@trayai/helix-sdk 0.63.0

package/CHANGELOG.md

@@ -0,0 +1,49 @@
+# Changelog
+
+All notable changes to `@trayai/helix-sdk` are documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and this
+project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html). Ahead of
+general availability, minor versions may include breaking changes.
+
+The SDK and [`@trayai/helix-cli`](https://www.npmjs.com/package/@trayai/helix-cli) are
+released together and share a version — install matching versions.
+
+## Initial release — 2026-07-17
+
+First **early-access** release of `@trayai/helix-sdk`. What this release provides:
+
+- **`defineFunction`** — the core handler primitive. Merges and validates input (query,
+  body, and path params), validates output, maps return values to HTTP responses
+  (`null`/`undefined` → 204, a `Response` passes through, any other value is validated and
+  sent as JSON), and maps thrown errors to statuses. Accepts either a bare Zod input schema
+  or an `{ input, output }` options object.
+- **`ctx` object** passed to every handler, plus **`getContext()`** to reach the active
+  context from anywhere in your code (no prop drilling).
+- **Authenticated outbound HTTP** — `ctx.http.authed(alias)` for calling third-party APIs by
+  credential alias; the platform supplies the secret, so credentials never appear in your
+  code, and the same code runs locally and when deployed. Upstream non-2xx is returned as a
+  value rather than thrown. Plain `ctx.http` is available for unauthenticated calls.
+- **Key-value store** — `ctx.kv()` (`getItem`/`setItem`/`removeItem`/`hasItem`).
+- **File storage** — `ctx.files()` (`put`/`get`/`head`/`list`/`delete`/`deleteMany` plus
+  pre-signed `getUploadUrl`/`getDownloadUrl`).
+- **Configuration** — `defineConfig` for `helix.config.ts`, `loadConfig()` returning a typed
+  `LoadedTrayConfig` discriminated union (provisioned/unprovisioned), `requireWorkspaceId()`
+  with a coded `WorkspaceIdRequiredError`, and `createConfigService()` with hot reload for
+  long-lived processes.
+- **Structured logging** — `ctx.log.info/warn/error/debug`; `helix dev` prints human-readable
+  logs locally by default.
+- **Minimal caller identity** — `ctx.identity` exposes the requesting user id when available.
+- **Testing entry point** — `@trayai/helix-sdk/testing` exports `runWithContext` for
+  unit-testing handlers and shared helpers with a mock context that throws on unset fields.
+
+### Requirements
+
+- Node.js ≥ 24.18.0.
+- ESM only — no CommonJS build is published.
+
+### Known limitations
+
+- `ctx.files().list()` returns the immediate children of a prefix.
+- Authenticated HTTP bodies must be JSON objects, and outbound URLs must be `https:`.
+- Early-access release — APIs may change between minor versions before general availability.

package/LICENSE.md

@@ -0,0 +1,178 @@
+Copyright 2026 Tray.ai, Inc.
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS

package/README.md

@@ -0,0 +1,230 @@
+# @trayai/helix-sdk
+
+The runtime SDK for **Helix** — a TypeScript-first platform for building integration backends. You write file-routed functions; the SDK gives every handler a batteries-included `ctx` object for authenticated HTTP, key-value and file storage, structured logging, and config.
+
+> **Early access.** Helix is under active development. APIs are stable enough to build on but may change between minor versions ahead of general availability. Distributed as part of the Helix early-access program.
+
+## Contents
+
+- [Requirements](#requirements)
+- [Install](#install)
+- [Quick start](#quick-start)
+- [The `ctx` object](#the-ctx-object)
+- [Authenticated HTTP](#authenticated-http)
+- [Capability modules](#capability-modules)
+- [Authentication](#authentication)
+- [Configuration](#configuration)
+- [Logging](#logging)
+- [Testing](#testing)
+- [Entry points](#entry-points)
+- [Tech stack](#tech-stack)
+- [License](#license)
+
+## Requirements
+
+- **Node.js ≥ 24.18.0**
+- ESM only (`"type": "module"`) — this package ships no CommonJS build
+- A [Tray](https://tray.io) account for authenticated calls (see [Authentication](#authentication))
+- The [`@trayai/helix-cli`](https://www.npmjs.com/package/@trayai/helix-cli) for scaffolding, local dev, and deploy (recommended)
+
+The CLI and SDK are **co-versioned** — install matching versions.
+
+## Install
+
+```bash
+npm install @trayai/helix-sdk
+npm install -D zod
+```
+
+Your function code imports `zod` directly (`import { z } from 'zod'`) to declare input/output
+schemas, so your project must declare it as a dependency — the SDK does not re-export it, and
+relying on it transitively through the SDK breaks under strict package managers like pnpm.
+Listing it as a dev dependency matches what `helix init` scaffolds.
+
+Most projects are created with `helix init`, which wires both dependencies for you.
+
+## Quick start
+
+A function is a single file under `functions/`. Its filename determines the route (`functions/items.post.ts` → `POST /items`); its default export is the handler.
+
+```typescript
+import { z } from 'zod';
+import { defineFunction } from '@trayai/helix-sdk';
+
+const input = z.object({ name: z.string().min(1) });
+
+export default defineFunction(async (ctx) => {
+  ctx.log.info('creating item', { name: ctx.input.name });
+  ctx.status(201);
+  return { created: true, name: ctx.input.name };
+}, {
+  input,
+  output: z.object({ created: z.boolean(), name: z.string() }),
+});
+```
+
+`defineFunction` handles input parsing and validation, output validation, and HTTP status/error mapping. Return `null`/`undefined` for a `204`, return a `Response` to pass it through untouched, or return a plain value to have it validated against your `output` schema and sent as JSON.
+
+## The `ctx` object
+
+Every handler receives a `ctx` (`TrayContext`). You can also reach the current context anywhere in the async call tree — including shared helpers — with `getContext()`, so there's no need to thread `ctx` through your code.
+
+| Property | Description |
+|----------|-------------|
+| `ctx.input` | Validated input — query, body, and path params merged (path wins, then body, then query) |
+| `ctx.method` / `ctx.path` | Request method and path |
+| `ctx.headers` | Sanitized request headers |
+| `ctx.http` | HTTP client for outbound requests |
+| `ctx.http.authed(alias)` | Authenticated HTTP — credentials are injected by the platform; secrets never touch your code |
+| `ctx.kv()` | Key-value store |
+| `ctx.files()` | File storage |
+| `ctx.log.info/warn/error/debug` | Structured logging |
+| `ctx.config` | The `config` block from `helix.config.ts` |
+| `ctx.state` | Per-request scratch space |
+| `ctx.status(code)` | Set the response status |
+| `ctx.error(code, message)` | Throw an HTTP error mapped to that status |
+| `ctx.executionId` / `ctx.deploymentId` / `ctx.traceId` | Invocation identifiers |
+| `ctx.identity` | Minimal caller identity (`{ user: { id } }` or `null`) |
+| `ctx.request` | The raw underlying request event |
+
+## Authenticated HTTP
+
+`ctx.http.authed(alias)` returns a per-method client for calling third-party APIs that require credentials. You reference a credential by its `alias` (declared in `helix.config.ts`); the platform supplies the actual secret, so credentials never appear in your code. The same code runs unchanged locally and when deployed.
+
+```typescript
+export default defineFunction(async (ctx) => {
+  const slack = ctx.http.authed('slack');           // alias defined in helix.config.ts
+  const result = await slack.post('https://slack.com/api/chat.postMessage', {
+    body: { channel: 'C123', text: 'hi' },          // JSON body only
+  });
+  return { ok: result.body.ok };
+});
+```
+
+Each method returns `{ status, body?, headers }`. An upstream non-2xx response is **not** thrown — you get the status as a value, matching `ctx.http`. Constraints in this release:
+
+- Outbound URLs must be `https:` (otherwise `SdkError.unsupportedScheme`).
+- Bodies are JSON objects only; strings, `Blob`, `FormData`, `ArrayBuffer`, `Uint8Array`, and streams are rejected with `SdkError.unsupportedBodyType`.
+- An unknown alias throws `SdkError.unknownAlias` (the error lists the configured aliases).
+
+## Capability modules
+
+### Key-value store — `ctx.kv()`
+
+A small, promise-based store (`getItem`, `setItem`, `removeItem`, `hasItem`).
+
+```typescript
+await ctx.kv().setItem('greeting', { hello: 'world' });
+const value = await ctx.kv().getItem('greeting');
+```
+
+### File storage — `ctx.files()`
+
+Object storage with `put`, `get`, `head`, `list`, `delete`, `deleteMany`, and pre-signed `getUploadUrl` / `getDownloadUrl`.
+
+```typescript
+await ctx.files().put('temp/a.json', JSON.stringify({ n: 1 }), {
+  contentType: 'application/json',
+});
+const file = await ctx.files().get('temp/a.json'); // { data, metadata } | null
+```
+
+> `list` returns the immediate children of a prefix.
+
+## Authentication
+
+Authenticated features (`ctx.http.authed`, `ctx.kv`, `ctx.files`) require you to be logged in during local development:
+
+- **Local (`helix dev`):** run `helix login` once, then `helix dev`.
+- **Deployed:** no token is needed — the platform handles credentials for you.
+
+```bash
+helix login
+helix dev
+```
+
+## Configuration
+
+Every project has a single `helix.config.ts` at its root, authored with `defineConfig`:
+
+```typescript
+// helix.config.ts
+import { defineConfig } from '@trayai/helix-sdk';
+
+export default defineConfig({
+  name: 'my-app',
+  projectId: '00000000-0000-4000-8000-000000000001',   // optional UUID
+  workspaceId: '00000000-0000-4000-8000-000000000002', // optional UUID
+  authentications: {
+    notion: '<your-notion-auth-uuid>',
+  },
+  config: {
+    apiVersion: '2022-06-28',
+  },
+});
+```
+
+Read it at runtime with `loadConfig()`, which returns a `LoadedTrayConfig` — a discriminated union on `kind`:
+
+```typescript
+import { loadConfig, requireWorkspaceId } from '@trayai/helix-sdk';
+
+const config = await loadConfig(); // reads helix.config.ts from process.cwd()
+
+if (config.kind === 'provisioned') {
+  console.log('Project:', config.projectId); // string — no optional chaining needed
+}
+
+// requireWorkspaceId returns the workspaceId or throws WorkspaceIdRequiredError
+const workspaceId = requireWorkspaceId(config);
+```
+
+For long-lived processes (a dev server, the MCP server) use `createConfigService`, which holds a stable snapshot and hot-reloads on disk edits:
+
+```typescript
+import { createConfigService } from '@trayai/helix-sdk';
+
+const service = await createConfigService({ cwd: process.cwd(), watch: true });
+const current = service.get();
+const unsubscribe = service.subscribe((next) => console.log('reloaded:', next.kind));
+// ... later
+await service.stop();
+```
+
+Use the CLI (`helix project set`, `helix workspace set`, `helix auth add`) or the Helix MCP tools to write config fields — you rarely edit these by hand.
+
+## Logging
+
+Use `ctx.log.info/warn/error/debug(message, properties?)` for structured logging from your handlers. `helix dev` prints human-readable logs by default.
+
+## Testing
+
+Import from the `/testing` subpath to unit-test handlers and shared helpers that call `getContext()`:
+
+```typescript
+import { runWithContext } from '@trayai/helix-sdk/testing';
+
+const result = await runWithContext({ input: { name: 'Ada' } }, async () => {
+  // code under test can call getContext() here
+});
+```
+
+The mock context is a Proxy: any field your code touches that you didn't provide throws a descriptive error, so tests fail loudly instead of silently reading `undefined`.
+
+## Entry points
+
+| Import | Contents |
+|--------|----------|
+| `@trayai/helix-sdk` | `defineFunction`, `defineConfig`, `getContext`, `loadConfig`, `requireWorkspaceId`, `createConfigService`, and the public types |
+| `@trayai/helix-sdk/testing` | `runWithContext` |
+
+Key exported types include `TrayContext`, `TrayConfig`, `LoadedTrayConfig`, `HttpClient`, `KeyValueStore`, `FileSystemClient`, `Logger`, `ConfigService`, and `WorkspaceIdRequiredError`.
+
+## Tech stack
+
+- TypeScript 5.x, Node.js 24+, ESM
+- [zod](https://zod.dev) — input/output schema validation
+
+## License
+
+Apache-2.0 — see [LICENSE.md](./LICENSE.md).

package/dist/broker/index.d.ts

@@ -0,0 +1,59 @@
+declare const BROKER_BASE_URLS: {
+    readonly production: "https://api.tray.io/private/v1/code";
+};
+type BrokerEnvironment = keyof typeof BROKER_BASE_URLS;
+
+interface BrokerDevCallParams {
+    /** Target Tray environment — selects the broker base URL. */
+    env: BrokerEnvironment;
+    /** Personal dev token (the user's local Tray login) sent as `Authorization: Bearer`. */
+    devToken: string;
+    /** Credential record UUID the broker injects auth for. */
+    authenticationId: string;
+    /** Upstream HTTP method (GET/POST/PUT/PATCH/DELETE…). */
+    method: string;
+    /** Full HTTPS URL of the upstream API. Non-https URLs are rejected by the builder. */
+    url: string;
+    /** Extra request headers forwarded to the upstream (broker injects auth headers). */
+    headers?: Record<string, string>;
+    /** JSON object body. Streams/blobs/strings are rejected by the broker contract. */
+    body?: unknown;
+    /** Extra query params appended to any already present on `url`. */
+    query?: Record<string, string | string[]>;
+    /** Per-call timeout in ms (default 60s). */
+    timeoutMs?: number;
+}
+/** The third-party API's response, as unpacked from the broker envelope. */
+interface UpstreamResponse {
+    status: number;
+    headers: Record<string, string | string[]>;
+    body?: unknown;
+}
+/**
+ * Result of a one-shot dev broker call.
+ * - `upstream` — the broker accepted the call and forwarded it; carries the
+ *   third-party API's status/headers/body.
+ * - `brokerError` — the broker rejected the call BEFORE reaching the upstream
+ *   (bad/expired token, unknown authentication, malformed request).
+ *   `brokerStatus` is the broker's own HTTP status and `body` its error payload.
+ */
+type BrokerDevCallResult = {
+    kind: "upstream";
+    upstream: UpstreamResponse;
+} | {
+    kind: "brokerError";
+    brokerStatus: number;
+    body: unknown;
+};
+/**
+ * Stateless, one-shot call through the credential broker's dev forward proxy.
+ *
+ * This is the path `ctx.http.authed(...)` takes inside `helix dev`, factored
+ * out so CLI tooling (notably the `tray_call_credential_broker` MCP tool) can
+ * exercise a credential and request payload without booting the dev server.
+ * Unlike the runtime path it reads no module-global state: the caller passes
+ * the env, dev token, and authentication UUID explicitly.
+ */
+declare function callBrokerDev(params: BrokerDevCallParams): Promise<BrokerDevCallResult>;
+
+export { type BrokerDevCallParams, type BrokerDevCallResult, type BrokerEnvironment, type UpstreamResponse, callBrokerDev };

package/dist/broker/index.js

@@ -0,0 +1 @@
+import{a as n,b as s,c as i,d as a}from"../chunk-V63DM4MB.js";import"../chunk-W5TFZBQD.js";import p from"ky";var d=6e4;async function l(e){let u=n({authenticationId:e.authenticationId,method:e.method,url:e.url,body:e.body,headers:e.headers,query:e.query}),k=s(e.env),r=await p.post(`${k}/broker/http/dev`,{json:u,headers:{Authorization:`Bearer ${e.devToken}`,Accept:"application/json"},throwHttpErrors:!1,timeout:e.timeoutMs??d}),t;if((r.headers.get("content-type")??"").includes("application/json")?t=await r.json():t=await r.text(),r.status<200||r.status>=300)return{kind:"brokerError",brokerStatus:r.status,body:t};let o=i.safeParse(t);return o.success?{kind:"upstream",upstream:a(o.data)}:{kind:"brokerError",brokerStatus:r.status,body:t}}export{l as callBrokerDev};

package/dist/chunk-J5OA4RGR.js

@@ -0,0 +1 @@
+import{a as i}from"./chunk-W5TFZBQD.js";var w="X-Helix-Project-Execution-Token",A="X-Tray-Token",E={mode:"dev",deploymentId:null},l={...E},o={};function k(t){let{internalJwt:e,helixExecutionJwt:n,devToken:r,...f}=t;"internalJwt"in t&&(o.internalJwt=e),"helixExecutionJwt"in t&&(o.helixExecutionJwt=n),"devToken"in t&&(o.devToken=r),l={...l,...f}}function y(){return l}function R(){return o.internalJwt}function D(){return o.helixExecutionJwt}function L(){return o.devToken}var F="tray-config-bridge",c=null;function N(t){c=t}function H(){if(!c)throw new Error("Active tray config not seeded. Worker boot must call setActiveConfig() before handlers run.");return c}function J(){c=null}var d=1024,g=100*1024*1024,u=250,h=3600,T=h*1e3,x=new TextEncoder,p=/(^|\/)\.\.(\/|$)/,C=/[?#]/;function S(t){for(let e=0;e<t.length;e++){let n=t.charCodeAt(e);if(n<=31||n===127)return!0}return!1}function M(t){if(t.length===0)throw i.filesPathInvalid("Path must be a non-empty string");v(t)}function O(t){return t.endsWith("/")?t.slice(0,-1):t}function v(t){if(t.length===0)return;if(p.test(t))throw i.filesPathInvalid("Path contains path traversal segment");if(C.test(t)||S(t))throw i.filesPathInvalid("Path contains illegal characters");let e=t.split("/");if(t.startsWith("/")||t.endsWith("/")||e.some(r=>r===""))throw i.filesPathInvalid("Path must not contain empty path segments");for(let r of e){let f=x.encode(r).length;if(f>u)throw i.filesPathInvalid(`Path segment exceeds ${u} UTF-8 bytes (got ${f})`)}let n=x.encode(t).length;if(n<1||n>d)throw i.filesPathInvalid(`Path must be between 1 and ${d} UTF-8 bytes (got ${n})`)}function X(t){if(t>g)throw i.filesValueTooLarge(`File exceeds maximum size of ${g} bytes (got ${t})`,g)}function $(t){let e=t!==void 0?t*1e3:T;return new Date(Date.now()+e)}import{join as s}from"path";var _="files",I="files-meta";function m(t){return s(t,".helix",_)}function a(t){return s(t,".helix",I)}function P(t,e){return s(m(t),...e.split("/"))}function W(t,e){return s(a(t),...e.split("/"))+".json"}function Y(t,e){return e.length===0?m(t):P(t,e)}function j(t,e){return e.length===0?a(t):s(a(t),...e.split("/"))}export{w as a,A as b,k as c,y as d,R as e,D as f,L as g,F as h,N as i,H as j,J as k,g as l,M as m,O as n,v as o,X as p,$ as q,P as r,W as s,Y as t,j as u};

package/dist/chunk-L6J5L3JQ.js

@@ -0,0 +1 @@
+import{AsyncLocalStorage as e}from"async_hooks";var o=new e;function r(){let t=o.getStore();if(!t)throw new Error("getContext() called outside of a defineFunction handler. Ensure this code runs inside a function wrapped with defineFunction().");return t}export{o as a,r as b};

package/dist/chunk-V63DM4MB.js

@@ -0,0 +1 @@
+import{a as p}from"./chunk-W5TFZBQD.js";var l=new Set(["proxy-authorization","x-tray-token"]);function m(e){let t=e.toLowerCase();return l.has(t)||t.startsWith("x-tray-internal-")}function R(e){let t;return e instanceof Headers?t=Array.from(e.entries()):Array.isArray(e)?t=e:t=Object.entries(e),t.filter(([o])=>!m(o)).map(([o,i])=>({name:o,value:i}))}function B(e){return typeof e=="string"?"string":e instanceof Blob?"Blob":e instanceof FormData?"FormData":e instanceof ArrayBuffer?"ArrayBuffer":e instanceof Uint8Array?"Uint8Array":typeof ReadableStream<"u"&&e instanceof ReadableStream?"ReadableStream":null}function S(e){let t=new URL(e.url);if(t.protocol!=="https:")throw p.unsupportedScheme(t.protocol.replace(/:$/,""));let o=e.body!==void 0&&e.body!==null?B(e.body):null;if(o!==null)throw p.unsupportedBodyType(o);let i=t.host,s=t.pathname,n=[];for(let[d,a]of t.searchParams.entries())n.push({name:d,value:a});if(e.query!==void 0)if(e.query instanceof URLSearchParams)for(let[d,a]of e.query.entries())n.push({name:d,value:a});else for(let[d,a]of Object.entries(e.query))if(Array.isArray(a))for(let h of a)n.push({name:d,value:h});else n.push({name:d,value:a});let u=e.headers!==void 0?R(e.headers):[],c=e.body!==void 0&&e.body!==null?{host:i,method:e.method,path:s,body:e.body,headers:u,queryParams:n}:{host:i,method:e.method,path:s,headers:u,queryParams:n};return{authenticationId:e.authenticationId,httpRequest:c}}var k={production:"https://api.tray.io/private/v1/code"};function q(e){return k[e]}import{z as r}from"zod";var y=r.object({name:r.string(),value:r.string()}),g=r.object({host:r.string(),method:r.string(),path:r.string().startsWith("/"),body:r.record(r.unknown()).optional(),headers:r.array(y),queryParams:r.array(y)}),v=r.object({authenticationId:r.string().uuid(),httpRequest:g}),w=r.object({httpResponse:r.object({status:r.number(),body:r.unknown().optional(),headers:r.array(y)})});function L(e){let{status:t,body:o,headers:i}=e.httpResponse,s={};for(let{name:n,value:u}of i){let f=n.toLowerCase(),c=s[f];c===void 0?s[f]=u:Array.isArray(c)?c.push(u):s[f]=[c,u]}return{status:t,body:o,headers:s}}export{S as a,q as b,w as c,L as d};

package/dist/chunk-W5TFZBQD.js

@@ -0,0 +1 @@
+var a=class e extends Error{detail;constructor(r){super(s(r)),this.name="SdkError",this.detail=r}get kind(){return this.detail.kind}static unknownAlias(r,n){return new e({kind:"unknown_alias",alias:r,available:n})}static inputValidationFailed(r){return new e({kind:"input_validation_failed",fields:r})}static outputValidationFailed(r){return new e({kind:"output_validation_failed",fields:r})}static configLoadFailed(r){return new e({kind:"config_load_failed",cause:r})}static brokerError(r,n,i){return new e({kind:"broker_error",status:r,message:n,body:i})}static unsupportedBodyType(r){return new e({kind:"unsupported_body_type",actualType:r})}static unsupportedScheme(r){return new e({kind:"unsupported_scheme",scheme:r})}static missingExecutionCredentials(){return new e({kind:"missing_execution_credentials"})}static missingTrayToken(){return new e({kind:"missing_tray_token"})}static dbCallFailed(r,n){return new e({kind:"db_call_failed",message:r,cause:n})}static dbQueryFailed(r){return new e({kind:"db_query_failed",message:r})}static dbInvalidParameters(r){return new e({kind:"db_invalid_parameters",message:r})}static kvKeyInvalid(r){return new e({kind:"kv_key_invalid",message:r})}static kvValueInvalid(r){return new e({kind:"kv_value_invalid",message:r})}static kvValueTooLarge(r,n){return new e({kind:"kv_value_too_large",message:r,maxBytes:n})}static kvNotAvailable(){return new e({kind:"kv_not_available"})}static kvCallFailed(r,n,i){return new e({kind:"kv_call_failed",status:r,message:n,body:i})}static kvRequiresProvisioning(){return new e({kind:"kv_requires_provisioning"})}static filesPathInvalid(r){return new e({kind:"files_path_invalid",message:r})}static filesValueInvalid(r){return new e({kind:"files_value_invalid",message:r})}static filesValueTooLarge(r,n){return new e({kind:"files_value_too_large",message:r,maxBytes:n})}static filesNotAvailable(){return new e({kind:"files_not_available"})}static filesCallFailed(r,n,i){return new e({kind:"files_call_failed",status:r,message:n,body:i})}static filesRequiresProvisioning(){return new e({kind:"files_requires_provisioning"})}};function t(e){return e instanceof a}function s(e){switch(e.kind){case"unknown_alias":return`Unknown auth alias "${e.alias}". Available: ${e.available.join(", ")||"(none)"}`;case"input_validation_failed":return`Input validation failed for fields: ${e.fields.join(", ")}`;case"output_validation_failed":return`Output validation failed for fields: ${e.fields.join(", ")}`;case"config_load_failed":return`Config load failed: ${e.cause}`;case"broker_error":return`broker error: ${e.status} ${e.message}`;case"unsupported_body_type":return`unsupported body type: ${e.actualType}`;case"unsupported_scheme":return`unsupported scheme: ${e.scheme} (only https supported)`;case"missing_execution_credentials":return"missing execution credentials: at least one of internalJwt / helixExecutionJwt must be set before an authed broker/KV call";case"missing_tray_token":return"Not logged in. Run `helix login` to authenticate before making authed HTTP calls in dev.";case"db_call_failed":return`Database call failed: ${e.message}`;case"db_query_failed":return`Database query failed: ${e.message}`;case"db_invalid_parameters":return`Invalid database parameters: ${e.message}`;case"kv_key_invalid":return`Invalid KV key: ${e.message}`;case"kv_value_invalid":return e.message;case"kv_value_too_large":return e.message;case"kv_not_available":return"Key-value store is not available in this environment";case"kv_call_failed":return`KV platform error: ${e.status} ${e.message}`;case"kv_requires_provisioning":return"Key-value store requires a provisioned project (run helix project set)";case"files_path_invalid":return`Invalid file path: ${e.message}`;case"files_value_invalid":return e.message;case"files_value_too_large":return e.message;case"files_not_available":return"File storage is not available in this environment";case"files_call_failed":return`Files platform error: ${e.status} ${e.message}`;case"files_requires_provisioning":return"File storage requires a provisioned project (run helix project set)"}}export{a,t as b};