Add opt-in decryption for CLI and web observability

[TooTallNate]

Summary

Adds encryption-aware observability so users can view encrypted workflow data in the CLI and web UI:

CLI

• --decrypt flag for workflow inspect commands
• EncryptedDataRef with util.inspect.custom for styled encrypted data display
• Fetches WorkflowRun for key resolution, caches per runId

Web UI

• getEncryptionKeyForRun RPC endpoint with client-side importKey() decryption
• Decrypt button in title bar with hover tooltip explaining scope
• Auto-decrypt expanded event data when encryption key becomes available
• Encrypted marker objects with named constructors and Lucide Lock icon in DataInspector
• Encryption key lifted to run-level state for consistent decrypt across all tabs

Shared

• hydrateResourceIOWithKey() for browser-side decryption
• Event data encryption support across step, hook, and sleep resource types

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
example-nextjs-workflow-turbopack	Ready	Preview, Comment	Feb 19, 2026 5:14pm
example-nextjs-workflow-webpack	Ready	Preview, Comment	Feb 19, 2026 5:14pm
example-workflow	Ready	Preview, Comment	Feb 19, 2026 5:14pm
workbench-astro-workflow	Ready	Preview, Comment	Feb 19, 2026 5:14pm
workbench-express-workflow	Ready	Preview, Comment	Feb 19, 2026 5:14pm
workbench-fastify-workflow	Ready	Preview, Comment	Feb 19, 2026 5:14pm
workbench-hono-workflow	Ready	Preview, Comment	Feb 19, 2026 5:14pm
workbench-nitro-workflow	Ready	Preview, Comment	Feb 19, 2026 5:14pm
workbench-nuxt-workflow	Ready	Preview, Comment	Feb 19, 2026 5:14pm
workbench-sveltekit-workflow	Ready	Preview, Comment	Feb 19, 2026 5:14pm
workbench-vite-workflow	Ready	Preview, Comment	Feb 19, 2026 5:14pm
workflow-docs	Ready	Preview, Comment, Open in v0	Feb 19, 2026 5:14pm
workflow-nest	Ready	Preview, Comment	Feb 19, 2026 5:14pm
workflow-swc-playground	Ready	Preview, Comment	Feb 19, 2026 5:14pm

[github-actions]

🧪 E2E Test Results

❌ Some tests failed

Summary

	Passed	Failed	Skipped	Total
✅ ▲ Vercel Production	534	0	38	572
✅ 💻 Local Development	556	0	68	624
✅ 📦 Local Production	556	0	68	624
✅ 🐘 Local Postgres	556	0	68	624
✅ 🪟 Windows	49	0	3	52
❌ 🌍 Community Worlds	110	46	9	165
✅ 📋 Other	135	0	21	156
Total	2496	46	275	2817

❌ Failed Tests

🌍 Community Worlds (46 failed)

mongodb (1 failed):

• webhookWorkflow

turso (45 failed):

• addTenWorkflow
• addTenWorkflow
• should work with react rendering in step
• promiseAllWorkflow
• promiseRaceWorkflow
• promiseAnyWorkflow
• hookWorkflow
• webhookWorkflow
• sleepingWorkflow
• parallelSleepWorkflow
• nullByteWorkflow
• workflowAndStepMetadataWorkflow
• fetchWorkflow
• promiseRaceStressTestWorkflow
• error handling error propagation workflow errors nested function calls preserve message and stack trace
• error handling error propagation workflow errors cross-file imports preserve message and stack trace
• error handling error propagation step errors basic step error preserves message and stack trace
• error handling error propagation step errors cross-file step error preserves message and function names in stack
• error handling retry behavior regular Error retries until success
• error handling retry behavior FatalError fails immediately without retries
• error handling retry behavior RetryableError respects custom retryAfter delay
• error handling retry behavior maxRetries=0 disables retries
• error handling retry behavior workflow completes despite transient 5xx on step_completed
• error handling catchability FatalError can be caught and detected with FatalError.is()
• hookCleanupTestWorkflow - hook token reuse after workflow completion
• concurrent hook token conflict - two workflows cannot use the same hook token simultaneously
• stepFunctionPassingWorkflow - step function references can be passed as arguments (without closure vars)
• stepFunctionWithClosureWorkflow - step function with closure variables passed as argument
• closureVariableWorkflow - nested step functions with closure variables
• spawnWorkflowFromStepWorkflow - spawning a child workflow using start() inside a step
• health check (queue-based) - workflow and step endpoints respond to health check messages
• pathsAliasWorkflow - TypeScript path aliases resolve correctly
• Calculator.calculate - static workflow method using static step methods from another class
• AllInOneService.processNumber - static workflow method using sibling static step methods
• ChainableService.processWithThis - static step methods using this to reference the class
• thisSerializationWorkflow - step function invoked with .call() and .apply()
• customSerializationWorkflow - custom class serialization with WORKFLOW_SERIALIZE/WORKFLOW_DESERIALIZE
• instanceMethodStepWorkflow - instance methods with "use step" directive
• crossContextSerdeWorkflow - classes defined in step code are deserializable in workflow context
• stepFunctionAsStartArgWorkflow - step function reference passed as start() argument
• cancelRun - cancelling a running workflow
• cancelRun via CLI - cancelling a running workflow
• pages router addTenWorkflow via pages router
• pages router promiseAllWorkflow via pages router
• pages router sleepingWorkflow via pages router

Details by Category

✅ ▲ Vercel Production

App	Passed	Failed	Skipped
✅ astro	48	0	4
✅ example	48	0	4
✅ express	48	0	4
✅ fastify	48	0	4
✅ hono	48	0	4
✅ nextjs-turbopack	51	0	1
✅ nextjs-webpack	51	0	1
✅ nitro	48	0	4
✅ nuxt	48	0	4
✅ sveltekit	48	0	4
✅ vite	48	0	4

✅ 💻 Local Development

App	Passed	Failed	Skipped
✅ astro-stable	45	0	7
✅ express-stable	45	0	7
✅ fastify-stable	45	0	7
✅ hono-stable	45	0	7
✅ nextjs-turbopack-canary	49	0	3
✅ nextjs-turbopack-stable	49	0	3
✅ nextjs-webpack-canary	49	0	3
✅ nextjs-webpack-stable	49	0	3
✅ nitro-stable	45	0	7
✅ nuxt-stable	45	0	7
✅ sveltekit-stable	45	0	7
✅ vite-stable	45	0	7

✅ 📦 Local Production

App	Passed	Failed	Skipped
✅ astro-stable	45	0	7
✅ express-stable	45	0	7
✅ fastify-stable	45	0	7
✅ hono-stable	45	0	7
✅ nextjs-turbopack-canary	49	0	3
✅ nextjs-turbopack-stable	49	0	3
✅ nextjs-webpack-canary	49	0	3
✅ nextjs-webpack-stable	49	0	3
✅ nitro-stable	45	0	7
✅ nuxt-stable	45	0	7
✅ sveltekit-stable	45	0	7
✅ vite-stable	45	0	7

✅ 🐘 Local Postgres

App	Passed	Failed	Skipped
✅ astro-stable	45	0	7
✅ express-stable	45	0	7
✅ fastify-stable	45	0	7
✅ hono-stable	45	0	7
✅ nextjs-turbopack-canary	49	0	3
✅ nextjs-turbopack-stable	49	0	3
✅ nextjs-webpack-canary	49	0	3
✅ nextjs-webpack-stable	49	0	3
✅ nitro-stable	45	0	7
✅ nuxt-stable	45	0	7
✅ sveltekit-stable	45	0	7
✅ vite-stable	45	0	7

✅ 🪟 Windows

App	Passed	Failed	Skipped
✅ nextjs-turbopack	49	0	3

❌ 🌍 Community Worlds

App	Passed	Failed	Skipped
✅ mongodb-dev	3	0	0
❌ mongodb	48	1	3
✅ redis-dev	3	0	0
✅ redis	49	0	3
✅ turso-dev	3	0	0
❌ turso	4	45	3

✅ 📋 Other

App	Passed	Failed	Skipped
✅ e2e-local-dev-nest-stable	45	0	7
✅ e2e-local-postgres-nest-stable	45	0	7
✅ e2e-local-prod-nest-stable	45	0	7

---

📋 View full workflow run

[TooTallNate]

Warning

This pull request is not mergeable via GitHub because a downstack PR is open. Once all requirements are satisfied, merge this PR as a stack on Graphite.
Learn more

• Add opt-in decryption for CLI and web observability #1000 👈 (View in Graphite)
• Wire encryption into serialization and fix EventsConsumer for async replay #957
• Add AES-256-GCM encryption primitives and HKDF key derivation #956
• Fix projectConfig.projectId containing project name instead of ID #999
• Add World.getEncryptionKeyForRun and thread encryption key through serialization #979
• Make serialization functions async #978
• main

This stack of pull requests is managed by Graphite. Learn more about stacking.

[changeset-bot]

🦋 Changeset detected

Latest commit: 9ef7740

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 15 packages

Name	Type
@workflow/cli	Patch
@workflow/core	Patch
@workflow/web	Patch
@workflow/web-shared	Patch
workflow	Patch
@workflow/world-testing	Patch
@workflow/builders	Patch
@workflow/next	Patch
@workflow/nitro	Patch
@workflow/astro	Patch
@workflow/nest	Patch
@workflow/rollup	Patch
@workflow/sveltekit	Patch
@workflow/vite	Patch
@workflow/nuxt	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR