Nathan Rajlich

This commit introduces a **new capability** by polyfilling the **TC39 `Uint8Array` base64 and hex encoding/decoding methods** directly into the **workflow VM context**. This **feature** provides standard-compliant `Uint8Array.prototype.toBase64()`, `Uint8Array.fromBase64()`, `Uint8Array.prototype.toHex()`, and `Uint8Array.fromHex()` methods, simplifying binary data manipulation for workflow developers. The polyfill is integrated into `packages/core/src/vm/index.ts`, includes comprehensive unit tests, and is thoroughly documented in the **Workflow Globals API reference** at `docs/content/docs/api-reference/workflow-globals.mdx`. This enhancement significantly improves developer experience by offering native, efficient encoding utilities within workflows.

This commit **fixes flaky tests** by replacing non-deterministic `setTimeout`-based waits with deterministic `withResolvers` and `vi.waitFor` patterns. This change specifically targets tests for the **`events-consumer`**, **`step`**, and **`sleep`** functionalities within the `packages/core` module. By adopting these more reliable waiting mechanisms, the commit significantly improves the determinism and stability of the test suite, ensuring consistent test results and following an established pattern from a previous fix.

This commit significantly **enhances the SWC playground's performance and developer experience** by **refactoring** its core code transformation logic. The transformation now executes **client-side using WebAssembly (WASM)**, eliminating server round-trips and cold starts for much faster feedback within the `SWC playground` module. Additionally, it integrates **comprehensive Monaco editor type intellisense** for `workflow` packages and Node.js built-ins, providing real-time autocomplete, hover information, and error checking. This dual improvement makes the `SWC playground` more responsive and user-friendly, enabling a smoother, type-aware code editing experience.

This commit introduces a **new documentation page** for **Workflow Globals**, detailing the available VM APIs within workflow functions. This **documentation enhancement** significantly improves the **API Reference documentation** by providing a dedicated resource for understanding the global objects and functions accessible in the workflow execution environment. The new page, `workflow-globals.mdx`, is seamlessly integrated into the documentation structure, with links added from the `api-reference/index.mdx` and `foundations/workflows-and-steps.mdx` pages. Furthermore, a relevant callout in `errors/node-js-module-in-workflow.mdx` is updated to reference this new resource, ensuring developers can easily find information on critical workflow capabilities.

This commit **updates the documentation** by adding a missing card for `workflow/errors` to the **API Reference index** within `docs/content/docs/api-reference/index.mdx`. This change improves the discoverability of the `workflow/errors` section within the **API documentation**, making it easier for users to navigate and find relevant information. It is a **documentation maintenance** task to ensure the API reference is complete and well-indexed, directly addressing a gap in the existing documentation structure.

This commit implements a **security hardening** measure by **removing the `Buffer` global object** from the **workflow VM execution context**. This change, affecting the `packages/core` module, ensures that code running within the VM no longer has direct access to Node.js's `Buffer` API, thereby enhancing the isolation and security of executed workflows. **Tests** in `packages/core/src/vm/index.test.ts` have been updated to verify that `Buffer` is no longer exposed, confirming the successful implementation of this **maintenance** task. The primary impact is a more controlled VM environment, potentially requiring adjustments for any workflows that previously relied on the `Buffer` global.

This commit **corrects a metadata error** within the `.changeset/inline-class-serialization.md` file. It updates the package name reference in the changeset's front matter from the incorrect `@workflow/swc-plugin-workflow` to the proper **`@workflow/swc-plugin`**. This **maintenance chore** ensures that the **release tooling** accurately identifies and attributes changes to the correct package, preventing potential misconfigurations during the release process.

This commit implements a **bug fix** and **refactoring** within the **`swc-plugin-workflow`** to address issues with **class serialization registration** in 3rd-party packages. Previously, the plugin generated an import for `registerSerializationClass` that failed when external packages lacked a direct dependency on `workflow`. The plugin now generates a self-contained IIFE that directly registers classes using `globalThis[Symbol.for('workflow-class-registry')]`, eliminating the problematic module dependency. This change **enables seamless support for serializable classes in external packages** like `@vercel/sandbox` and includes updated fixtures for CJS require patterns, ensuring broader compatibility without breaking existing deserialization logic in `@workflow/core`.

This commit introduces a **refactoring** to the **`@workflow/swc-plugin`** to **fix class serialization registration** for **3rd-party packages**. Previously, the plugin generated an import for `registerSerializationClass` from the `workflow` package, which caused module resolution failures for external packages lacking this direct dependency. Now, the plugin inlines a self-contained Immediately Invoked Function Expression (IIFE) that directly registers classes using a `globalThis` symbol, eliminating external module dependencies. This change ensures **broader compatibility** and **seamless interoperability** for serializable classes defined in independent packages, while maintaining compatibility with the existing deserialization logic in `@workflow/core`.

This commit introduces a **new capability** to the **SWC plugin** (`packages/swc-plugin-workflow`), enabling it to correctly detect custom class serialization methods (`WORKFLOW_SERIALIZE` / `WORKFLOW_DESERIALIZE`) when their symbols are obtained via CommonJS `require()` calls. This enhancement addresses scenarios where ESM code is pre-compiled to CommonJS by tools like TypeScript or esbuild, ensuring that both namespace and destructured `require()` patterns are recognized for proper **class serialization detection**. The change significantly improves the plugin's compatibility and robustness across various build environments, with internal improvements including tightening `is_require_call` and extracting the `track_serialization_bindings` helper.

This commit **introduces comprehensive documentation for end-to-end encryption** within Workflow DevKit and **enhances the "Worlds" system** to display supported features. A new `encryption.mdx` page explains the E2E encryption mechanism, cross-referenced from relevant **Vercel World** and **Observability** documentation. Concurrently, a `features` array is added to `worlds-manifest.json`, allowing specific capabilities like encryption to be declared for each world, which is then **displayed in the `WorldCardSimple` and `WorldDetailHero` UI components**. This **new capability** provides clearer visibility into world features and improves user understanding of security aspects.

This commit **significantly enhances the project's documentation** by adding a comprehensive guide on **custom class serialization** within the workflow system. It provides detailed examples for implementing custom serialization, including patterns for `use step` on instance methods and handling `this` context, alongside new API reference pages for `WORKFLOW_SERIALIZE` and `WORKFLOW_DESERIALIZE`. Concurrently, it **fixes the documentation type-checker** by updating `extractor.ts` to correctly parse `@expect-error` markers in both HTML and MDX comment syntaxes. This work improves developer understanding of advanced serialization patterns and ensures the robustness of documentation type-checking.

This commit **enhances the configuration of workflow functions** by explicitly setting `maxDuration` values within the generated `.vc-config.json`. It configures **step functions** and **webhook functions** to have a `maxDuration` of `"max"`, allowing them to run for the maximum allowed time, while the main **flow route** for workflows is set to a `maxDuration` of `60` seconds to ensure responsiveness. This **feature enhancement** impacts the **Next.js** (eager and deferred) and **SvelteKit** builders, ensuring consistent application of these optimized execution limits across different project types. The change allows for longer-running background tasks while maintaining a responsive primary workflow execution.

This commit **refactors** the implementation of **built-in step functions** such as `json()`, `text()`, and `arrayBuffer()` within the **`@workflow/core`** and **`@workflow/workflow`** packages. It modifies these functions to utilize the `this` context directly, leveraging the `useStep()` proxy's `this` value serialization support, rather than requiring an explicit parameter. This change involves assigning `useStep()` proxies directly to `Request.prototype` and `Response.prototype` using `Object.defineProperties` for non-enumerable methods, and updating the internal built-in function signatures. The **refactoring** streamlines the internal architecture, improves consistency in how core methods are attached and behave, and includes the removal of an unused duplicate builtins file.

This commit delivers a significant **bug fix** and **enhancement** to the **`swc-plugin-workflow`**'s **closure variable detection** and **step function hoisting** mechanisms. It expands the plugin's ability to correctly identify and capture closure variables across a wider range of JavaScript and TypeScript syntax, including `new` expressions, various statement and expression types, nested function/method bodies, class members, and TypeScript expression wrappers. Crucially, it refines **step function hoisting** to preserve original function bodies for direct calls while still registering hoisted copies, and prevents over-capturing by excluding module-level declarations, which improves **Dead Code Elimination**. These changes ensure more accurate and robust workflow transformations, fixing several issues related to variable scope and function execution.

This commit significantly **enhances the documentation** for the `deploymentId: "latest"` option within the **Workflow API's `start()` function**. It adds a new section to the `start.mdx` API reference, providing examples and compatibility notes, and includes a callout in `common-patterns.mdx` to guide users on its application for child workflows. Concurrently, the `@deprecated` tag has been **removed from the JSDoc** for `deploymentId` in `packages/core/src/runtime/start.ts`, officially endorsing this feature and clarifying its usage for **starting workflows** with the latest deployment. This work improves user understanding and promotes the use of a stable, officially supported API pattern.

This commit **refactors** the `trigger-pages` API endpoint within the `workbench/nextjs-webpack` module by changing an aliased import for `allWorkflows` from `_workflows.ts` to a **relative import**. This **bug fix** addresses a specific limitation in `esbuild`'s discovery build process, which struggled to resolve `@/` path aliases when the `tsconfig` did not define a `baseUrl`. By using a relative path, `esbuild` can now correctly trace through `_workflows.ts` to discover all workflow files, ensuring proper build system functionality and compatibility.

This commit **fixes a critical bug** in the **`packages/ai` agent module's `streamTextIterator`** where the **system message was being lost** during `prepareStep` when a `messages` override was also present. The **fix reorders the application of overrides**, ensuring that the `system` message is correctly prepended to the conversation prompt *after* any `messages` override has been applied, thereby preserving essential context. This **enhances the reliability of agent conversations** by preventing unintended loss of system instructions. **Comprehensive new tests** have been added to `stream-text-iterator.test.ts` to validate the correct behavior across various `system` and `messages` interaction scenarios, including multi-step tool calls.

This commit introduces a **performance optimization** and **refactoring** to the **Vercel OIDC token resolution logic** within the `world-vercel` package. It **reorders the token fallback chain** in `fetchRunKey` and `createResolveLatestDeploymentId`, ensuring that `options.token` and `VERCEL_TOKEN` are checked before attempting an OIDC call. This change **skips unnecessary OIDC requests** when a token is already available, thereby **improving reliability and speed** for Vercel operations, particularly in CI/e2e environments where tokens are often pre-configured. The fix prevents potential hangs and wasted network calls, streamlining the token acquisition process.

This commit significantly enhances the **SWC Playground UI** by introducing several **new capabilities** and performing substantial **dependency cleanup**. Users can now customize their workspace with **resizable panels**, organize output with **collapsible views**, and toggle **Vim keybindings** which persist across sessions. The work involved **refactoring** UI components, consolidating `@radix-ui/react-*` packages, and removing numerous unused dependencies from `package.json` to improve performance and maintainability. It also includes a **bug fix** for a Vim mode initialization race condition and adds `aria` attributes for improved accessibility. This comprehensive update greatly improves the user experience and technical foundation of the **SWC Playground**.