QuickJS engine: host-side, side-effect-free serialization via handles

.changeset/quickjs-host-serde.md

@@ -0,0 +1,5 @@
+---
+'@workflow/core': patch
+---
+
+QuickJS engine: serialization now runs entirely on the host through `JSValueHandle`s (quickjs-wasi 3.3 introspection primitives + devalue 5.9 pluggable operations), replacing the serde bundle previously evaluated inside the VM. Wire format is unchanged; classification and extraction are side-effect free (engine brand checks, boot-captured intrinsics, descriptor reads), matching the node:vm engine's architecture.

packages/core/.gitignore

@@ -4,6 +4,3 @@ src/version.ts
 # Auto-generated quickjs-wasi binary assets (base64-encoded WASM + .so files)
 src/runtime/quickjs-assets.generated.ts
 
-# Auto-generated VM serde bundle (devalue + format-prefix + reducers,
-# packaged as an ES-module string for evaluation inside the QuickJS VM)
-src/runtime/vm-serde-bundle.generated.ts

packages/core/package.json

@@ -80,7 +80,7 @@
     "./_workflow": "./dist/workflow/index.js"
   },
   "scripts": {
-    "build": "genversion --es6 src/version.ts && node scripts/build-vm-serde-bundle.js && node scripts/build-quickjs-assets.js && tsc",
+    "build": "genversion --es6 src/version.ts && node scripts/build-quickjs-assets.js && tsc",
     "dev": "genversion --es6 src/version.ts && tsc --watch",
     "clean": "tsc --build --clean && rm -rf dist src/version.ts docs ||:",
     "test": "cross-env WORKFLOW_TARGET_WORLD=local vitest run src",
@@ -105,7 +105,7 @@
     "devalue": "5.9.0",
     "ms": "2.1.3",
     "nanoid": "5.1.6",
-    "quickjs-wasi": "3.1.0",
+    "quickjs-wasi": "3.3.0",
     "seedrandom": "3.0.5",
     "semver": "catalog:",
     "ulid": "catalog:",