@runlane/realtime 0.0.0-stage → 0.5.1

package/dist/index.mjs

@@ -0,0 +1,667 @@
+import { a as invalidOptions, i as realtimeTiming, n as streamSelectionQuery, r as realtimeClock } from "./wire-BEevjo-K.mjs";
+import { ErrorCode, ErrorCode as ErrorCode$1, RunReadPermission, RunReadPermission as RunReadPermission$1, RunSubscriptionEventType, RunlaneError, RunlaneError as RunlaneError$1, RunlaneLogAttribute, RunlaneLogEventType, RunlaneLogLevel, RunlaneMetricAttribute, RunlaneMetricName, RunlaneSpanName, contractDefaults, createDurationSchema, createRunlaneIdSchema, realtimeDefaults, recordRunlaneTelemetryLog, recordRunlaneTelemetryMetric, runAccessGrantSchema, runCursorSchema, runRealtimeErrorCodeSchema, runRealtimeSnapshotSchema, runStatusValues, runStreamNameSchema, runWithRunlaneTelemetrySpan, verifiedRunTokenSchema } from "@runlane/contracts/realtime";
+import { createFunctionSchema, objectSurfaceSchema, waitForAbortableTimeout } from "@runlane/utilities/browser";
+import { encode } from "eventsource-encoder";
+import * as z$1 from "zod";
+import { z } from "zod";
+import { CompactSign, base64url, compactVerify } from "jose";
+// src/access.ts
+function intersectGrants(app, token) {
+	if (token === void 0) return app;
+	const permissions = app.permissions.filter((permission) => token.permissions.includes(permission));
+	let streams = app.streams ?? token.streams;
+	if (app.streams !== void 0 && token.streams !== void 0) streams = app.streams.filter((name) => token.streams?.includes(name));
+	return {
+		permissions,
+		...streams === void 0 ? {} : { streams }
+	};
+}
+function permitsStream(grant, name) {
+	return grant.permissions.includes(RunReadPermission$1.Streams) && (grant.streams === void 0 || grant.streams.includes(name));
+}
+function projectEvent(event, grant) {
+	if (event.type === RunSubscriptionEventType.Stream) return permitsStream(grant, event.record.name) ? event : void 0;
+	if (event.type === RunSubscriptionEventType.Meta) return grant.permissions.includes(RunReadPermission$1.Meta) ? event : void 0;
+	if (!grant.permissions.includes(RunReadPermission$1.Status)) return void 0;
+	if (event.type === RunSubscriptionEventType.Status) {
+		const status = { ...event };
+		if (!grant.permissions.includes(RunReadPermission$1.Output)) {
+			delete status.output;
+			delete status.failure;
+		}
+		if (status.failure !== void 0) status.failure = runRealtimeSnapshotSchema.shape.failure.parse(status.failure);
+		return status;
+	}
+	return {
+		...event,
+		run: projectSnapshot(event.run, grant)
+	};
+}
+function projectSnapshot(source, grant) {
+	const { meta, output, failure, ...status } = runRealtimeSnapshotSchema.parse(source);
+	return {
+		...status,
+		...grant.permissions.includes(RunReadPermission$1.Meta) && meta !== void 0 ? { meta } : {},
+		...grant.permissions.includes(RunReadPermission$1.Output) ? {
+			...output === void 0 ? {} : { output },
+			...failure === void 0 ? {} : { failure }
+		} : {}
+	};
+}
+// src/tokens.ts
+const tokenPartsSchema = z.tuple([
+	z.string(),
+	z.string(),
+	z.string()
+]);
+const headerSchema = z.strictObject({
+	alg: z.literal("HS256"),
+	typ: z.literal("JWT"),
+	kid: z.string().min(1).max(128)
+});
+const algorithmSchema = z.object({
+	name: z.literal("HMAC"),
+	hash: z.object({ name: z.literal("SHA-256") }),
+	length: z.number().int().min(256)
+});
+const encoder$1 = new TextEncoder();
+const decoder = new TextDecoder("utf-8", { fatal: true });
+const maximumTokenLength = 16384;
+/** Strict construction schema; claim and header constraints remain the canonical owners. */
+const realtimeTokenOptionsSchema = z.strictObject({
+	audience: verifiedRunTokenSchema.shape.audience,
+	keyId: headerSchema.shape.kid,
+	key: z.instanceof(CryptoKey),
+	verifyKeys: z.record(headerSchema.shape.kid, z.instanceof(CryptoKey)).readonly().optional()
+}).refine((tokens) => !Object.hasOwn(tokens.verifyKeys ?? {}, tokens.keyId), "tokens.keyId must not also appear in verifyKeys.");
+const createTokenOptionsSchema = z.strictObject({
+	runId: z.string(),
+	grant: runAccessGrantSchema.optional(),
+	expiresIn: createDurationSchema("expiresIn must be whole seconds between 1s and realtime.maxTokenTTL.").optional()
+});
+/** Signs one run/environment/audience grant using an HMAC-SHA256 key of at least 256 bits. */
+async function signRunToken(environment, tokens, input) {
+	try {
+		const options = createTokenOptionsSchema.parse(input);
+		const header = headerSchema.parse({
+			alg: "HS256",
+			typ: "JWT",
+			kid: tokens.keyId
+		});
+		requireHmacKey(tokens.key, "sign");
+		const ttl = tokenLifetime(options.expiresIn?.milliseconds);
+		const issuedAt = Math.floor(realtimeClock.now() / 1e3);
+		const claims = verifiedRunTokenSchema.parse({
+			environment,
+			runId: options.runId,
+			grant: options.grant ?? { permissions: Object.values(RunReadPermission$1) },
+			audience: tokens.audience,
+			issuedAt,
+			expiresAt: issuedAt + ttl / 1e3,
+			version: 1
+		});
+		const token = await new CompactSign(encoder$1.encode(JSON.stringify(claims))).setProtectedHeader(header).sign(tokens.key);
+		if (token.length > maximumTokenLength) throw invalidToken();
+		return token;
+	} catch (cause) {
+		if (cause instanceof RunlaneError$1) throw cause;
+		const message = cause instanceof z.ZodError ? `Token ${cause.issues[0]?.path.join(".") ?? "expiresIn"} is invalid: ${cause.issues[0]?.message ?? "Check the token options."}` : "Token signing failed; check key and claims.";
+		const field = cause instanceof z.ZodError ? cause.issues[0]?.path[0] : void 0;
+		let code = ErrorCode$1.InternalError;
+		if (cause instanceof z.ZodError) code = field === "environment" || field === "runId" || field === "grant" ? ErrorCode$1.ValidationFailed : ErrorCode$1.ConfigurationInvalid;
+		throw new RunlaneError$1({
+			code,
+			message,
+			retryable: false,
+			cause
+		});
+	}
+}
+function tokenLifetime(ttl = realtimeTiming.tokenTTL) {
+	if (ttl < 1e3 || ttl > realtimeTiming.maxTokenTTL || ttl % 1e3 !== 0) throw new RunlaneError$1({
+		code: ErrorCode$1.ConfigurationInvalid,
+		message: "expiresIn must be whole seconds between 1s and realtime.maxTokenTTL.",
+		retryable: false
+	});
+	return ttl;
+}
+/** Verifies a scoped token and records only bounded rejection reasons through the supplied telemetry. */
+async function verifyRunToken(token, options, diagnostics = {}, operation = "verify") {
+	let reason = "malformed";
+	try {
+		if (token.length > maximumTokenLength) throw invalidToken();
+		const [head, body, signature] = tokenPartsSchema.parse(token.split("."));
+		reason = "header";
+		const header = headerSchema.parse(JSON.parse(decoder.decode(decodeBase64(head))));
+		reason = "unknown_key";
+		const key = Object.hasOwn(options.keys, header.kid) ? options.keys[header.kid] : void 0;
+		if (key === void 0) throw invalidToken();
+		reason = "key";
+		requireHmacKey(key, "verify");
+		reason = "signature";
+		decodeBase64(signature);
+		const verified = await compactVerify(token, key, { algorithms: ["HS256"] });
+		reason = "claims";
+		decodeBase64(body);
+		const claims = verifiedRunTokenSchema.parse(JSON.parse(decoder.decode(verified.payload)));
+		const now = Math.floor(realtimeClock.now() / 1e3);
+		const rejection = tokenClaimRejection(claims, options.audience, now);
+		if (rejection !== void 0) {
+			reason = rejection;
+			throw invalidToken();
+		}
+		return claims;
+	} catch (cause) {
+		recordRunlaneTelemetryMetric(diagnostics, {
+			name: RunlaneMetricName.RealtimeTokenRejectedCount,
+			value: 1,
+			attributes: {
+				[RunlaneMetricAttribute.Operation]: operation,
+				[RunlaneMetricAttribute.Reason]: reason
+			}
+		});
+		recordRunlaneTelemetryLog(diagnostics, {
+			type: RunlaneLogEventType.RealtimeTokenRejected,
+			level: RunlaneLogLevel.Warn,
+			attributes: {
+				[RunlaneLogAttribute.Operation]: operation,
+				[RunlaneLogAttribute.Reason]: reason
+			}
+		});
+		throw invalidToken(cause);
+	}
+}
+function tokenClaimRejection(claims, audience, now) {
+	if (claims.audience !== audience) return "audience";
+	if (claims.issuedAt > now + realtimeTiming.issuedAtLeeway / 1e3) return "issued_at";
+	if (claims.expiresAt <= now) return "expired";
+	if (claims.expiresAt <= claims.issuedAt || (claims.expiresAt - claims.issuedAt) * 1e3 > realtimeTiming.maxTokenTTL) return "lifetime";
+}
+/** Shared key policy for signing, verification, and handler startup checks. */
+function requireHmacKey(key, usage) {
+	if (!(key instanceof CryptoKey) || key.type !== "secret" || !algorithmSchema.safeParse(key.algorithm).success || !key.usages.includes(usage)) throw new RunlaneError$1({
+		code: ErrorCode$1.ConfigurationInvalid,
+		message: `key must be an HMAC-SHA256 key of at least 256 bits with ${usage} usage.`,
+		retryable: false
+	});
+}
+function decodeBase64(value) {
+	if (!/^[A-Za-z0-9_-]+$/.test(value)) throw invalidToken();
+	const bytes = base64url.decode(value);
+	if (base64url.encode(bytes) !== value) throw invalidToken();
+	return bytes;
+}
+function invalidToken(cause) {
+	return new RunlaneError$1({
+		code: ErrorCode$1.AccessDenied,
+		message: "Run access denied.",
+		retryable: false,
+		cause
+	});
+}
+// src/handler.ts
+const encoder = new TextEncoder();
+const runIdSchema = createRunlaneIdSchema("Run id");
+const pollInterval = createDurationSchema().parse(contractDefaults.streams.pollInterval).milliseconds;
+const handlerOptionsSchema = z$1.strictObject({
+	runlane: objectSurfaceSchema,
+	authorize: createFunctionSchema("authorize must be a function.").optional(),
+	tokens: realtimeTokenOptionsSchema.optional(),
+	telemetry: objectSurfaceSchema.optional(),
+	onTelemetryError: createFunctionSchema("onTelemetryError must be a function.").optional()
+}).refine((options) => options.authorize !== void 0 || options.tokens !== void 0, "Configure authorize for session access, tokens for bearer access, or both.");
+/** Mounts authorized, bounded SSE reads without starting workers or adding runtime storage work. */
+function createRunlaneRealtime(options) {
+	const checked = handlerOptionsSchema.safeParse(options);
+	if (!checked.success) throw invalidOptions(checked.error, "handler");
+	const tokens = checked.data.tokens;
+	if (tokens !== void 0) {
+		requireHmacKey(tokens.key, "sign");
+		requireHmacKey(tokens.key, "verify");
+		for (const key of Object.values(tokens.verifyKeys ?? {})) requireHmacKey(key, "verify");
+	}
+	const verification = tokens === void 0 ? void 0 : {
+		audience: tokens.audience,
+		keys: {
+			...tokens.verifyKeys,
+			[tokens.keyId]: tokens.key
+		}
+	};
+	return {
+		async createToken(input) {
+			if (tokens === void 0) throw new RunlaneError$1({
+				code: ErrorCode$1.ConfigurationInvalid,
+				message: "Configure tokens before calling createToken."
+			});
+			return signRunToken(options.runlane.environment, tokens, input);
+		},
+		async handle(request) {
+			let operation = "subscribe";
+			try {
+				const route = parseRoute(request);
+				operation = route.name === void 0 ? "subscribe" : "read";
+				const token = await requestToken(request, route.runId, options, verification);
+				return await openConnection(options, request, route, await authorizeGrant(options, request, route, token, operation), token);
+			} catch (cause) {
+				const error = publicError(cause);
+				if (error.code === ErrorCode$1.AccessDenied) recordDenial(options, cause, operation);
+				return Response.json({ error }, {
+					status: request.method === "GET" ? httpStatus(error.code) : 405,
+					headers: {
+						"cache-control": "no-store",
+						...request.method === "GET" ? {} : { allow: "GET" }
+					}
+				});
+			}
+		}
+	};
+}
+async function authorizeGrant(options, request, route, token, operation) {
+	let app;
+	try {
+		app = options.authorize === void 0 ? token?.grant : await options.authorize({
+			request,
+			runId: route.runId,
+			...token === void 0 ? {} : { token }
+		});
+	} catch (cause) {
+		recordRunlaneTelemetryMetric(options, {
+			name: RunlaneMetricName.RealtimeAuthorizationErrorCount,
+			value: 1,
+			attributes: {
+				[RunlaneMetricAttribute.Operation]: operation,
+				[RunlaneMetricAttribute.Reason]: "authorize_exception"
+			}
+		});
+		recordRunlaneTelemetryLog(options, {
+			type: RunlaneLogEventType.RealtimeAuthorizationFailed,
+			level: RunlaneLogLevel.Error,
+			attributes: {
+				[RunlaneLogAttribute.Operation]: operation,
+				[RunlaneLogAttribute.Reason]: "authorize_exception"
+			}
+		});
+		throw new RunlaneError$1({
+			code: ErrorCode$1.InternalError,
+			message: "Realtime authorization failed.",
+			cause
+		});
+	}
+	if (app === void 0) throw accessDenied();
+	const parsed = runAccessGrantSchema.safeParse(app);
+	if (!parsed.success) throw invalidRequest("Realtime grant is invalid.", parsed.error);
+	const grant = intersectGrants(parsed.data, token?.grant);
+	if (grant.permissions.length === 0 || route.name !== void 0 && !permitsStream(grant, route.name)) throw accessDenied();
+	return grant;
+}
+function recordDenial(options, cause, operation) {
+	const reason = accessDenialReasonSchema.safeParse(cause instanceof RunlaneError$1 ? cause.meta?.reason : void 0).data ?? "token_rejected";
+	if (reason !== "token_rejected") recordRunlaneTelemetryLog(options, {
+		type: RunlaneLogEventType.RealtimeAuthorizationDenied,
+		level: RunlaneLogLevel.Warn,
+		attributes: {
+			[RunlaneLogAttribute.Operation]: operation,
+			[RunlaneLogAttribute.Reason]: reason
+		}
+	});
+	recordRunlaneTelemetryMetric(options, {
+		name: RunlaneMetricName.RealtimeAuthorizationDeniedCount,
+		value: 1,
+		attributes: {
+			[RunlaneMetricAttribute.Operation]: operation,
+			[RunlaneMetricAttribute.Reason]: reason
+		}
+	});
+}
+function parseRoute(request) {
+	if (request.method !== "GET") throw new RunlaneError$1({
+		code: ErrorCode$1.ValidationFailed,
+		message: "Realtime routes require GET.",
+		retryable: false
+	});
+	const url = new URL(request.url);
+	if (Array.from(url.searchParams.keys()).some((key) => key !== "after" && key !== streamSelectionQuery.name) || url.searchParams.getAll("after").length > 1) throw invalidRequest("Only one after and one streams query parameter are accepted; use Authorization for credentials.");
+	const match = /\/runs\/([^/]+)\/(events|streams\/([^/]+))$/.exec(url.pathname);
+	if (match?.[1] === void 0) throw new RunlaneError$1({
+		code: ErrorCode$1.RunNotFound,
+		message: "Realtime route was not found.",
+		retryable: false
+	});
+	let runId;
+	let name;
+	try {
+		runId = runIdSchema.parse(decodeURIComponent(match[1]));
+		name = match[3] === void 0 ? void 0 : runStreamNameSchema.parse(decodeURIComponent(match[3]));
+	} catch (cause) {
+		throw invalidRequest("Run id or stream name is invalid.", cause);
+	}
+	const selections = url.searchParams.getAll(streamSelectionQuery.name);
+	if (selections.length > 1 || selections.length === 1 && (name !== void 0 || selections[0] !== streamSelectionQuery.none)) throw invalidRequest("Stream selection requires one streams=none parameter on the events route.");
+	return {
+		runId,
+		...name === void 0 ? {} : { name },
+		...selections.length === 1 ? { streams: false } : {},
+		...parseResumeCursor(request, url)
+	};
+}
+function parseResumeCursor(request, url) {
+	const header = request.headers.get("last-event-id");
+	const query = url.searchParams.get("after");
+	if (header !== null && query !== null && header !== query) throw invalidCursor();
+	const raw = header ?? query;
+	const parsed = raw === null ? void 0 : runCursorSchema.safeParse(raw);
+	if (parsed !== void 0 && !parsed.success) throw invalidCursor();
+	return parsed?.success ? { after: parsed.data } : {};
+}
+async function openConnection(options, request, route, grant, token) {
+	const started = realtimeClock.now();
+	const operation = route.name === void 0 ? "subscribe" : "read";
+	const control = new AbortController();
+	const expires = Math.min(started + realtimeTiming.connectionDuration, token === void 0 ? Infinity : token.expiresAt * 1e3);
+	const stop = () => control.abort();
+	request.signal.addEventListener("abort", stop, { once: true });
+	if (request.signal.aborted) stop();
+	const expiry = setTimeout(stop, Math.max(0, expires - realtimeClock.now()));
+	const frames = sourceFrames(options.runlane, route, grant, control.signal);
+	let pending;
+	let cursor = route.after;
+	let closed = false;
+	const finish = () => {
+		if (closed) return;
+		closed = true;
+		clearTimeout(expiry);
+		request.signal.removeEventListener("abort", stop);
+		control.abort();
+		frames.return().catch(() => void 0);
+		recordRunlaneTelemetryMetric(options, {
+			name: RunlaneMetricName.RealtimeConnectionDurationMs,
+			value: Math.max(0, realtimeClock.now() - started),
+			attributes: { [RunlaneMetricAttribute.Operation]: operation }
+		});
+	};
+	const next = async () => {
+		if (control.signal.aborted || realtimeClock.now() >= expires) return void 0;
+		pending ??= runWithRunlaneTelemetrySpan(options, { name: route.name === void 0 ? RunlaneSpanName.RealtimeSubscribe : RunlaneSpanName.RealtimeRead }, () => frames.next()).catch((cause) => {
+			const { cursor, ...error } = publicSourceError(cause);
+			throw new RunlaneError$1({
+				...error,
+				cause,
+				...cursor === void 0 ? {} : { meta: { cursor } }
+			});
+		});
+		const timer = new AbortController();
+		const abortTimer = () => timer.abort();
+		control.signal.addEventListener("abort", abortTimer, { once: true });
+		try {
+			const result = await Promise.race([pending, waitForAbortableTimeout(realtimeTiming.heartbeatInterval, timer.signal).then(() => void 0)]);
+			if (realtimeClock.now() >= expires) return void 0;
+			if (result === void 0) return encoder.encode(encode({ comment: "heartbeat" }));
+			pending = void 0;
+			if (result.done) return void 0;
+			const frame = result.value;
+			const bytes = encodeFrame(frame, cursor);
+			cursor = frame.cursor ?? cursor;
+			return bytes;
+		} finally {
+			timer.abort();
+			control.signal.removeEventListener("abort", abortTimer);
+		}
+	};
+	let first;
+	try {
+		first = await next();
+	} catch (cause) {
+		finish();
+		throw cause;
+	}
+	const body = new ReadableStream({
+		start(controller) {
+			const end = () => {
+				if (closed) return;
+				controller.close();
+				finish();
+			};
+			control.signal.addEventListener("abort", end, { once: true });
+			if (control.signal.aborted) end();
+		},
+		async pull(controller) {
+			try {
+				const bytes = control.signal.aborted || realtimeClock.now() >= expires ? void 0 : first ?? await next();
+				if (closed) return;
+				first = void 0;
+				if (bytes === void 0) {
+					controller.close();
+					finish();
+					return;
+				}
+				controller.enqueue(bytes);
+			} catch (cause) {
+				if (closed) return;
+				controller.enqueue(encoder.encode(encode({
+					event: "error",
+					data: JSON.stringify(publicError(cause, cursor))
+				})));
+				controller.close();
+				finish();
+			}
+		},
+		cancel() {
+			finish();
+		}
+	}, { highWaterMark: 0 });
+	return new Response(body, { headers: {
+		"content-type": "text/event-stream; charset=utf-8",
+		"cache-control": "no-store",
+		"x-accel-buffering": "no"
+	} });
+}
+function encodeFrame(frame, cursor) {
+	const data = JSON.stringify(frame.data);
+	const bytes = encoder.encode(encode({
+		event: frame.event,
+		data,
+		...frame.cursor === void 0 ? {} : { id: frame.cursor }
+	}));
+	if (bytes.byteLength > realtimeDefaults.maxEventBytes) throw new RunlaneError$1({
+		code: ErrorCode$1.EventTooLarge,
+		message: "Realtime event exceeds the serialized UTF-8 byte limit.",
+		retryable: false,
+		...cursor === void 0 ? {} : { meta: { cursor } }
+	});
+	return bytes;
+}
+async function* sourceFrames(source, route, grant, signal) {
+	if (route.name === void 0) {
+		for await (const event of source.runs.subscribe(route.runId, {
+			after: route.after,
+			signal,
+			streams: route.streams === false || !grant.permissions.includes(RunReadPermission$1.Streams) ? false : grant.streams
+		})) {
+			if (signal.aborted) return;
+			const projected = projectEvent(event, grant);
+			yield projected === void 0 ? {
+				event: "checkpoint",
+				cursor: event.cursor,
+				data: {}
+			} : {
+				event: projected.type,
+				cursor: projected.cursor,
+				data: projected
+			};
+		}
+		if (!signal.aborted) yield {
+			event: "end",
+			data: {}
+		};
+		return;
+	}
+	yield* namedFrames(source, route.runId, route.name, route.after, signal);
+}
+async function* namedFrames(source, runId, name, initial, signal) {
+	let after = initial;
+	let terminal = false;
+	while (!signal.aborted) {
+		const controller = new AbortController();
+		const waiting = source.lane?.runSignal?.wait({
+			environment: source.environment,
+			runId,
+			signal: AbortSignal.any([signal, controller.signal]),
+			timeoutMs: pollInterval
+		}).catch((cause) => {
+			throw new RunlaneError$1({
+				code: ErrorCode$1.AdapterContractViolation,
+				message: "Lane run signal wait must not reject.",
+				cause
+			});
+		});
+		waiting?.catch(() => void 0);
+		try {
+			const page = await source.runs.readStream(runId, name, {
+				after,
+				limit: contractDefaults.pagination.defaultLimit
+			});
+			yield* namedPageFrames(page, after);
+			after = page.cursor;
+			if (page.hasMore) continue;
+			if (terminal && page.records.length === 0) {
+				yield {
+					event: "end",
+					data: {}
+				};
+				return;
+			}
+			terminal = await readNamedRunTerminal(source, runId);
+			if (terminal) continue;
+			if (page.records.length === 0) await (waiting ?? waitForAbortableTimeout(pollInterval, signal));
+		} finally {
+			controller.abort();
+			await waiting;
+		}
+	}
+}
+async function readNamedRunTerminal(source, runId) {
+	const run = await source.runs.get(runId);
+	if (run === void 0) throw new RunlaneError$1({
+		code: ErrorCode$1.RunNotFound,
+		message: "Run was not found.",
+		retryable: false
+	});
+	return runStatusValues.isTerminal(run.status);
+}
+function* namedPageFrames(page, after) {
+	for (const [index, record] of page.records.entries()) {
+		const last = index === page.records.length - 1;
+		yield {
+			event: "stream",
+			...last ? { cursor: page.cursor } : {},
+			data: {
+				...last ? { cursor: page.cursor } : {},
+				record
+			}
+		};
+	}
+	if (page.records.length === 0 && page.cursor !== after) yield {
+		event: "checkpoint",
+		cursor: page.cursor,
+		data: {}
+	};
+}
+function publicError(cause, cursor) {
+	const checkpoint = cursor ?? (cause instanceof RunlaneError$1 ? runCursorSchema.safeParse(cause.meta?.cursor).data : void 0);
+	const resume = checkpoint === void 0 ? {} : { cursor: checkpoint };
+	if (cause instanceof RunlaneError$1) {
+		const code = runRealtimeErrorCodeSchema.safeParse(cause.code);
+		if (code.success && code.data !== ErrorCode$1.InternalError) return {
+			code: code.data,
+			message: cause.message,
+			retryable: cause.retryable,
+			...resume
+		};
+	}
+	return {
+		code: ErrorCode$1.InternalError,
+		message: "Realtime request failed.",
+		retryable: true,
+		...resume
+	};
+}
+function publicSourceError(cause) {
+	const error = publicError(cause);
+	if (cause instanceof RunlaneError$1) switch (cause.code) {
+		case ErrorCode$1.ConfigurationInvalid:
+		case ErrorCode$1.ValidationFailed: return {
+			...error,
+			code: ErrorCode$1.ValidationFailed,
+			message: "Realtime request is invalid.",
+			retryable: false
+		};
+		case ErrorCode$1.RunCursorInvalid: return {
+			...error,
+			code: ErrorCode$1.RunCursorInvalid,
+			message: "Run cursor is invalid.",
+			retryable: false
+		};
+		case ErrorCode$1.RunNotFound: return {
+			...error,
+			code: ErrorCode$1.RunNotFound,
+			message: "Run was not found.",
+			retryable: false
+		};
+		case ErrorCode$1.OperationCancelled: return {
+			...error,
+			code: ErrorCode$1.Disconnected,
+			message: "Realtime runtime is closing; reconnect to resume.",
+			retryable: true
+		};
+	}
+	return error;
+}
+function httpStatus(code) {
+	if (code === ErrorCode$1.AccessDenied) return 403;
+	if (code === ErrorCode$1.RunNotFound) return 404;
+	if (code === ErrorCode$1.ValidationFailed || code === ErrorCode$1.RunCursorInvalid) return 400;
+	return 500;
+}
+var AccessDenialReason = /* @__PURE__ */ function(AccessDenialReason) {
+	AccessDenialReason["ApplicationDenied"] = "application_denied";
+	AccessDenialReason["AuthorizationHeader"] = "authorization_header";
+	AccessDenialReason["VerificationUnconfigured"] = "verification_unconfigured";
+	AccessDenialReason["TokenScope"] = "token_scope";
+	return AccessDenialReason;
+}(AccessDenialReason || {});
+const accessDenialReasonSchema = z$1.enum(AccessDenialReason);
+function accessDenied(reason = "application_denied") {
+	return new RunlaneError$1({
+		code: ErrorCode$1.AccessDenied,
+		message: "Run access denied.",
+		meta: { reason }
+	});
+}
+function invalidRequest(message, cause) {
+	return new RunlaneError$1({
+		code: ErrorCode$1.ValidationFailed,
+		message,
+		retryable: false,
+		cause
+	});
+}
+function invalidCursor() {
+	return new RunlaneError$1({
+		code: ErrorCode$1.RunCursorInvalid,
+		message: "Run cursor is invalid or conflicts with after.",
+		retryable: false
+	});
+}
+async function requestToken(request, runId, options, verification) {
+	const supplied = request.headers.get("authorization");
+	if (supplied === null) return void 0;
+	const match = /^Bearer ([a-z0-9_.-]+)$/i.exec(supplied);
+	if (match?.[1] === void 0) throw accessDenied("authorization_header");
+	if (verification === void 0) throw accessDenied("verification_unconfigured");
+	const token = await verifyRunToken(match[1], verification, options, new URL(request.url).pathname.endsWith("/events") ? "subscribe" : "read");
+	if (token.runId !== runId || token.environment.name !== options.runlane.environment.name) throw accessDenied("token_scope");
+	return token;
+}
+export { ErrorCode, RunReadPermission, RunlaneError, createRunlaneRealtime };
+
+//# sourceMappingURL=index.mjs.map