@segmentstream/agent 0.8.4 → 0.8.6

package/dist/_chunks/workflow-serializable-BwttWNmY.mjs

@@ -0,0 +1,715 @@
+import { fileURLToPath as __eveFileURLToPath } from "node:url";
+import { dirname as __eveDirname } from "node:path";
+import { createRequire as __eveCreateRequire } from "node:module";
+const __filename = __eveFileURLToPath(import.meta.url);
+__eveDirname(__filename);
+__eveCreateRequire(import.meta.url);
+import { createHash, randomUUID } from "node:crypto";
+import { Buffer as Buffer$1 } from "node:buffer";
+import { types } from "node:util";
+function makeRedactor(values = []) {
+	const secrets = [...new Set(values.filter((v) => typeof v === "string" && v.length > 0))].sort((a, b) => b.length - a.length);
+	return (input) => {
+		let text = input;
+		for (const value of secrets) text = text.replaceAll(value, "[REDACTED]");
+		return redactPrivateKeys(text).replace(/\bsscli_(?:access_)?v1\.[a-f0-9-]{36}\.[A-Za-z0-9_-]{43}\b/gi, "[REDACTED CLI CREDENTIAL]").replace(/\b(?:Bearer|Basic)\s+[A-Za-z0-9+/_=.:~-]+/gi, "[REDACTED AUTHORIZATION]").replace(/\beyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\b/g, "[REDACTED JWT]").replace(/\b(?:sk|rk|vercel_blob_rw|vercel_blob_r|access_token|refresh_token)_[A-Za-z0-9._~-]{8,}/g, "[REDACTED]").replace(/\b([a-z][a-z0-9+.-]*:\/\/)[^\s/@]+@/gi, "$1[REDACTED]@").replace(/([?&](?:access_token|api_key|apikey|key|password|refresh_token|secret|token|signature|sig)=)[^&#\s]*/gi, "$1[REDACTED]").replace(/((?:["']?)(?:password|passwd|credential|secret|client_secret|api_key|access_token|refresh_token|authorization|cookie|set-cookie|token)(?:["']?)\s*[:=]\s*)(?:"(?:\\.|[^"\\])*"|'(?:\\.|[^'\\])*'|[^\s,;})]+)/gi, "$1[REDACTED]").replace(/(Key\s*\([^)]*\)\s*=\s*)\([^)]*\)/gi, "$1([REDACTED])").replace(/(invalid input syntax for [^:]+:\s*)"[^"]*"/gi, "$1[REDACTED]");
+	};
+}
+function environmentSecrets(env) {
+	return Object.entries(env).filter(([key]) => /(?:TOKEN|SECRET|PASSWORD|PRIVATE_KEY|API_KEY|COOKIE|SIGNING_KEY|DATABASE_URL|POSTGRES_URL|GRANT)/i.test(key)).map(([, value]) => value);
+}
+function isSensitiveField(key) {
+	return /password|passwd|credential|secret|token|authorization|cookie|private[_-]?key|api[_-]?key|grant/i.test(key);
+}
+function redactPrivateKeys(text) {
+	const begin = /-----BEGIN [^-]*PRIVATE KEY-----/g;
+	const end = /-----END [^-]*PRIVATE KEY-----/g;
+	const parts = [];
+	let copiedThrough = 0;
+	let opening;
+	while ((opening = begin.exec(text)) !== null) {
+		end.lastIndex = begin.lastIndex;
+		if (end.exec(text) === null) break;
+		parts.push(text.slice(copiedThrough, opening.index), "[REDACTED PRIVATE KEY]");
+		copiedThrough = end.lastIndex;
+		begin.lastIndex = copiedThrough;
+	}
+	parts.push(text.slice(copiedThrough));
+	return parts.join("");
+}
+const failureRedactions = new WeakMap();
+const MAX_BYTES = 1048576;
+const MAX_NODES = 1024;
+const FIELDS = [
+	"fiberId",
+	"code",
+	"status",
+	"statusCode",
+	"provider",
+	"providerCode",
+	"providerRequestId",
+	"method",
+	"host",
+	"path",
+	"retryable",
+	"constraint",
+	"sqlState",
+	"field",
+	"expected",
+	"actual",
+	"setting",
+	"resourceId",
+	"runtimeAttemptId",
+	"sandboxId",
+	"sessionId",
+	"remoteErrorId",
+	"endpoint",
+	"requestId",
+	"providerMessage",
+	"providerDescription",
+	"stderr",
+	"exitCode"
+];
+const links = Symbol.for("segmentstream.diagnostic.links");
+const incomplete = Symbol.for("segmentstream.diagnostic.omissions");
+const RELATIONS = [
+	"cause",
+	"aggregate",
+	"primary",
+	"cleanup",
+	"concurrent"
+];
+const MAX_EDGES = 8192;
+function property(value, key) {
+	if ((typeof value !== "object" || value === null) && typeof value !== "function") return void 0;
+	try {
+		return Reflect.get(value, key);
+	} catch {
+		return;
+	}
+}
+function scalar(value) {
+	return typeof value === "string" || typeof value === "boolean" || typeof value === "number" && Number.isFinite(value);
+}
+function ownValues(value) {
+	if (!value || typeof value !== "object") return [];
+	try {
+		return Object.values(Object.getOwnPropertyDescriptors(value)).filter((descriptor) => "value" in descriptor).map((descriptor) => descriptor.value);
+	} catch {
+		return [];
+	}
+}
+function schemaInputRedactions(root) {
+	const values = new Set();
+	const seen = new Set();
+	const errors = [root];
+	const issues = [];
+	let limited = false;
+	let traversed = 0;
+	while (errors.length && seen.size < MAX_NODES) {
+		if (++traversed > MAX_EDGES || errors.length > MAX_EDGES) {
+			limited = true;
+			break;
+		}
+		const value = errors.shift();
+		if (seen.has(value)) continue;
+		seen.add(value);
+		if (value !== null && (typeof value === "object" || typeof value === "function")) {
+			for (const secret of failureRedactions.get(value) ?? []) if (secret) values.add(secret);
+		}
+		if (property(value, "_tag") === "SchemaError" || property(value, "name") === "SchemaError") issues.push(property(value, "issue"));
+		const explicit = property(value, links);
+		if (Array.isArray(explicit)) {
+			if (explicit.length > MAX_NODES) limited = true;
+			errors.push(...explicit.slice(0, MAX_NODES).map((item) => property(item, "error")));
+		}
+		const cause = property(value, "cause");
+		if (cause !== void 0) errors.push(cause);
+		const aggregate = property(value, "errors");
+		if (property(value, "name") === "AggregateError" && Array.isArray(aggregate)) {
+			if (aggregate.length > MAX_NODES) limited = true;
+			errors.push(...aggregate.slice(0, MAX_NODES));
+		}
+	}
+	if (errors.length) limited = true;
+	seen.clear();
+	const inputs = [];
+	while (issues.length && seen.size < MAX_NODES) {
+		if (++traversed > MAX_EDGES || issues.length > MAX_EDGES) {
+			limited = true;
+			break;
+		}
+		const issue = issues.pop();
+		if (!issue || seen.has(issue)) continue;
+		seen.add(issue);
+		for (const key of ["input", "actual"]) {
+			const input = property(issue, key);
+			if (input !== void 0) inputs.push(input);
+		}
+		const child = property(issue, "issue");
+		if (child !== void 0) issues.push(child);
+		const children = property(issue, "issues");
+		if (Array.isArray(children)) {
+			if (children.length > MAX_NODES) limited = true;
+			issues.push(...children.slice(0, MAX_NODES));
+		}
+	}
+	if (issues.length) limited = true;
+	seen.clear();
+	let characters = 0;
+	while (inputs.length && seen.size < 4096 && characters < MAX_BYTES) {
+		if (++traversed > MAX_EDGES || inputs.length > MAX_EDGES) {
+			limited = true;
+			break;
+		}
+		const value = inputs.pop();
+		if (seen.has(value)) continue;
+		seen.add(value);
+		if (scalar(value) && String(value)) {
+			const text = String(value);
+			characters += text.length;
+			values.add(text);
+			if (typeof value === "string") values.add(JSON.stringify(value).slice(1, -1));
+		} else {
+			const children = ownValues(value);
+			if (children.length > 4096) limited = true;
+			inputs.push(...children.slice(0, 4096));
+		}
+	}
+	if (inputs.length) limited = true;
+	return {
+		values: [...values],
+		limited
+	};
+}
+function createFailureReport(error, options) {
+	const schemaInputs = schemaInputRedactions(error);
+	if (schemaInputs.limited) return redactionLimitReport();
+	const redact = makeRedactor([...options.redactedValues ?? [], ...schemaInputs.values]);
+	let remaining = 1044480;
+	const omissions = new Set();
+	const clean = (value) => {
+		const safe = redact(value.slice(0, MAX_BYTES));
+		if (value.length > MAX_BYTES) omissions.add("field input exceeded 1 MiB");
+		const bytes = Buffer.from(JSON.stringify(safe));
+		const allowance = Math.max(0, remaining);
+		if (bytes.length > allowance) {
+			omissions.add("report exceeded 1 MiB");
+			remaining = 0;
+			let low = 0;
+			let high = safe.length;
+			while (low < high) {
+				const middle = Math.ceil((low + high) / 2);
+				if (Buffer.byteLength(JSON.stringify(safe.slice(0, middle))) + 20 <= allowance) low = middle;
+				else high = middle - 1;
+			}
+			return safe.slice(0, low).replace(/[\uD800-\uDBFF]$/, "") + " [TRUNCATED]";
+		}
+		remaining -= bytes.length;
+		return safe;
+	};
+	const report = {
+		version: 1,
+		errorId: options.errorId && /^[A-Za-z0-9_.:-]{1,200}$/.test(options.errorId) ? options.errorId : `err_${randomUUID().replaceAll("-", "")}`,
+		timestamp: options.timestamp?.slice(0, 100) ?? new Date().toISOString(),
+		service: clean(options.service),
+		context: {},
+		roots: [],
+		nodes: [],
+		complete: true,
+		omissions: []
+	};
+	const contextEntries = Object.entries(options.context ?? {});
+	if (contextEntries.length > 128) omissions.add("context exceeded 128 fields");
+	for (const [key, value] of contextEntries.slice(0, 128)) if (scalar(value)) report.context[clean(key)] = isSensitiveField(key) ? "[REDACTED]" : typeof value === "string" ? clean(value) : value;
+	const seen = new Map();
+	const queue = [];
+	const add = (value) => {
+		const object = typeof value === "object" && value !== null || typeof value === "function";
+		if (object && seen.has(value)) return seen.get(value);
+		if (queue.length >= MAX_NODES || remaining < 1024) {
+			omissions.add(queue.length >= MAX_NODES ? "report exceeded 1024 nodes" : "report exceeded 1 MiB");
+			return;
+		}
+		const id = `n${queue.length + 1}`;
+		if (object) seen.set(value, id);
+		queue.push({
+			value,
+			id
+		});
+		remaining -= 512;
+		return id;
+	};
+	const root = add(error);
+	if (root) report.roots.push(root);
+	let edges = 0;
+	for (let index = 0; index < queue.length; index++) {
+		const { value, id } = queue[index];
+		const inheritedOmissions = property(value, incomplete);
+		if (Array.isArray(inheritedOmissions)) {
+			for (const reason of inheritedOmissions.slice(0, 128)) if (typeof reason === "string") omissions.add(clean(reason));
+		}
+		const name = property(value, "_tag") ?? property(value, "name");
+		const message = property(value, "message");
+		const node = {
+			id,
+			type: typeof name === "string" ? clean(name) : "NonErrorThrow",
+			message: clean(typeof message === "string" && message ? message : typeof value === "string" ? value : `Thrown ${typeof value} value`),
+			causes: []
+		};
+		for (const key of [
+			"stack",
+			"operation",
+			"diagnostic"
+		]) {
+			const field = property(value, key);
+			if (typeof field === "string") node[key] = clean(field);
+		}
+		const details = {};
+		for (const key of FIELDS) {
+			const field = property(value, key);
+			if (scalar(field)) details[key] = (key === "expected" || key === "actual") && isSensitiveField(String(property(value, "field") ?? "")) ? "[REDACTED]" : typeof field === "string" ? clean(field) : field;
+		}
+		if (Object.keys(details).length) node.details = details;
+		const children = [];
+		const explicit = property(value, links);
+		if (Array.isArray(explicit)) {
+			for (const item of explicit.slice(0, MAX_NODES)) {
+				const relation = property(item, "relation");
+				if (typeof relation === "string" && RELATIONS.includes(relation)) children.push({
+					error: property(item, "error"),
+					relation
+				});
+				else omissions.add("invalid diagnostic cause link");
+			}
+			if (explicit.length > MAX_NODES) omissions.add("cause links exceeded 1024 children");
+		}
+		const cause = property(value, "cause");
+		if (cause !== void 0) children.push({
+			error: cause,
+			relation: "cause"
+		});
+		if (value instanceof AggregateError || property(value, "name") === "AggregateError") {
+			const errors = property(value, "errors");
+			if (Array.isArray(errors)) {
+				for (const item of errors.slice(0, MAX_NODES)) children.push({
+					error: item,
+					relation: "aggregate"
+				});
+				if (errors.length > MAX_NODES) omissions.add("aggregate exceeded 1024 children");
+			}
+		}
+		for (const child of children) {
+			if (edges >= MAX_EDGES || remaining < 100) {
+				omissions.add(edges >= MAX_EDGES ? "report exceeded 8192 cause links" : "report exceeded 1 MiB");
+				break;
+			}
+			edges++;
+			remaining -= 100;
+			const childId = add(child.error);
+			if (childId) node.causes.push({
+				id: childId,
+				relation: child.relation
+			});
+		}
+		report.nodes.push(node);
+	}
+	report.omissions = [...omissions];
+	report.complete = !report.omissions.length;
+	return fitReport(report);
+}
+function redactionLimitReport() {
+	return {
+		version: 1,
+		errorId: `err_${randomUUID().replaceAll("-", "")}`,
+		timestamp: new Date().toISOString(),
+		service: "diagnostics",
+		context: {},
+		roots: ["n1"],
+		nodes: [{
+			id: "n1",
+			type: "RedactionLimitError",
+			message: "Failure details omitted because secret-redaction traversal was incomplete.",
+			causes: []
+		}],
+		complete: false,
+		omissions: ["secret redaction traversal exceeded its defensive budget (1024 graph/issue nodes, 4096 input values, 8192 traversal steps, 1 MiB)"]
+	};
+}
+function fitReport(report) {
+	const wireBytes = () => Buffer.byteLength(JSON.stringify(report));
+	if (wireBytes() <= MAX_BYTES) return report;
+	report.complete = false;
+	report.omissions.push("serialized report exceeded 1 MiB");
+	while (wireBytes() > MAX_BYTES && report.nodes.length > 1) report.nodes.pop();
+	const retained = new Set(report.nodes.map((node) => node.id));
+	report.roots = report.roots.filter((id) => retained.has(id));
+	for (const node of report.nodes) node.causes = node.causes.filter((edge) => retained.has(edge.id));
+	if (wireBytes() > MAX_BYTES) {
+		report.context = {};
+		report.service = report.service.slice(0, 200);
+		report.omissions = report.omissions.map((message) => message.slice(0, 1e3)).slice(0, 128);
+		report.nodes = report.nodes.map((node) => ({
+			id: node.id,
+			type: node.type.slice(0, 200),
+			message: node.message.slice(0, 1e3) + " [TRUNCATED]",
+			causes: node.causes
+		}));
+	}
+	return report;
+}
+function renderFailure(report, maxBytes = 8192) {
+	const nodes = new Map(report.nodes.map((node) => [node.id, node]));
+	const seen = new Set();
+	const pending = report.roots.map((id) => ({
+		id,
+		depth: 0,
+		relation: "root"
+	}));
+	const lines = [`Failure ${report.errorId} (${report.service})`];
+	while (pending.length) {
+		const item = pending.pop();
+		const prefix = `${"  ".repeat(Math.min(item.depth, 32))}${item.relation}: `;
+		if (seen.has(item.id)) {
+			lines.push(`${prefix}[reference ${item.id}]`);
+			continue;
+		}
+		seen.add(item.id);
+		const node = nodes.get(item.id);
+		if (!node) {
+			lines.push(`${prefix}[missing ${item.id}]`);
+			continue;
+		}
+		lines.push(`${prefix}${node.type}${node.diagnostic ? `:${node.diagnostic}` : ""}${node.operation ? ` at ${node.operation}` : ""}: ${node.message}`);
+		if (node.details) lines.push(`${prefix}${JSON.stringify(node.details)}`);
+		for (const child of [...node.causes].reverse()) pending.push({
+			...child,
+			depth: item.depth + 1
+		});
+	}
+	if (!report.complete) lines.push(`Incomplete: ${report.omissions.join("; ")}`);
+	const text = lines.join("\n");
+	if (Buffer.byteLength(text) <= maxBytes) return text;
+	const suffix = `\n[Journal shortened; complete report in diagnostics logs: ${report.errorId}]`;
+	return Buffer.from(text).subarray(0, Math.max(0, maxBytes - Buffer.byteLength(suffix) - 3)).toString("utf8").replace(/\uFFFD$/, "") + suffix;
+}
+function encodeReport(report) {
+	const direct = JSON.stringify({
+		event: "diagnostics.report",
+		report
+	});
+	if (Buffer.byteLength(direct) <= 4096) return [direct];
+	const bytes = Buffer.from(JSON.stringify(report));
+	const checksum = createHash("sha256").update(bytes).digest("hex");
+	const size = 2e3;
+	const correlation = Object.fromEntries([
+		"workflowRunId",
+		"requestId",
+		"pipelineRunId"
+	].flatMap((key) => typeof report.context[key] === "string" && /^[A-Za-z0-9_.:-]{1,200}$/.test(String(report.context[key])) ? [[key, String(report.context[key]).slice(0, 200)]] : []));
+	const total = Math.ceil(bytes.length / size);
+	return Array.from({ length: total }, (_, i) => JSON.stringify({
+		event: "diagnostics.chunk",
+		errorId: report.errorId,
+		part: i + 1,
+		total,
+		checksum,
+		correlation,
+		encoding: "base64",
+		data: bytes.subarray(i * size, (i + 1) * size).toString("base64")
+	}));
+}
+function makeErrorReporter({ configuration, generateId = randomUUID, now = () => new Date(), observe, write = (severity, line) => severity === "warning" ? console.warn(line) : console.error(line) }) {
+	function capture(error, context) {
+		let report;
+		const errorId = context.errorReference ?? `err_${randomUUID().replaceAll("-", "")}`;
+		try {
+			report = createFailureReport(error, {
+				service: configuration.service,
+				context: {
+					environment: configuration.environment,
+					release: configuration.release,
+					region: configuration.region,
+					...context
+				},
+				errorId: context.errorReference ?? `err_${generateId().replaceAll("-", "").toLowerCase()}`,
+				timestamp: now().toISOString(),
+				redactedValues: configuration.redactedValues
+			});
+		} catch {
+			report = createFailureReport(error, {
+				service: configuration.service,
+				errorId,
+				redactedValues: configuration.redactedValues,
+				context: { reportingFailure: true }
+			});
+		}
+		try {
+			const lines = encodeReport(report);
+			if (lines.length > 1) {
+				let budget = 2e3;
+				let summary;
+				do {
+					summary = JSON.stringify({
+						event: "diagnostics.summary",
+						errorId: report.errorId,
+						tree: renderFailure(report, budget),
+						completeReport: "Reconstruct diagnostics.chunk entries by errorId"
+					});
+					budget = Math.floor(budget / 2);
+				} while (Buffer.byteLength(summary) > 4096 && budget > 128);
+				if (Buffer.byteLength(summary) <= 4096) write(context.severity ?? "error", summary);
+			}
+			for (const line of lines) write(context.severity ?? "error", line);
+		} catch {
+			report.context.reportingFailure = true;
+			try {
+				for (const line of encodeReport(report)) process.stderr.write(line + "\n");
+			} catch {}
+		}
+		try {
+			observe?.(report);
+		} catch {}
+		return report;
+	}
+	return {
+		capture,
+		report: (error, context) => capture(error, context).errorId
+	};
+}
+function reportRuntimeFailure(error, context, environment = process.env) {
+	const { service, ...details } = context;
+	return makeErrorReporter({ configuration: {
+		service,
+		redactedValues: environmentSecrets(environment)
+	} }).report(error, details);
+}
+const errorStackGetter = Object.getOwnPropertyDescriptor(new Error(), "stack")?.get;
+function intrinsicGetter(prototype, name) {
+	return Object.getOwnPropertyDescriptor(prototype, name)?.get;
+}
+const binaryGetters = [Object.getPrototypeOf(Uint8Array.prototype), DataView.prototype].map((prototype) => ({
+	buffer: intrinsicGetter(prototype, "buffer"),
+	offset: intrinsicGetter(prototype, "byteOffset"),
+	length: intrinsicGetter(prototype, "byteLength")
+}));
+function binaryBytes(item) {
+	if (!ArrayBuffer.isView(item)) return new Uint8Array(item);
+	const getters = binaryGetters[types.isDataView(item) ? 1 : 0];
+	return new Uint8Array(getters.buffer.call(item), getters.offset.call(item), getters.length.call(item));
+}
+function toWorkflowSerializable(value, report = () => {}) {
+	const ancestors = new WeakSet();
+	let remaining = 5e4;
+	const issue = (path, reason, cause) => {
+		try {
+			report({
+				path,
+				reason,
+				...cause === void 0 ? {} : { cause }
+			});
+		} catch {}
+	};
+	const property = (output, key, item) => {
+		Object.defineProperty(output, key, {
+			value: item,
+			enumerable: true,
+			configurable: true
+		});
+	};
+	const dropped = (item) => item === void 0 || typeof item === "function" || typeof item === "symbol";
+	const dataProperty = (item, key) => {
+		let current = item;
+		for (let depth = 0; current !== null && depth <= 64; depth++) {
+			const descriptor = Object.getOwnPropertyDescriptor(current, key);
+			if (descriptor) return "value" in descriptor ? descriptor.value : void 0;
+			current = Object.getPrototypeOf(current);
+		}
+	};
+	function visit(item, path, depth) {
+		if (--remaining < 0 || depth > 64) {
+			issue(path, "limit");
+			return null;
+		}
+		if (item === null || typeof item === "string" || typeof item === "boolean") return item;
+		if (typeof item === "number") {
+			if (Number.isFinite(item)) return item;
+			issue(path, "non-finite number");
+			return null;
+		}
+		if (typeof item === "bigint") {
+			issue(path, "bigint");
+			return String(item);
+		}
+		if (typeof item !== "object") {
+			issue(path, typeof item);
+			return null;
+		}
+		if (ancestors.has(item)) {
+			issue(path, "cycle");
+			return null;
+		}
+		ancestors.add(item);
+		try {
+			if (types.isDate(item)) {
+				issue(path, "Date");
+				const time = Date.prototype.getTime.call(item);
+				return Number.isFinite(time) ? new Date(time).toISOString() : null;
+			}
+			if (ArrayBuffer.isView(item) || types.isAnyArrayBuffer(item)) {
+				issue(path, "binary");
+				const bytes = binaryBytes(item);
+				return Buffer$1.from(bytes.buffer, bytes.byteOffset, bytes.byteLength).toString("base64");
+			}
+			if (types.isMap(item)) {
+				issue(path, "Map");
+				const output = [];
+				for (const [key, entry] of Map.prototype.entries.call(item)) {
+					if (remaining <= 0) {
+						issue(path, "map limit");
+						break;
+					}
+					const index = output.length;
+					output.push([visit(key, `${path}[${index}][0]`, depth + 1), visit(entry, `${path}[${index}][1]`, depth + 1)]);
+				}
+				return output;
+			}
+			if (types.isSet(item)) {
+				issue(path, "Set");
+				const output = [];
+				for (const entry of Set.prototype.values.call(item)) {
+					if (remaining <= 0) {
+						issue(path, "set limit");
+						break;
+					}
+					output.push(visit(entry, `${path}[${output.length}]`, depth + 1));
+				}
+				return output;
+			}
+			if (Array.isArray(item)) {
+				const count = Object.getOwnPropertyDescriptor(item, "length")?.value;
+				if (typeof count !== "number" || !Number.isSafeInteger(count) || count < 0) {
+					issue(path, "invalid array length");
+					return null;
+				}
+				const length = Math.min(count, Math.max(remaining, 0));
+				if (length !== count) issue(path, "array limit");
+				return Array.from({ length }, (_, index) => {
+					const descriptor = Object.getOwnPropertyDescriptor(item, String(index));
+					if (descriptor?.get) {
+						issue(`${path}[${index}]`, "accessor");
+						return null;
+					}
+					return visit(descriptor?.value, `${path}[${index}]`, depth + 1);
+				});
+			}
+			const prototype = Object.getPrototypeOf(item);
+			const plain = prototype === null || Object.getPrototypeOf(prototype) === null;
+			const nativeError = types.isNativeError(item);
+			if (!plain) issue(path, nativeError ? "Error" : "class instance");
+			if (nativeError) {
+				const name = dataProperty(item, "name");
+				const message = dataProperty(item, "message");
+				const output = {
+					name: typeof name === "string" ? name : "Error",
+					message: typeof message === "string" ? message : ""
+				};
+				for (const key of Object.getOwnPropertyNames(item)) {
+					if (remaining <= 0) {
+						issue(path, "error limit");
+						break;
+					}
+					const descriptor = Object.getOwnPropertyDescriptor(item, key);
+					if (key === "stack" && errorStackGetter && descriptor?.get) {
+						property(output, key, visit(errorStackGetter.call(item), `${path}.stack`, depth + 1));
+						continue;
+					}
+					if (key !== "__proto__" && descriptor && "value" in descriptor && !dropped(descriptor.value)) property(output, key, visit(descriptor.value, `${path}[${JSON.stringify(key)}]`, depth + 1));
+				}
+				return output;
+			}
+			if (!plain) {
+				let current = prototype;
+				const prototypes = new WeakSet();
+				for (let prototypeDepth = 0; current !== null; prototypeDepth++) {
+					if (prototypeDepth >= 64 || prototypes.has(current)) {
+						issue(path, "prototype limit");
+						break;
+					}
+					prototypes.add(current);
+					const json = Object.getOwnPropertyDescriptor(current, "toJSON");
+					if (typeof json?.value === "function") return visit(json.value.call(item), path, depth + 1);
+					current = Object.getPrototypeOf(current);
+				}
+			}
+			const output = {};
+			for (const key of Reflect.ownKeys(item)) {
+				if (remaining <= 0) {
+					issue(path, "object limit");
+					break;
+				}
+				const descriptor = Object.getOwnPropertyDescriptor(item, key);
+				if (!descriptor?.enumerable) continue;
+				const childPath = `${path}[${JSON.stringify(String(key))}]`;
+				if (typeof key === "symbol" || key === "__proto__" || descriptor.get) {
+					issue(childPath, descriptor.get ? "accessor" : "unsupported key");
+					continue;
+				}
+				if (dropped(descriptor.value)) {
+					if (descriptor.value !== void 0) issue(childPath, typeof descriptor.value);
+					continue;
+				}
+				property(output, key, visit(descriptor.value, childPath, depth + 1));
+			}
+			return output;
+		} catch (cause) {
+			issue(path, "unreadable value", cause);
+			return null;
+		} finally {
+			ancestors.delete(item);
+		}
+	}
+	return visit(value, "$", 0);
+}
+let diagnosticSequence = 0;
+function workflowValue(value, context) {
+	const issues = [];
+	const failures = [];
+	let count = 0;
+	const output = toWorkflowSerializable(value, (issue) => {
+		count++;
+		if ("cause" in issue) failures.push(issue.cause);
+		if (issues.length < 20) issues.push({
+			reason: issue.reason,
+			path: issue.path.replace(/\["(?:[^"\\]|\\.)*"\]/g, "[field]")
+		});
+	});
+	if (count > 0) try {
+		const errorId = globalThis.crypto?.randomUUID?.() ?? `serialization-${Date.now()}-${++diagnosticSequence}`;
+		if (failures.length > 0) reportRuntimeFailure(failures.length === 1 ? failures[0] : new AggregateError(failures, "Workflow value projections failed"), {
+			service: "segmentstream-agent",
+			boundary: context.boundary,
+			operation: "workflow.normalize",
+			severity: "warning",
+			errorReference: errorId
+		});
+		console.warn("[workflow] normalized non-JSON value", {
+			errorId,
+			boundary: context.boundary,
+			toolName: context.toolName,
+			toolCallId: context.toolCallId,
+			eventType: context.eventType,
+			issues,
+			issueCount: count
+		});
+	} catch {}
+	return output;
+}
+function workflowToolResult(value, context) {
+	return workflowValue(value, {
+		boundary: "SDK tool result",
+		toolName: context.toolName,
+		toolCallId: context.callId
+	});
+}
+export { workflowToolResult as n, workflowValue as r, toWorkflowSerializable as t };