Workflow Development Kit Updates & Release Notes

@workflow/core@5.1.0

• #4578 941e031 @wycats - Export the existing Serializable type from @workflow/core and workflow.
• #4595 09bc2f8 @TooTallNate - Remove the unused, stale vm-serde-bundle.generated.ts left over from the retired in-VM QuickJS serializer.
• #4667 a7cc482 @alangenfeld - Wait for run creation before writing to writable streams passed as arguments to turbo steps.
• #4496 8fa7584 @alangenfeld - Mark step_failed writes that record a failed step body with afterStepBody, so a World can keep waiting out a throttled write instead of re-running the body. …

@workflow/core@4.8.12

• #4213 69a4b76 @VaguelySerious - Fix an issue with the workflow's deterministic clock tracking advancement on consumption, not on write, which could lead to a determinism issue when concurrent replays called Date.now with different amounts of events read from the log
• #4215 8b3bb55 @gaojude - Order hook registration and conflict settlements with earlier workflow deliveries so replay preserves concurrent step correlation IDs.

@workflow/world-postgres@4.3.9

• #4219 50e8b41 @AndrewBarba - Allow same-run queue wakes to reach a workflow while an inline step is pending, so hook-driven cancellation and steering do not wait for the step to finish. …

@workflow/core@5.0.1

• #4531 14dbfdc @alangenfeld - Dynamic start() refusals (opt-in, validation, same-deployment, World capability, execution-context budget) are now fatal, so a start() inside a step fails fast instead of retrying.
• #4530 1fcf4bb @alangenfeld - Dynamic start() now publishes the run only after run_created confirms its code was stored, so a refused or failed create can no longer leave an executing run behind.
• #4534 0147fa5 @alangenfeld - Dynamic start() validation: cap exportName at 64 characters, detect "use step" only as a real directive, and name non-async, generator, and duplicate workflow declarations.
• #4328 0e64f7b @VaguelySerious - Stop re-executing a running lazy or pre-claimed inline step when its message is redelivered. …

@workflow/world-vercel@4.7.6

• #4557 3c033a9 @SandboxRD - Fix createQueueDispatcher() and createEventsDispatcher() crashing under Bun with compose is not a function. Bun resolves undici to its built-in module, whose dispatchers can't compose interceptors and are ignored by Bun's fetch, so the plain dispatcher is used instead.
• #4275 b5a78f8 @alangenfeld - Honor server-provided Retry-After delays when scheduling queue redeliveries.

@workflow/builders@4.1.16

• #3954 08b4420 @withkarann - Fix directive discovery missing "use step" and "use workflow" when a backtick appears earlier in a comment or regex literal
• #4537 6bb5224 @VaguelySerious - Keep JSON import attributes in generated bundles, and stop bundling the builder's own serde checker into step and workflow bundles …

@workflow/core@4.8.10

• #4176 e1f712b @pranaygp - Fix an unhandled rejection that could exit the process when the encryption-key lookup for a forwarded writable stream failed (for example a run metadata read that timed out) before anything was written to that stream. The lookup now starts on the first write, and a failure rejects that stream instead.
• #4443 3699c30 @TooTallNate - Serialize a DataView as the bytes it views. It previously fell through to devalue's built-in encoding, which persists the whole backing ArrayBuffer — for a view onto Node's pooled Buffer allocator, unrelated process memory.
• #4422 bc6a97f @TooTallNate - Retry the max-deliveries run_failed/step_failed write and the step handler's workflow re-queue through queue redelivery when they fail transiently (429, 5xx, transport) instead of acking and leaving the run stuck running. …

@workflow/core@5.0.0-beta.58

• #2062 20e8440 @pranaygp - Add experimental dynamic workflows: start() accepts workflow source as a string, compiles and stores it with the run through the run-payload serialization pipeline, and replays from that stored code. Steps are exposed to the source through an explicit experimental_dynamic.steps map, which is not a security boundary: dynamic source runs with the deployment's full privileges. Off by default; a deployment opts in with WORKFLOW_EXPERIMENTAL_DYNAMIC_WORKFLOWS=1, and dynamic runs can only start on the current deployment.
• #4440 ee1a09b @karthikscale3 - Add the optional world.telemetry.recordStepExecution hook so Worlds can correlate flow requests with inline-executed workflow steps.
• #4478 9d72807 @VaguelySerious - Worlds declare dynamic workflow support with capabilities.dynamicWorkflowCode, replacing getBackendCapabilities() …

@workflow/core@5.0.0-beta.57

• #4327 c0aad6d @VaguelySerious - When running start({ deploymentId }) cross-deploy, stamp the new run with the spec version that the target deployment reports on its capability probe, instead of the caller's own
• #4398 ff80d62 @pranaygp - Republish a force-claimed hook's victim wake on every replay within 24 hours of the takeover instead of only while the forced hook_created is the claimer's last own event, ensuring resilience against crashes
• #4415 20aa656 @alangenfeld - Stamp events written to another runtime's run (hook_received from resumeHook, run_cancelled from Run.cancel(), and the deployment-mismatch run_failed) with the run's spec version when it is older than the SDK's. …

@workflow/core@5.0.0-beta.56

• #4193 4f52438 @pranaygp - Add createHook({ experimental_force: true }) option, which takes a hook token over from the run that currently holds it instead of rejecting with HookConflictError. Previous runs awaiting the hook are rejected with HookForceClaimedError naming the run that took the token. See experimental_force docs for details.
• #4124 873b70b @VaguelySerious - A pending sleep() that cannot fire during the current invocation (for example one that lost a Promise.race() against a hook) no longer costs an extra event-log read per step boundary. The window follows the invocation's inline budget plus WORKFLOW_OPEN_WAIT_CLOCK_SKEW_MS; a wait completed early via run.wakeUp() is picked up by a read before the run parks on it.

@workflow/world@5.0.0-beta.38 …

@workflow/core@5.0.0-beta.55

• #4266 101d347 @AndrewBarba - Stop warning about expected overlapping inline step executions in the QuickJS runtime, debug log instead

@workflow/world-vercel@5.0.0-beta.50

• #4275 39f1d5c @alangenfeld - Honor server-provided Retry-After delays when scheduling queue redeliveries.

@workflow/core@5.0.0-beta.54

• #4168 97dccc9 @shalabhc - Add an optional invoke method and capability to the World interface. It routes a payload to the runner handling the specified runId and returns a promise for its response. In world-postgres, this uses a regular queue roundtrip with a run-scoped queue. The runtime uses invoke when available, initially to resume hooks.
• #3678 20ad2b3 @TooTallNate - Add registerLifecycleHooks from workflow/api for best-effort completion and failure reporting with a read-free workflow name, lazy Run instance, and failure cause hydrated from the persisted payload. Run metadata getters avoid resolving input/output payloads.
• #4213 d3ea4a6 @VaguelySerious - Fix an issue with the workflow's deterministic clock tracking advancement on consumption, not on write, which could lead to a determinism issue when concurrent replays called Date.now with different amounts of events read from the log …

@workflow/core@5.0.0-beta.53

• #4175 56322af @pranaygp - Fix an unhandled rejection that could exit the process when the encryption-key lookup for a forwarded writable stream failed (for example a run metadata read that timed out) before anything was written to that stream. The lookup now starts on the first write, and a failure rejects that stream instead.
• #4179 5dbbcf9 @karthikscale3 - Route unrecognized backend connection and stream failures through existing retry policies, preserving event-write retries and rebuilding shared event connections after repeated HTTP/2 failures. Keep invalid request headers and caller cancellations out of event-write retries. Include error cause chains in run-failure logs to expose underlying socket, DNS, and TLS failures.

@workflow/world-postgres@5.0.0-beta.44 …

@workflow/core@4.8.9

• #3882 b7385f0 @ctgowrie - Stop framed stream reconnects after the consumer cancels, including while completion checks or reconnect acquisition are still pending.
• #3843 284d7c0 @Rich-Harris - Bump devalue to 5.9.2 to address published security advisory.
• #4070 a158f81 @torsello - Allow parentheses and square brackets in workflow names

@workflow/world-postgres@4.3.7

• #4111 f72c6a6 @komly - Fix run creation and slot allocation not happening transactionally …

@workflow/core@5.0.0-beta.52

• #4145 37f1011 @pranaygp - Render the errorStack field as the log body when the message carries no stack of its own, so the run-failure log shows the stack instead of discarding it.
• #4070 d427c47 @torsello - Allow parentheses and square brackets in workflow names, so workflows can live in Next.js route groups (app/(dashboard)/…) and dynamic segments (app/[teamId]/…).

@workflow/world@5.0.0-beta.36

• #3707 79e7436 @unusdon - Allow runs.list({ status }) to accept an array of statuses so callers can easily express set filters (e.g. non-terminal runs). world-vercel does not yet support the array form and throws a clear INVALID_ARGUMENT error instead of a broken request.

@workflow/world-local@5.0.0-beta.45 …

@workflow/core@5.0.0-beta.51

• #3457 03455a2 @TooTallNate - Carry immutable run identity on step-execution queue messages to skip the blocking runs.get before starting a step, fetching the run row only when continuing into replay. Messages without runContext keep the previous behavior.
• #4098 fb9e275 @pranaygp - Commit the batched fan-out's pre-claimed inline [step_created, step_started] pairs in their own leading chunk, ahead of the plain step/wait creates, so the write that gates the inline bodies stays small and commits faster. The pairs now fold only with two or more inline steps (a lone inline step keeps the lazy start), and a lone plain create beside them takes the single write.
• #4099 788d4fb @pranaygp - Skip re-publishing a pending step's execution message on a later replay pass when this same invocation already published it (a fresh delivery still re-enqueues unconditionally). …

@workflow/world-vercel@4.7.4

• #4044 4607916 @VaguelySerious - Honor WORKFLOW_NODE_HTTP on the queue client's transport, so a deployment whose bundled undici is unusable can still acknowledge queue messages instead of redelivering them until the invocation is killed.
• #4049 5f2fb36 @VaguelySerious - Give the queue client its own connection pool and a total per-request deadline, so a stalled queue acknowledgement fails fast instead of holding the invocation until the platform kills it.

@workflow/world-local@4.4.1

• #3824 41abe2d @AndrewBarba - Abort active local queue deliveries when the World closes, including when transport timeouts are disabled.

@workflow/world-vercel@4.7.2

• #4041 0deceda @karthikscale3 - Recycle the events HTTP/2 connection pool when a streamed response body fails after its headers arrive.
• #3844 7024b5b @VaguelySerious - Authenticate deploymentId: "latest" with the deployment's own OIDC identity instead of an ambient VERCEL_TOKEN, and scope the request to the configured team, fixing spurious 404s when resolving the latest deployment

@workflow/web-shared@4.1.22

• #3906 bf5cd3a @karthikscale3 - Prevent event payload flicker during decryption.

@workflow/swc-plugin@4.1.3 …

@workflow/core@5.0.0-beta.49

• #3787 61fb1f9 @VaguelySerious - Add an experimental_retention option to start(): experimental_retention: 0 asks the World to delete the run's user data as soon as the run completes or fails, while keeping the run itself listable. Implemented on the Vercel, Postgres and Local Worlds. Reading a run whose data has expired now throws RunExpiredError instead of resolving to a placeholder.
• #3972 c340820 @alangenfeld - Add Run#getWritable() and run.writable to append to an existing run's stream.
• #3832 4547e1a @alangenfeld - Add an optional stateful stream writer-session seam with stable writer identity and sequence tracking.

@workflow/world@5.0.0-beta.34 …

@workflow/core@5.0.0-beta.47

• #3849 855e479 @VaguelySerious - Fix runs failing with CORRUPTED_EVENT_LOG after every step had already succeeded, when the event log held two attribute writes under one id.
• #3841 2668e33 @karthikscale3 - Make resumeHook() durable before it resolves: the hook_received event is written durably first, and the workflow wake is published only after the write is acknowledged. A disposal racing the queue delivery can no longer lose a resume the caller was told succeeded. The wake message is unchanged, so no consumer or backend coordination is needed; WORKFLOW_DISABLE_LAZY_HOOK_RESUME is now a no-op and the internal resumeHookDurable() alias is removed.
• #3879 07ec212 @NathanColosimo - Keep late-claimed buffered hook payloads from being preempted by workflow suspension in retained VMs. …