@helmr/sdk 0.1.0

package/dist/index.js

@@ -0,0 +1,1023 @@
+// sdk/typescript/src/schema/task.ts
+var TASK_ID_PATTERN = "^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$";
+var TASK_ID_MAX_LENGTH = 128;
+var DEFAULT_MAX_DURATION_SECONDS = 900;
+var MIN_MAX_DURATION_SECONDS = 5;
+var MAX_DURATION_SECONDS = 86400;
+
+class TaskIdError extends Error {
+  name = "TaskIdError";
+  value;
+  constructor(value) {
+    super(`task id must match ${TASK_ID_PATTERN}: ${JSON.stringify(value)}`);
+    this.value = value;
+  }
+}
+function validateTaskId(value) {
+  if (!isValidTaskId(value)) {
+    throw new TaskIdError(value);
+  }
+}
+function isValidTaskId(value) {
+  if (value.length === 0 || value.length > TASK_ID_MAX_LENGTH) {
+    return false;
+  }
+  const first = value.charCodeAt(0);
+  if (!isAsciiAlnum(first)) {
+    return false;
+  }
+  for (let index = 1;index < value.length; index += 1) {
+    const code = value.charCodeAt(index);
+    if (!(isAsciiAlnum(code) || code === 46 || code === 95 || code === 45)) {
+      return false;
+    }
+  }
+  return true;
+}
+
+class TaskMaxDurationError extends Error {
+  name = "TaskMaxDurationError";
+  value;
+  label;
+  constructor(value, label = "task maxDuration") {
+    super(`${label} must be an integer number of seconds between ${MIN_MAX_DURATION_SECONDS} and ${MAX_DURATION_SECONDS}`);
+    this.value = value;
+    this.label = label;
+  }
+}
+function readOptionalMaxDurationSeconds(value, label = "task maxDuration") {
+  if (value === undefined) {
+    return DEFAULT_MAX_DURATION_SECONDS;
+  }
+  if (typeof value === "number" && Number.isInteger(value) && Number.isFinite(value) && value >= MIN_MAX_DURATION_SECONDS && value <= MAX_DURATION_SECONDS) {
+    return value;
+  }
+  throw new TaskMaxDurationError(value, label);
+}
+function validateOptionalMaxDurationSeconds(value, label = "task maxDuration") {
+  readOptionalMaxDurationSeconds(value, label);
+}
+function isAsciiAlnum(code) {
+  return code >= 48 && code <= 57 || code >= 65 && code <= 90 || code >= 97 && code <= 122;
+}
+
+// sdk/typescript/src/internal.ts
+var approvalTimeoutErrorBrand = Symbol.for("helmr.sdk.ApprovalTimeoutError");
+var messageTimeoutErrorBrand = Symbol.for("helmr.sdk.MessageTimeoutError");
+var concurrentWaitErrorBrand = Symbol.for("helmr.sdk.ConcurrentWaitError");
+
+class ApprovalTimeoutError extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "ApprovalTimeoutError";
+    Object.defineProperty(this, approvalTimeoutErrorBrand, { value: true });
+  }
+  static [Symbol.hasInstance](value) {
+    return this === ApprovalTimeoutError && typeof value === "object" && value !== null && approvalTimeoutErrorBrand in value;
+  }
+}
+
+class MessageTimeoutError extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "MessageTimeoutError";
+    Object.defineProperty(this, messageTimeoutErrorBrand, { value: true });
+  }
+  static [Symbol.hasInstance](value) {
+    return this === MessageTimeoutError && typeof value === "object" && value !== null && messageTimeoutErrorBrand in value;
+  }
+}
+
+class ConcurrentWaitError extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "ConcurrentWaitError";
+    Object.defineProperty(this, concurrentWaitErrorBrand, { value: true });
+  }
+  static [Symbol.hasInstance](value) {
+    return this === ConcurrentWaitError && typeof value === "object" && value !== null && concurrentWaitErrorBrand in value;
+  }
+}
+function validateSecretName(name, label = "secret name") {
+  if (name.length === 0) {
+    throw new Error(`${label} must not be empty`);
+  }
+  if (name.length > 128) {
+    throw new Error(`${label} must be at most 128 characters`);
+  }
+  if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(name)) {
+    throw new Error(`${label} must match /^[A-Za-z_][A-Za-z0-9_]*$/`);
+  }
+  const upper = name.toUpperCase();
+  if (upper === "CON" || upper === "PRN" || upper === "AUX" || upper === "NUL" || /^COM[1-9]$/.test(upper) || /^LPT[1-9]$/.test(upper)) {
+    throw new Error(`${label} is reserved`);
+  }
+}
+function validateImageBuildSecretRef(name) {
+  validateSecretName(name, "image build secret ref");
+  return name;
+}
+var RESERVED_WORKSPACE_MOUNT_PATHS = [
+  "/dev",
+  "/opt/helmr",
+  "/proc",
+  "/run",
+  "/sys",
+  "/tmp",
+  "/.helmr-old-root"
+];
+function normalizeWorkspaceMountPath(raw) {
+  if (raw.length === 0) {
+    throw new Error("sandbox.workspace() mountPath is empty");
+  }
+  if (raw.includes("\x00")) {
+    throw new Error("sandbox.workspace() mountPath contains NUL");
+  }
+  if (!raw.startsWith("/")) {
+    throw new Error(`sandbox.workspace() mountPath must be absolute: ${raw}`);
+  }
+  const parts = [];
+  for (const part of raw.split("/")) {
+    if (part === "" || part === ".")
+      continue;
+    if (part === "..") {
+      throw new Error(`sandbox.workspace() mountPath contains unsafe path components: ${raw}`);
+    }
+    parts.push(part);
+  }
+  if (parts.length === 0) {
+    throw new Error("sandbox.workspace() mountPath cannot be /");
+  }
+  const normalized = `/${parts.join("/")}`;
+  if (RESERVED_WORKSPACE_MOUNT_PATHS.some((reserved) => normalized === reserved || normalized.startsWith(`${reserved}/`))) {
+    throw new Error(`sandbox.workspace() mountPath conflicts with reserved runtime mount paths: ${normalized}`);
+  }
+  return normalized;
+}
+var taskBrand = Symbol.for("helmr.sdk.Task");
+var taskOriginBrand = Symbol.for("helmr.sdk.TaskOrigin");
+var configBrand = Symbol.for("helmr.sdk.Config");
+var imageBuilderBrand = Symbol.for("helmr.sdk.ImageBuilder");
+var sandboxBuilderBrand = Symbol.for("helmr.sdk.SandboxBuilder");
+var sourceFileRefBrand = Symbol.for("helmr.sdk.SourceFileRef");
+var sourceDirRefBrand = Symbol.for("helmr.sdk.SourceDirRef");
+function markTask(config) {
+  validateTaskId(config.id);
+  validateOptionalMaxDurationSeconds(config.maxDuration);
+  Object.defineProperty(config, taskBrand, { value: true });
+  Object.defineProperty(config, taskOriginBrand, { value: captureTaskOrigin() });
+  return config;
+}
+function markConfig(config) {
+  Object.defineProperty(config, configBrand, { value: true });
+  return config;
+}
+function captureTaskOrigin() {
+  const stack = new Error().stack ?? "";
+  for (const line of stack.split(`
+`).slice(1)) {
+    const file = stackFrameFile(line);
+    if (file === null || isSdkInternalFrame(file)) {
+      continue;
+    }
+    return file;
+  }
+  return "unknown";
+}
+function stackFrameFile(line) {
+  const match = /\(?((?:file:\/\/)?\/[^():]+):\d+:\d+\)?$/.exec(line.trim());
+  if (!match?.[1]) {
+    return null;
+  }
+  return match[1].startsWith("file://") ? decodeURIComponent(new URL(match[1]).pathname) : match[1];
+}
+function isSdkInternalFrame(file) {
+  return file.includes("/sdk/typescript/src/internal.ts") || file.includes("/sdk/typescript/src/task.ts") || file.includes("/sdk/typescript/src/index.ts") || file.includes("/runtime/typescript/src/");
+}
+
+class ImageBuilderImpl {
+  id;
+  steps;
+  constructor(id, steps = []) {
+    Object.defineProperty(this, imageBuilderBrand, { value: true });
+    this.id = id;
+    this.steps = steps;
+  }
+  from(ref) {
+    return new ImageBuilderImpl(this.id, [...this.steps, { kind: "from", ref }]);
+  }
+  run(argv, opts = {}) {
+    return new ImageBuilderImpl(this.id, [
+      ...this.steps,
+      {
+        kind: "run",
+        argv: [...argv],
+        cache: (opts.cache ?? []).map((binding) => ({
+          mountPath: binding.mountPath,
+          cache: { id: binding.cache.id }
+        })),
+        secrets: (opts.secrets ?? []).map((binding) => ({
+          mountPath: binding.mountPath,
+          secret: validateImageBuildSecretRef(binding.secret)
+        }))
+      }
+    ]);
+  }
+  copy(dest, src) {
+    return new ImageBuilderImpl(this.id, [...this.steps, { kind: "copy", dest, source: src }]);
+  }
+  copyFrom(dest, src, srcPath) {
+    if (!isImageBuilder(src)) {
+      throw new Error("image.copyFrom() requires an ImageBuilder created by image()");
+    }
+    return new ImageBuilderImpl(this.id, [
+      ...this.steps,
+      { kind: "copyFrom", dest, source: src, srcPath }
+    ]);
+  }
+  workdir(path) {
+    return new ImageBuilderImpl(this.id, [...this.steps, { kind: "workdir", path }]);
+  }
+  env(key, value) {
+    return new ImageBuilderImpl(this.id, [...this.steps, { kind: "env", key, value }]);
+  }
+  user(name) {
+    return new ImageBuilderImpl(this.id, [...this.steps, { kind: "user", name }]);
+  }
+}
+
+class SandboxBuilderImpl {
+  id;
+  imageBuilder;
+  workspaceBinding;
+  resourceSpec;
+  constructor(id, imageBuilder, workspaceBinding, resourceSpec) {
+    Object.defineProperty(this, sandboxBuilderBrand, { value: true });
+    this.id = id;
+    this.imageBuilder = imageBuilder;
+    this.workspaceBinding = workspaceBinding;
+    this.resourceSpec = resourceSpec;
+  }
+  image(img) {
+    if (!isImageBuilder(img)) {
+      throw new Error("sandbox.image() requires an ImageBuilder created by image()");
+    }
+    return new SandboxBuilderImpl(this.id, img, this.workspaceBinding, this.resourceSpec);
+  }
+  workspace(mountPath = "/workspace") {
+    return new SandboxBuilderImpl(this.id, this.imageBuilder, { mountPath: normalizeWorkspaceMountPath(mountPath) }, this.resourceSpec);
+  }
+  resources(opts) {
+    const resourceSpec = {
+      ...opts.cpu === undefined ? {} : { cpu: opts.cpu },
+      ...opts.memory === undefined ? {} : { memory: opts.memory }
+    };
+    return new SandboxBuilderImpl(this.id, this.imageBuilder, this.workspaceBinding, resourceSpec);
+  }
+}
+
+class SourceFileRefImpl {
+  path;
+  constructor(path) {
+    Object.defineProperty(this, sourceFileRefBrand, { value: true });
+    this.path = path;
+  }
+}
+
+class SourceDirRefImpl {
+  path;
+  ignore;
+  constructor(path, ignore) {
+    Object.defineProperty(this, sourceDirRefBrand, { value: true });
+    this.path = path;
+    this.ignore = ignore;
+  }
+}
+function isImageBuilder(value) {
+  return hasBrand(value, imageBuilderBrand);
+}
+function hasBrand(value, brand) {
+  return value !== null && typeof value === "object" && value[brand] === true;
+}
+
+// sdk/typescript/src/runtime/errors.ts
+class RunNotFoundError extends Error {
+  runId;
+  constructor(runId) {
+    super(`run ${runId} was not found`);
+    this.name = "RunNotFoundError";
+    this.runId = runId;
+  }
+}
+
+class AuthError extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "AuthError";
+  }
+}
+
+class TimeoutError extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "TimeoutError";
+  }
+}
+
+class UnsupportedTransportError extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "UnsupportedTransportError";
+  }
+}
+
+// sdk/typescript/src/runtime/run.ts
+function runHandle(id, taskId) {
+  return { id, taskId };
+}
+function runSnapshot(snapshot) {
+  const status = runStatus(snapshot.status);
+  return {
+    id: snapshot.id,
+    taskId: snapshot.taskId,
+    status,
+    exitCode: snapshot.exitCode ?? null,
+    createdAt: snapshot.createdAt ?? null,
+    updatedAt: snapshot.updatedAt ?? null,
+    pendingWaitpoint: snapshot.pendingWaitpoint ?? null,
+    ...runStateBooleans(status),
+    ...snapshot.output === undefined ? {} : { output: snapshot.output }
+  };
+}
+function pendingWaitpointFromResponse(runId, wait) {
+  if (wait === undefined || wait === null)
+    return null;
+  if (wait.kind === "approval") {
+    return {
+      kind: "approval",
+      runId,
+      waitpointId: wait.waitpoint_id,
+      message: wait.message ?? "",
+      timeout: wait.timeout ?? null,
+      requestedAt: wait.requested_at
+    };
+  }
+  return {
+    kind: "message",
+    runId,
+    waitpointId: wait.waitpoint_id,
+    prompt: wait.prompt ?? null,
+    timeout: wait.timeout ?? null,
+    requestedAt: wait.requested_at
+  };
+}
+function isTerminalRunStatus(status) {
+  return status === "succeeded" || status === "failed" || status === "cancelled";
+}
+function runId(value) {
+  return typeof value === "string" ? value : value.id;
+}
+function runStateBooleans(status) {
+  return {
+    isQueued: status === "queued",
+    isRunning: status === "claimed" || status === "running",
+    isWaiting: status === "waiting",
+    isTerminal: isTerminalRunStatus(status),
+    isSuccess: status === "succeeded",
+    isFailed: status === "failed",
+    isCancelled: status === "cancelled"
+  };
+}
+function runStatus(status) {
+  switch (status) {
+    case "queued":
+    case "claimed":
+    case "running":
+    case "waiting":
+    case "succeeded":
+    case "failed":
+    case "cancelled":
+      return status;
+    default:
+      throw new Error(`unsupported run status ${JSON.stringify(status)}`);
+  }
+}
+
+// sdk/typescript/src/runtime/source.ts
+function runWorkspaceFromSpec(spec) {
+  return {
+    repository: spec.repository,
+    ref: spec.ref,
+    ...spec.subpath === undefined ? {} : { subpath: spec.subpath }
+  };
+}
+
+// sdk/typescript/src/runtime/client.ts
+class HelmrClient {
+  #baseUrl;
+  #apiKey;
+  constructor(options = {}) {
+    const rawUrl = options.url ?? process.env["HELMR_URL"];
+    if (rawUrl === undefined || rawUrl.trim() === "") {
+      throw new UnsupportedTransportError("HelmrClient requires a url option or HELMR_URL; no default transport is used");
+    }
+    const envApiKey = process.env["HELMR_API_KEY"];
+    const apiKey = options.apiKey ?? envApiKey;
+    let parsedUrl;
+    try {
+      parsedUrl = new URL(rawUrl);
+    } catch {
+      throw new UnsupportedTransportError("HelmrClient requires an http(s) URL");
+    }
+    if (parsedUrl.protocol === "https:") {
+      if (apiKey === undefined || apiKey === "") {
+        throw new AuthError("HelmrClient https:// transport requires apiKey or HELMR_API_KEY");
+      }
+      this.#baseUrl = normalizedBaseUrl(parsedUrl);
+      this.#apiKey = apiKey;
+    } else if (parsedUrl.protocol === "http:") {
+      if (!isLoopbackHost(parsedUrl.hostname)) {
+        throw new UnsupportedTransportError(`refusing to send credentials over plaintext non-loopback URL ${parsedUrl.toString()}`);
+      }
+      console.warn("HelmrClient http:// transport is plaintext and must be explicitly opted into; use https:// for remote services");
+      this.#baseUrl = normalizedBaseUrl(parsedUrl);
+      this.#apiKey = apiKey;
+    } else {
+      throw new UnsupportedTransportError(`unsupported HelmrClient transport scheme ${parsedUrl.protocol.replace(/:$/, "")}`);
+    }
+  }
+  tasks = {
+    trigger: async (task, opts) => {
+      const runWorkspace = runWorkspaceFromSpec(opts.workspace);
+      const maxDurationSeconds = readOptionalMaxDurationSeconds(task.maxDuration);
+      const response = await this.#fetch("/api/runs", {
+        method: "POST",
+        body: JSON.stringify({
+          task_id: task.id,
+          secrets: opts.secrets ?? {},
+          payload: opts.payload,
+          workspace: runWorkspace,
+          max_duration_seconds: maxDurationSeconds
+        }),
+        headers: { "content-type": "application/json" }
+      });
+      const run = await response.json();
+      return runHandle(run.id, run.task_id);
+    }
+  };
+  runs = {
+    retrieve: async (idOrHandle, opts = {}) => {
+      const response = await this.#json(`/api/runs/${encodeURIComponent(runId(idOrHandle))}`, requestSignal(opts.signal));
+      return runResponseToSnapshot(response);
+    },
+    wait: async (idOrHandle, opts = {}) => {
+      const id = runId(idOrHandle);
+      const timeoutMs = opts.timeoutMs;
+      const intervalMs = opts.intervalMs ?? 1000;
+      const started = Date.now();
+      for (;; ) {
+        throwIfAborted(opts.signal);
+        const run = await this.runs.retrieve(id, retrieveOptions(opts.signal));
+        if (isTerminalRunStatus(run.status)) {
+          return run;
+        }
+        if (timeoutMs !== undefined && Date.now() - started > timeoutMs) {
+          throw new TimeoutError(`run ${id} did not finish within ${timeoutMs}ms`);
+        }
+        await delay(intervalMs, opts.signal);
+      }
+    },
+    list: async (opts = {}) => {
+      const query = new URLSearchParams;
+      if (opts.status !== undefined)
+        query.set("status", opts.status);
+      if (opts.limit !== undefined)
+        query.set("limit", String(opts.limit));
+      if (opts.projectId !== undefined)
+        query.set("project_id", opts.projectId);
+      if (opts.environmentId !== undefined)
+        query.set("environment_id", opts.environmentId);
+      const suffix = query.size === 0 ? "" : `?${query}`;
+      const response = await this.#json(`/api/runs${suffix}`, requestSignal(opts.signal));
+      return response.runs.map((run) => runResponseToSnapshot(run));
+    },
+    logs: {
+      retrieve: async (idOrHandle, opts = {}) => {
+        return await this.#retrieveLogs(runId(idOrHandle), opts.signal);
+      }
+    },
+    events: {
+      list: async (idOrHandle, opts = {}) => {
+        return await this.#listEvents(runId(idOrHandle), opts);
+      },
+      subscribe: async (idOrHandle, opts = {}) => {
+        return await this.#subscribeEvents(runId(idOrHandle), opts);
+      }
+    }
+  };
+  waitpoints = {
+    approve: async (target, waitpointIdOrOpts, opts = {}) => {
+      const resolved = resolveWaitpointArgs(target, waitpointIdOrOpts, opts);
+      await this.#fetch(`/api/runs/${encodeURIComponent(resolved.runId)}/waitpoints/${encodeURIComponent(resolved.waitpointId)}/approve`, {
+        method: "POST",
+        body: JSON.stringify(approvalBody(resolved.opts)),
+        headers: { "content-type": "application/json" }
+      });
+    },
+    deny: async (target, waitpointIdOrOpts, opts = {}) => {
+      const resolved = resolveWaitpointArgs(target, waitpointIdOrOpts, opts);
+      await this.#fetch(`/api/runs/${encodeURIComponent(resolved.runId)}/waitpoints/${encodeURIComponent(resolved.waitpointId)}/deny`, {
+        method: "POST",
+        body: JSON.stringify(approvalBody(resolved.opts)),
+        headers: { "content-type": "application/json" }
+      });
+    },
+    reply: async (target, waitpointIdOrOpts, opts) => {
+      const resolved = resolveWaitpointArgs(target, waitpointIdOrOpts, opts);
+      await this.#fetch(`/api/runs/${encodeURIComponent(resolved.runId)}/waitpoints/${encodeURIComponent(resolved.waitpointId)}/message`, {
+        method: "POST",
+        body: JSON.stringify({ text: resolved.opts.text, attachments: [] }),
+        headers: { "content-type": "application/json" }
+      });
+    }
+  };
+  async#retrieveLogs(id, signal) {
+    const response = await this.#json(`/api/runs/${encodeURIComponent(id)}/logs`, requestSignal(signal));
+    return {
+      stdout: decodeBase64Text(response.stdout_base64),
+      stderr: decodeBase64Text(response.stderr_base64),
+      cursor: response.cursor,
+      truncated: response.truncated
+    };
+  }
+  async#listEvents(id, opts) {
+    const events = [];
+    let cursor = opts.cursor;
+    for (;; ) {
+      const query = new URLSearchParams;
+      if (cursor !== undefined)
+        query.set("cursor", String(cursor));
+      if (opts.pageSize !== undefined)
+        query.set("limit", String(opts.pageSize));
+      const suffix = query.size === 0 ? "" : `?${query}`;
+      const page = await this.#json(`/api/runs/${encodeURIComponent(id)}/events${suffix}`, requestSignal(opts.signal));
+      events.push(...page.events);
+      if (page.next_cursor === undefined || page.next_cursor === null) {
+        break;
+      }
+      cursor = page.next_cursor;
+    }
+    return events.map((event) => runEventRecordToRunEvent(event)).filter((event) => event !== undefined);
+  }
+  async#subscribeEvents(id, opts) {
+    const query = new URLSearchParams;
+    query.set("follow", "1");
+    if (opts.cursor !== undefined)
+      query.set("cursor", String(opts.cursor));
+    const response = await this.#fetch(`/api/runs/${encodeURIComponent(id)}/events?${query}`, {
+      headers: { accept: "text/event-stream" },
+      ...requestSignal(opts.signal)
+    });
+    return parseSse(response);
+  }
+  async#json(path, init = {}) {
+    return (await this.#fetch(path, init)).json();
+  }
+  async#fetch(path, init = {}) {
+    const headers = new Headers(init.headers);
+    if (this.#apiKey !== undefined) {
+      headers.set("authorization", `Bearer ${this.#apiKey}`);
+    }
+    const request = {
+      ...init,
+      headers
+    };
+    const response = await fetch(endpointUrl(this.#baseUrl, path), request);
+    if (response.status === 401) {
+      throw new AuthError("Helmr authentication failed");
+    }
+    if (!response.ok) {
+      throw new Error(`Helmr API ${response.status}: ${await response.text()}`);
+    }
+    return response;
+  }
+}
+function normalizedBaseUrl(url) {
+  if (url.search !== "" || url.hash !== "") {
+    throw new UnsupportedTransportError("HelmrClient URL must not include query or fragment");
+  }
+  return url;
+}
+function isLoopbackHost(hostname) {
+  const host = hostname.trim().toLowerCase().replace(/^\[/, "").replace(/\]$/, "");
+  if (host === "localhost" || host === "::1") {
+    return true;
+  }
+  const ipv4 = /^(\d+)\.(\d+)\.(\d+)\.(\d+)$/.exec(host);
+  if (ipv4 === null) {
+    return false;
+  }
+  return ipv4[1] === "127" && ipv4.slice(2).every((part) => Number(part) >= 0 && Number(part) <= 255);
+}
+function endpointUrl(baseUrl, path) {
+  const endpoint = new URL(baseUrl.toString());
+  const queryStart = path.indexOf("?");
+  const pathOnly = queryStart === -1 ? path : path.slice(0, queryStart);
+  const query = queryStart === -1 ? "" : path.slice(queryStart + 1);
+  endpoint.pathname = joinUrlPath(endpoint.pathname, pathOnly);
+  endpoint.search = query;
+  endpoint.hash = "";
+  return endpoint;
+}
+function joinUrlPath(basePath, path) {
+  const base = basePath.replace(/\/+$/, "");
+  const suffix = `/${path.replace(/^\/+/, "")}`;
+  return base === "" ? suffix : `${base}${suffix}`;
+}
+function runResponseToSnapshot(response) {
+  return runSnapshot({
+    id: response.id,
+    taskId: response.task_id,
+    status: response.status,
+    exitCode: response.exit_code ?? null,
+    ...response.created_at === undefined ? {} : { createdAt: response.created_at },
+    ...response.updated_at === undefined ? {} : { updatedAt: response.updated_at },
+    pendingWaitpoint: pendingWaitpointFromResponse(response.id, response.pending_wait),
+    ..."output" in response ? { output: response.output } : {}
+  });
+}
+function approvalBody(opts) {
+  return opts.reason === undefined ? {} : { reason: opts.reason };
+}
+function resolveWaitpointArgs(target, waitpointIdOrOpts, opts) {
+  if (isWaitpointRef(target)) {
+    const resolvedOpts = waitpointIdOrOpts !== undefined && typeof waitpointIdOrOpts !== "string" ? waitpointIdOrOpts : opts;
+    return {
+      runId: target.runId,
+      waitpointId: target.waitpointId,
+      opts: resolvedOpts ?? {}
+    };
+  }
+  if (typeof waitpointIdOrOpts !== "string") {
+    throw new Error("waitpoint id is required when resolving a waitpoint by run id");
+  }
+  return {
+    runId: target,
+    waitpointId: waitpointIdOrOpts,
+    opts: opts ?? {}
+  };
+}
+function isWaitpointRef(value) {
+  if (value === null || typeof value !== "object")
+    return false;
+  const record = value;
+  return typeof record["runId"] === "string" && typeof record["waitpointId"] === "string";
+}
+function retrieveOptions(signal) {
+  return signal === undefined ? {} : { signal };
+}
+function requestSignal(signal) {
+  return signal === undefined ? {} : { signal };
+}
+function throwIfAborted(signal) {
+  if (signal?.aborted !== true)
+    return;
+  if (signal.reason instanceof Error) {
+    throw signal.reason;
+  }
+  throw new Error("operation aborted");
+}
+function delay(ms, signal) {
+  throwIfAborted(signal);
+  return new Promise((resolve, reject) => {
+    const cleanup = () => {
+      clearTimeout(timeout);
+      signal?.removeEventListener("abort", onAbort);
+    };
+    const timeout = setTimeout(() => {
+      cleanup();
+      resolve();
+    }, ms);
+    const onAbort = () => {
+      cleanup();
+      reject(signal?.reason instanceof Error ? signal.reason : new Error("operation aborted"));
+    };
+    signal?.addEventListener("abort", onAbort, { once: true });
+  });
+}
+async function* parseSse(response) {
+  const reader = response.body?.getReader();
+  if (reader === undefined) {
+    return;
+  }
+  const decoder = new TextDecoder;
+  let buffer = "";
+  for (;; ) {
+    const { value, done } = await reader.read();
+    if (done) {
+      return;
+    }
+    buffer += decoder.decode(value, { stream: true });
+    let boundary = findSseBoundary(buffer);
+    while (boundary !== -1) {
+      const delimiter = buffer.startsWith(`\r
+\r
+`, boundary) ? 4 : 2;
+      const raw = buffer.slice(0, boundary);
+      buffer = buffer.slice(boundary + delimiter);
+      const data = raw.split(/\r?\n/).filter((line) => line.startsWith("data:")).map((line) => line.slice(5).trimStart()).join(`
+`);
+      if (data !== "") {
+        const event = runEventRecordToRunEvent(JSON.parse(data));
+        if (event !== undefined) {
+          yield event;
+        }
+      }
+      boundary = findSseBoundary(buffer);
+    }
+  }
+}
+function findSseBoundary(buffer) {
+  const lf = buffer.indexOf(`
+
+`);
+  const crlf = buffer.indexOf(`\r
+\r
+`);
+  if (lf === -1)
+    return crlf;
+  if (crlf === -1)
+    return lf;
+  return Math.min(lf, crlf);
+}
+function runEventRecordToRunEvent(event) {
+  const attributes = objectRecord(event.attributes);
+  const runId2 = event.run_id ?? stringValue(attributes?.["run_id"]) ?? "";
+  if (event.message === "log.stdout" || event.message === "log.stderr") {
+    const stream = event.message === "log.stdout" ? "stdout" : "stderr";
+    return {
+      type: "log",
+      run_id: runId2,
+      stream,
+      bytes: numberValue(attributes?.["bytes"]) ?? 0,
+      observed_seq: numberValue(attributes?.["observed_seq"]) ?? 0,
+      at: event.at
+    };
+  }
+  if (event.message === "waitpoint.requested" && stringValue(attributes?.["kind"]) === "approval") {
+    const message = stringValue(attributes?.["display_text"]);
+    const waitpointId = stringValue(attributes?.["waitpoint_id"]);
+    if (waitpointId === undefined)
+      return;
+    return {
+      type: "approval_request",
+      run_id: runId2,
+      waitpoint_id: waitpointId,
+      message: message ?? "",
+      ...optionalNumber("timeout", attributes?.["timeout"]),
+      at: event.at
+    };
+  }
+  if (event.message === "waitpoint.resolved" && stringValue(attributes?.["kind"]) === "approval") {
+    const waitpointId = stringValue(attributes?.["waitpoint_id"]);
+    const resolution = stringValue(attributes?.["resolution_kind"]);
+    if (waitpointId === undefined)
+      return;
+    if (resolution !== "approved" && resolution !== "denied")
+      return;
+    return {
+      type: "approval_decided",
+      run_id: runId2,
+      waitpoint_id: waitpointId,
+      decision: resolution,
+      ...optionalString("reason", attributes?.["reason"]),
+      at: event.at
+    };
+  }
+  if (event.message === "waitpoint.requested" && stringValue(attributes?.["kind"]) === "message") {
+    const request = objectRecord(attributes?.["request"]);
+    const message = stringValue(attributes?.["display_text"]) ?? stringValue(request?.["prompt"]);
+    const waitpointId = stringValue(attributes?.["waitpoint_id"]);
+    if (waitpointId === undefined)
+      return;
+    return {
+      type: "message_request",
+      run_id: runId2,
+      waitpoint_id: waitpointId,
+      ...optionalString("prompt", message),
+      ...optionalNumber("timeout", attributes?.["timeout"]),
+      at: event.at
+    };
+  }
+  if (event.message === "waitpoint.resolved" && stringValue(attributes?.["kind"]) === "message") {
+    const result = objectRecord(attributes?.["result"]);
+    const text = stringValue(result?.["text"]);
+    const waitpointId = stringValue(attributes?.["waitpoint_id"]);
+    if (waitpointId === undefined)
+      return;
+    if (stringValue(attributes?.["resolution_kind"]) !== "replied")
+      return;
+    return {
+      type: "message_received",
+      run_id: runId2,
+      waitpoint_id: waitpointId,
+      text: text ?? "",
+      at: event.at
+    };
+  }
+  if (event.message.startsWith("emit.")) {
+    return {
+      type: "emit",
+      run_id: runId2,
+      event_type: stringValue(attributes?.["type"]) ?? event.message.slice("emit.".length),
+      content: attributes?.["content"],
+      at: event.at
+    };
+  }
+  if (event.message === "run.completed") {
+    return {
+      type: "task_complete",
+      run_id: runId2,
+      exit_code: numberValue(attributes?.["exit_code"]) ?? 0,
+      at: event.at
+    };
+  }
+  if (event.message === "run.failed") {
+    return {
+      type: "run_failed",
+      run_id: runId2,
+      failure_kind: stringValue(attributes?.["failure_kind"]) ?? "task_failed",
+      detail: attributes?.["detail"],
+      at: event.at
+    };
+  }
+  if (event.message === "run.timeout") {
+    return {
+      type: "run_timeout",
+      run_id: runId2,
+      elapsed_secs: numberValue(attributes?.["elapsed_active_secs"]) ?? 0,
+      limit_secs: numberValue(attributes?.["limit_secs"]) ?? 0,
+      at: event.at
+    };
+  }
+  if (event.message === "run.cancelled") {
+    return {
+      type: "run_cancelled",
+      run_id: runId2,
+      ...optionalString("reason", attributes?.["reason"]),
+      at: event.at
+    };
+  }
+  return;
+}
+function optionalString(key, value) {
+  const text = stringValue(value);
+  return text === undefined ? {} : { [key]: text };
+}
+function optionalNumber(key, value) {
+  return typeof value === "number" ? { [key]: value } : {};
+}
+function objectRecord(value) {
+  return value !== null && typeof value === "object" ? value : undefined;
+}
+function stringValue(value) {
+  return typeof value === "string" ? value : undefined;
+}
+function numberValue(value) {
+  return typeof value === "number" ? value : undefined;
+}
+function decodeBase64Text(value) {
+  const binary = atob(value);
+  const bytes = Uint8Array.from(binary, (char) => char.charCodeAt(0));
+  return new TextDecoder().decode(bytes);
+}
+
+// sdk/typescript/src/sandbox.ts
+var sandbox = (id) => new SandboxBuilderImpl(id);
+
+// sdk/typescript/src/config.ts
+function defineConfig(config) {
+  if (config === null || typeof config !== "object") {
+    throw new Error("defineConfig() requires an object");
+  }
+  if (!("dirs" in config)) {
+    throw new Error("defineConfig({ dirs }) requires a non-empty dirs array");
+  }
+  if (!Array.isArray(config.dirs) || config.dirs.length === 0) {
+    throw new Error("defineConfig({ dirs }) requires a non-empty dirs array");
+  }
+  if (config.project !== undefined) {
+    if (typeof config.project !== "string" || config.project.trim() === "") {
+      throw new Error("defineConfig({ project }) must be a non-empty string");
+    }
+    if (config.project.includes("\x00")) {
+      throw new Error("defineConfig({ project }) must not contain NUL");
+    }
+  }
+  for (const dir of config.dirs) {
+    if (typeof dir !== "string" || dir.trim() === "") {
+      throw new Error("defineConfig({ dirs }) entries must be non-empty strings");
+    }
+    if (dir.includes("\x00")) {
+      throw new Error("defineConfig({ dirs }) entries must not contain NUL");
+    }
+  }
+  if (config.ignorePatterns !== undefined) {
+    if (!Array.isArray(config.ignorePatterns)) {
+      throw new Error("defineConfig({ ignorePatterns }) must be an array of strings");
+    }
+    for (const pattern of config.ignorePatterns) {
+      if (typeof pattern !== "string" || pattern.trim() === "") {
+        throw new Error("defineConfig({ ignorePatterns }) entries must be non-empty strings");
+      }
+      if (pattern.includes("\x00")) {
+        throw new Error("defineConfig({ ignorePatterns }) entries must not contain NUL");
+      }
+    }
+  }
+  return markConfig({
+    ...config.project === undefined ? {} : { project: config.project },
+    dirs: [...config.dirs],
+    ...config.ignorePatterns === undefined ? {} : { ignorePatterns: [...config.ignorePatterns] }
+  });
+}
+
+// sdk/typescript/src/task.ts
+function task(config) {
+  return markTask(config);
+}
+
+// sdk/typescript/src/trigger.ts
+var defaultClient;
+function getDefaultClient() {
+  defaultClient ??= new HelmrClient;
+  return defaultClient;
+}
+var tasks = {
+  trigger(task2, opts) {
+    return getDefaultClient().tasks.trigger(task2, opts);
+  }
+};
+// sdk/typescript/src/index.ts
+var image = (id) => new ImageBuilderImpl(id);
+var cache = (id) => ({ id });
+var source = {
+  file(path) {
+    return new SourceFileRefImpl(path);
+  },
+  directory(path, opts) {
+    return new SourceDirRefImpl(path, opts?.ignore ? [...opts.ignore] : []);
+  }
+};
+var workspace = {
+  github(repo, opts) {
+    const [org, name, extra] = repo.split("/");
+    if (!org || !name || extra !== undefined) {
+      throw new Error('workspace.github() repo must be "org/repo"');
+    }
+    const ref = opts.ref.trim();
+    if (!ref) {
+      throw new Error("workspace.github() ref is required");
+    }
+    if (ref.includes("\x00")) {
+      throw new Error("workspace.github() ref must not contain NUL");
+    }
+    return {
+      kind: "github",
+      repository: repo,
+      ref,
+      ...opts.subpath === undefined ? {} : { subpath: opts.subpath }
+    };
+  }
+};
+var runs = new Proxy({}, {
+  get(_target, property, receiver) {
+    return Reflect.get(getDefaultClient().runs, property, receiver);
+  }
+});
+var waitpoints = new Proxy({}, {
+  get(_target, property, receiver) {
+    return Reflect.get(getDefaultClient().waitpoints, property, receiver);
+  }
+});
+export {
+  workspace,
+  waitpoints,
+  validateSecretName,
+  tasks,
+  task,
+  source,
+  sandbox,
+  runs,
+  image,
+  defineConfig,
+  cache,
+  UnsupportedTransportError,
+  TimeoutError,
+  RunNotFoundError,
+  MessageTimeoutError,
+  HelmrClient,
+  ConcurrentWaitError,
+  AuthError,
+  ApprovalTimeoutError
+};