - Add an optional, experimental experimental_snapshots storage interface for the QuickJS engine's VM-memory snapshotting (save/load/delete plus SnapshotMetadata, and encodeSnapshotEnvelope/decodeSnapshotEnvelope.

v5.0.0

Major Changes

• #​1293 66d49c0 Thanks @​VaguelySerious! - BREAKING CHANGE: Restructure stream methods on World interface to use world.streams.* namespace with runId as the first parameter. writeToStream(name, runId, chunk) → streams.write(runId, name, chunk), writeToStreamMulti → streams.writeMulti, closeStream → streams.close, readFromStream → streams.get(runId, name, startIndex?), listStreamsByRunId → streams.list(runId).

• #​3280 de1905f Thanks @​VaguelySerious! - Breaking: events.listByCorrelationId and analytics.events.listByCorrelationId now require a runId. A correlation id is unique within its run, not across runs, so an unscoped lookup answered with one event per run that numbered a step or wait the same.

• #​1217 e55c636 Thanks @​pranaygp! - Initial v5 beta release

• #​3550 d62b444 Thanks @​NathanColosimo! - Keep schema-only World modules out of workflow VM bundles, prevent unknown attribute deletions from offsetting new keys, and safely ignore prototype-like event type names.

• #​3061 62d570e Thanks @​NathanColosimo! - Remove legacy step queue topics and payloads now that queued steps use the workflow topic and combined flow handler.

• #​1851 5f22832 Thanks @​TooTallNate! - BREAKING CHANGE: Run and step errors are now serialized through the workflow serialization pipeline, preserving original class identity and cause chains on WorkflowRunFailedError.cause. Pre-upgrade failed runs in the world-postgres legacy error text column surface as error: undefined on read; the original payload is still readable directly from the errorJson column for manual inspection.

• #​1293 66d49c0 Thanks @​VaguelySerious! - Require runId argument for world.steps.get.

Minor Changes

• #​2903 f2be954 Thanks @​karthikscale3! - Add analytics.attributes.list() for attribute key discovery, and an attributes key=value filter to analytics.runs.list().

• #​3943 fbfb9fe Thanks @​karthikscale3! - Validate world.analytics arguments up front: an invalid id, an out-of-range page limit, an oversized attribute filter, or a half-open startTime/endTime window now throws a WorkflowWorldError with code: 'INVALID_ARGUMENT' and field set to the offending parameter, instead of failing the request. The message names the method, the parameter, and what it received. Adds ANALYTICS_RUN_SCOPED_PAGE_LIMIT, ANALYTICS_PAGE_LIMIT and ANALYTICS_MAX_ATTRIBUTE_FILTERS.

  Deprecate analytics.events.listByCorrelationId() in favour of analytics.events.list({ runId, correlationId }).

  Fix analytics.attributes.list() timestamps being shifted by the local UTC offset.

• #​3390 600b096 Thanks @​alangenfeld! - Add a bounded batch analytics event lookup for enriching canonical event pages.

• #​2915 7d29bab Thanks @​joeyhotz! - Add runs.getMany() for retrieving ordered workflow run snapshots in one storage operation.

• #​2850 f28150c Thanks @​karthikscale3! - Report step progress alongside step-to-step overhead latency telemetry.

• #​3347 8d47928 Thanks @​karthikscale3! - Add a bulk run cancellation primitive. @workflow/world defines the BulkCancelWorkflowRuns* contract and an optional runs.cancelMany; @workflow/world-vercel implements it via a single POST /v4/runs/cancel; @workflow/core adds a cancelRuns helper that uses cancelMany when available and falls back to bounded-concurrency single-run cancellation.

• #​2790 145835b Thanks @​NathanColosimo! - Centralize workflow event type classifiers and event-data payload field helpers.

• #​3186 4a9d26b Thanks @​alangenfeld! - Record the compute instance that ran each step attempt: CreateEventParams.computeInstanceId is stamped on step_started writes, forwarded in the world-vercel v4 frame meta alongside vercelId, read back on AnalyticsEvent / AnalyticsStep, and surfaced as "Compute Instance ID" in the observability attribute panel.

• #​2062 20e8440 Thanks @​pranaygp! - Add experimental dynamic workflows: start() accepts workflow source as a string, compiles and stores it with the run through the run-payload serialization pipeline, and replays from that stored code. Steps are exposed to the source through an explicit experimental_dynamic.steps map, which is not a security boundary: dynamic source runs with the deployment's full privileges. Off by default; a deployment opts in with WORKFLOW_EXPERIMENTAL_DYNAMIC_WORKFLOWS=1, and dynamic runs can only start on the current deployment.

• #​3095 b4ba79e Thanks @​TooTallNate! - Persist and transport the new optional encryptionPublicKey field on workflow runs, carried on run_created (and run_started for resilient start).

• #​3099 a86035f Thanks @​TooTallNate! - The cross-deployment capability probe now returns the target run's public key, letting start() seal workflow arguments without a separate key-lookup request.

• #​3145 1471f25 Thanks @​VaguelySerious! - Strengthen the event-creation precondition guard: replay-context writes now also send the number of loaded events, so a snapshot that is missing an event is rejected instead of committing a divergent event log, and a rejection restarts the replay in-process (consuming the events a world may attach to the rejection) rather than re-committing the rejected payload or re-invoking over the queue. @workflow/world-local and @workflow/world-postgres do not implement the check.

• #​2266 a00d169 Thanks @​VaguelySerious! - Add an opt-in optimistic-concurrency guard for event creation (WORKFLOW_PRECONDITION_GUARD=1): replay-context event creations send a stateUpdatedAt snapshot timestamp, and the runtime reloads the event log and retries (then falls back to a queue re-invocation) when the backend reports a newer out-of-band event with a 412 PreconditionFailedError.

• #​2960 79e4c04 Thanks @​alangenfeld! - Re-route a queue delivery that reaches a deployment other than the one its run is pinned to, retry transient publishing failures through normal queue redelivery, and fail the run with the new DEPLOYMENT_MISMATCH error code once the recovery budget is spent.

• #​2394 5f0b845 Thanks @​pranaygp! - Bump SPEC_VERSION_CURRENT to 5 (SPEC_VERSION_SUPPORTS_COMPRESSION): runs at spec 5+ may contain gzip-compressed payloads, and older SDKs reject them via requiresNewerWorld() instead of failing on individual payloads.

• #​4193 4f52438 Thanks @​pranaygp! - Add createHook({ experimental_force: true }) option, which takes a hook token over from the run that currently holds it instead of rejecting with HookConflictError. Previous runs awaiting the hook are rejected with HookForceClaimedError naming the run that took the token. See experimental_force docs for details.

• #​2865 a5e6f11 Thanks @​NathanColosimo! - Add experimental_minRetention for keeping a Hook token unavailable after its run ends, and require supporting Worlds to advertise the hookRetention capability.

• #​3345 9c1b3c8 Thanks @​karthikscale3! - Initialize lazy hook resume replay from the hook_received write via the new advisory preloadEvents param, skipping run_started and the initial events.list; safe fallback otherwise.

• #​3230 31f92df Thanks @​karthikscale3! - Lazy hook resumption: on a fast path, resumeHook() writes the hook_received event and dispatches the workflow queue message concurrently instead of sequentially, cutting a round trip off resume latency. A (runId, resumeId) dedup constraint keeps the two writers converging on exactly one event; the runtime falls back to the sequential path when dedup support is unavailable or when WORKFLOW_DISABLE_LAZY_HOOK_RESUME=1. resumeHook() resolves to a ResumedHook (a Hook plus an optional resilientResume: true flag, set only when the direct write failed transiently and the resume was recovered via the queue consumer's re-ensure) — preserving the contract introduced alongside the resilient-resume work.

• #​3374 439a495 Thanks @​karthikscale3! - Carry the run's pinned deployment on lazy resume messages so misrouted deliveries re-route before the hook_received write.

• #​2866 e6f1b6f Thanks @​NathanColosimo! - Keep Hook tokens reserved through their configured minimum retention.

• #​3787 61fb1f9 Thanks @​VaguelySerious! - Add an experimental_retention option to start(): experimental_retention: 0 asks the World to delete the run's user data as soon as the run completes or fails, while keeping the run itself listable. Implemented on the Vercel, Postgres and Local Worlds. Reading a run whose data has expired now throws RunExpiredError instead of resolving to a placeholder.

• #​2226 ae8d6fe Thanks @​pranaygp! - Allow passing initial run attributes through start(), and speed up workflow-level setAttribute calls by using native events for recording attributes.

• #​3461 04e060a Thanks @​VaguelySerious! - Add WORKFLOW_NODE_HTTP to run the Vercel and Local World HTTP layers on Node's built-in node:http and node:https modules instead of their usual HTTP client library.

• #​2833 3f69666 Thanks @​VaguelySerious! - Report time-to-first-step and step-to-step overhead latency telemetry on step completion events.

• #​2305 4670c4b Thanks @​willsather! - Add an optional namespace parameter that scopes queue topic prefixes to __{namespace}_wkf_workflow_*. This allows configuring multiple frameworks in the same deployment without queue topic collision.

• #​2234 f76377b Thanks @​karthikscale3! - Add an optional metadata-only world.analytics namespace for observability reads (runs, steps, events, hooks, waits). Implemented by @workflow/world-vercel; payload-bearing fields remain on the canonical runtime storage APIs.

• #​1834 438eaa6 Thanks @​TooTallNate! - Make resumeHook() resilient to transient hook_received event write failures (429/5xx) by carrying the payload on the queue message for the runtime to materialize. Returned Hook gets a new resilientResume: true flag when this fallback path is taken.

• #​3365 7683130 Thanks @​TooTallNate! - Resilient step dispatch: newly created steps are published to the queue in parallel with their step_created event write, with the serialized input carried on the message (stepInput) so the consumer re-ensures the event if the direct write failed transiently — mirroring resilient start (runInput) and resilient hook resume (hookInput). Worlds that enforce the precondition guard keep the sequential create-then-publish dispatch (only sequencing gives the message a happens-after edge over the create's guard verdict); step-dispatch idempotency keys are now step-identity-scoped. Disable via WORKFLOW_RESILIENT_STEP_DISPATCH=0.

• #​2929 1933e29 Thanks @​VaguelySerious! - Report run-started-to-first-step (rsfs) and final-scheduling-replay (finalSchedulingReplay) latency telemetry on step completion events.

• #​3570 9454d51 Thanks @​pranaygp! - Add world.runs.waitForTerminalStatus(runId, { timeoutMs, signal, resolveData }) method, which long-polls until the run reaches a terminal status. await run.returnValue now internally uses this, if the World supports it, instead of using a polling interval.

• #​3707 79e7436 Thanks @​unusdon! - Allow runs.list({ status }) to accept an array of statuses so callers can easily express set filters (e.g. non-terminal runs). world-vercel does not yet support the array form and throws a clear INVALID_ARGUMENT error instead of a broken request.

• #​3634 7b79ba3 Thanks @​pranaygp! - New runs are created with the sealed-log event identity (specVersion 7). A sealed-log run's event positions are assigned by the backend before each write commits, so concurrent writers never contend for a position. A position whose writer dies is closed by the backend with a noop event; replay steps over those without delivering them or advancing the deterministic clock. Set WORKFLOW_SEALED_LOG=0 to put a deployment back on the previous scheme. Every runtime reads sealed logs either way, and a run's version is fixed at creation, so the setting only affects new runs.

• #​4168 97dccc9 Thanks @​shalabhc! - Add an optional invoke method and capability to the World interface. It routes a payload to the runner handling the specified runId and returns a promise for its response. In world-postgres, this uses a regular queue roundtrip with a run-scoped queue. The runtime uses invoke when available, initially to resume hooks.

• #​2385 628795a Thanks @​pranaygp! - Add an allowReservedAttributes option to start() so framework-level callers can seed reserved $-prefixed run attributes at creation, matching the existing experimental_setAttributes option. The flag is carried through the resilient-start queue input so lazy run creation validates identically.

• #​3457 03455a2 Thanks @​TooTallNate! - Carry immutable run identity on step-execution queue messages to skip the blocking runs.get before starting a step, fetching the run row only when continuing into replay. Messages without runContext keep the previous behavior.

• #​2718 cc7f076 Thanks @​VaguelySerious! - Make runtime tuning constants (timeouts, retry counts, stream buffering/reconnect) configurable via WORKFLOW_* environment variables, and forward WORKFLOW_TEST_LIMIT_OVERRIDES to the backend as a request header so a deployment can tighten server-side limits for testing.

• #​4440 ee1a09b Thanks @​karthikscale3! - Add the optional world.telemetry.recordStepExecution hook so Worlds can correlate flow requests with inline-executed workflow steps.

• #​2970 bb773e9 Thanks @​VaguelySerious! - Add an optional capabilities?: WorldCapabilities field to the World interface so implementations can declare backend feature support (preconditionGuard, maxConcurrency) instead of the runtime inferring it from environment variables; the Vercel World declares both.

• #​1981 9da2d76 Thanks @​TooTallNate! - Add optional createRunId(options?) to the World interface and region to QueueOptions. Worlds can now mint custom run IDs (reading whichever start-option fields they recognise) and route messages to a specific region.

• #​3244 ee944d2 Thanks @​pranaygp! - Add an optional World.getEnvironment() hook and an optional environment field on RunInputSchema, so the environment a run was created in can travel with its queue message.

• #​3832 4547e1a Thanks @​alangenfeld! - Add an optional stateful stream writer-session seam with stable writer identity and sequence tracking.

Patch Changes

• #​2899 ac41e7d Thanks @​TooTallNate! - Parse timezone-naive analytics timestamps as UTC so CLI and local web output shows correct times in any timezone.

• #​3849 855e479 Thanks @​VaguelySerious! - Fix runs failing with CORRUPTED_EVENT_LOG after every step had already succeeded, when the event log held two attribute writes under one id.

• #​2134 1e6b1fd Thanks @​VaguelySerious! - Add experimental_setAttributes() workflow-level helper for attaching string key/value metadata to a workflow run, surfaced as run.attributes

• #​3025 b0adb50 Thanks @​pranaygp! - Add world.events.createBatch World API method, which allows writing ordered events in one durable write, returning per-event outcomes. Optional. On by default if implemented by the World. Disable with WORKFLOW_BATCH_TRANSITIONS=0.

• #​3568 37e1d9e Thanks @​pranaygp! - Pre-claim inline steps inside the suspension batch, so a fan-out's inline step bodies start off the batch commit with no per-step claim request

• #​3111 8c12358 Thanks @​NathanColosimo! - Clarify runtime invariants and compression behavior.

• #​2012 9d2a926 Thanks @​pranaygp! - Expose the active run ID on hook token conflict errors.

• #​2038 dc0be50 Thanks @​pranaygp! - Refresh workflow events after completing elapsed waits so concurrent hook events preserve deterministic replay order.

• #​3385 74dbf81 Thanks @​NathanColosimo! - Retry replay timeouts through normal queue redelivery instead of exiting the process, and keep Postgres jobs retryable through Core's terminal delivery limit.

• #​2046 ad71b58 Thanks @​pranaygp! - Report corrupted event logs with a distinct CorruptedEventLogError type and CORRUPTED_EVENT_LOG run error code.

• #​2191 8f68d35 Thanks @​pranaygp! - Fix forwarded writable stream encryption when child workflows execute on a newer deployment than their parent.

• #​4021 ec57aff Thanks @​VaguelySerious! - When logging corrupt event logs due to replay divergence, specify the divergent events, and carry error message through retries

• #​4096 6cc851c Thanks @​pranaygp! - Stop sending a slot snapshot (eventCount) on step executor writes, so a World no longer reads and returns a skipped-slot event page that the executor only discards.

• #​3519 dc85865 Thanks @​VaguelySerious! - Remove the preconditionGuard World capability. A stale replay-context write no longer needs to be rejected: a reader holds a prefix of the log, replay is deterministic on a prefix, and the writer's next write reports the events it was pushed past.

• #​3381 efbc408 Thanks @​VaguelySerious! - Ignore duplicate events that a concurrent replay wrote for an entity the event log already records, instead of failing the run with a corrupted event log

• #​3497 1321570 Thanks @​VaguelySerious! - Log ignored duplicate events at debug instead of info/error, so a straggler no longer prints on every replay of the run.

• #​3841 2668e33 Thanks @​karthikscale3! - Make resumeHook() durable before it resolves: the hook_received event is
  written durably first, and the workflow wake is published only after the write
  is acknowledged. A disposal racing the queue delivery can no longer lose a
  resume the caller was told succeeded. The wake message is unchanged, so no
  consumer or backend coordination is needed; WORKFLOW_DISABLE_LAZY_HOOK_RESUME
  is now a no-op and the internal resumeHookDurable() alias is removed.

  Behavior changes: a resume against an ended run now throws HookNotFoundError
  instead of resolving (the lazy path never observed the server's rejection, so a
  late webhook delivery to a finished run answered 202 where it now answers 404).
  A transient write conflict (HTTP 409, e.g. an event-slot conflict under
  contention) is no longer re-keyed to HookNotFoundError: it surfaces as a
  retryable error, since its transaction committed nothing.

• #​4478 9d72807 Thanks @​VaguelySerious! - Worlds declare dynamic workflow support with capabilities.dynamicWorkflowCode, replacing getBackendCapabilities()

• #​2986 fe12b84 Thanks @​shalabhc! - Enforce a server-supplied per-run event limit (default 25K)

• #​3382 a8db185 Thanks @​VaguelySerious! - Fold new events returned by events.create into the replay log so a completed wait no longer needs a follow-up events.list round trip

• #​1658 a5c90ce Thanks @​VaguelySerious! - Fix community world E2E tests by adding specVersion to the World interface so start() uses the safe baseline (v2) for worlds that don't declare their supported version

• #​2888 7a1ea5a Thanks @​ctgowrie! - Use the active queue namespace when re-enqueuing workflow runs during world startup recovery.

• #​1939 5374148 Thanks @​TooTallNate! - Fix compatibility with Zod 4.4.x in WorkflowRunSchema by marking output, error, and completedAt as .optional() on non-final / cancelled / completed / failed run states.

• #​2030 b124365 Thanks @​pranaygp! - Validate step, wait, and hook lifecycle events against replay ownership metadata.

• #​3938 7cc5c88 Thanks @​pranaygp! - Answer the sinceCursor event-log delta on a hook_conflict write the same way as on hook_created.

• #​3125 d24c91c Thanks @​karthikscale3! - Hooks can carry an optional resumeContext; when present, resumeHook/resumeWebhook resume from it directly instead of fetching the full run, saving a round trip per resume. When the context also carries the run's encryptionPublicKey, the resume seals its payload (encp) directly to that key, so a default webhook resume needs neither a run read nor a run-key lookup. These two optimizations fall back independently: it fetches the full run when the context is absent, and uses symmetric encryption when no usable public key is available.

• #​3437 a0ccfe0 Thanks @​karthikscale3! - Add OTEL telemetry for hook-triggered time-to-resume: workflow.resume.total_ms plus a non-overlapping phase breakdown, on the first durable step after a resume.

• #​2475 2074f91 Thanks @​pranaygp! - Skip the per-step incremental events.list round-trip in the inline sequential loop by consuming an event-log delta returned from the step's terminal write (gated to the single-step case with no open hooks or waits).

  Add the opt-in CreateEventParams.sinceCursor contract so a step-terminal events.create can return the event-log delta since that cursor (via EventResult.events/cursor/hasMore).

  Return the inline delta from a step-terminal write when sinceCursor is supplied, computed identically to events.list so the consumed prefix cannot skew from the server log.

  Forward sinceCursor over the v4 wire in @workflow/world-vercel so the server can return the delta on a step-terminal response; older servers ignore it and the runtime falls back to events.list.

• #​2848 6603628 Thanks @​VaguelySerious! - Fix duplicate inline step execution when a hook or wait wakes a run while the step is still running (#​2780). The lazy step_started now records the owning queue message ID, and wake replays schedule a delayed backstop for in-flight inline steps instead of immediately re-dispatching them. Disable with WORKFLOW_INLINE_OWNERSHIP=0.

• #​2896 c31e30c Thanks @​TooTallNate! - Show world-specific run fields (e.g. region on Vercel) in workflow inspect output via the new optional World.describeRun hook.

• #​2478 e7ef9d8 Thanks @​pranaygp! - Lazy inline step start: the owned-inline runtime path now sends a single step_started carrying the step input, letting the world create the step on the fly and saving one round-trip per inline step.

  @workflow/world: step_started event data accepts an optional input, and EventResult gains a stepCreated ownership signal.

  @workflow/world-local: step_started with input atomically creates the step plus a synthetic step_created event; a lazy step_started for an already-existing step throws EntityConflictError so concurrent losers skip (exactly-once).

  @workflow/world-postgres: same lazy-create + exactly-once create-claim for the Postgres backend.

  @workflow/world-vercel: sends the step input on step_started over the v4 wire and threads the server's stepCreated signal into EventResult.

• #​3794 d9e0777 Thanks @​VaguelySerious! - Document that hookInput and the (runId, resumeId) dedup contract now cover repeated deliveries of one resume rather than a producer/consumer race, and accept lazy as a hook-resume strategy.

• #​3914 4a18b01 Thanks @​shalabhc! - Accept lazy completed and failed runs whose payload is represented by a remote reference.

• #​3088 fc81f45 Thanks @​karthikscale3! - Stream writes dispatch the first chunk of an idle stream immediately (flush window default 0 instead of 10ms). Fast producers keep full batching via in-flight accumulation; set streamFlushIntervalMs (World option) or WORKFLOW_STREAM_FLUSH_INTERVAL_MS (env, takes precedence) above 0 to opt into a windowed leading edge.

• #​3728 f771585 Thanks @​pranaygp! - Hold process-wide state on globalThis rather than at module scope in the packages that get bundled into the host application's server build, where a bundler compiles one copy of each module per layer. Covers warn-once latches, lazy caches, the VM script and QuickJS asset caches, the dev-server port cache, and step single-flight, whose per-copy map was not actually single-flight. State that is deliberately per-copy is annotated with the reason.

• #​4348 f2daf40 Thanks @​pranaygp! - Added a resolveData: 'skip-step-inputs' option, which directs the World to leave out input from step_created and step_started events. Replay recomputes step arguments by re-running workflow code, and steps take their input from the step_started response or from memory, never from the replay log, so replay now reads the event log with this option and no longer downloads recorded step inputs. For workflows that pass growing state into their steps, this removes the part of the replay transfer that grows quadratically. A World that doesn't implement the option must treat it as 'all'.

• #​1979 62ec537 Thanks @​adamiBs! - Make run.input and step.input .optional() on the World snapshot schemas so consumers no longer fail validation when the service externalizes payloads as RemoteRef blobs.

• #​2511 ab2e9b8 Thanks @​VaguelySerious! - Emit workflowName on per-step events (step_created, step_completed, and lazy-start step_started) so Worlds can access it without additional queries

• #​2946 eb8fdb9 Thanks @​VaguelySerious! - The WORKFLOW_PRECONDITION_GUARD event-creation guard is now on by default; opt out with WORKFLOW_PRECONDITION_GUARD=0.

• #​3548 e9d5c56 Thanks @​NathanColosimo! - Prepare replay payloads as validated event frames arrive, reuse primitive step results across fresh VMs, and preserve replay startup overlap.

• #​3838 e00b1a5 Thanks @​pranaygp! - Publish a fan-out's step-execution messages in one batched queue request instead of one per step, via a new optional Queue.queueBatch implemented on @vercel/queue's experimental_sendBatch.

• #​4082 6c0d510 Thanks @​shalabhc! - Validate complete attribute event data against the World's 8KiB UTF-8 JSON limit before new writes, with catchable SDK errors and unchanged replay of persisted events.

• #​3878 ffc5807 Thanks @​pranaygp! - Stop logging on healthy workflow execution: the breadcrumbs that only described the runtime working correctly now print under DEBUG=workflow:*. Warnings and errors are unchanged.

• #​3542 de2a86c Thanks @​VaguelySerious! - Breaking: New runs are created at spec version 6, and a World that declares an older spec version is now rejected before the first run rather than failing partway through one.

• #​2882 0b956f6 Thanks @​VaguelySerious! - Update doc comments to reference setAttributes (renamed from experimental_setAttributes).

• #​2212 2a3b11b Thanks @​pranaygp! - Retry transient workflow replay divergence before classifying repeated divergence as a corrupted event log.

• #​2013 2a446af Thanks @​TooTallNate! - Exclude inline step execution from the workflow replay timeout. Long-running steps no longer hit REPLAY_TIMEOUT (fixes #​2009). Adds a WORKFLOW_REPLAY_TIMEOUT_MS env var override and a new optional World.processExitTriggersQueueRedelivery capability used to gate the runtime's process.exit(1) failure path.

• #​3208 4017597 Thanks @​alangenfeld! - Report replay-divergence counts on event writes that recover or exhaust replay retries.

• #​3519 dc85865 Thanks @​VaguelySerious! - Require every event id the runtime reads to be a log position. requireEventSlot replaces the lenient decode that returned "no position" for an id that is not a slot.

• #​2840 712ed61 Thanks @​VaguelySerious! - Add an optional reason to run cancellation (run.cancel({ cancelReason })), recorded on the cancellation event and shown in the run detail view.

• #​2580 25c3df7 Thanks @​karthikscale3! - Send optional client-side event occurrence timestamps through world event creation.

• #​3389 6786db9 Thanks @​VaguelySerious! - Breaking: SpecVersion 6: Event IDs are now a dense per-run slot number, allocated by the world at publish time so a rejected write leaves no gap in the event log. A replay tells the world how many events it had read and gets back the ones it did not see, so an event that arrives from outside the replay and lands ahead of an event the replay wrote no longer fails the run with CORRUPTED_EVENT_LOG: it is held for whichever part of the workflow awaits it. A gap in the numbering fails the run instead of being replayed over.

• #​3519 dc85865 Thanks @​VaguelySerious! - Slot-numbered event ids are a requirement of the World contract, not a capability. The slotEventIds flag is gone, and the conformance suite now fails a World whose event ids are not positions.

• #​3479 b589460 Thanks @​VaguelySerious! - Replay-context event writes now always report the log position they replayed from, and the WORKFLOW_PRECONDITION_GUARD flag is removed.

• #​4366 54b48ef Thanks @​VaguelySerious! - Classify each spec version as capability-only or structural (CAPABILITY_ONLY_SPEC_VERSIONS, STRUCTURAL_SPEC_VERSIONS, crossesStructuralSpecVersion), so a backend raising a run to its executor's version knows which moves need a fresh log

• #​2153 6b8efd5 Thanks @​rchasman! - Record cross-run lineage when start() is called from inside a workflow or step: the new run is tagged with $parentRunId (its direct parent) and inherits the parent's $rootRunId, so a daisy chain or fan-out of any depth groups under one root id.

• #​3205 22349e9 Thanks @​NathanColosimo! - Load replay-event suffixes through one World request.

• #​2569 d108ba3 Thanks @​VaguelySerious! - Turbo mode now tells world-vercel to skip the run_started event-log preload it never reads, reducing request time.

• #​3124 65139ac Thanks @​NathanColosimo! - Infer required run and step entities, including their start times, from
  events.create request types.

• #​3901 5c4eef0 Thanks @​NathanColosimo! - Upgrade repository tooling and CI from pnpm 10 to pnpm 11.

• #​1338 8ea1532 Thanks @​VaguelySerious! - Merge flow and step routes into a single combined handler that executes steps inline when possible, reducing function invocations and queue overhead.

• #​3743 bf9de1c Thanks @​VaguelySerious! - A wait-continuation delivered before its wait elapses now re-arms under a fresh idempotency key instead of losing the wait's timer. Previously the re-enqueue reused a key the early delivery had already spent, so the world's dedupe window dropped it and the run slept indefinitely with nothing scheduled to wake it.

• #​1799 503a929 Thanks @​TooTallNate! - Use inline sourcemaps for all workspace packages; published packages no longer ship external .js.map files.

• #​2812 fe327e6 Thanks [@​karthikscale3](https://redirect.github.com/k

❗ Important

✂ PR body was truncated to here.

---

Configuration

📅 Schedule: (in timezone Europe/Rome)

• Branch creation
  • Between 12:00 AM and 06:59 AM, only on Sunday and Saturday (* 0-6 * * 6,0)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.