@oxygen-agent/cli 1.45.4

package/node_modules/@oxygen/workflows/dist/index.js

@@ -0,0 +1,983 @@
+import { createHash } from "node:crypto";
+import * as vm from "node:vm";
+export const WORKFLOW_MANIFEST_VERSION = 1;
+export const WORKFLOW_COMPILER_VERSION = "oxygen-workflows-v1";
+export const DURABLE_RECIPE_COMPILER_VERSION = "oxygen-recipes-v2";
+export const MAX_RECIPE_BUNDLE_BYTES = 2_000_000;
+export const DEFAULT_WORKFLOW_CRON_TIMEZONE = "UTC";
+// Compatibility and determinism lint only. The Vercel sandbox process,
+// denied network policy, and runtime global guards are the security boundary.
+const UNSAFE_RECIPE_BUNDLE_PATTERNS = [
+    { token: "globalThis", pattern: /\bglobalThis\b/ },
+    { token: "global", pattern: /\bglobal\b/ },
+    { token: "process", pattern: /\bprocess\b/ },
+    { token: "fetch", pattern: /\bfetch\b/ },
+    { token: "XMLHttpRequest", pattern: /\bXMLHttpRequest\b/ },
+    { token: "WebSocket", pattern: /\bWebSocket\b/ },
+    { token: "EventSource", pattern: /\bEventSource\b/ },
+    { token: "require", pattern: /\brequire\b/ },
+    { token: "dynamic import", pattern: /\bimport(?:\s|\/\*[\s\S]*?\*\/)*\(/ },
+    { token: "node module import", pattern: /\b(?:node:)?(?:fs|child_process|net|tls|http|https|dns|dgram|worker_threads)\b/ },
+    { token: "eval", pattern: /\beval\b/ },
+    { token: "Function", pattern: /\bFunction\b/ },
+    { token: "constructor", pattern: /\bconstructor\b/ },
+    { token: "Date.now", pattern: /\bDate\s*\.\s*now\b/ },
+    { token: "new Date", pattern: /\bnew\s+Date\b/ },
+    { token: "Math.random", pattern: /\bMath\s*\.\s*random\b/ },
+    { token: "crypto.randomUUID", pattern: /\bcrypto\s*\.\s*randomUUID\b/ },
+    { token: "setTimeout", pattern: /\bsetTimeout\b/ },
+    { token: "setInterval", pattern: /\bsetInterval\b/ },
+];
+export function defineWorkflow(input) {
+    return {
+        __oxygen_workflow_definition: true,
+        id: input.id,
+        name: input.name,
+        ...(input.status ? { status: input.status } : {}),
+        ...(input.specification ? { specification: input.specification } : {}),
+        ...(input.trigger ? { trigger: input.trigger } : {}),
+        ...(input.inputSchema ? { inputSchema: input.inputSchema } : {}),
+        steps: input.steps,
+    };
+}
+export function apiTrigger(input = {}) {
+    return {
+        type: "api",
+        ...(input.status ? { status: input.status } : {}),
+    };
+}
+export function webhookTrigger(input) {
+    return {
+        type: "webhook",
+        trigger_id: input.id,
+        ...(input.name !== undefined ? { trigger_name: input.name } : {}),
+        secret_required: input.secret ?? true,
+        ...(input.idempotencyKeyPath !== undefined
+            ? { idempotency_key_path: input.idempotencyKeyPath }
+            : {}),
+        ...(input.status ? { status: input.status } : {}),
+    };
+}
+export function cronTrigger(input) {
+    return {
+        type: "cron",
+        cron: input.cron,
+        ...(input.timezone !== undefined ? { timezone: input.timezone } : {}),
+        ...(input.status ? { status: input.status } : {}),
+    };
+}
+export function eventTrigger(input) {
+    return {
+        type: "event",
+        source: input.source,
+        event: input.event,
+        ...(input.filters ? { filters: input.filters } : {}),
+        ...(input.idempotencyKeyPath !== undefined
+            ? { idempotency_key_path: input.idempotencyKeyPath }
+            : {}),
+        ...(input.status ? { status: input.status } : {}),
+    };
+}
+export function nextCronRunAfter(input) {
+    const schedule = parseCronSchedule(input.cron);
+    const timezone = input.timezone?.trim() || DEFAULT_WORKFLOW_CRON_TIMEZONE;
+    let candidate = roundUpToNextMinute(input.after ?? new Date());
+    const deadline = candidate.getTime() + 370 * 24 * 60 * 60 * 1000;
+    while (candidate.getTime() <= deadline) {
+        if (matchesCronSchedule(schedule, zonedDateParts(candidate, timezone))) {
+            return candidate;
+        }
+        candidate = new Date(candidate.getTime() + 60_000);
+    }
+    throw new Error("Cron expression has no matching run time in the next 370 days.");
+}
+export function transformStep(input) {
+    return {
+        __oxygen_workflow_step: true,
+        kind: "transform",
+        id: input.id,
+        ...(input.description ? { description: input.description } : {}),
+        run: input.run,
+    };
+}
+export function toolStep(input) {
+    return {
+        __oxygen_workflow_step: true,
+        kind: "tool",
+        id: input.id,
+        ...(input.description ? { description: input.description } : {}),
+        tool: input.tool,
+        ...(input.effect ? { effect: input.effect } : {}),
+        ...(input.mode ? { mode: input.mode } : {}),
+        payload: input.payload,
+    };
+}
+export function isWorkflowDefinition(value) {
+    return isRecord(value) && value.__oxygen_workflow_definition === true;
+}
+export function isWorkflowManifest(value) {
+    return isRecord(value)
+        && value.manifest_version === WORKFLOW_MANIFEST_VERSION
+        && Array.isArray(value.steps);
+}
+export function isRecipeManifest(value) {
+    return isRecord(value)
+        && value.manifest_version === WORKFLOW_MANIFEST_VERSION
+        && value.compiler_version === DURABLE_RECIPE_COMPILER_VERSION;
+}
+export function isDurableRecipeManifest(value) {
+    return isRecipeManifest(value);
+}
+export function isAnyWorkflowManifest(value) {
+    return isWorkflowManifest(value) || isRecipeManifest(value);
+}
+export function compileWorkflowDefinition(definition, options = {}) {
+    const sourceHash = options.sourceHash
+        ?? hashWorkflowSource(options.source ?? JSON.stringify(definition, workflowJsonReplacer));
+    const manifest = {
+        manifest_version: WORKFLOW_MANIFEST_VERSION,
+        workflow: {
+            id: definition.id,
+            name: definition.name,
+            ...(definition.status ? { status: definition.status } : {}),
+        },
+        ...(definition.specification ? { specification: definition.specification } : {}),
+        ...(definition.trigger ? { trigger: definition.trigger } : {}),
+        ...(definition.inputSchema ? { input_schema: definition.inputSchema } : {}),
+        steps: definition.steps.map((step) => {
+            if (step.kind === "transform") {
+                return {
+                    kind: "transform",
+                    id: step.id,
+                    ...(step.description ? { description: step.description } : {}),
+                    run_source: serializeWorkflowFunction(step.run, `steps.${step.id}.run`),
+                };
+            }
+            return {
+                kind: "tool",
+                id: step.id,
+                ...(step.description ? { description: step.description } : {}),
+                tool: step.tool,
+                effect: step.effect ?? "external_read",
+                ...(step.mode ? { mode: step.mode } : {}),
+                payload_source: serializeWorkflowFunction(step.payload, `steps.${step.id}.payload`),
+            };
+        }),
+        source_hash: sourceHash,
+        compiler_version: WORKFLOW_COMPILER_VERSION,
+        created_at: (options.createdAt ?? new Date()).toISOString(),
+    };
+    assertWorkflowManifest(manifest);
+    return manifest;
+}
+export function buildRecipeManifest(input) {
+    const bundle = input.bundle;
+    if (typeof bundle !== "string" || bundle.length === 0) {
+        throw new Error("Recipe bundle source is required.");
+    }
+    const sourceHash = input.sourceHash ?? hashWorkflowSource(bundle);
+    const manifest = {
+        manifest_version: WORKFLOW_MANIFEST_VERSION,
+        workflow: {
+            id: input.workflowId,
+            name: input.workflowName,
+            ...(input.status ? { status: input.status } : {}),
+        },
+        ...(input.trigger ? { trigger: input.trigger } : {}),
+        ...(input.inputSchema ? { input_schema: input.inputSchema } : {}),
+        runtime: "durable",
+        bundle,
+        bundle_format: "esm",
+        tools_used: Array.from(new Set((input.toolsUsed ?? []).filter(Boolean))).sort(),
+        source_hash: sourceHash,
+        compiler_version: DURABLE_RECIPE_COMPILER_VERSION,
+        created_at: (input.createdAt ?? new Date()).toISOString(),
+    };
+    return manifest;
+}
+export function lintWorkflowManifest(value, options = {}) {
+    if (isRecord(value)
+        && typeof value.compiler_version === "string"
+        && value.compiler_version.startsWith("oxygen-recipes-")) {
+        return lintRecipeManifest(value, options);
+    }
+    const issues = [];
+    const add = (path, code, message) => issues.push({ path, code, message });
+    if (!isRecord(value)) {
+        add("$", "invalid_manifest", "Workflow manifest must be an object.");
+        return { ok: false, issues };
+    }
+    if (value.manifest_version !== WORKFLOW_MANIFEST_VERSION) {
+        add("$.manifest_version", "invalid_manifest_version", "Workflow manifest version must be 1.");
+    }
+    const workflow = value.workflow;
+    if (!isRecord(workflow)) {
+        add("$.workflow", "missing_workflow", "Workflow metadata is required.");
+    }
+    else {
+        if (!isNonEmptyString(workflow.id))
+            add("$.workflow.id", "invalid_workflow_id", "Workflow id is required.");
+        if (!isNonEmptyString(workflow.name))
+            add("$.workflow.name", "invalid_workflow_name", "Workflow name is required.");
+        if (workflow.status !== undefined && workflow.status !== "active" && workflow.status !== "disabled") {
+            add("$.workflow.status", "invalid_workflow_status", "Workflow status must be active or disabled.");
+        }
+    }
+    if (value.trigger !== undefined)
+        validateTrigger(value.trigger, "$.trigger", add);
+    if (!Array.isArray(value.steps) || value.steps.length === 0) {
+        add("$.steps", "missing_steps", "At least one workflow step is required.");
+    }
+    else {
+        const ids = new Set();
+        value.steps.forEach((step, index) => {
+            const path = `$.steps.${index}`;
+            if (!isRecord(step)) {
+                add(path, "invalid_step", "Workflow step must be an object.");
+                return;
+            }
+            if (!isNonEmptyString(step.id)) {
+                add(`${path}.id`, "invalid_step_id", "Step id is required.");
+            }
+            else if (ids.has(step.id)) {
+                add(`${path}.id`, "duplicate_step_id", `Step id '${step.id}' is duplicated.`);
+            }
+            else {
+                ids.add(step.id);
+            }
+            if (step.kind === "transform") {
+                if (!isNonEmptyString(step.run_source)) {
+                    add(`${path}.run_source`, "missing_step_code", "Transform step run_source is required.");
+                }
+                else {
+                    validatePureFunctionSource(step.run_source, `${path}.run_source`, add);
+                }
+                return;
+            }
+            if (step.kind === "tool") {
+                if (!isNonEmptyString(step.tool)) {
+                    add(`${path}.tool`, "missing_tool", "Tool step tool id is required.");
+                }
+                else if (isWorkflowToolRejected(step.tool)) {
+                    add(`${path}.tool`, "unsupported_workflow_tool", `Tool '${step.tool}' is not allowed in workflow automations.`);
+                }
+                else if (options.isToolAllowed && !options.isToolAllowed(step.tool)) {
+                    add(`${path}.tool`, "tool_not_allowed", `Tool '${step.tool}' is not available for workflow automations.`);
+                }
+                if (!isNonEmptyString(step.payload_source)) {
+                    add(`${path}.payload_source`, "missing_step_code", "Tool step payload_source is required.");
+                }
+                else {
+                    validatePureFunctionSource(step.payload_source, `${path}.payload_source`, add);
+                }
+                if (step.effect !== "none"
+                    && step.effect !== "external_read"
+                    && step.effect !== "external_write") {
+                    add(`${path}.effect`, "invalid_step_effect", "Step effect is invalid.");
+                }
+                if (step.mode !== undefined
+                    && step.mode !== "dry_run"
+                    && step.mode !== "live"
+                    && step.mode !== "smoke_test") {
+                    add(`${path}.mode`, "invalid_step_mode", "Step mode is invalid.");
+                }
+                return;
+            }
+            add(`${path}.kind`, "invalid_step_kind", "Step kind must be transform or tool.");
+        });
+    }
+    if (!isNonEmptyString(value.source_hash)) {
+        add("$.source_hash", "missing_source_hash", "Manifest source_hash is required.");
+    }
+    if (!isNonEmptyString(value.compiler_version)) {
+        add("$.compiler_version", "missing_compiler_version", "Manifest compiler_version is required.");
+    }
+    return { ok: issues.length === 0, issues };
+}
+export function lintRecipeManifest(value, options = {}) {
+    const issues = [];
+    const add = (path, code, message) => issues.push({ path, code, message });
+    if (!isRecord(value)) {
+        add("$", "invalid_manifest", "Recipe manifest must be an object.");
+        return { ok: false, issues };
+    }
+    if (value.manifest_version !== WORKFLOW_MANIFEST_VERSION) {
+        add("$.manifest_version", "invalid_manifest_version", "Recipe manifest version must be 1.");
+    }
+    if (value.compiler_version !== DURABLE_RECIPE_COMPILER_VERSION) {
+        add("$.compiler_version", "invalid_compiler_version", `Recipe manifest compiler_version must be '${DURABLE_RECIPE_COMPILER_VERSION}'.`);
+    }
+    const workflow = value.workflow;
+    if (!isRecord(workflow)) {
+        add("$.workflow", "missing_workflow", "Recipe metadata is required.");
+    }
+    else {
+        if (!isNonEmptyString(workflow.id))
+            add("$.workflow.id", "invalid_workflow_id", "Recipe id is required.");
+        if (!isNonEmptyString(workflow.name))
+            add("$.workflow.name", "invalid_workflow_name", "Recipe name is required.");
+        if (workflow.status !== undefined && workflow.status !== "active" && workflow.status !== "disabled") {
+            add("$.workflow.status", "invalid_workflow_status", "Recipe status must be active or disabled.");
+        }
+    }
+    if (value.trigger !== undefined)
+        validateTrigger(value.trigger, "$.trigger", add);
+    if (!isNonEmptyString(value.bundle)) {
+        add("$.bundle", "missing_bundle", "Recipe bundle is required.");
+    }
+    else if (Buffer.byteLength(value.bundle, "utf8") > MAX_RECIPE_BUNDLE_BYTES) {
+        add("$.bundle", "bundle_too_large", "Recipe bundle exceeds the maximum allowed size.");
+    }
+    else {
+        validateRecipeBundleSafety(value.bundle, "$.bundle", add);
+    }
+    if (value.bundle_format !== "esm") {
+        add("$.bundle_format", "invalid_bundle_format", "Recipe bundle_format must be 'esm'.");
+    }
+    if (value.runtime !== "durable") {
+        add("$.runtime", "invalid_recipe_runtime", "Durable recipe manifests must set runtime to durable.");
+    }
+    if (Array.isArray(value.tools_used)) {
+        if (value.tools_used.length === 0) {
+            add("$.tools_used", "missing_recipe_tools", "Durable recipes must declare at least one allowed tool.");
+        }
+        value.tools_used.forEach((toolId, index) => {
+            if (typeof toolId !== "string" || !toolId.trim()) {
+                add(`$.tools_used.${index}`, "invalid_tool_id", "Recipe tools_used entries must be non-empty strings.");
+            }
+            else if (isWorkflowToolRejected(toolId)) {
+                add(`$.tools_used.${index}`, "unsupported_workflow_tool", `Tool '${toolId}' is not allowed in durable recipes.`);
+            }
+            else if (options.isToolAllowed && !options.isToolAllowed(toolId)) {
+                add(`$.tools_used.${index}`, "tool_not_allowed", `Tool '${toolId}' is not available for durable recipes.`);
+            }
+        });
+    }
+    else if (value.tools_used !== undefined) {
+        add("$.tools_used", "invalid_tools_used", "Recipe tools_used must be an array of tool ids.");
+    }
+    else {
+        add("$.tools_used", "missing_recipe_tools", "Durable recipes must declare at least one allowed tool.");
+    }
+    if (!isNonEmptyString(value.source_hash)) {
+        add("$.source_hash", "missing_source_hash", "Recipe manifest source_hash is required.");
+    }
+    return { ok: issues.length === 0, issues };
+}
+export function assertRecipeManifest(value, options = {}) {
+    const result = lintRecipeManifest(value, options);
+    if (result.ok)
+        return;
+    const first = result.issues[0];
+    throw new Error(first ? `${first.code}: ${first.message}` : "Invalid recipe manifest.");
+}
+export function assertWorkflowManifest(value, options = {}) {
+    const result = lintWorkflowManifest(value, options);
+    if (result.ok)
+        return;
+    const first = result.issues[0];
+    throw new Error(first ? `${first.code}: ${first.message}` : "Invalid workflow manifest.");
+}
+export function validateJsonSchemaValue(value, schema, path = "$") {
+    if (!schema || typeof schema !== "object" || Array.isArray(schema))
+        return [];
+    const issues = [];
+    validateJsonSchemaValueInto(value, schema, path, issues);
+    return issues;
+}
+export function assertRecipeBundleSafe(bundle) {
+    const issues = lintRecipeBundleSafety(bundle, "$.bundle");
+    const first = issues[0];
+    if (first)
+        throw new Error(`${first.code}: ${first.message}`);
+}
+export function lintRecipeBundleSafety(bundle, path = "$.bundle") {
+    const issues = [];
+    validateRecipeBundleSafety(bundle, path, (issuePath, code, message) => {
+        issues.push({ path: issuePath, code, message });
+    });
+    return issues;
+}
+export async function runPureWorkflowFunction(input) {
+    const timeoutMs = Math.max(10, Math.min(input.timeoutMs ?? 1_000, 10_000));
+    const maxOutputBytes = Math.max(1_000, Math.min(input.maxOutputBytes ?? 250_000, 2_000_000));
+    const issues = [];
+    validatePureFunctionSource(input.source, "$.source", (path, code, message) => {
+        issues.push({ path, code, message });
+    });
+    if (issues.length > 0) {
+        const first = issues[0];
+        throw new Error(first ? `${first.code}: ${first.message}` : "Invalid workflow function source.");
+    }
+    const context = toJsonValue(input.context, "context");
+    const sandbox = Object.create(null);
+    sandbox.__oxygen_context = context;
+    const script = new vm.Script(`"use strict";\nconst __oxygen_fn = (${input.source});\n__oxygen_fn(__oxygen_context);`);
+    const result = script.runInNewContext(sandbox, { timeout: timeoutMs });
+    const resolved = isPromiseLike(result)
+        ? await withTimeout(result, timeoutMs)
+        : result;
+    return enforceJsonOutput(resolved, maxOutputBytes);
+}
+export function getWorkflowApplySchema() {
+    return workflowApplySchema;
+}
+export function getWorkflowSchema(subject = "apply") {
+    const schemas = {
+        apply: workflowApplySchema,
+        call: workflowCallSchema,
+        event: workflowEventEmitSchema,
+        trigger: workflowTriggerSchema,
+        manifest: workflowManifestSchema,
+    };
+    if (subject === "all")
+        return { schemas };
+    return schemas[subject];
+}
+export const workflowApplySchema = {
+    $schema: "https://json-schema.org/draft/2020-12/schema",
+    title: "OXYGEN Workflow Apply Input",
+    type: "object",
+    additionalProperties: false,
+    properties: {
+        manifest: { $ref: "#/$defs/manifest" },
+    },
+    required: ["manifest"],
+    $defs: {
+        manifest: { type: "object", additionalProperties: true },
+    },
+};
+export const workflowCallSchema = {
+    $schema: "https://json-schema.org/draft/2020-12/schema",
+    title: "OXYGEN Workflow Call Input",
+    type: "object",
+    additionalProperties: false,
+    properties: {
+        workflow_id: { type: "string" },
+        workflow_name: { type: "string" },
+        input: { type: "object", additionalProperties: true },
+        mode: { enum: ["dry_run", "live", "smoke_test"] },
+        idempotency_key: { type: "string" },
+    },
+};
+export const workflowEventEmitSchema = {
+    $schema: "https://json-schema.org/draft/2020-12/schema",
+    title: "OXYGEN Workflow Event Emit Input",
+    type: "object",
+    additionalProperties: false,
+    properties: {
+        source: { type: "string" },
+        event: { type: "string" },
+        payload: { type: "object", additionalProperties: true },
+        raw_payload: { type: "object", additionalProperties: true },
+        headers: { type: "object", additionalProperties: true },
+        external_event_id: { type: "string" },
+        idempotency_key: { type: "string" },
+        mode: { enum: ["dry_run", "live", "smoke_test"] },
+    },
+    required: ["source", "event", "payload"],
+};
+export const workflowTriggerSchema = {
+    $schema: "https://json-schema.org/draft/2020-12/schema",
+    title: "OXYGEN Workflow Trigger",
+    type: "object",
+    additionalProperties: false,
+    properties: {
+        type: { enum: ["api", "webhook", "cron"] },
+        trigger_id: { type: "string" },
+        trigger_name: { type: ["string", "null"] },
+        secret_required: { type: "boolean" },
+        idempotency_key_path: { type: ["string", "null"] },
+        cron: { type: "string" },
+        timezone: { type: ["string", "null"] },
+        source: { type: "string" },
+        event: { type: "string" },
+        filters: {
+            type: "array",
+            items: {
+                type: "object",
+                additionalProperties: false,
+                properties: {
+                    path: { type: "string" },
+                    op: { enum: ["eq", "neq", "exists", "not_exists"] },
+                    value: {},
+                },
+                required: ["path", "op"],
+            },
+        },
+        status: { enum: ["active", "disabled"] },
+    },
+    required: ["type"],
+};
+export const workflowManifestSchema = {
+    $schema: "https://json-schema.org/draft/2020-12/schema",
+    title: "OXYGEN Workflow Manifest",
+    type: "object",
+    additionalProperties: true,
+    required: ["manifest_version", "workflow", "steps", "source_hash", "compiler_version"],
+};
+function validateJsonSchemaValueInto(value, schema, path, issues) {
+    const startCount = issues.length;
+    if (schema.const !== undefined && !jsonEqual(value, schema.const)) {
+        issues.push({
+            path,
+            code: "schema_const_mismatch",
+            message: `${path} must equal the schema const value.`,
+        });
+        return;
+    }
+    if (Array.isArray(schema.enum) && schema.enum.length > 0 && !schema.enum.some((entry) => jsonEqual(value, entry))) {
+        issues.push({
+            path,
+            code: "schema_enum_mismatch",
+            message: `${path} must be one of the allowed values.`,
+        });
+        return;
+    }
+    if (Array.isArray(schema.anyOf) && schema.anyOf.length > 0) {
+        const matched = schema.anyOf.some((candidate) => {
+            const candidateIssues = [];
+            validateJsonSchemaValueInto(value, candidate, path, candidateIssues);
+            return candidateIssues.length === 0;
+        });
+        if (!matched) {
+            issues.push({
+                path,
+                code: "schema_any_of_mismatch",
+                message: `${path} must match at least one allowed schema.`,
+            });
+        }
+        return;
+    }
+    const expectedTypes = normalizeSchemaTypes(schema);
+    if (expectedTypes.length > 0 && !expectedTypes.some((type) => matchesJsonSchemaType(value, type))) {
+        issues.push({
+            path,
+            code: "schema_type_mismatch",
+            message: `${path} must be ${formatSchemaTypes(expectedTypes)}.`,
+        });
+        return;
+    }
+    const shouldValidateObject = expectedTypes.includes("object")
+        || Boolean(schema.properties)
+        || Array.isArray(schema.required)
+        || schema.additionalProperties !== undefined;
+    if (shouldValidateObject && isRecord(value)) {
+        const properties = schema.properties ?? {};
+        for (const requiredKey of schema.required ?? []) {
+            if (!Object.hasOwn(value, requiredKey) || value[requiredKey] === undefined) {
+                issues.push({
+                    path: `${path}.${requiredKey}`,
+                    code: "schema_required",
+                    message: `${path}.${requiredKey} is required.`,
+                });
+            }
+        }
+        for (const [key, propertyValue] of Object.entries(value)) {
+            const propertySchema = properties[key];
+            if (propertySchema) {
+                validateJsonSchemaValueInto(propertyValue, propertySchema, `${path}.${key}`, issues);
+            }
+            else if (schema.additionalProperties === false) {
+                issues.push({
+                    path: `${path}.${key}`,
+                    code: "schema_additional_property",
+                    message: `${path}.${key} is not allowed.`,
+                });
+            }
+            else if (isRecord(schema.additionalProperties)) {
+                validateJsonSchemaValueInto(propertyValue, schema.additionalProperties, `${path}.${key}`, issues);
+            }
+        }
+    }
+    const shouldValidateArray = expectedTypes.includes("array") || Boolean(schema.items);
+    if (shouldValidateArray && Array.isArray(value) && schema.items) {
+        value.forEach((entry, index) => {
+            validateJsonSchemaValueInto(entry, schema.items, `${path}.${index}`, issues);
+        });
+    }
+    if (issues.length > startCount)
+        return;
+}
+function normalizeSchemaTypes(schema) {
+    if (Array.isArray(schema.type))
+        return schema.type.filter((entry) => typeof entry === "string");
+    if (typeof schema.type === "string")
+        return [schema.type];
+    if (schema.properties || schema.required || schema.additionalProperties !== undefined)
+        return ["object"];
+    if (schema.items)
+        return ["array"];
+    return [];
+}
+function matchesJsonSchemaType(value, type) {
+    switch (type) {
+        case "array":
+            return Array.isArray(value);
+        case "boolean":
+            return typeof value === "boolean";
+        case "integer":
+            return typeof value === "number" && Number.isInteger(value);
+        case "null":
+            return value === null;
+        case "number":
+            return typeof value === "number" && Number.isFinite(value);
+        case "object":
+            return isRecord(value);
+        case "string":
+            return typeof value === "string";
+        default:
+            return true;
+    }
+}
+function formatSchemaTypes(types) {
+    if (types.length === 1)
+        return `a ${types[0]}`;
+    return types.map((type) => type === "null" ? "null" : `a ${type}`).join(" or ");
+}
+function jsonEqual(left, right) {
+    return JSON.stringify(left) === JSON.stringify(right);
+}
+function validateTrigger(value, path, add) {
+    if (!isRecord(value)) {
+        add(path, "invalid_trigger", "Workflow trigger must be an object.");
+        return;
+    }
+    if (value.status !== undefined && value.status !== "active" && value.status !== "disabled") {
+        add(`${path}.status`, "invalid_trigger_status", "Trigger status must be active or disabled.");
+    }
+    if (value.type === "api")
+        return;
+    if (value.type === "webhook") {
+        if (!isNonEmptyString(value.trigger_id)) {
+            add(`${path}.trigger_id`, "invalid_trigger_id", "Webhook trigger_id is required.");
+        }
+        if (value.idempotency_key_path !== undefined
+            && value.idempotency_key_path !== null
+            && !isNonEmptyString(value.idempotency_key_path)) {
+            add(`${path}.idempotency_key_path`, "invalid_idempotency_key_path", "Webhook idempotency path is invalid.");
+        }
+        return;
+    }
+    if (value.type === "cron") {
+        if (!isNonEmptyString(value.cron)) {
+            add(`${path}.cron`, "invalid_cron", "Cron trigger cron expression is required.");
+        }
+        else {
+            try {
+                parseCronSchedule(value.cron);
+            }
+            catch (error) {
+                add(`${path}.cron`, "invalid_cron", error instanceof Error ? error.message : "Cron expression is invalid.");
+            }
+        }
+        return;
+    }
+    if (value.type === "event") {
+        if (!isNonEmptyString(value.source)) {
+            add(`${path}.source`, "invalid_event_source", "Event trigger source is required.");
+        }
+        if (!isNonEmptyString(value.event)) {
+            add(`${path}.event`, "invalid_event_type", "Event trigger event is required.");
+        }
+        if (value.idempotency_key_path !== undefined
+            && value.idempotency_key_path !== null
+            && !isNonEmptyString(value.idempotency_key_path)) {
+            add(`${path}.idempotency_key_path`, "invalid_idempotency_key_path", "Event idempotency path is invalid.");
+        }
+        if (value.filters !== undefined)
+            validateEventFilters(value.filters, `${path}.filters`, add);
+        return;
+    }
+    add(`${path}.type`, "invalid_trigger_type", "Trigger type must be api, webhook, cron, or event.");
+}
+function validateEventFilters(value, path, add) {
+    if (!Array.isArray(value)) {
+        add(path, "invalid_event_filters", "Event trigger filters must be an array.");
+        return;
+    }
+    value.forEach((filter, index) => {
+        const filterPath = `${path}.${index}`;
+        if (!isRecord(filter)) {
+            add(filterPath, "invalid_event_filter", "Event trigger filter must be an object.");
+            return;
+        }
+        if (!isNonEmptyString(filter.path)) {
+            add(`${filterPath}.path`, "invalid_event_filter_path", "Event filter path is required.");
+        }
+        if (filter.op !== "eq"
+            && filter.op !== "neq"
+            && filter.op !== "exists"
+            && filter.op !== "not_exists") {
+            add(`${filterPath}.op`, "invalid_event_filter_op", "Event filter op is invalid.");
+        }
+        if ((filter.op === "eq" || filter.op === "neq") && !Object.hasOwn(filter, "value")) {
+            add(`${filterPath}.value`, "missing_event_filter_value", "Event eq/neq filters require a value.");
+        }
+    });
+}
+function serializeWorkflowFunction(fn, path) {
+    if (typeof fn !== "function") {
+        throw new Error(`${path} must be a function.`);
+    }
+    const source = Function.prototype.toString.call(fn);
+    const issues = [];
+    validatePureFunctionSource(source, path, (issuePath, code, message) => {
+        issues.push({ path: issuePath, code, message });
+    });
+    if (issues.length > 0) {
+        const first = issues[0];
+        throw new Error(first ? `${first.code}: ${first.message}` : `${path} is invalid.`);
+    }
+    return source;
+}
+function validatePureFunctionSource(source, path, add) {
+    if (!source.trim()) {
+        add(path, "empty_function_source", "Workflow function source cannot be empty.");
+        return;
+    }
+    const forbidden = [
+        "import",
+        "require",
+        "process",
+        "global",
+        "globalThis",
+        "fetch",
+        "XMLHttpRequest",
+        "Function",
+        "eval",
+        "constructor",
+        "setTimeout",
+        "setInterval",
+    ];
+    for (const token of forbidden) {
+        const pattern = new RegExp(`\\b${escapeRegExp(token)}\\b`);
+        if (pattern.test(source)) {
+            add(path, "impure_workflow_function", `Workflow function source cannot reference '${token}'.`);
+            return;
+        }
+    }
+}
+function validateRecipeBundleSafety(source, path, add) {
+    if (!source.trim()) {
+        add(path, "empty_recipe_bundle", "Recipe bundle cannot be empty.");
+        return;
+    }
+    for (const entry of UNSAFE_RECIPE_BUNDLE_PATTERNS) {
+        if (entry.pattern.test(source)) {
+            add(path, "unsafe_recipe_bundle", `Durable recipe bundle cannot reference '${entry.token}'. Use ctx.tools.run(), ctx.step(), ctx.now(), or ctx.uuid() instead.`);
+            return;
+        }
+    }
+}
+function isWorkflowToolRejected(toolId) {
+    return toolId === "run_javascript" || toolId === "custom_http" || toolId.includes("custom_http");
+}
+const CRON_FIELD_LIMITS = [
+    { name: "minute", min: 0, max: 59 },
+    { name: "hour", min: 0, max: 23 },
+    { name: "day-of-month", min: 1, max: 31 },
+    { name: "month", min: 1, max: 12 },
+    { name: "day-of-week", min: 0, max: 7 },
+];
+const zonedFormatters = new Map();
+function parseCronSchedule(value) {
+    const parts = value.trim().split(/\s+/);
+    if (parts.length !== 5) {
+        throw new Error("Cron expression must have five space-separated parts.");
+    }
+    const [minute, hour, dayOfMonth, month, dayOfWeek] = parts;
+    if (!minute || !hour || !dayOfMonth || !month || !dayOfWeek) {
+        throw new Error("Cron expression must have five space-separated parts.");
+    }
+    const minutes = parseCronField(minute, CRON_FIELD_LIMITS[0]);
+    const hours = parseCronField(hour, CRON_FIELD_LIMITS[1]);
+    const daysOfMonth = parseCronField(dayOfMonth, CRON_FIELD_LIMITS[2]);
+    const months = parseCronField(month, CRON_FIELD_LIMITS[3]);
+    const daysOfWeek = normalizeDaysOfWeek(parseCronField(dayOfWeek, CRON_FIELD_LIMITS[4]));
+    return {
+        minutes,
+        hours,
+        daysOfMonth,
+        months,
+        daysOfWeek,
+        dayOfMonthRestricted: dayOfMonth !== "*",
+        dayOfWeekRestricted: dayOfWeek !== "*",
+    };
+}
+function parseCronField(expression, limits) {
+    const values = new Set();
+    for (const rawToken of expression.split(",")) {
+        const token = rawToken.trim();
+        if (!token)
+            throw new Error(`Cron ${limits.name} field contains an empty item.`);
+        const parts = token.split("/");
+        const rangePart = parts[0];
+        const stepPart = parts[1];
+        if (!rangePart || parts.length > 2) {
+            throw new Error(`Cron ${limits.name} field is invalid.`);
+        }
+        const step = stepPart === undefined ? 1 : Number(stepPart);
+        if (!Number.isInteger(step) || step < 1) {
+            throw new Error(`Cron ${limits.name} step must be a positive integer.`);
+        }
+        const [start, end] = parseCronRange(rangePart, limits);
+        for (let current = start; current <= end; current += step) {
+            values.add(current);
+        }
+    }
+    if (values.size === 0)
+        throw new Error(`Cron ${limits.name} field is empty.`);
+    return values;
+}
+function parseCronRange(value, limits) {
+    if (value === "*")
+        return [limits.min, limits.max];
+    const parts = value.split("-");
+    const startRaw = parts[0];
+    const endRaw = parts[1];
+    if (!startRaw || parts.length > 2) {
+        throw new Error(`Cron ${limits.name} range is invalid.`);
+    }
+    const start = Number(startRaw);
+    const end = endRaw === undefined ? start : Number(endRaw);
+    if (!Number.isInteger(start) || !Number.isInteger(end)) {
+        throw new Error(`Cron ${limits.name} values must be integers.`);
+    }
+    if (start < limits.min || end > limits.max || start > end) {
+        throw new Error(`Cron ${limits.name} values must be between ${limits.min} and ${limits.max}.`);
+    }
+    return [start, end];
+}
+function normalizeDaysOfWeek(values) {
+    const normalized = new Set();
+    for (const value of values) {
+        normalized.add(value === 7 ? 0 : value);
+    }
+    return normalized;
+}
+function matchesCronSchedule(schedule, parts) {
+    if (!schedule.minutes.has(parts.minute))
+        return false;
+    if (!schedule.hours.has(parts.hour))
+        return false;
+    if (!schedule.months.has(parts.month))
+        return false;
+    const dayOfMonthMatches = schedule.daysOfMonth.has(parts.dayOfMonth);
+    const dayOfWeekMatches = schedule.daysOfWeek.has(parts.dayOfWeek);
+    if (schedule.dayOfMonthRestricted && schedule.dayOfWeekRestricted) {
+        return dayOfMonthMatches || dayOfWeekMatches;
+    }
+    return dayOfMonthMatches && dayOfWeekMatches;
+}
+function roundUpToNextMinute(value) {
+    const result = new Date(value.getTime());
+    result.setUTCSeconds(0, 0);
+    if (result.getTime() <= value.getTime()) {
+        result.setUTCMinutes(result.getUTCMinutes() + 1);
+    }
+    return result;
+}
+function zonedDateParts(date, timezone) {
+    const formatter = getZonedFormatter(timezone);
+    const parts = new Map();
+    for (const part of formatter.formatToParts(date)) {
+        if (part.type !== "literal")
+            parts.set(part.type, part.value);
+    }
+    return {
+        minute: Number(parts.get("minute")),
+        hour: Number(parts.get("hour")),
+        dayOfMonth: Number(parts.get("day")),
+        month: Number(parts.get("month")),
+        dayOfWeek: weekdayToNumber(parts.get("weekday") ?? ""),
+    };
+}
+function getZonedFormatter(timezone) {
+    const cached = zonedFormatters.get(timezone);
+    if (cached)
+        return cached;
+    const formatter = new Intl.DateTimeFormat("en-US", {
+        timeZone: timezone,
+        weekday: "short",
+        year: "numeric",
+        month: "numeric",
+        day: "numeric",
+        hour: "numeric",
+        minute: "numeric",
+        hourCycle: "h23",
+    });
+    zonedFormatters.set(timezone, formatter);
+    return formatter;
+}
+function weekdayToNumber(value) {
+    switch (value.toLowerCase()) {
+        case "sun":
+            return 0;
+        case "mon":
+            return 1;
+        case "tue":
+            return 2;
+        case "wed":
+            return 3;
+        case "thu":
+            return 4;
+        case "fri":
+            return 5;
+        case "sat":
+            return 6;
+        default:
+            throw new Error(`Unsupported weekday '${value}'.`);
+    }
+}
+function hashWorkflowSource(source) {
+    return createHash("sha256").update(source).digest("hex");
+}
+function workflowJsonReplacer(_key, value) {
+    return typeof value === "function" ? Function.prototype.toString.call(value) : value;
+}
+function enforceJsonOutput(value, maxOutputBytes) {
+    const json = JSON.stringify(value);
+    if (json === undefined)
+        return null;
+    if (Buffer.byteLength(json) > maxOutputBytes) {
+        throw new Error("workflow_output_too_large: Workflow function output is too large.");
+    }
+    return JSON.parse(json);
+}
+function toJsonValue(value, label) {
+    const json = JSON.stringify(value);
+    if (json === undefined) {
+        throw new Error(`${label} must be JSON serializable.`);
+    }
+    return JSON.parse(json);
+}
+function isPromiseLike(value) {
+    return value !== null && typeof value === "object" && "then" in value
+        && typeof value.then === "function";
+}
+async function withTimeout(promise, timeoutMs) {
+    let timer = null;
+    try {
+        return await Promise.race([
+            promise,
+            new Promise((_, reject) => {
+                timer = setTimeout(() => reject(new Error("workflow_function_timeout: Workflow function timed out.")), timeoutMs);
+            }),
+        ]);
+    }
+    finally {
+        if (timer)
+            clearTimeout(timer);
+    }
+}
+function isRecord(value) {
+    return Boolean(value) && typeof value === "object" && !Array.isArray(value);
+}
+function isNonEmptyString(value) {
+    return typeof value === "string" && value.trim().length > 0;
+}
+function escapeRegExp(value) {
+    return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+//# sourceMappingURL=index.js.map