@helmr/sdk 0.1.0-preview.g52eb0eef.b35190749915

package/dist/internal.js

@@ -0,0 +1,994 @@
+// sdk/typescript/src/internal/utf8.ts
+var encoder = new TextEncoder;
+var encode = TextEncoder.prototype.encode.call.bind(TextEncoder.prototype.encode);
+var charCodeAt = String.prototype.charCodeAt.call.bind(String.prototype.charCodeAt);
+function compareUTF8(left, right) {
+  const leftBytes = encode(encoder, left);
+  const rightBytes = encode(encoder, right);
+  const length = leftBytes.length < rightBytes.length ? leftBytes.length : rightBytes.length;
+  for (let index = 0;index < length; index++) {
+    const difference = leftBytes[index] - rightBytes[index];
+    if (difference !== 0)
+      return difference;
+  }
+  return leftBytes.length - rightBytes.length;
+}
+function hasOnlyUnicodeScalarValues(value) {
+  for (let index = 0;index < value.length; index++) {
+    const unit = charCodeAt(value, index);
+    if (unit >= 55296 && unit <= 56319) {
+      if (index + 1 === value.length)
+        return false;
+      const next = charCodeAt(value, index + 1);
+      if (next < 56320 || next > 57343)
+        return false;
+      index++;
+    } else if (unit >= 56320 && unit <= 57343) {
+      return false;
+    }
+  }
+  return true;
+}
+function assertUnicodeString(value) {
+  if (!hasOnlyUnicodeScalarValues(value)) {
+    throw new Error("canonical JSON contains an unpaired surrogate");
+  }
+}
+
+// sdk/typescript/src/config.ts
+var arrayIsArray = Array.isArray;
+var arrayPrototype = Array.prototype;
+var defineProperty = Object.defineProperty;
+var objectPrototype = Object.prototype;
+var getOwnPropertyDescriptor = Object.getOwnPropertyDescriptor;
+var getOwnPropertyDescriptors = Object.getOwnPropertyDescriptors;
+var getPrototypeOf = Object.getPrototypeOf;
+var hasOwn = Object.hasOwn;
+var freeze = Object.freeze;
+var ownKeys = Reflect.ownKeys;
+var startsWith = String.prototype.startsWith.call.bind(String.prototype.startsWith);
+var endsWith = String.prototype.endsWith.call.bind(String.prototype.endsWith);
+var includes = String.prototype.includes.call.bind(String.prototype.includes);
+var split = String.prototype.split.call.bind(String.prototype.split);
+var slice = String.prototype.slice.call.bind(String.prototype.slice);
+var charCodeAt2 = String.prototype.charCodeAt.call.bind(String.prototype.charCodeAt);
+var regexpTest = RegExp.prototype.test.call.bind(RegExp.prototype.test);
+function inspectConfig(value) {
+  if (typeof value !== "object" || value === null) {
+    throw new Error("config must be an ordinary object");
+  }
+  return normalizeConfig(value);
+}
+function matchesIgnorePattern(pattern, path) {
+  const patternSegments = split(pattern, "/");
+  const pathSegments = split(path, "/");
+  const matches = (patternIndex, pathIndex) => {
+    if (patternIndex === patternSegments.length) {
+      return pathIndex === pathSegments.length;
+    }
+    const segment = patternSegments[patternIndex];
+    if (segment === "**") {
+      if (patternIndex === patternSegments.length - 1) {
+        return pathIndex < pathSegments.length;
+      }
+      for (let candidate = pathIndex;candidate <= pathSegments.length; candidate++) {
+        if (matches(patternIndex + 1, candidate))
+          return true;
+      }
+      return false;
+    }
+    return pathIndex < pathSegments.length && matchesSegment(segment, pathSegments[pathIndex]) && matches(patternIndex + 1, pathIndex + 1);
+  };
+  return matches(0, 0);
+}
+function validateDirectory(value) {
+  if (typeof value !== "string" || value === "" || !hasOnlyUnicodeScalarValues(value) || startsWith(value, "/") || includes(value, "\\") || hasControl(value)) {
+    throw new Error("config dirs entries must be non-empty root-relative POSIX paths");
+  }
+  const normalized = startsWith(value, "./") ? slice(value, 2) : value;
+  const segments = split(normalized, "/");
+  let invalidSegment = normalized === "";
+  for (let index = 0;index < segments.length; index++) {
+    const segment = segments[index];
+    if (segment === "" || segment === "." || segment === "..") {
+      invalidSegment = true;
+      break;
+    }
+  }
+  if (invalidSegment) {
+    throw new Error("config dirs entries must be normalized root-relative paths");
+  }
+  return normalized;
+}
+function validateIgnorePattern(value) {
+  if (typeof value !== "string" || value === "" || !hasOnlyUnicodeScalarValues(value) || startsWith(value, "./") || startsWith(value, "/") || endsWith(value, "/") || includes(value, "//") || includes(value, "\\") || hasControl(value) || startsWith(value, "!") || regexpTest(/[[\]{}]/, value) || regexpTest(/[?*+@!]\(/, value)) {
+    throw new Error(`unsupported ignorePattern ${JSON.stringify(value)}`);
+  }
+  const segments = split(value, "/");
+  for (let index = 0;index < segments.length; index++) {
+    const segment = segments[index];
+    if (segment === ".." || includes(segment, "**") && segment !== "**") {
+      throw new Error(`unsupported ignorePattern ${JSON.stringify(value)}`);
+    }
+  }
+  return value;
+}
+function matchesSegment(pattern, value) {
+  const patternCharacters = codePoints(pattern);
+  const valueCharacters = codePoints(value);
+  let patternIndex = 0;
+  let valueIndex = 0;
+  let star = -1;
+  let starValue = -1;
+  while (valueIndex < valueCharacters.length) {
+    const token = patternCharacters[patternIndex];
+    if (token === "?" || token === valueCharacters[valueIndex]) {
+      patternIndex++;
+      valueIndex++;
+      continue;
+    }
+    if (token === "*") {
+      star = patternIndex++;
+      starValue = valueIndex;
+      continue;
+    }
+    if (star !== -1) {
+      patternIndex = star + 1;
+      valueIndex = ++starValue;
+      continue;
+    }
+    return false;
+  }
+  while (patternCharacters[patternIndex] === "*")
+    patternIndex++;
+  return patternIndex === patternCharacters.length;
+}
+function hasControl(value) {
+  for (let index = 0;index < value.length; index++) {
+    const code = charCodeAt2(value, index);
+    if (code <= 31 || code >= 127 && code <= 159)
+      return true;
+  }
+  return false;
+}
+function codePoints(value) {
+  const result = [];
+  for (let index = 0;index < value.length; ) {
+    const first = charCodeAt2(value, index);
+    const width = first >= 55296 && first <= 56319 ? 2 : 1;
+    setArrayIndex(result, result.length, slice(value, index, index + width));
+    index += width;
+  }
+  return result;
+}
+function normalizeConfig(value) {
+  if (arrayIsArray(value) || getPrototypeOf(value) !== objectPrototype) {
+    throw new Error("config must be an ordinary object");
+  }
+  const descriptors = getOwnPropertyDescriptors(value);
+  const keys = ownKeys(value);
+  let invalidKey = false;
+  for (let index = 0;index < keys.length; index++) {
+    const key = keys[index];
+    if (typeof key !== "string" || key !== "dirs" && key !== "ignorePatterns") {
+      invalidKey = true;
+      break;
+    }
+  }
+  if (invalidKey) {
+    throw new Error("config accepts only dirs and ignorePatterns");
+  }
+  for (let index = 0;index < keys.length; index++) {
+    const key = keys[index];
+    if (typeof key !== "string") {
+      throw new Error("config accepts only dirs and ignorePatterns");
+    }
+    const descriptor = descriptors[key];
+    if (descriptor === undefined || !descriptor.enumerable || !hasOwn(descriptor, "value")) {
+      throw new Error("config properties must be enumerable data properties");
+    }
+  }
+  const dirs = normalizeStringSet(hasOwn(descriptors, "dirs") ? descriptors["dirs"]?.value : ["tasks"], "config dirs", validateDirectory, true);
+  const ignorePatterns = normalizeStringSet(hasOwn(descriptors, "ignorePatterns") ? descriptors["ignorePatterns"]?.value : [], "config ignorePatterns", validateIgnorePattern, false);
+  return freeze({
+    dirs: freeze(dirs),
+    ignorePatterns: freeze(ignorePatterns)
+  });
+}
+function normalizeStringSet(value, name, normalize, nonempty) {
+  if (!arrayIsArray(value) || getPrototypeOf(value) !== arrayPrototype) {
+    throw new Error(`${name} must be an array`);
+  }
+  const keys = ownKeys(value);
+  const lengthDescriptor = getOwnPropertyDescriptor(value, "length");
+  const length = lengthDescriptor?.value;
+  if (typeof length !== "number" || keys.length !== length + 1 || keys[length] !== "length") {
+    throw new Error(`${name} must be a dense ordinary array`);
+  }
+  const normalized = [];
+  for (let index = 0;index < length; index++) {
+    const key = `${index}`;
+    if (keys[index] !== key) {
+      throw new Error(`${name} must be a dense ordinary array`);
+    }
+    const descriptor = getOwnPropertyDescriptor(value, key);
+    if (descriptor === undefined || !descriptor.enumerable || !hasOwn(descriptor, "value")) {
+      throw new Error(`${name} entries must be enumerable data properties`);
+    }
+    const current = normalize(descriptor.value);
+    let insertion = normalized.length;
+    while (insertion > 0 && compareUTF8(current, normalized[insertion - 1]) < 0) {
+      setArrayIndex(normalized, insertion, normalized[insertion - 1]);
+      insertion--;
+    }
+    setArrayIndex(normalized, insertion, current);
+  }
+  if (nonempty && length === 0) {
+    throw new Error(`${name} must be non-empty`);
+  }
+  for (let index = 1;index < normalized.length; index++) {
+    if (normalized[index] === normalized[index - 1]) {
+      throw new Error(`${name} contains a duplicate entry`);
+    }
+  }
+  return normalized;
+}
+function setArrayIndex(array, index, value) {
+  defineProperty(array, `${index}`, {
+    configurable: true,
+    enumerable: true,
+    value,
+    writable: true
+  });
+}
+// sdk/typescript/src/schema/payload.ts
+var payloadSchemaValidationErrorBrand = Symbol.for("helmr.sdk.PayloadSchemaValidationError");
+function assertPayloadSchema(value, label = "payload") {
+  if (value === undefined) {
+    return;
+  }
+  assertStandardSchema(value, label);
+}
+function assertStandardSchema(value, label = "schema") {
+  if (value === null || typeof value !== "object" && typeof value !== "function") {
+    throw new Error(`${label} must implement the Standard Schema v1 interface`);
+  }
+  const standard = value["~standard"];
+  if (standard === null || typeof standard !== "object") {
+    throw new Error(`${label} must implement the Standard Schema v1 interface`);
+  }
+  const record = standard;
+  if (record["version"] !== 1 || typeof record["validate"] !== "function") {
+    throw new Error(`${label} must implement the Standard Schema v1 interface`);
+  }
+}
+
+// sdk/typescript/src/schema/task.ts
+var TASK_ID_PATTERN = "^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$";
+var TASK_ID_MAX_LENGTH = 128;
+var QUEUE_NAME_PATTERN = "^[A-Za-z0-9][A-Za-z0-9._/-]{0,255}$";
+var QUEUE_NAME_MAX_LENGTH = 256;
+
+class TaskIdError extends Error {
+  name = "TaskIdError";
+  value;
+  constructor(value) {
+    super(`task id must match ${TASK_ID_PATTERN}: ${JSON.stringify(value)}`);
+    this.value = value;
+  }
+}
+function validateTaskId(value) {
+  if (!isValidTaskId(value)) {
+    throw new TaskIdError(value);
+  }
+}
+function isValidTaskId(value) {
+  if (value.length === 0 || value.length > TASK_ID_MAX_LENGTH) {
+    return false;
+  }
+  const first = value.charCodeAt(0);
+  if (!isAsciiAlnum(first)) {
+    return false;
+  }
+  for (let index = 1;index < value.length; index += 1) {
+    const code = value.charCodeAt(index);
+    if (!(isAsciiAlnum(code) || code === 46 || code === 95 || code === 45)) {
+      return false;
+    }
+  }
+  return true;
+}
+
+class TaskQueueNameError extends Error {
+  name = "TaskQueueNameError";
+  value;
+  constructor(value) {
+    super(`queue name must match ${QUEUE_NAME_PATTERN}: ${JSON.stringify(value)}`);
+    this.value = value;
+  }
+}
+
+class TaskQueueConcurrencyLimitError extends Error {
+  name = "TaskQueueConcurrencyLimitError";
+  value;
+  constructor(value) {
+    super("queue concurrencyLimit must be a positive integer");
+    this.value = value;
+  }
+}
+function validateQueueName(value) {
+  if (!isValidQueueName(value)) {
+    throw new TaskQueueNameError(value);
+  }
+}
+function isValidQueueName(value) {
+  if (value.length === 0 || value.length > QUEUE_NAME_MAX_LENGTH) {
+    return false;
+  }
+  const first = value.charCodeAt(0);
+  if (!isAsciiAlnum(first)) {
+    return false;
+  }
+  for (let index = 1;index < value.length; index += 1) {
+    const code = value.charCodeAt(index);
+    if (!(isAsciiAlnum(code) || code === 46 || code === 95 || code === 45 || code === 47)) {
+      return false;
+    }
+  }
+  return true;
+}
+function validateOptionalQueueConcurrencyLimit(value) {
+  if (value === undefined || value === null) {
+    return;
+  }
+  if (typeof value === "number" && Number.isSafeInteger(value) && value > 0) {
+    return;
+  }
+  throw new TaskQueueConcurrencyLimitError(value);
+}
+function isAsciiAlnum(code) {
+  return code >= 48 && code <= 57 || code >= 65 && code <= 90 || code >= 97 && code <= 122;
+}
+
+// sdk/typescript/src/internal/runtime.ts
+var runtimeOperationsSymbol = Symbol.for("helmr.sdk.v0.runtime_operations");
+function installRuntimeOperations(operations) {
+  const target = globalThis;
+  if (target[runtimeOperationsSymbol] !== undefined) {
+    throw new Error("Helmr runtime operations are already installed");
+  }
+  const installed = Object.freeze(operations);
+  target[runtimeOperationsSymbol] = installed;
+  return () => {
+    if (target[runtimeOperationsSymbol] === installed) {
+      delete target[runtimeOperationsSymbol];
+    }
+  };
+}
+function currentRuntimeOperations() {
+  const operations = globalThis[runtimeOperationsSymbol];
+  if (operations === undefined) {
+    throw new Error("runtime operation is unavailable without the Helmr managed runtime");
+  }
+  return operations;
+}
+
+// sdk/typescript/src/internal/id.ts
+var uuidV7Pattern = /^[0-9a-f]{8}-[0-9a-f]{4}-7[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/;
+function resourceID(value, label) {
+  if (typeof value !== "string" || !uuidV7Pattern.test(value)) {
+    throw new Error(`${label} must be a canonical UUIDv7`);
+  }
+  return value;
+}
+
+// sdk/typescript/src/session.ts
+function createRuntimeSessionRef(id) {
+  const sessionID = resourceID(id, "Session ID");
+  return Object.freeze({
+    id: sessionID,
+    input: Object.freeze({
+      send(input, request, options) {
+        return currentRuntimeOperations().actorInputSend(sessionID, input, request, options?.signal);
+      }
+    }),
+    output: Object.freeze({
+      list(query, options) {
+        return currentRuntimeOperations().sessionOutputPage(sessionID, query, options?.signal);
+      }
+    }),
+    retrieve(options = {}) {
+      return currentRuntimeOperations().sessionRetrieve(sessionID, options.signal);
+    },
+    close(request, options) {
+      return currentRuntimeOperations().sessionClose(sessionID, request, options?.signal);
+    }
+  });
+}
+var sessions = Object.freeze({
+  ref(id) {
+    return createRuntimeSessionRef(id);
+  }
+});
+
+// sdk/typescript/src/internal/run-handle.ts
+function createRunHandle(id) {
+  return Object.freeze({
+    id: resourceID(id, "Run ID")
+  });
+}
+function runHandleID(value) {
+  return resourceID(typeof value === "string" ? value : value.id, "Run ID");
+}
+
+// sdk/typescript/src/definitions.ts
+var privateDefinitionBrand = Symbol.for("helmr.sdk.v0.definition");
+var privateQueueBrand = Symbol.for("helmr.sdk.v0.queue");
+function inspectDefinition(value) {
+  if (typeof value !== "object" && typeof value !== "function" || value === null) {
+    return;
+  }
+  if (!Object.hasOwn(value, privateDefinitionBrand))
+    return;
+  const definition = value[privateDefinitionBrand];
+  if (!isInternalDefinition(definition)) {
+    throw new Error("invalid private definition record");
+  }
+  return definition;
+}
+function isQueue(value) {
+  if (typeof value !== "object" || value === null)
+    return false;
+  if (!Object.hasOwn(value, privateQueueBrand))
+    return false;
+  if (value[privateQueueBrand] !== true) {
+    throw new Error("invalid private queue record");
+  }
+  const queue = value;
+  if (typeof queue.name !== "string") {
+    throw new Error("invalid private queue record");
+  }
+  validateQueueName(queue.name);
+  validateOptionalQueueConcurrencyLimit(queue.concurrencyLimit);
+  return true;
+}
+function isInternalDefinition(value) {
+  if (typeof value !== "object" || value === null)
+    return false;
+  const definition = value;
+  if (typeof definition.id !== "string")
+    return false;
+  validateTaskId(definition.id);
+  switch (definition.kind) {
+    case "task":
+      if (typeof definition.handler !== "function" || typeof definition.hasPayload !== "boolean") {
+        return false;
+      }
+      if (definition.hasPayload) {
+        assertPayloadSchema(definition.payloadSchema, `task ${JSON.stringify(definition.id)} payload`);
+      } else if (Object.hasOwn(definition, "payloadSchema")) {
+        return false;
+      }
+      return true;
+    case "actor":
+      return typeof definition.handler === "function";
+    default:
+      return false;
+  }
+}
+// sdk/typescript/src/image.ts
+var imageBrand = Symbol.for("helmr.sdk.v0.image");
+var sourceFileBrand = Symbol.for("helmr.sdk.v0.source-file");
+var sourceDirectoryBrand = Symbol.for("helmr.sdk.v0.source-directory");
+class SourceFileValue {
+  path;
+  constructor(path) {
+    this.path = path;
+    Object.defineProperty(this, sourceFileBrand, { value: true });
+    Object.freeze(this);
+  }
+}
+
+class SourceDirectoryValue {
+  path;
+  constructor(path) {
+    this.path = path;
+    Object.defineProperty(this, sourceDirectoryBrand, { value: true });
+    Object.freeze(this);
+  }
+}
+var source = Object.freeze({
+  file(path) {
+    return new SourceFileValue(path);
+  },
+  directory(path) {
+    return new SourceDirectoryValue(path);
+  }
+});
+function inspectImage(value) {
+  if (typeof value !== "object" || value === null || value[imageBrand] !== true) {
+    return;
+  }
+  const imageValue = value;
+  return { key: imageValue.key, steps: imageValue.steps };
+}
+// sdk/typescript/src/secret.ts
+var secretNamePattern = /^[A-Za-z0-9][A-Za-z0-9_.-]{0,127}$/;
+function validateSecretName(value) {
+  if (typeof value !== "string" || !secretNamePattern.test(value)) {
+    throw new Error("Secret name is invalid");
+  }
+}
+
+// sdk/typescript/src/internal/origin.ts
+function canonicalSecretOrigin(value) {
+  if (typeof value !== "string" || value.trim() !== value || !/^https:\/\//i.test(value)) {
+    throw new Error("Secret origin must be an exact HTTPS origin");
+  }
+  const authority = value.replace(/^https:\/\//i, "").replace(/\/$/, "");
+  if (!/^[A-Za-z0-9.-]+(?::[0-9]+)?$/.test(authority))
+    throw new Error("Secret origin must contain only a DNS hostname and optional port");
+  const [rawHost, port] = authority.split(":");
+  const host = rawHost.toLowerCase();
+  if (host.length > 253 || host === "localhost" || host.endsWith(".localhost") || /^[0-9.]+$/.test(host) || host.split(".").some((label) => !/^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/.test(label))) {
+    throw new Error("Secret origin must use a DNS hostname without wildcards or IP addresses");
+  }
+  if (port !== undefined && (!/^[1-9][0-9]*$/.test(port) || Number(port) > 65535))
+    throw new Error("Secret origin port is invalid");
+  return `https://${host}${port === undefined || port === "443" ? "" : `:${port}`}`;
+}
+
+// sdk/typescript/src/internal/timestamp.ts
+var utcRFC3339 = /^(\d{4})-(\d{2})-(\d{2})T(\d{2}):(\d{2}):(\d{2})(?:\.\d{1,9})?Z$/;
+function timestampString(value, label) {
+  const match = typeof value === "string" ? utcRFC3339.exec(value) : null;
+  if (match === null || !validDateTime(match)) {
+    throw new Error(`${label} must be a UTC RFC 3339 timestamp`);
+  }
+  return value;
+}
+function validDateTime(match) {
+  const year = Number(match[1]);
+  const month = Number(match[2]);
+  const day = Number(match[3]);
+  const hour = Number(match[4]);
+  const minute = Number(match[5]);
+  const second = Number(match[6]);
+  if (month < 1 || month > 12 || hour > 23 || minute > 59 || second > 59) {
+    return false;
+  }
+  const leap = year % 4 === 0 && (year % 100 !== 0 || year % 400 === 0);
+  const days = [31, leap ? 29 : 28, 31, 30, 31, 30, 31, 31, 30, 31, 30, 31];
+  return day >= 1 && day <= days[month - 1];
+}
+
+// sdk/typescript/src/workspace.ts
+var sandboxDefinitionBrand = Symbol.for("helmr.sdk.v0.sandbox");
+var workspaceAddressBrand = Symbol.for("helmr.sdk.v0.workspace-address");
+var workspaces = Object.freeze({
+  ref: createWorkspaceRef
+});
+function inspectWorkspaceAddress(value) {
+  if (typeof value !== "object" || value === null || value[workspaceAddressBrand] !== true) {
+    return;
+  }
+  const address = value;
+  if (address.id === undefined) {
+    throw new Error("private Workspace address is invalid");
+  }
+  return createWorkspaceAddress(address.id);
+}
+function workspaceRefID(value) {
+  const address = inspectWorkspaceAddress(value);
+  if (address === undefined || typeof address.id !== "string") {
+    throw new Error("Workspace requires a Workspace ref");
+  }
+  return address.id;
+}
+function encodeWorkspaceSecrets(inputs) {
+  if (inputs === undefined)
+    return Object.freeze([]);
+  if (!Array.isArray(inputs) || inputs.length > 64)
+    throw new Error("Workspace secrets must be an array of at most 64 bindings");
+  const envNames = new Set;
+  const files = [];
+  let originCount = 0;
+  const result = inputs.map((input) => {
+    const value = workspaceObject(input, "Workspace Secret");
+    validateSecretName(value["secret"]);
+    const hasEnv = value["env"] !== undefined;
+    const hasFile = value["file"] !== undefined;
+    if (hasEnv === hasFile)
+      throw new Error("Workspace Secret requires exactly one of env or file");
+    exactBindingKeys(value, ["secret", "env", "file"]);
+    if (hasEnv) {
+      const env = workspaceObject(value["env"], "Workspace Secret env");
+      const mode = env["mode"];
+      if (mode !== "raw" && mode !== "protected")
+        throw new Error("Workspace Secret env requires explicit raw or protected mode");
+      exactBindingKeys(env, ["name", "mode", "allowedOrigins"]);
+      if (mode === "raw" && env["allowedOrigins"] !== undefined)
+        throw new Error("Raw env cannot specify allowedOrigins");
+      const name = env["name"];
+      if (typeof name !== "string" || !/^[A-Za-z_][A-Za-z0-9_]*$/.test(name) || name.startsWith("HELMR_") || name.startsWith("LD_") || ["NODE_OPTIONS", "NODE_PATH", "NODE_ICU_DATA", "OPENSSL_CONF", "OPENSSL_MODULES", "OPENSSL_ENGINES", "GCONV_PATH", "LOCPATH"].includes(name) || ["SSL_CERT_FILE", "SSL_CERT_DIR", "NODE_EXTRA_CA_CERTS", "NODE_USE_SYSTEM_CA"].includes(name.toUpperCase()))
+        throw new Error("Invalid or reserved Secret env name");
+      if (envNames.has(name))
+        throw new Error(`Duplicate Secret env target ${name}`);
+      envNames.add(name);
+      if (mode === "raw")
+        return Object.freeze({ secret: input.secret, env: Object.freeze({ name, mode }) });
+      const origins = env["allowedOrigins"];
+      if (!Array.isArray(origins) || origins.length === 0 || origins.length > 16)
+        throw new Error("Protected env requires 1 to 16 exact HTTPS origins");
+      const allowed_origins = Object.freeze([...new Set(origins.map(canonicalSecretOrigin))].sort());
+      originCount += allowed_origins.length;
+      return Object.freeze({ secret: input.secret, env: Object.freeze({ name, mode, allowed_origins }) });
+    }
+    const file = workspaceObject(value["file"], "Workspace Secret file");
+    exactBindingKeys(file, ["path"]);
+    const path = file["path"];
+    if (typeof path !== "string" || path.length > 4096 || !path.startsWith("/") || path === "/" || path.includes("\x00") || path.split("/").slice(1).some((part) => part === "" || part === "." || part === "..") || ["/workspace", "/var/lib/helmr", "/dev", "/opt/helmr", "/proc", "/sys", "/.helmr-old-root", "/run/helmr"].some((root) => path === root || path.startsWith(root + "/")))
+      throw new Error("Invalid or reserved Secret file path");
+    files.push(path);
+    return Object.freeze({ secret: input.secret, file: Object.freeze({ path }) });
+  });
+  files.sort();
+  if (files.some((path, index) => index > 0 && (path === files[index - 1] || path.startsWith(files[index - 1] + "/"))))
+    throw new Error("Conflicting Secret file paths");
+  if (originCount > 256)
+    throw new Error("Workspace Secret origins exceed 256");
+  return Object.freeze(result);
+}
+function exactBindingKeys(value, allowed) {
+  const unknown = Object.keys(value).find((key) => !allowed.includes(key));
+  if (unknown !== undefined)
+    throw new Error(`Workspace Secret has unknown member ${JSON.stringify(unknown)}`);
+}
+function inspectSandboxDefinition(value) {
+  if (typeof value !== "object" || value === null)
+    return;
+  if (!Object.hasOwn(value, sandboxDefinitionBrand))
+    return;
+  if (value[sandboxDefinitionBrand] !== true) {
+    throw new Error("invalid private Sandbox record");
+  }
+  const internal = value.internal;
+  if (typeof internal !== "object" || internal === null || internal.kind !== "sandbox" || typeof internal.id !== "string" || typeof internal.image !== "object" || internal.image === null || typeof internal.resources !== "object" || internal.resources === null) {
+    throw new Error("invalid private Sandbox record");
+  }
+  validateTaskId(internal.id);
+  return internal;
+}
+function createWorkspaceRef(id) {
+  const workspaceID = resourceID(id, "Workspace ID");
+  const operations = {
+    retrieve(options) {
+      return currentRuntimeOperations().workspaceRetrieve(workspaceID, options?.signal);
+    },
+    exec(request, options) {
+      return currentRuntimeOperations().workspaceExec(workspaceID, request, options?.signal);
+    },
+    delete(request, options) {
+      return currentRuntimeOperations().workspaceDelete(workspaceID, request, options?.signal);
+    }
+  };
+  return brandWorkspaceAddress({ id: workspaceID, ...operations });
+}
+function createWorkspaceAddress(id) {
+  return brandWorkspaceAddress({ id: resourceID(id, "Workspace ID") });
+}
+function brandWorkspaceAddress(value) {
+  resourceID(value.id, "Workspace ID");
+  return freezeWorkspaceAddress(value);
+}
+function freezeWorkspaceAddress(value) {
+  Object.defineProperty(value, workspaceAddressBrand, { value: true });
+  return Object.freeze(value);
+}
+function parseWorkspace(value) {
+  const input = workspaceObject(value, "Workspace response");
+  const key = input["key"];
+  if (key !== undefined && typeof key !== "string") {
+    throw new Error("Workspace response.key must be a string");
+  }
+  const sandboxId = input["sandbox_id"];
+  if (typeof sandboxId !== "string") {
+    throw new Error("Workspace response.sandbox_id must be a string");
+  }
+  validateTaskId(sandboxId);
+  const status = input["status"];
+  if (status !== "available" && status !== "recovery_required" && status !== "deleting") {
+    throw new Error("Workspace response.status is invalid");
+  }
+  if (!Array.isArray(input["secrets"])) {
+    throw new Error("Workspace response.secrets must be an array");
+  }
+  const owner = parseWorkspaceOwner(input["owner"], "Workspace response.owner");
+  return Object.freeze({
+    id: resourceID(input["id"], "Workspace response.id"),
+    ...key === undefined ? {} : { key },
+    sandboxId,
+    deploymentId: resourceID(input["deployment_id"], "Workspace response.deployment_id"),
+    status,
+    ...owner === undefined ? {} : { owner },
+    secrets: Object.freeze(input["secrets"].map(parseWorkspaceSecret)),
+    lastActivityAt: workspaceTimestamp(input["last_activity_at"], "last_activity_at"),
+    createdAt: workspaceTimestamp(input["created_at"], "created_at"),
+    updatedAt: workspaceTimestamp(input["updated_at"], "updated_at")
+  });
+}
+function parseWorkspaceOwner(value, label) {
+  if (value === undefined)
+    return;
+  const input = workspaceObject(value, label);
+  const hasSession = input["session_id"] !== undefined;
+  const hasRun = input["run_id"] !== undefined;
+  if (hasSession === hasRun) {
+    throw new Error(`${label} must name exactly one of session_id or run_id`);
+  }
+  return Object.freeze(hasSession ? { sessionId: resourceID(input["session_id"], `${label}.session_id`) } : { runId: resourceID(input["run_id"], `${label}.run_id`) });
+}
+function parseWorkspaceSecret(value) {
+  const wire = workspaceObject(value, "Workspace Secret");
+  exactBindingKeys(wire, wire["env"] !== undefined ? ["secret", "env"] : ["secret", "file"]);
+  let binding;
+  if (wire["env"] !== undefined) {
+    const env = workspaceObject(wire["env"], "Workspace Secret env");
+    exactBindingKeys(env, ["name", "mode", "allowed_origins"]);
+    binding = { secret: wire["secret"], env: { name: env["name"], mode: env["mode"], ...env["allowed_origins"] === undefined ? {} : { allowedOrigins: env["allowed_origins"] } } };
+  } else {
+    binding = { secret: wire["secret"], file: wire["file"] };
+  }
+  const normalized = encodeWorkspaceSecrets([binding])[0];
+  return normalized.env !== undefined ? Object.freeze({ secret: normalized.secret, env: Object.freeze({ name: normalized.env.name, mode: normalized.env.mode, ...normalized.env.allowed_origins === undefined ? {} : { allowedOrigins: normalized.env.allowed_origins } }) }) : Object.freeze({ secret: normalized.secret, file: normalized.file });
+}
+function parseWorkspaceExecResult(value) {
+  const response = workspaceObject(value, "Workspace exec response");
+  const exitCode = response["exit_code"];
+  if (!Number.isSafeInteger(exitCode)) {
+    throw new Error("Workspace exec response.exit_code must be an integer");
+  }
+  return Object.freeze({
+    exitCode,
+    stdout: decodeWorkspaceBase64(response["stdout_base64"], "Workspace exec response.stdout_base64"),
+    stderr: decodeWorkspaceBase64(response["stderr_base64"], "Workspace exec response.stderr_base64")
+  });
+}
+function parseWorkspaceDeleteReceipt(value) {
+  const response = workspaceObject(value, "Workspace delete response");
+  return Object.freeze({
+    workspaceId: resourceID(response["workspace_id"], "Workspace delete response.workspace_id")
+  });
+}
+function workspaceObject(value, label) {
+  if (value === null || typeof value !== "object" || Array.isArray(value)) {
+    throw new Error(`${label} must be an object`);
+  }
+  return value;
+}
+function workspaceTimestamp(value, field) {
+  return timestampString(value, `Workspace response.${field}`);
+}
+function decodeWorkspaceBase64(value, label) {
+  if (typeof value !== "string") {
+    throw new Error(`${label} must be canonical padded base64`);
+  }
+  let binary;
+  try {
+    binary = atob(value);
+  } catch {
+    throw new Error(`${label} must be canonical padded base64`);
+  }
+  if (btoa(binary) !== value) {
+    throw new Error(`${label} must be canonical padded base64`);
+  }
+  const output = new Uint8Array(binary.length);
+  for (let index = 0;index < binary.length; index++) {
+    output[index] = binary.charCodeAt(index);
+  }
+  return output;
+}
+// sdk/typescript/src/internal/jsoncanon.ts
+var textEncoder = new TextEncoder;
+function canonicalizeJsonValue(value) {
+  return textEncoder.encode(serialize(value, new Set));
+}
+function serialize(value, ancestors) {
+  if (value === null || typeof value === "boolean") {
+    return String(value);
+  }
+  if (typeof value === "number") {
+    if (!Number.isFinite(value)) {
+      throw new Error("canonical JSON numbers must be finite IEEE 754 doubles");
+    }
+    return JSON.stringify(value);
+  }
+  if (typeof value === "string") {
+    assertUnicodeString(value);
+    return JSON.stringify(value);
+  }
+  if (typeof value !== "object") {
+    throw new Error(`canonical JSON does not support ${typeof value}`);
+  }
+  if (ancestors.has(value)) {
+    throw new Error("canonical JSON does not support cyclic values");
+  }
+  ancestors.add(value);
+  try {
+    if (Array.isArray(value)) {
+      assertPlainArray(value);
+      const items = value.map((item) => serialize(item, ancestors));
+      return `[${items.join(",")}]`;
+    }
+    const objectValue = value;
+    assertPlainObject(objectValue);
+    const entries = Object.keys(objectValue).sort().map((key) => {
+      assertUnicodeString(key);
+      return `${JSON.stringify(key)}:${serialize(objectValue[key], ancestors)}`;
+    });
+    return `{${entries.join(",")}}`;
+  } finally {
+    ancestors.delete(value);
+  }
+}
+function assertPlainArray(value) {
+  const keys = Reflect.ownKeys(value);
+  const expected = Array.from({ length: value.length }, (_, index) => String(index));
+  expected.push("length");
+  if (keys.length !== expected.length || keys.some((key, index) => key !== expected[index])) {
+    throw new Error("canonical JSON arrays must be dense and have no extra properties");
+  }
+}
+function assertPlainObject(value) {
+  const prototype = Object.getPrototypeOf(value);
+  if (prototype !== Object.prototype && prototype !== null) {
+    throw new Error("canonical JSON objects must have a plain or null prototype");
+  }
+  for (const key of Reflect.ownKeys(value)) {
+    if (typeof key !== "string") {
+      throw new Error("canonical JSON objects cannot have symbol properties");
+    }
+    const descriptor = Object.getOwnPropertyDescriptor(value, key);
+    if (!descriptor?.enumerable || !("value" in descriptor)) {
+      throw new Error("canonical JSON object properties must be enumerable data properties");
+    }
+  }
+}
+// sdk/typescript/src/internal/session.ts
+function parseSession(value) {
+  const input = objectValue(value, "Session response");
+  const status = sessionStatus(input["status"]);
+  const failure = input["failure"] === undefined ? undefined : parseSessionFailure(input["failure"]);
+  const terminalFailure = status === "cancelled" || status === "failed";
+  if (terminalFailure !== (failure !== undefined)) {
+    throw new Error("Session response has an inconsistent failure projection");
+  }
+  if (failure !== undefined && status === "cancelled" !== (failure.code === "cancelled")) {
+    throw new Error("Session response failure code is inconsistent with status");
+  }
+  const actorId = requiredString(input, "actor_id", "Session response");
+  validateTaskId(actorId);
+  return Object.freeze({
+    id: resourceID(input["id"], "Session response.id"),
+    actorId,
+    deploymentId: resourceID(input["deployment_id"], "Session response.deployment_id"),
+    workspaceId: resourceID(input["workspace_id"], "Session response.workspace_id"),
+    ...input["key"] === undefined ? {} : { key: requiredString(input, "key", "Session response") },
+    status,
+    createdAt: timestampString(input["created_at"], "Session response.created_at"),
+    updatedAt: timestampString(input["updated_at"], "Session response.updated_at"),
+    ...input["current_run_id"] === undefined ? {} : { currentRunId: resourceID(input["current_run_id"], "Session response.current_run_id") },
+    ...failure === undefined ? {} : { failure }
+  });
+}
+function parseSessionInputRecord(value) {
+  const input = objectValue(value, "Session input response");
+  if (!Object.hasOwn(input, "data")) {
+    throw new Error("Session input response.data is required");
+  }
+  const data = input["data"];
+  canonicalizeJsonValue(data);
+  const source2 = objectValue(input["source"], "Session input response.source");
+  const type = source2["type"];
+  if (type !== "external" && type !== "run") {
+    throw new Error("Session input response.source.type is invalid");
+  }
+  const parsedSource = type === "external" ? Object.freeze({ type }) : Object.freeze({
+    type,
+    runId: resourceID(source2["run_id"], "Session input response.source.run_id")
+  });
+  return Object.freeze({
+    id: resourceID(input["id"], "Session input response.id"),
+    sequence: safeSequence(input["sequence"], "Session input response.sequence"),
+    data,
+    source: parsedSource,
+    createdAt: timestampString(input["created_at"], "Session input response.created_at")
+  });
+}
+function parseSessionOutputRecord(value) {
+  const input = objectValue(value, "Session output record");
+  if (!Object.hasOwn(input, "data")) {
+    throw new Error("Session output record.data is required");
+  }
+  const provenance = objectValue(input["provenance"], "Session output provenance");
+  return Object.freeze({
+    id: resourceID(input["id"], "Session output record.id"),
+    sequence: safeSequence(input["sequence"], "Session output record.sequence"),
+    data: input["data"],
+    contentType: requiredString(input, "content_type", "Session output record"),
+    createdAt: timestampString(input["created_at"], "Session output record.created_at"),
+    provenance: Object.freeze({
+      runId: resourceID(provenance["run_id"], "Session output provenance.run_id"),
+      attemptNumber: safeSequence(provenance["attempt_number"], "Session output provenance.attempt_number"),
+      deploymentId: resourceID(provenance["deployment_id"], "Session output provenance.deployment_id")
+    })
+  });
+}
+function parseSessionFailure(value) {
+  const input = objectValue(value, "Session failure");
+  const code = requiredString(input, "code", "Session failure");
+  const details = objectValue(input["details"], "Session failure.details");
+  const runId = details["run_id"] === undefined ? undefined : resourceID(details["run_id"], "Session failure.details.run_id");
+  return Object.freeze({
+    code,
+    message: requiredString(input, "message", "Session failure"),
+    details: Object.freeze(runId === undefined ? {} : { runId })
+  });
+}
+function sessionStatus(value, label = "Session response.status") {
+  if (value !== "open" && value !== "closed" && value !== "cancelled" && value !== "failed") {
+    throw new Error(`${label} is invalid`);
+  }
+  return value;
+}
+function requiredString(value, field, label) {
+  const result = value[field];
+  if (typeof result !== "string" || result.length === 0) {
+    throw new Error(`${label}.${field} must be a non-empty string`);
+  }
+  return result;
+}
+function objectValue(value, label) {
+  if (value === null || typeof value !== "object" || Array.isArray(value)) {
+    throw new Error(`${label} must be an object`);
+  }
+  return value;
+}
+function safeSequence(value, label) {
+  if (!Number.isSafeInteger(value) || value < 0) {
+    throw new Error(`${label} must be a non-negative safe integer`);
+  }
+  return value;
+}
+// sdk/typescript/src/internal/strings.ts
+var goSpaceEdges = /^[\u0009-\u000d\u0020\u0085\u00a0\u1680\u2000-\u200a\u2028\u2029\u202f\u205f\u3000]+|[\u0009-\u000d\u0020\u0085\u00a0\u1680\u2000-\u200a\u2028\u2029\u202f\u205f\u3000]+$/gu;
+function trimGoSpace(value) {
+  return value.replace(goSpaceEdges, "");
+}
+export {
+  workspaceRefID,
+  validateQueueName,
+  trimGoSpace,
+  timestampString,
+  runHandleID,
+  resourceID,
+  parseWorkspaceExecResult,
+  parseWorkspaceDeleteReceipt,
+  parseWorkspace,
+  parseSessionOutputRecord,
+  parseSessionInputRecord,
+  parseSession,
+  matchesIgnorePattern,
+  isQueue,
+  installRuntimeOperations,
+  inspectWorkspaceAddress,
+  inspectSandboxDefinition,
+  inspectImage,
+  inspectDefinition,
+  inspectConfig,
+  encodeWorkspaceSecrets,
+  createWorkspaceRef,
+  createRunHandle,
+  canonicalizeJsonValue,
+  brandWorkspaceAddress
+};