@workflow/core 5.0.0-beta.4 → 5.0.0-beta.40

package/dist/runtime/count-step-started-events.js

@@ -0,0 +1,72 @@
+const ownerOf = (e) => 'eventData' in e &&
+    e.eventData &&
+    'ownerMessageId' in e.eventData &&
+    typeof e.eventData.ownerMessageId === 'string'
+    ? e.eventData.ownerMessageId
+    : undefined;
+/**
+ * Number of `step_started` events already recorded for a step, used as the
+ * authoritative attempt count for the maxRetries ceiling (the only bound for
+ * steps that time out without writing a `step_failed`).
+ *
+ * IMPORTANT: the raw (unscoped) count is NOT a reliable attempt number.
+ * Concurrent invocations racing on the same pending batch (stale replays,
+ * wake replays, a step message dispatched by a replay that lost the
+ * create-claim race, ...) can each write a `step_started` for the same
+ * logical attempt — worlds without an atomic start guard (world-local) let
+ * all of them through. Counting those duplicates as "attempts" made the
+ * maxRetries ceiling fire on healthy runs and fail them with a false
+ * "exceeded max retries" (see workflow#3069).
+ *
+ * Callers therefore scope the count to the starts their ceiling is actually
+ * about via `scope`:
+ * - the inline owned-recovery ceiling counts only THIS message's starts
+ *   (`ownedBy`) — each real (re)delivery of the owning message stamps its
+ *   `ownerMessageId` on the start it writes, while racing invocations stamp
+ *   their own IDs (or none), so they no longer inflate the count;
+ * - the background-step ceiling counts the lifecycle attempt total
+ *   (`totalAttempts`: bare starts plus the largest single owner's starts) —
+ *   so a step that exhausted part of its budget under inline ownership
+ *   before transitioning to queued/bare retries still trips the combined
+ *   ceiling, while racers' one-off stamped duplicates don't accumulate, and
+ *   throttle/too-early redeliveries (which write no start at all) stay
+ *   excluded as before.
+ */
+export function countStepStartedEvents(events, stepId, scope) {
+    if (!events) {
+        return 0;
+    }
+    let bare = 0;
+    const byOwner = new Map();
+    for (const e of events) {
+        if (e.eventType !== 'step_started' || e.correlationId !== stepId) {
+            continue;
+        }
+        const owner = ownerOf(e);
+        if (owner === undefined) {
+            bare++;
+        }
+        else {
+            byOwner.set(owner, (byOwner.get(owner) ?? 0) + 1);
+        }
+    }
+    if (scope === undefined) {
+        let total = bare;
+        for (const count of byOwner.values()) {
+            total += count;
+        }
+        return total;
+    }
+    if (scope.type === 'ownedBy') {
+        return byOwner.get(scope.messageId) ?? 0;
+    }
+    // totalAttempts
+    let maxOwner = 0;
+    for (const count of byOwner.values()) {
+        if (count > maxOwner) {
+            maxOwner = count;
+        }
+    }
+    return bare + maxOwner;
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY291bnQtc3RlcC1zdGFydGVkLWV2ZW50cy5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3NyYy9ydW50aW1lL2NvdW50LXN0ZXAtc3RhcnRlZC1ldmVudHMudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBcUJBLE1BQU0sT0FBTyxHQUFHLENBQUMsQ0FBUSxFQUFzQixFQUFFLENBQy9DLFdBQVcsSUFBSSxDQUFDO0lBQ2hCLENBQUMsQ0FBQyxTQUFTO0lBQ1gsZ0JBQWdCLElBQUksQ0FBQyxDQUFDLFNBQVM7SUFDL0IsT0FBTyxDQUFDLENBQUMsU0FBUyxDQUFDLGNBQWMsS0FBSyxRQUFRO0lBQzVDLENBQUMsQ0FBQyxDQUFDLENBQUMsU0FBUyxDQUFDLGNBQWM7SUFDNUIsQ0FBQyxDQUFDLFNBQVMsQ0FBQztBQUVoQjs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7O0dBMkJHO0FBQ0gsTUFBTSxVQUFVLHNCQUFzQixDQUNwQyxNQUFrQyxFQUNsQyxNQUFjLEVBQ2QsS0FBc0I7SUFFdEIsSUFBSSxDQUFDLE1BQU0sRUFBRSxDQUFDO1FBQ1osT0FBTyxDQUFDLENBQUM7SUFDWCxDQUFDO0lBQ0QsSUFBSSxJQUFJLEdBQUcsQ0FBQyxDQUFDO0lBQ2IsTUFBTSxPQUFPLEdBQUcsSUFBSSxHQUFHLEVBQWtCLENBQUM7SUFDMUMsS0FBSyxNQUFNLENBQUMsSUFBSSxNQUFNLEVBQUUsQ0FBQztRQUN2QixJQUFJLENBQUMsQ0FBQyxTQUFTLEtBQUssY0FBYyxJQUFJLENBQUMsQ0FBQyxhQUFhLEtBQUssTUFBTSxFQUFFLENBQUM7WUFDakUsU0FBUztRQUNYLENBQUM7UUFDRCxNQUFNLEtBQUssR0FBRyxPQUFPLENBQUMsQ0FBQyxDQUFDLENBQUM7UUFDekIsSUFBSSxLQUFLLEtBQUssU0FBUyxFQUFFLENBQUM7WUFDeEIsSUFBSSxFQUFFLENBQUM7UUFDVCxDQUFDO2FBQU0sQ0FBQztZQUNOLE9BQU8sQ0FBQyxHQUFHLENBQUMsS0FBSyxFQUFFLENBQUMsT0FBTyxDQUFDLEdBQUcsQ0FBQyxLQUFLLENBQUMsSUFBSSxDQUFDLENBQUMsR0FBRyxDQUFDLENBQUMsQ0FBQztRQUNwRCxDQUFDO0lBQ0gsQ0FBQztJQUNELElBQUksS0FBSyxLQUFLLFNBQVMsRUFBRSxDQUFDO1FBQ3hCLElBQUksS0FBSyxHQUFHLElBQUksQ0FBQztRQUNqQixLQUFLLE1BQU0sS0FBSyxJQUFJLE9BQU8sQ0FBQyxNQUFNLEVBQUUsRUFBRSxDQUFDO1lBQ3JDLEtBQUssSUFBSSxLQUFLLENBQUM7UUFDakIsQ0FBQztRQUNELE9BQU8sS0FBSyxDQUFDO0lBQ2YsQ0FBQztJQUNELElBQUksS0FBSyxDQUFDLElBQUksS0FBSyxTQUFTLEVBQUUsQ0FBQztRQUM3QixPQUFPLE9BQU8sQ0FBQyxHQUFHLENBQUMsS0FBSyxDQUFDLFNBQVMsQ0FBQyxJQUFJLENBQUMsQ0FBQztJQUMzQyxDQUFDO0lBQ0QsZ0JBQWdCO0lBQ2hCLElBQUksUUFBUSxHQUFHLENBQUMsQ0FBQztJQUNqQixLQUFLLE1BQU0sS0FBSyxJQUFJLE9BQU8sQ0FBQyxNQUFNLEVBQUUsRUFBRSxDQUFDO1FBQ3JDLElBQUksS0FBSyxHQUFHLFFBQVEsRUFBRSxDQUFDO1lBQ3JCLFFBQVEsR0FBRyxLQUFLLENBQUM7UUFDbkIsQ0FBQztJQUNILENBQUM7SUFDRCxPQUFPLElBQUksR0FBRyxRQUFRLENBQUM7QUFDekIsQ0FBQyIsInNvdXJjZXNDb250ZW50IjpbImltcG9ydCB0eXBlIHsgRXZlbnQgfSBmcm9tICdAd29ya2Zsb3cvd29ybGQnO1xuXG4vKipcbiAqIFNjb3BlIGZvciB7QGxpbmsgY291bnRTdGVwU3RhcnRlZEV2ZW50c306XG4gKiAtIGB7IHR5cGU6ICdvd25lZEJ5JywgbWVzc2FnZUlkIH1gIGNvdW50cyBvbmx5IHN0YXJ0cyB3aG9zZVxuICogICBgZXZlbnREYXRhLm93bmVyTWVzc2FnZUlkYCBtYXRjaGVzIOKAlCBpLmUuIGF0dGVtcHRzIHBlcmZvcm1lZCBieSB0aGF0XG4gKiAgIG93bmluZyBxdWV1ZSBtZXNzYWdlIChpbmxpbmUgbGF6eSBzdGFydHMgYW5kIG93bmVkLXJlY292ZXJ5IHJlLXN0YW1wcykuXG4gKiAtIGB7IHR5cGU6ICd0b3RhbEF0dGVtcHRzJyB9YCBlc3RpbWF0ZXMgdGhlIHN0ZXAncyBnZW51aW5lIGF0dGVtcHQgdG90YWxcbiAqICAgYWNyb3NzIGl0cyB3aG9sZSBsaWZlY3ljbGU6IHVuc3RhbXBlZCAoYmFyZSkgc3RhcnRzIOKAlCB3aGljaCBvbmx5IHJlYWxcbiAqICAgcXVldWUtZGlzcGF0Y2hlZCBiYWNrZ3JvdW5kIGRlbGl2ZXJpZXMgd3JpdGUg4oCUIHBsdXMgdGhlIHN0YXJ0cyBvZiB0aGVcbiAqICAgc2luZ2xlIG1vc3Qtc3RhcnRlZCBvd25lci4gQSBnZW51aW5lIGxpZmVjeWNsZSBoYXMgYXQgbW9zdCBvbmUgaW5saW5lXG4gKiAgIG93bmVyIHBoYXNlIChvd25lcnNoaXAgaXMgY2xhaW1lZCBhdG9taWNhbGx5IGF0IHN0ZXAgY3JlYXRpb24gYW5kXG4gKiAgIGxhcHNlcyBwZXJtYW5lbnRseSBhdCBgc3RlcF9yZXRyeWluZ2Agb3Igb24gYW55IGJhcmUgc3RhcnQpLCBzbyB0YWtpbmdcbiAqICAgdGhlIG1heCBvdmVyIG93bmVycyBjb3VudHMgdGhhdCBwaGFzZSdzIHJlYWwgYXR0ZW1wdHMgd2hpbGUgaW52b2NhdGlvbnNcbiAqICAgcmFjaW5nIG9uIHRoZSBzYW1lIGJhdGNoIOKAlCB3aGljaCBzdGFtcCB0aGVpciBvd24gb25lLW9mZiBtZXNzYWdlIElEcyDigJRcbiAqICAgY29udHJpYnV0ZSBhdCBtb3N0IHRoZWlyIHNpbmdsZSBsYXJnZXN0IGNvdW50IGluc3RlYWQgb2YgYWNjdW11bGF0aW5nLlxuICovXG5leHBvcnQgdHlwZSBTdGVwU3RhcnRTY29wZSA9XG4gIHwgeyB0eXBlOiAnb3duZWRCeSc7IG1lc3NhZ2VJZDogc3RyaW5nIH1cbiAgfCB7IHR5cGU6ICd0b3RhbEF0dGVtcHRzJyB9O1xuXG5jb25zdCBvd25lck9mID0gKGU6IEV2ZW50KTogc3RyaW5nIHwgdW5kZWZpbmVkID0+XG4gICdldmVudERhdGEnIGluIGUgJiZcbiAgZS5ldmVudERhdGEgJiZcbiAgJ293bmVyTWVzc2FnZUlkJyBpbiBlLmV2ZW50RGF0YSAmJlxuICB0eXBlb2YgZS5ldmVudERhdGEub3duZXJNZXNzYWdlSWQgPT09ICdzdHJpbmcnXG4gICAgPyBlLmV2ZW50RGF0YS5vd25lck1lc3NhZ2VJZFxuICAgIDogdW5kZWZpbmVkO1xuXG4vKipcbiAqIE51bWJlciBvZiBgc3RlcF9zdGFydGVkYCBldmVudHMgYWxyZWFkeSByZWNvcmRlZCBmb3IgYSBzdGVwLCB1c2VkIGFzIHRoZVxuICogYXV0aG9yaXRhdGl2ZSBhdHRlbXB0IGNvdW50IGZvciB0aGUgbWF4UmV0cmllcyBjZWlsaW5nICh0aGUgb25seSBib3VuZCBmb3JcbiAqIHN0ZXBzIHRoYXQgdGltZSBvdXQgd2l0aG91dCB3cml0aW5nIGEgYHN0ZXBfZmFpbGVkYCkuXG4gKlxuICogSU1QT1JUQU5UOiB0aGUgcmF3ICh1bnNjb3BlZCkgY291bnQgaXMgTk9UIGEgcmVsaWFibGUgYXR0ZW1wdCBudW1iZXIuXG4gKiBDb25jdXJyZW50IGludm9jYXRpb25zIHJhY2luZyBvbiB0aGUgc2FtZSBwZW5kaW5nIGJhdGNoIChzdGFsZSByZXBsYXlzLFxuICogd2FrZSByZXBsYXlzLCBhIHN0ZXAgbWVzc2FnZSBkaXNwYXRjaGVkIGJ5IGEgcmVwbGF5IHRoYXQgbG9zdCB0aGVcbiAqIGNyZWF0ZS1jbGFpbSByYWNlLCAuLi4pIGNhbiBlYWNoIHdyaXRlIGEgYHN0ZXBfc3RhcnRlZGAgZm9yIHRoZSBzYW1lXG4gKiBsb2dpY2FsIGF0dGVtcHQg4oCUIHdvcmxkcyB3aXRob3V0IGFuIGF0b21pYyBzdGFydCBndWFyZCAod29ybGQtbG9jYWwpIGxldFxuICogYWxsIG9mIHRoZW0gdGhyb3VnaC4gQ291bnRpbmcgdGhvc2UgZHVwbGljYXRlcyBhcyBcImF0dGVtcHRzXCIgbWFkZSB0aGVcbiAqIG1heFJldHJpZXMgY2VpbGluZyBmaXJlIG9uIGhlYWx0aHkgcnVucyBhbmQgZmFpbCB0aGVtIHdpdGggYSBmYWxzZVxuICogXCJleGNlZWRlZCBtYXggcmV0cmllc1wiIChzZWUgd29ya2Zsb3cjMzA2OSkuXG4gKlxuICogQ2FsbGVycyB0aGVyZWZvcmUgc2NvcGUgdGhlIGNvdW50IHRvIHRoZSBzdGFydHMgdGhlaXIgY2VpbGluZyBpcyBhY3R1YWxseVxuICogYWJvdXQgdmlhIGBzY29wZWA6XG4gKiAtIHRoZSBpbmxpbmUgb3duZWQtcmVjb3ZlcnkgY2VpbGluZyBjb3VudHMgb25seSBUSElTIG1lc3NhZ2UncyBzdGFydHNcbiAqICAgKGBvd25lZEJ5YCkg4oCUIGVhY2ggcmVhbCAocmUpZGVsaXZlcnkgb2YgdGhlIG93bmluZyBtZXNzYWdlIHN0YW1wcyBpdHNcbiAqICAgYG93bmVyTWVzc2FnZUlkYCBvbiB0aGUgc3RhcnQgaXQgd3JpdGVzLCB3aGlsZSByYWNpbmcgaW52b2NhdGlvbnMgc3RhbXBcbiAqICAgdGhlaXIgb3duIElEcyAob3Igbm9uZSksIHNvIHRoZXkgbm8gbG9uZ2VyIGluZmxhdGUgdGhlIGNvdW50O1xuICogLSB0aGUgYmFja2dyb3VuZC1zdGVwIGNlaWxpbmcgY291bnRzIHRoZSBsaWZlY3ljbGUgYXR0ZW1wdCB0b3RhbFxuICogICAoYHRvdGFsQXR0ZW1wdHNgOiBiYXJlIHN0YXJ0cyBwbHVzIHRoZSBsYXJnZXN0IHNpbmdsZSBvd25lcidzIHN0YXJ0cykg4oCUXG4gKiAgIHNvIGEgc3RlcCB0aGF0IGV4aGF1c3RlZCBwYXJ0IG9mIGl0cyBidWRnZXQgdW5kZXIgaW5saW5lIG93bmVyc2hpcFxuICogICBiZWZvcmUgdHJhbnNpdGlvbmluZyB0byBxdWV1ZWQvYmFyZSByZXRyaWVzIHN0aWxsIHRyaXBzIHRoZSBjb21iaW5lZFxuICogICBjZWlsaW5nLCB3aGlsZSByYWNlcnMnIG9uZS1vZmYgc3RhbXBlZCBkdXBsaWNhdGVzIGRvbid0IGFjY3VtdWxhdGUsIGFuZFxuICogICB0aHJvdHRsZS90b28tZWFybHkgcmVkZWxpdmVyaWVzICh3aGljaCB3cml0ZSBubyBzdGFydCBhdCBhbGwpIHN0YXlcbiAqICAgZXhjbHVkZWQgYXMgYmVmb3JlLlxuICovXG5leHBvcnQgZnVuY3Rpb24gY291bnRTdGVwU3RhcnRlZEV2ZW50cyhcbiAgZXZlbnRzOiBFdmVudFtdIHwgbnVsbCB8IHVuZGVmaW5lZCxcbiAgc3RlcElkOiBzdHJpbmcsXG4gIHNjb3BlPzogU3RlcFN0YXJ0U2NvcGVcbik6IG51bWJlciB7XG4gIGlmICghZXZlbnRzKSB7XG4gICAgcmV0dXJuIDA7XG4gIH1cbiAgbGV0IGJhcmUgPSAwO1xuICBjb25zdCBieU93bmVyID0gbmV3IE1hcDxzdHJpbmcsIG51bWJlcj4oKTtcbiAgZm9yIChjb25zdCBlIG9mIGV2ZW50cykge1xuICAgIGlmIChlLmV2ZW50VHlwZSAhPT0gJ3N0ZXBfc3RhcnRlZCcgfHwgZS5jb3JyZWxhdGlvbklkICE9PSBzdGVwSWQpIHtcbiAgICAgIGNvbnRpbnVlO1xuICAgIH1cbiAgICBjb25zdCBvd25lciA9IG93bmVyT2YoZSk7XG4gICAgaWYgKG93bmVyID09PSB1bmRlZmluZWQpIHtcbiAgICAgIGJhcmUrKztcbiAgICB9IGVsc2Uge1xuICAgICAgYnlPd25lci5zZXQob3duZXIsIChieU93bmVyLmdldChvd25lcikgPz8gMCkgKyAxKTtcbiAgICB9XG4gIH1cbiAgaWYgKHNjb3BlID09PSB1bmRlZmluZWQpIHtcbiAgICBsZXQgdG90YWwgPSBiYXJlO1xuICAgIGZvciAoY29uc3QgY291bnQgb2YgYnlPd25lci52YWx1ZXMoKSkge1xuICAgICAgdG90YWwgKz0gY291bnQ7XG4gICAgfVxuICAgIHJldHVybiB0b3RhbDtcbiAgfVxuICBpZiAoc2NvcGUudHlwZSA9PT0gJ293bmVkQnknKSB7XG4gICAgcmV0dXJuIGJ5T3duZXIuZ2V0KHNjb3BlLm1lc3NhZ2VJZCkgPz8gMDtcbiAgfVxuICAvLyB0b3RhbEF0dGVtcHRzXG4gIGxldCBtYXhPd25lciA9IDA7XG4gIGZvciAoY29uc3QgY291bnQgb2YgYnlPd25lci52YWx1ZXMoKSkge1xuICAgIGlmIChjb3VudCA+IG1heE93bmVyKSB7XG4gICAgICBtYXhPd25lciA9IGNvdW50O1xuICAgIH1cbiAgfVxuICByZXR1cm4gYmFyZSArIG1heE93bmVyO1xufVxuIl19

package/dist/runtime/deployment-guard.d.ts

@@ -0,0 +1,99 @@
+import { type WorkflowRun, type World } from '@workflow/world';
+/**
+ * How the guard resolved a delivery. Both non-`continue` outcomes mean the
+ * caller must ack the message and return without executing anything.
+ */
+export type DeploymentAffinityOutcome = 
+/** The run belongs here (or this world has no deployment affinity). */
+'continue'
+/** Misrouted; re-enqueued at the run's own deployment. */
+ | 'rerouted'
+/** Misrouted and out of budget (or unroutable); `run_failed` recorded. */
+ | 'failed';
+/**
+ * `spanAttributes` is present only on a misrouted delivery — mismatches are
+ * rare, so the presence of `workflow.deployment.pinned_id` on a span *is* the
+ * signal that one happened, and `recovered` separates the ones a re-route fixed
+ * from the ones that kept misrouting.
+ */
+export interface DeploymentAffinityResult {
+    outcome: DeploymentAffinityOutcome;
+    spanAttributes?: Record<string, string | number | boolean>;
+}
+/**
+ * Arguments handed to a call site's re-enqueue closure. The guard owns the
+ * policy — counting, backoff, logging, telemetry, escalation — and the call
+ * site owns only the shape of the message it needs to put back on the queue.
+ */
+export interface ReenqueueArgs {
+    /** The deployment to target: the one the run is pinned to. */
+    deploymentId: string;
+    /**
+     * The run's spec version, so the world picks the right queue transport
+     * (CBOR vs JSON). Undefined on legacy runs that predate the field; worlds
+     * then fall back to their current default.
+     */
+    specVersion: number | undefined;
+    deploymentMismatchRetryCount: number;
+    /** Backoff before the re-routed message becomes visible. */
+    delaySeconds: number;
+}
+/**
+ * Guards deployment affinity: a run may only execute on the deployment it is
+ * pinned to.
+ *
+ * A run's `deploymentId` is fixed when it starts — the deployment that called
+ * `start()`, or whatever `start({ deploymentId })` resolved to (an explicit id
+ * or `'latest'`) — and no replay or step execution may happen anywhere else:
+ * the bundles here may not match the run's persisted history, and any step
+ * dispatched from here derives the per-run encryption key from the wrong
+ * deployment's master key, which surfaces as a `RuntimeDecryptionError` the
+ * queue retry callback swallows into a blank "exceeded max retries".
+ *
+ * A misrouted delivery is not treated as permanent. Rather than failing
+ * immediately, re-enqueue the message *explicitly targeted* at the run's own
+ * deployment; that send is strictly better-addressed than the one that
+ * misrouted, which inherited the producing deployment's ambient id. Fail only
+ * once the budget (`WORKFLOW_DEPLOYMENT_MISMATCH_MAX_RETRIES`, default 3) is
+ * spent, mirroring how a replay divergence gets bounded recovery replays before
+ * being recorded as a corrupted event log.
+ *
+ * Callers must pass a run entity they already have in hand — every call site
+ * loads the run for other reasons — so the guard costs no extra round trip.
+ * (`world.getDeploymentId()` reads the ambient deployment id, e.g.
+ * `VERCEL_DEPLOYMENT_ID`, and does not call the backend either.)
+ *
+ * The failure is recorded **without resolving the run's encryption key**: the
+ * key is fetched from the pinned deployment's API, often unavailable once that
+ * deployment is past its retention window, so depending on it would throw here
+ * instead of recording the failure. The payload is written unencrypted (it
+ * holds only deployment ids, nothing sensitive), and the plaintext `errorCode`
+ * is the signal observability and the UI key off.
+ */
+export declare function guardDeploymentAffinity({ world, run, requestId, retryCount, reenqueue, isDeploymentUnavailableError, beforeStop, }: {
+    world: World;
+    run: Pick<WorkflowRun, 'runId' | 'deploymentId' | 'specVersion'>;
+    requestId?: string;
+    /** `deploymentMismatchRetryCount` from the incoming message, if any. */
+    retryCount?: number;
+    /**
+     * Puts this delivery's message back on the queue, targeted at the run's own
+     * deployment. Omitted by callers that cannot reconstruct their message, which
+     * makes the guard fail-fast.
+     */
+    reenqueue?: (args: ReenqueueArgs) => Promise<void>;
+    /**
+     * Classifies a re-enqueue failure as definitive proof that the pinned
+     * deployment cannot receive the message. Unclassified failures are retried
+     * by rejecting the handler and leaving the current queue message unacked.
+     */
+    isDeploymentUnavailableError?: (error: unknown) => boolean;
+    /**
+     * Ordering barrier awaited once a mismatch is confirmed, before either
+     * stopping action. Under turbo the `run_started` write is backgrounded, and
+     * both outcomes hand the run off (to a `run_failed` here, or to the pinned
+     * deployment's own `run_started`) — so that write must have landed first.
+     */
+    beforeStop?: () => Promise<void>;
+}): Promise<DeploymentAffinityResult>;
+//# sourceMappingURL=deployment-guard.d.ts.map

package/dist/runtime/deployment-guard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"deployment-guard.d.ts","sourceRoot":"","sources":["../../src/runtime/deployment-guard.ts"],"names":[],"mappings":"AAMA,OAAO,EAGL,KAAK,WAAW,EAChB,KAAK,KAAK,EACX,MAAM,iBAAiB,CAAC;AASzB;;;GAGG;AACH,MAAM,MAAM,yBAAyB;AACnC,uEAAuE;AACrE,UAAU;AACZ,0DAA0D;GACxD,UAAU;AACZ,0EAA0E;GACxE,QAAQ,CAAC;AAEb;;;;;GAKG;AACH,MAAM,WAAW,wBAAwB;IACvC,OAAO,EAAE,yBAAyB,CAAC;IACnC,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,CAAC;CAC5D;AAwBD;;;;GAIG;AACH,MAAM,WAAW,aAAa;IAC5B,8DAA8D;IAC9D,YAAY,EAAE,MAAM,CAAC;IACrB;;;;OAIG;IACH,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;IAChC,4BAA4B,EAAE,MAAM,CAAC;IACrC,4DAA4D;IAC5D,YAAY,EAAE,MAAM,CAAC;CACtB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,wBAAsB,uBAAuB,CAAC,EAC5C,KAAK,EACL,GAAG,EACH,SAAS,EACT,UAAc,EACd,SAAS,EACT,4BAA4B,EAC5B,UAAU,GACX,EAAE;IACD,KAAK,EAAE,KAAK,CAAC;IACb,GAAG,EAAE,IAAI,CAAC,WAAW,EAAE,OAAO,GAAG,cAAc,GAAG,aAAa,CAAC,CAAC;IACjE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,wEAAwE;IACxE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;OAIG;IACH,SAAS,CAAC,EAAE,CAAC,IAAI,EAAE,aAAa,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACnD;;;;OAIG;IACH,4BAA4B,CAAC,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,OAAO,CAAC;IAC3D;;;;;OAKG;IACH,UAAU,CAAC,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAClC,GAAG,OAAO,CAAC,wBAAwB,CAAC,CAoIpC"}

package/dist/runtime/deployment-guard.js

@@ -0,0 +1,154 @@
+import { EntityConflictError, RUN_ERROR_CODES, RunExpiredError, WorkflowDeploymentMismatchError, } from '@workflow/errors';
+import { SPEC_VERSION_CURRENT, SPEC_VERSION_SUPPORTS_COMPRESSION, } from '@workflow/world';
+import { runtimeLogger } from '../logger.js';
+import { dehydrateRunError } from '../serialization.js';
+import * as Attribute from '../telemetry/semantic-conventions.js';
+import { getDeploymentMismatchMaxRetries } from './constants.js';
+/** Cap on the re-route backoff, in seconds. */
+const MAX_REROUTE_DELAY_SECONDS = 8;
+/** The common case, allocation-free. */
+const CONTINUE = { outcome: 'continue' };
+/**
+ * Builds a stopping result. `attempts` is the re-route count *including* this
+ * invocation's own attempt, so the span attribute reads as "attempts so far".
+ */
+function result(outcome, pinnedDeploymentId, attempts) {
+    return {
+        outcome,
+        spanAttributes: {
+            ...Attribute.WorkflowRunPinnedDeploymentId(pinnedDeploymentId),
+            ...Attribute.WorkflowDeploymentMismatchRetryCount(attempts),
+            ...Attribute.WorkflowDeploymentMismatchRecovered(outcome === 'rerouted'),
+        },
+    };
+}
+/**
+ * Guards deployment affinity: a run may only execute on the deployment it is
+ * pinned to.
+ *
+ * A run's `deploymentId` is fixed when it starts — the deployment that called
+ * `start()`, or whatever `start({ deploymentId })` resolved to (an explicit id
+ * or `'latest'`) — and no replay or step execution may happen anywhere else:
+ * the bundles here may not match the run's persisted history, and any step
+ * dispatched from here derives the per-run encryption key from the wrong
+ * deployment's master key, which surfaces as a `RuntimeDecryptionError` the
+ * queue retry callback swallows into a blank "exceeded max retries".
+ *
+ * A misrouted delivery is not treated as permanent. Rather than failing
+ * immediately, re-enqueue the message *explicitly targeted* at the run's own
+ * deployment; that send is strictly better-addressed than the one that
+ * misrouted, which inherited the producing deployment's ambient id. Fail only
+ * once the budget (`WORKFLOW_DEPLOYMENT_MISMATCH_MAX_RETRIES`, default 3) is
+ * spent, mirroring how a replay divergence gets bounded recovery replays before
+ * being recorded as a corrupted event log.
+ *
+ * Callers must pass a run entity they already have in hand — every call site
+ * loads the run for other reasons — so the guard costs no extra round trip.
+ * (`world.getDeploymentId()` reads the ambient deployment id, e.g.
+ * `VERCEL_DEPLOYMENT_ID`, and does not call the backend either.)
+ *
+ * The failure is recorded **without resolving the run's encryption key**: the
+ * key is fetched from the pinned deployment's API, often unavailable once that
+ * deployment is past its retention window, so depending on it would throw here
+ * instead of recording the failure. The payload is written unencrypted (it
+ * holds only deployment ids, nothing sensitive), and the plaintext `errorCode`
+ * is the signal observability and the UI key off.
+ */
+export async function guardDeploymentAffinity({ world, run, requestId, retryCount = 0, reenqueue, isDeploymentUnavailableError, beforeStop, }) {
+    // Deployment affinity is only meaningful in worlds whose deployments are
+    // atomic and immutable, which the World declares (world-vercel does) and
+    // capabilities default to unsupported. Local and self-hosted worlds report a
+    // synthetic deployment id (e.g. `dpl_local@<sdk-version>`) that legitimately
+    // differs across SDK versions within one logical environment, so guarding
+    // them would fail ordinary local runs after a version bump.
+    if (world.capabilities?.deploymentAffinity !== true) {
+        return CONTINUE;
+    }
+    const currentDeploymentId = await world.getDeploymentId();
+    if (run.deploymentId === currentDeploymentId) {
+        return CONTINUE;
+    }
+    await beforeStop?.();
+    const maxRetries = getDeploymentMismatchMaxRetries();
+    const logContext = {
+        workflowRunId: run.runId,
+        pinnedDeploymentId: run.deploymentId,
+        actualDeploymentId: currentDeploymentId,
+        retryCount,
+        maxRetries,
+    };
+    /**
+     * Records the terminal `run_failed`. Mirrors `recordFatalRunError`: it
+     * records and returns rather than throwing, so the caller acks the message
+     * instead of letting the queue redeliver a run that is now terminal.
+     */
+    const failRun = async (recoveryAttempts, cause) => {
+        const error = new WorkflowDeploymentMismatchError(run.runId, run.deploymentId, currentDeploymentId, { recoveryAttempts, cause });
+        try {
+            await world.events.create(run.runId, {
+                eventType: 'run_failed',
+                specVersion: SPEC_VERSION_CURRENT,
+                eventData: {
+                    // Unencrypted (undefined key): see the note on
+                    // `guardDeploymentAffinity`. dehydrate/hydrate are self-describing,
+                    // so this reads back without a key.
+                    error: await dehydrateRunError(error, run.runId, undefined, undefined, (run.specVersion ?? 0) >= SPEC_VERSION_SUPPORTS_COMPRESSION),
+                    errorCode: RUN_ERROR_CODES.DEPLOYMENT_MISMATCH,
+                },
+            }, { requestId });
+        }
+        catch (failError) {
+            // Run already reached a terminal state (a concurrent writer failed it, or
+            // it was cancelled/expired) — still stop. Anything else is a transient
+            // persistence failure: rethrow so the queue redelivers and we try again.
+            if (!EntityConflictError.is(failError) &&
+                !RunExpiredError.is(failError)) {
+                throw failError;
+            }
+        }
+        return result('failed', run.deploymentId, recoveryAttempts);
+    };
+    if (reenqueue && retryCount < maxRetries) {
+        const attempt = retryCount + 1;
+        // Exponential, capped: 1s, 2s, 4s — cheap insurance against a hot
+        // re-enqueue loop, and time for a mid-flight routing change to settle.
+        const delaySeconds = Math.min(2 ** retryCount, MAX_REROUTE_DELAY_SECONDS);
+        try {
+            await reenqueue({
+                deploymentId: run.deploymentId,
+                specVersion: run.specVersion,
+                deploymentMismatchRetryCount: attempt,
+                delaySeconds,
+            });
+            runtimeLogger.warn('Workflow run received by a deployment it is not pinned to; re-routing to its own deployment', { ...logContext, attempt, delaySeconds });
+            return result('rerouted', run.deploymentId, attempt);
+        }
+        catch (reenqueueError) {
+            // A generic send failure can be transient (429, 5xx, connect/DNS). Do not
+            // turn one infrastructure blip into a terminal run failure: reject the
+            // handler so the current message remains unacked and is redelivered.
+            if (!isDeploymentUnavailableError?.(reenqueueError)) {
+                throw reenqueueError;
+            }
+            // The World explicitly classified the target as unavailable — deleted,
+            // aged out of its retention window, or otherwise undiscoverable. Burning
+            // the rest of the budget on a deployment that provably cannot be reached
+            // only delays the failure, so fail now.
+            runtimeLogger.error('Cannot re-route a misrouted workflow run to its own deployment; failing the run', {
+                ...logContext,
+                attempt,
+                errorMessage: reenqueueError instanceof Error
+                    ? reenqueueError.message
+                    : String(reenqueueError),
+            });
+            // Recovery never actually happened, so report 0 attempts and let `cause`
+            // explain why.
+            return failRun(0, reenqueueError);
+        }
+    }
+    runtimeLogger.error(retryCount > 0
+        ? 'Workflow run kept arriving at a deployment it is not pinned to after re-routing; failing the run'
+        : 'Workflow run received by a deployment it is not pinned to; failing the run', logContext);
+    return failRun(retryCount);
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiZGVwbG95bWVudC1ndWFyZC5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3NyYy9ydW50aW1lL2RlcGxveW1lbnQtZ3VhcmQudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsT0FBTyxFQUNMLG1CQUFtQixFQUNuQixlQUFlLEVBQ2YsZUFBZSxFQUNmLCtCQUErQixHQUNoQyxNQUFNLGtCQUFrQixDQUFDO0FBQzFCLE9BQU8sRUFDTCxvQkFBb0IsRUFDcEIsaUNBQWlDLEdBR2xDLE1BQU0saUJBQWlCLENBQUM7QUFDekIsT0FBTyxFQUFFLGFBQWEsRUFBRSxNQUFNLGNBQWMsQ0FBQztBQUM3QyxPQUFPLEVBQUUsaUJBQWlCLEVBQUUsTUFBTSxxQkFBcUIsQ0FBQztBQUN4RCxPQUFPLEtBQUssU0FBUyxNQUFNLHNDQUFzQyxDQUFDO0FBQ2xFLE9BQU8sRUFBRSwrQkFBK0IsRUFBRSxNQUFNLGdCQUFnQixDQUFDO0FBRWpFLCtDQUErQztBQUMvQyxNQUFNLHlCQUF5QixHQUFHLENBQUMsQ0FBQztBQXlCcEMsd0NBQXdDO0FBQ3hDLE1BQU0sUUFBUSxHQUE2QixFQUFFLE9BQU8sRUFBRSxVQUFVLEVBQUUsQ0FBQztBQUVuRTs7O0dBR0c7QUFDSCxTQUFTLE1BQU0sQ0FDYixPQUE4QixFQUM5QixrQkFBMEIsRUFDMUIsUUFBZ0I7SUFFaEIsT0FBTztRQUNMLE9BQU87UUFDUCxjQUFjLEVBQUU7WUFDZCxHQUFHLFNBQVMsQ0FBQyw2QkFBNkIsQ0FBQyxrQkFBa0IsQ0FBQztZQUM5RCxHQUFHLFNBQVMsQ0FBQyxvQ0FBb0MsQ0FBQyxRQUFRLENBQUM7WUFDM0QsR0FBRyxTQUFTLENBQUMsbUNBQW1DLENBQUMsT0FBTyxLQUFLLFVBQVUsQ0FBQztTQUN6RTtLQUNGLENBQUM7QUFDSixDQUFDO0FBcUJEOzs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7O0dBK0JHO0FBQ0gsTUFBTSxDQUFDLEtBQUssVUFBVSx1QkFBdUIsQ0FBQyxFQUM1QyxLQUFLLEVBQ0wsR0FBRyxFQUNILFNBQVMsRUFDVCxVQUFVLEdBQUcsQ0FBQyxFQUNkLFNBQVMsRUFDVCw0QkFBNEIsRUFDNUIsVUFBVSxHQTBCWDtJQUNDLHlFQUF5RTtJQUN6RSx5RUFBeUU7SUFDekUsNkVBQTZFO0lBQzdFLDZFQUE2RTtJQUM3RSwwRUFBMEU7SUFDMUUsNERBQTREO0lBQzVELElBQUksS0FBSyxDQUFDLFlBQVksRUFBRSxrQkFBa0IsS0FBSyxJQUFJLEVBQUUsQ0FBQztRQUNwRCxPQUFPLFFBQVEsQ0FBQztJQUNsQixDQUFDO0lBRUQsTUFBTSxtQkFBbUIsR0FBRyxNQUFNLEtBQUssQ0FBQyxlQUFlLEVBQUUsQ0FBQztJQUMxRCxJQUFJLEdBQUcsQ0FBQyxZQUFZLEtBQUssbUJBQW1CLEVBQUUsQ0FBQztRQUM3QyxPQUFPLFFBQVEsQ0FBQztJQUNsQixDQUFDO0lBRUQsTUFBTSxVQUFVLEVBQUUsRUFBRSxDQUFDO0lBRXJCLE1BQU0sVUFBVSxHQUFHLCtCQUErQixFQUFFLENBQUM7SUFDckQsTUFBTSxVQUFVLEdBQUc7UUFDakIsYUFBYSxFQUFFLEdBQUcsQ0FBQyxLQUFLO1FBQ3hCLGtCQUFrQixFQUFFLEdBQUcsQ0FBQyxZQUFZO1FBQ3BDLGtCQUFrQixFQUFFLG1CQUFtQjtRQUN2QyxVQUFVO1FBQ1YsVUFBVTtLQUNYLENBQUM7SUFFRjs7OztPQUlHO0lBQ0gsTUFBTSxPQUFPLEdBQUcsS0FBSyxFQUNuQixnQkFBd0IsRUFDeEIsS0FBZSxFQUNvQixFQUFFO1FBQ3JDLE1BQU0sS0FBSyxHQUFHLElBQUksK0JBQStCLENBQy9DLEdBQUcsQ0FBQyxLQUFLLEVBQ1QsR0FBRyxDQUFDLFlBQVksRUFDaEIsbUJBQW1CLEVBQ25CLEVBQUUsZ0JBQWdCLEVBQUUsS0FBSyxFQUFFLENBQzVCLENBQUM7UUFFRixJQUFJLENBQUM7WUFDSCxNQUFNLEtBQUssQ0FBQyxNQUFNLENBQUMsTUFBTSxDQUN2QixHQUFHLENBQUMsS0FBSyxFQUNUO2dCQUNFLFNBQVMsRUFBRSxZQUFZO2dCQUN2QixXQUFXLEVBQUUsb0JBQW9CO2dCQUNqQyxTQUFTLEVBQUU7b0JBQ1QsK0NBQStDO29CQUMvQyxvRUFBb0U7b0JBQ3BFLG9DQUFvQztvQkFDcEMsS0FBSyxFQUFFLE1BQU0saUJBQWlCLENBQzVCLEtBQUssRUFDTCxHQUFHLENBQUMsS0FBSyxFQUNULFNBQVMsRUFDVCxTQUFTLEVBQ1QsQ0FBQyxHQUFHLENBQUMsV0FBVyxJQUFJLENBQUMsQ0FBQyxJQUFJLGlDQUFpQyxDQUM1RDtvQkFDRCxTQUFTLEVBQUUsZUFBZSxDQUFDLG1CQUFtQjtpQkFDL0M7YUFDRixFQUNELEVBQUUsU0FBUyxFQUFFLENBQ2QsQ0FBQztRQUNKLENBQUM7UUFBQyxPQUFPLFNBQVMsRUFBRSxDQUFDO1lBQ25CLDBFQUEwRTtZQUMxRSx1RUFBdUU7WUFDdkUseUVBQXlFO1lBQ3pFLElBQ0UsQ0FBQyxtQkFBbUIsQ0FBQyxFQUFFLENBQUMsU0FBUyxDQUFDO2dCQUNsQyxDQUFDLGVBQWUsQ0FBQyxFQUFFLENBQUMsU0FBUyxDQUFDLEVBQzlCLENBQUM7Z0JBQ0QsTUFBTSxTQUFTLENBQUM7WUFDbEIsQ0FBQztRQUNILENBQUM7UUFDRCxPQUFPLE1BQU0sQ0FBQyxRQUFRLEVBQUUsR0FBRyxDQUFDLFlBQVksRUFBRSxnQkFBZ0IsQ0FBQyxDQUFDO0lBQzlELENBQUMsQ0FBQztJQUVGLElBQUksU0FBUyxJQUFJLFVBQVUsR0FBRyxVQUFVLEVBQUUsQ0FBQztRQUN6QyxNQUFNLE9BQU8sR0FBRyxVQUFVLEdBQUcsQ0FBQyxDQUFDO1FBQy9CLGtFQUFrRTtRQUNsRSx1RUFBdUU7UUFDdkUsTUFBTSxZQUFZLEdBQUcsSUFBSSxDQUFDLEdBQUcsQ0FBQyxDQUFDLElBQUksVUFBVSxFQUFFLHlCQUF5QixDQUFDLENBQUM7UUFDMUUsSUFBSSxDQUFDO1lBQ0gsTUFBTSxTQUFTLENBQUM7Z0JBQ2QsWUFBWSxFQUFFLEdBQUcsQ0FBQyxZQUFZO2dCQUM5QixXQUFXLEVBQUUsR0FBRyxDQUFDLFdBQVc7Z0JBQzVCLDRCQUE0QixFQUFFLE9BQU87Z0JBQ3JDLFlBQVk7YUFDYixDQUFDLENBQUM7WUFDSCxhQUFhLENBQUMsSUFBSSxDQUNoQiw2RkFBNkYsRUFDN0YsRUFBRSxHQUFHLFVBQVUsRUFBRSxPQUFPLEVBQUUsWUFBWSxFQUFFLENBQ3pDLENBQUM7WUFDRixPQUFPLE1BQU0sQ0FBQyxVQUFVLEVBQUUsR0FBRyxDQUFDLFlBQVksRUFBRSxPQUFPLENBQUMsQ0FBQztRQUN2RCxDQUFDO1FBQUMsT0FBTyxjQUFjLEVBQUUsQ0FBQztZQUN4QiwwRUFBMEU7WUFDMUUsdUVBQXVFO1lBQ3ZFLHFFQUFxRTtZQUNyRSxJQUFJLENBQUMsNEJBQTRCLEVBQUUsQ0FBQyxjQUFjLENBQUMsRUFBRSxDQUFDO2dCQUNwRCxNQUFNLGNBQWMsQ0FBQztZQUN2QixDQUFDO1lBRUQsdUVBQXVFO1lBQ3ZFLHlFQUF5RTtZQUN6RSx5RUFBeUU7WUFDekUsd0NBQXdDO1lBQ3hDLGFBQWEsQ0FBQyxLQUFLLENBQ2pCLGlGQUFpRixFQUNqRjtnQkFDRSxHQUFHLFVBQVU7Z0JBQ2IsT0FBTztnQkFDUCxZQUFZLEVBQ1YsY0FBYyxZQUFZLEtBQUs7b0JBQzdCLENBQUMsQ0FBQyxjQUFjLENBQUMsT0FBTztvQkFDeEIsQ0FBQyxDQUFDLE1BQU0sQ0FBQyxjQUFjLENBQUM7YUFDN0IsQ0FDRixDQUFDO1lBQ0YseUVBQXlFO1lBQ3pFLGVBQWU7WUFDZixPQUFPLE9BQU8sQ0FBQyxDQUFDLEVBQUUsY0FBYyxDQUFDLENBQUM7UUFDcEMsQ0FBQztJQUNILENBQUM7SUFFRCxhQUFhLENBQUMsS0FBSyxDQUNqQixVQUFVLEdBQUcsQ0FBQztRQUNaLENBQUMsQ0FBQyxrR0FBa0c7UUFDcEcsQ0FBQyxDQUFDLDRFQUE0RSxFQUNoRixVQUFVLENBQ1gsQ0FBQztJQUNGLE9BQU8sT0FBTyxDQUFDLFVBQVUsQ0FBQyxDQUFDO0FBQzdCLENBQUMiLCJzb3VyY2VzQ29udGVudCI6WyJpbXBvcnQge1xuICBFbnRpdHlDb25mbGljdEVycm9yLFxuICBSVU5fRVJST1JfQ09ERVMsXG4gIFJ1bkV4cGlyZWRFcnJvcixcbiAgV29ya2Zsb3dEZXBsb3ltZW50TWlzbWF0Y2hFcnJvcixcbn0gZnJvbSAnQHdvcmtmbG93L2Vycm9ycyc7XG5pbXBvcnQge1xuICBTUEVDX1ZFUlNJT05fQ1VSUkVOVCxcbiAgU1BFQ19WRVJTSU9OX1NVUFBPUlRTX0NPTVBSRVNTSU9OLFxuICB0eXBlIFdvcmtmbG93UnVuLFxuICB0eXBlIFdvcmxkLFxufSBmcm9tICdAd29ya2Zsb3cvd29ybGQnO1xuaW1wb3J0IHsgcnVudGltZUxvZ2dlciB9IGZyb20gJy4uL2xvZ2dlci5qcyc7XG5pbXBvcnQgeyBkZWh5ZHJhdGVSdW5FcnJvciB9IGZyb20gJy4uL3NlcmlhbGl6YXRpb24uanMnO1xuaW1wb3J0ICogYXMgQXR0cmlidXRlIGZyb20gJy4uL3RlbGVtZXRyeS9zZW1hbnRpYy1jb252ZW50aW9ucy5qcyc7XG5pbXBvcnQgeyBnZXREZXBsb3ltZW50TWlzbWF0Y2hNYXhSZXRyaWVzIH0gZnJvbSAnLi9jb25zdGFudHMuanMnO1xuXG4vKiogQ2FwIG9uIHRoZSByZS1yb3V0ZSBiYWNrb2ZmLCBpbiBzZWNvbmRzLiAqL1xuY29uc3QgTUFYX1JFUk9VVEVfREVMQVlfU0VDT05EUyA9IDg7XG5cbi8qKlxuICogSG93IHRoZSBndWFyZCByZXNvbHZlZCBhIGRlbGl2ZXJ5LiBCb3RoIG5vbi1gY29udGludWVgIG91dGNvbWVzIG1lYW4gdGhlXG4gKiBjYWxsZXIgbXVzdCBhY2sgdGhlIG1lc3NhZ2UgYW5kIHJldHVybiB3aXRob3V0IGV4ZWN1dGluZyBhbnl0aGluZy5cbiAqL1xuZXhwb3J0IHR5cGUgRGVwbG95bWVudEFmZmluaXR5T3V0Y29tZSA9XG4gIC8qKiBUaGUgcnVuIGJlbG9uZ3MgaGVyZSAob3IgdGhpcyB3b3JsZCBoYXMgbm8gZGVwbG95bWVudCBhZmZpbml0eSkuICovXG4gIHwgJ2NvbnRpbnVlJ1xuICAvKiogTWlzcm91dGVkOyByZS1lbnF1ZXVlZCBhdCB0aGUgcnVuJ3Mgb3duIGRlcGxveW1lbnQuICovXG4gIHwgJ3Jlcm91dGVkJ1xuICAvKiogTWlzcm91dGVkIGFuZCBvdXQgb2YgYnVkZ2V0IChvciB1bnJvdXRhYmxlKTsgYHJ1bl9mYWlsZWRgIHJlY29yZGVkLiAqL1xuICB8ICdmYWlsZWQnO1xuXG4vKipcbiAqIGBzcGFuQXR0cmlidXRlc2AgaXMgcHJlc2VudCBvbmx5IG9uIGEgbWlzcm91dGVkIGRlbGl2ZXJ5IOKAlCBtaXNtYXRjaGVzIGFyZVxuICogcmFyZSwgc28gdGhlIHByZXNlbmNlIG9mIGB3b3JrZmxvdy5kZXBsb3ltZW50LnBpbm5lZF9pZGAgb24gYSBzcGFuICppcyogdGhlXG4gKiBzaWduYWwgdGhhdCBvbmUgaGFwcGVuZWQsIGFuZCBgcmVjb3ZlcmVkYCBzZXBhcmF0ZXMgdGhlIG9uZXMgYSByZS1yb3V0ZSBmaXhlZFxuICogZnJvbSB0aGUgb25lcyB0aGF0IGtlcHQgbWlzcm91dGluZy5cbiAqL1xuZXhwb3J0IGludGVyZmFjZSBEZXBsb3ltZW50QWZmaW5pdHlSZXN1bHQge1xuICBvdXRjb21lOiBEZXBsb3ltZW50QWZmaW5pdHlPdXRjb21lO1xuICBzcGFuQXR0cmlidXRlcz86IFJlY29yZDxzdHJpbmcsIHN0cmluZyB8IG51bWJlciB8IGJvb2xlYW4+O1xufVxuXG4vKiogVGhlIGNvbW1vbiBjYXNlLCBhbGxvY2F0aW9uLWZyZWUuICovXG5jb25zdCBDT05USU5VRTogRGVwbG95bWVudEFmZmluaXR5UmVzdWx0ID0geyBvdXRjb21lOiAnY29udGludWUnIH07XG5cbi8qKlxuICogQnVpbGRzIGEgc3RvcHBpbmcgcmVzdWx0LiBgYXR0ZW1wdHNgIGlzIHRoZSByZS1yb3V0ZSBjb3VudCAqaW5jbHVkaW5nKiB0aGlzXG4gKiBpbnZvY2F0aW9uJ3Mgb3duIGF0dGVtcHQsIHNvIHRoZSBzcGFuIGF0dHJpYnV0ZSByZWFkcyBhcyBcImF0dGVtcHRzIHNvIGZhclwiLlxuICovXG5mdW5jdGlvbiByZXN1bHQoXG4gIG91dGNvbWU6ICdyZXJvdXRlZCcgfCAnZmFpbGVkJyxcbiAgcGlubmVkRGVwbG95bWVudElkOiBzdHJpbmcsXG4gIGF0dGVtcHRzOiBudW1iZXJcbik6IERlcGxveW1lbnRBZmZpbml0eVJlc3VsdCB7XG4gIHJldHVybiB7XG4gICAgb3V0Y29tZSxcbiAgICBzcGFuQXR0cmlidXRlczoge1xuICAgICAgLi4uQXR0cmlidXRlLldvcmtmbG93UnVuUGlubmVkRGVwbG95bWVudElkKHBpbm5lZERlcGxveW1lbnRJZCksXG4gICAgICAuLi5BdHRyaWJ1dGUuV29ya2Zsb3dEZXBsb3ltZW50TWlzbWF0Y2hSZXRyeUNvdW50KGF0dGVtcHRzKSxcbiAgICAgIC4uLkF0dHJpYnV0ZS5Xb3JrZmxvd0RlcGxveW1lbnRNaXNtYXRjaFJlY292ZXJlZChvdXRjb21lID09PSAncmVyb3V0ZWQnKSxcbiAgICB9LFxuICB9O1xufVxuXG4vKipcbiAqIEFyZ3VtZW50cyBoYW5kZWQgdG8gYSBjYWxsIHNpdGUncyByZS1lbnF1ZXVlIGNsb3N1cmUuIFRoZSBndWFyZCBvd25zIHRoZVxuICogcG9saWN5IOKAlCBjb3VudGluZywgYmFja29mZiwgbG9nZ2luZywgdGVsZW1ldHJ5LCBlc2NhbGF0aW9uIOKAlCBhbmQgdGhlIGNhbGxcbiAqIHNpdGUgb3ducyBvbmx5IHRoZSBzaGFwZSBvZiB0aGUgbWVzc2FnZSBpdCBuZWVkcyB0byBwdXQgYmFjayBvbiB0aGUgcXVldWUuXG4gKi9cbmV4cG9ydCBpbnRlcmZhY2UgUmVlbnF1ZXVlQXJncyB7XG4gIC8qKiBUaGUgZGVwbG95bWVudCB0byB0YXJnZXQ6IHRoZSBvbmUgdGhlIHJ1biBpcyBwaW5uZWQgdG8uICovXG4gIGRlcGxveW1lbnRJZDogc3RyaW5nO1xuICAvKipcbiAgICogVGhlIHJ1bidzIHNwZWMgdmVyc2lvbiwgc28gdGhlIHdvcmxkIHBpY2tzIHRoZSByaWdodCBxdWV1ZSB0cmFuc3BvcnRcbiAgICogKENCT1IgdnMgSlNPTikuIFVuZGVmaW5lZCBvbiBsZWdhY3kgcnVucyB0aGF0IHByZWRhdGUgdGhlIGZpZWxkOyB3b3JsZHNcbiAgICogdGhlbiBmYWxsIGJhY2sgdG8gdGhlaXIgY3VycmVudCBkZWZhdWx0LlxuICAgKi9cbiAgc3BlY1ZlcnNpb246IG51bWJlciB8IHVuZGVmaW5lZDtcbiAgZGVwbG95bWVudE1pc21hdGNoUmV0cnlDb3VudDogbnVtYmVyO1xuICAvKiogQmFja29mZiBiZWZvcmUgdGhlIHJlLXJvdXRlZCBtZXNzYWdlIGJlY29tZXMgdmlzaWJsZS4gKi9cbiAgZGVsYXlTZWNvbmRzOiBudW1iZXI7XG59XG5cbi8qKlxuICogR3VhcmRzIGRlcGxveW1lbnQgYWZmaW5pdHk6IGEgcnVuIG1heSBvbmx5IGV4ZWN1dGUgb24gdGhlIGRlcGxveW1lbnQgaXQgaXNcbiAqIHBpbm5lZCB0by5cbiAqXG4gKiBBIHJ1bidzIGBkZXBsb3ltZW50SWRgIGlzIGZpeGVkIHdoZW4gaXQgc3RhcnRzIOKAlCB0aGUgZGVwbG95bWVudCB0aGF0IGNhbGxlZFxuICogYHN0YXJ0KClgLCBvciB3aGF0ZXZlciBgc3RhcnQoeyBkZXBsb3ltZW50SWQgfSlgIHJlc29sdmVkIHRvIChhbiBleHBsaWNpdCBpZFxuICogb3IgYCdsYXRlc3QnYCkg4oCUIGFuZCBubyByZXBsYXkgb3Igc3RlcCBleGVjdXRpb24gbWF5IGhhcHBlbiBhbnl3aGVyZSBlbHNlOlxuICogdGhlIGJ1bmRsZXMgaGVyZSBtYXkgbm90IG1hdGNoIHRoZSBydW4ncyBwZXJzaXN0ZWQgaGlzdG9yeSwgYW5kIGFueSBzdGVwXG4gKiBkaXNwYXRjaGVkIGZyb20gaGVyZSBkZXJpdmVzIHRoZSBwZXItcnVuIGVuY3J5cHRpb24ga2V5IGZyb20gdGhlIHdyb25nXG4gKiBkZXBsb3ltZW50J3MgbWFzdGVyIGtleSwgd2hpY2ggc3VyZmFjZXMgYXMgYSBgUnVudGltZURlY3J5cHRpb25FcnJvcmAgdGhlXG4gKiBxdWV1ZSByZXRyeSBjYWxsYmFjayBzd2FsbG93cyBpbnRvIGEgYmxhbmsgXCJleGNlZWRlZCBtYXggcmV0cmllc1wiLlxuICpcbiAqIEEgbWlzcm91dGVkIGRlbGl2ZXJ5IGlzIG5vdCB0cmVhdGVkIGFzIHBlcm1hbmVudC4gUmF0aGVyIHRoYW4gZmFpbGluZ1xuICogaW1tZWRpYXRlbHksIHJlLWVucXVldWUgdGhlIG1lc3NhZ2UgKmV4cGxpY2l0bHkgdGFyZ2V0ZWQqIGF0IHRoZSBydW4ncyBvd25cbiAqIGRlcGxveW1lbnQ7IHRoYXQgc2VuZCBpcyBzdHJpY3RseSBiZXR0ZXItYWRkcmVzc2VkIHRoYW4gdGhlIG9uZSB0aGF0XG4gKiBtaXNyb3V0ZWQsIHdoaWNoIGluaGVyaXRlZCB0aGUgcHJvZHVjaW5nIGRlcGxveW1lbnQncyBhbWJpZW50IGlkLiBGYWlsIG9ubHlcbiAqIG9uY2UgdGhlIGJ1ZGdldCAoYFdPUktGTE9XX0RFUExPWU1FTlRfTUlTTUFUQ0hfTUFYX1JFVFJJRVNgLCBkZWZhdWx0IDMpIGlzXG4gKiBzcGVudCwgbWlycm9yaW5nIGhvdyBhIHJlcGxheSBkaXZlcmdlbmNlIGdldHMgYm91bmRlZCByZWNvdmVyeSByZXBsYXlzIGJlZm9yZVxuICogYmVpbmcgcmVjb3JkZWQgYXMgYSBjb3JydXB0ZWQgZXZlbnQgbG9nLlxuICpcbiAqIENhbGxlcnMgbXVzdCBwYXNzIGEgcnVuIGVudGl0eSB0aGV5IGFscmVhZHkgaGF2ZSBpbiBoYW5kIOKAlCBldmVyeSBjYWxsIHNpdGVcbiAqIGxvYWRzIHRoZSBydW4gZm9yIG90aGVyIHJlYXNvbnMg4oCUIHNvIHRoZSBndWFyZCBjb3N0cyBubyBleHRyYSByb3VuZCB0cmlwLlxuICogKGB3b3JsZC5nZXREZXBsb3ltZW50SWQoKWAgcmVhZHMgdGhlIGFtYmllbnQgZGVwbG95bWVudCBpZCwgZS5nLlxuICogYFZFUkNFTF9ERVBMT1lNRU5UX0lEYCwgYW5kIGRvZXMgbm90IGNhbGwgdGhlIGJhY2tlbmQgZWl0aGVyLilcbiAqXG4gKiBUaGUgZmFpbHVyZSBpcyByZWNvcmRlZCAqKndpdGhvdXQgcmVzb2x2aW5nIHRoZSBydW4ncyBlbmNyeXB0aW9uIGtleSoqOiB0aGVcbiAqIGtleSBpcyBmZXRjaGVkIGZyb20gdGhlIHBpbm5lZCBkZXBsb3ltZW50J3MgQVBJLCBvZnRlbiB1bmF2YWlsYWJsZSBvbmNlIHRoYXRcbiAqIGRlcGxveW1lbnQgaXMgcGFzdCBpdHMgcmV0ZW50aW9uIHdpbmRvdywgc28gZGVwZW5kaW5nIG9uIGl0IHdvdWxkIHRocm93IGhlcmVcbiAqIGluc3RlYWQgb2YgcmVjb3JkaW5nIHRoZSBmYWlsdXJlLiBUaGUgcGF5bG9hZCBpcyB3cml0dGVuIHVuZW5jcnlwdGVkIChpdFxuICogaG9sZHMgb25seSBkZXBsb3ltZW50IGlkcywgbm90aGluZyBzZW5zaXRpdmUpLCBhbmQgdGhlIHBsYWludGV4dCBgZXJyb3JDb2RlYFxuICogaXMgdGhlIHNpZ25hbCBvYnNlcnZhYmlsaXR5IGFuZCB0aGUgVUkga2V5IG9mZi5cbiAqL1xuZXhwb3J0IGFzeW5jIGZ1bmN0aW9uIGd1YXJkRGVwbG95bWVudEFmZmluaXR5KHtcbiAgd29ybGQsXG4gIHJ1bixcbiAgcmVxdWVzdElkLFxuICByZXRyeUNvdW50ID0gMCxcbiAgcmVlbnF1ZXVlLFxuICBpc0RlcGxveW1lbnRVbmF2YWlsYWJsZUVycm9yLFxuICBiZWZvcmVTdG9wLFxufToge1xuICB3b3JsZDogV29ybGQ7XG4gIHJ1bjogUGljazxXb3JrZmxvd1J1biwgJ3J1bklkJyB8ICdkZXBsb3ltZW50SWQnIHwgJ3NwZWNWZXJzaW9uJz47XG4gIHJlcXVlc3RJZD86IHN0cmluZztcbiAgLyoqIGBkZXBsb3ltZW50TWlzbWF0Y2hSZXRyeUNvdW50YCBmcm9tIHRoZSBpbmNvbWluZyBtZXNzYWdlLCBpZiBhbnkuICovXG4gIHJldHJ5Q291bnQ/OiBudW1iZXI7XG4gIC8qKlxuICAgKiBQdXRzIHRoaXMgZGVsaXZlcnkncyBtZXNzYWdlIGJhY2sgb24gdGhlIHF1ZXVlLCB0YXJnZXRlZCBhdCB0aGUgcnVuJ3Mgb3duXG4gICAqIGRlcGxveW1lbnQuIE9taXR0ZWQgYnkgY2FsbGVycyB0aGF0IGNhbm5vdCByZWNvbnN0cnVjdCB0aGVpciBtZXNzYWdlLCB3aGljaFxuICAgKiBtYWtlcyB0aGUgZ3VhcmQgZmFpbC1mYXN0LlxuICAgKi9cbiAgcmVlbnF1ZXVlPzogKGFyZ3M6IFJlZW5xdWV1ZUFyZ3MpID0+IFByb21pc2U8dm9pZD47XG4gIC8qKlxuICAgKiBDbGFzc2lmaWVzIGEgcmUtZW5xdWV1ZSBmYWlsdXJlIGFzIGRlZmluaXRpdmUgcHJvb2YgdGhhdCB0aGUgcGlubmVkXG4gICAqIGRlcGxveW1lbnQgY2Fubm90IHJlY2VpdmUgdGhlIG1lc3NhZ2UuIFVuY2xhc3NpZmllZCBmYWlsdXJlcyBhcmUgcmV0cmllZFxuICAgKiBieSByZWplY3RpbmcgdGhlIGhhbmRsZXIgYW5kIGxlYXZpbmcgdGhlIGN1cnJlbnQgcXVldWUgbWVzc2FnZSB1bmFja2VkLlxuICAgKi9cbiAgaXNEZXBsb3ltZW50VW5hdmFpbGFibGVFcnJvcj86IChlcnJvcjogdW5rbm93bikgPT4gYm9vbGVhbjtcbiAgLyoqXG4gICAqIE9yZGVyaW5nIGJhcnJpZXIgYXdhaXRlZCBvbmNlIGEgbWlzbWF0Y2ggaXMgY29uZmlybWVkLCBiZWZvcmUgZWl0aGVyXG4gICAqIHN0b3BwaW5nIGFjdGlvbi4gVW5kZXIgdHVyYm8gdGhlIGBydW5fc3RhcnRlZGAgd3JpdGUgaXMgYmFja2dyb3VuZGVkLCBhbmRcbiAgICogYm90aCBvdXRjb21lcyBoYW5kIHRoZSBydW4gb2ZmICh0byBhIGBydW5fZmFpbGVkYCBoZXJlLCBvciB0byB0aGUgcGlubmVkXG4gICAqIGRlcGxveW1lbnQncyBvd24gYHJ1bl9zdGFydGVkYCkg4oCUIHNvIHRoYXQgd3JpdGUgbXVzdCBoYXZlIGxhbmRlZCBmaXJzdC5cbiAgICovXG4gIGJlZm9yZVN0b3A/OiAoKSA9PiBQcm9taXNlPHZvaWQ+O1xufSk6IFByb21pc2U8RGVwbG95bWVudEFmZmluaXR5UmVzdWx0PiB7XG4gIC8vIERlcGxveW1lbnQgYWZmaW5pdHkgaXMgb25seSBtZWFuaW5nZnVsIGluIHdvcmxkcyB3aG9zZSBkZXBsb3ltZW50cyBhcmVcbiAgLy8gYXRvbWljIGFuZCBpbW11dGFibGUsIHdoaWNoIHRoZSBXb3JsZCBkZWNsYXJlcyAod29ybGQtdmVyY2VsIGRvZXMpIGFuZFxuICAvLyBjYXBhYmlsaXRpZXMgZGVmYXVsdCB0byB1bnN1cHBvcnRlZC4gTG9jYWwgYW5kIHNlbGYtaG9zdGVkIHdvcmxkcyByZXBvcnQgYVxuICAvLyBzeW50aGV0aWMgZGVwbG95bWVudCBpZCAoZS5nLiBgZHBsX2xvY2FsQDxzZGstdmVyc2lvbj5gKSB0aGF0IGxlZ2l0aW1hdGVseVxuICAvLyBkaWZmZXJzIGFjcm9zcyBTREsgdmVyc2lvbnMgd2l0aGluIG9uZSBsb2dpY2FsIGVudmlyb25tZW50LCBzbyBndWFyZGluZ1xuICAvLyB0aGVtIHdvdWxkIGZhaWwgb3JkaW5hcnkgbG9jYWwgcnVucyBhZnRlciBhIHZlcnNpb24gYnVtcC5cbiAgaWYgKHdvcmxkLmNhcGFiaWxpdGllcz8uZGVwbG95bWVudEFmZmluaXR5ICE9PSB0cnVlKSB7XG4gICAgcmV0dXJuIENPTlRJTlVFO1xuICB9XG5cbiAgY29uc3QgY3VycmVudERlcGxveW1lbnRJZCA9IGF3YWl0IHdvcmxkLmdldERlcGxveW1lbnRJZCgpO1xuICBpZiAocnVuLmRlcGxveW1lbnRJZCA9PT0gY3VycmVudERlcGxveW1lbnRJZCkge1xuICAgIHJldHVybiBDT05USU5VRTtcbiAgfVxuXG4gIGF3YWl0IGJlZm9yZVN0b3A/LigpO1xuXG4gIGNvbnN0IG1heFJldHJpZXMgPSBnZXREZXBsb3ltZW50TWlzbWF0Y2hNYXhSZXRyaWVzKCk7XG4gIGNvbnN0IGxvZ0NvbnRleHQgPSB7XG4gICAgd29ya2Zsb3dSdW5JZDogcnVuLnJ1bklkLFxuICAgIHBpbm5lZERlcGxveW1lbnRJZDogcnVuLmRlcGxveW1lbnRJZCxcbiAgICBhY3R1YWxEZXBsb3ltZW50SWQ6IGN1cnJlbnREZXBsb3ltZW50SWQsXG4gICAgcmV0cnlDb3VudCxcbiAgICBtYXhSZXRyaWVzLFxuICB9O1xuXG4gIC8qKlxuICAgKiBSZWNvcmRzIHRoZSB0ZXJtaW5hbCBgcnVuX2ZhaWxlZGAuIE1pcnJvcnMgYHJlY29yZEZhdGFsUnVuRXJyb3JgOiBpdFxuICAgKiByZWNvcmRzIGFuZCByZXR1cm5zIHJhdGhlciB0aGFuIHRocm93aW5nLCBzbyB0aGUgY2FsbGVyIGFja3MgdGhlIG1lc3NhZ2VcbiAgICogaW5zdGVhZCBvZiBsZXR0aW5nIHRoZSBxdWV1ZSByZWRlbGl2ZXIgYSBydW4gdGhhdCBpcyBub3cgdGVybWluYWwuXG4gICAqL1xuICBjb25zdCBmYWlsUnVuID0gYXN5bmMgKFxuICAgIHJlY292ZXJ5QXR0ZW1wdHM6IG51bWJlcixcbiAgICBjYXVzZT86IHVua25vd25cbiAgKTogUHJvbWlzZTxEZXBsb3ltZW50QWZmaW5pdHlSZXN1bHQ+ID0+IHtcbiAgICBjb25zdCBlcnJvciA9IG5ldyBXb3JrZmxvd0RlcGxveW1lbnRNaXNtYXRjaEVycm9yKFxuICAgICAgcnVuLnJ1bklkLFxuICAgICAgcnVuLmRlcGxveW1lbnRJZCxcbiAgICAgIGN1cnJlbnREZXBsb3ltZW50SWQsXG4gICAgICB7IHJlY292ZXJ5QXR0ZW1wdHMsIGNhdXNlIH1cbiAgICApO1xuXG4gICAgdHJ5IHtcbiAgICAgIGF3YWl0IHdvcmxkLmV2ZW50cy5jcmVhdGUoXG4gICAgICAgIHJ1bi5ydW5JZCxcbiAgICAgICAge1xuICAgICAgICAgIGV2ZW50VHlwZTogJ3J1bl9mYWlsZWQnLFxuICAgICAgICAgIHNwZWNWZXJzaW9uOiBTUEVDX1ZFUlNJT05fQ1VSUkVOVCxcbiAgICAgICAgICBldmVudERhdGE6IHtcbiAgICAgICAgICAgIC8vIFVuZW5jcnlwdGVkICh1bmRlZmluZWQga2V5KTogc2VlIHRoZSBub3RlIG9uXG4gICAgICAgICAgICAvLyBgZ3VhcmREZXBsb3ltZW50QWZmaW5pdHlgLiBkZWh5ZHJhdGUvaHlkcmF0ZSBhcmUgc2VsZi1kZXNjcmliaW5nLFxuICAgICAgICAgICAgLy8gc28gdGhpcyByZWFkcyBiYWNrIHdpdGhvdXQgYSBrZXkuXG4gICAgICAgICAgICBlcnJvcjogYXdhaXQgZGVoeWRyYXRlUnVuRXJyb3IoXG4gICAgICAgICAgICAgIGVycm9yLFxuICAgICAgICAgICAgICBydW4ucnVuSWQsXG4gICAgICAgICAgICAgIHVuZGVmaW5lZCxcbiAgICAgICAgICAgICAgdW5kZWZpbmVkLFxuICAgICAgICAgICAgICAocnVuLnNwZWNWZXJzaW9uID8/IDApID49IFNQRUNfVkVSU0lPTl9TVVBQT1JUU19DT01QUkVTU0lPTlxuICAgICAgICAgICAgKSxcbiAgICAgICAgICAgIGVycm9yQ29kZTogUlVOX0VSUk9SX0NPREVTLkRFUExPWU1FTlRfTUlTTUFUQ0gsXG4gICAgICAgICAgfSxcbiAgICAgICAgfSxcbiAgICAgICAgeyByZXF1ZXN0SWQgfVxuICAgICAgKTtcbiAgICB9IGNhdGNoIChmYWlsRXJyb3IpIHtcbiAgICAgIC8vIFJ1biBhbHJlYWR5IHJlYWNoZWQgYSB0ZXJtaW5hbCBzdGF0ZSAoYSBjb25jdXJyZW50IHdyaXRlciBmYWlsZWQgaXQsIG9yXG4gICAgICAvLyBpdCB3YXMgY2FuY2VsbGVkL2V4cGlyZWQpIOKAlCBzdGlsbCBzdG9wLiBBbnl0aGluZyBlbHNlIGlzIGEgdHJhbnNpZW50XG4gICAgICAvLyBwZXJzaXN0ZW5jZSBmYWlsdXJlOiByZXRocm93IHNvIHRoZSBxdWV1ZSByZWRlbGl2ZXJzIGFuZCB3ZSB0cnkgYWdhaW4uXG4gICAgICBpZiAoXG4gICAgICAgICFFbnRpdHlDb25mbGljdEVycm9yLmlzKGZhaWxFcnJvcikgJiZcbiAgICAgICAgIVJ1bkV4cGlyZWRFcnJvci5pcyhmYWlsRXJyb3IpXG4gICAgICApIHtcbiAgICAgICAgdGhyb3cgZmFpbEVycm9yO1xuICAgICAgfVxuICAgIH1cbiAgICByZXR1cm4gcmVzdWx0KCdmYWlsZWQnLCBydW4uZGVwbG95bWVudElkLCByZWNvdmVyeUF0dGVtcHRzKTtcbiAgfTtcblxuICBpZiAocmVlbnF1ZXVlICYmIHJldHJ5Q291bnQgPCBtYXhSZXRyaWVzKSB7XG4gICAgY29uc3QgYXR0ZW1wdCA9IHJldHJ5Q291bnQgKyAxO1xuICAgIC8vIEV4cG9uZW50aWFsLCBjYXBwZWQ6IDFzLCAycywgNHMg4oCUIGNoZWFwIGluc3VyYW5jZSBhZ2FpbnN0IGEgaG90XG4gICAgLy8gcmUtZW5xdWV1ZSBsb29wLCBhbmQgdGltZSBmb3IgYSBtaWQtZmxpZ2h0IHJvdXRpbmcgY2hhbmdlIHRvIHNldHRsZS5cbiAgICBjb25zdCBkZWxheVNlY29uZHMgPSBNYXRoLm1pbigyICoqIHJldHJ5Q291bnQsIE1BWF9SRVJPVVRFX0RFTEFZX1NFQ09ORFMpO1xuICAgIHRyeSB7XG4gICAgICBhd2FpdCByZWVucXVldWUoe1xuICAgICAgICBkZXBsb3ltZW50SWQ6IHJ1bi5kZXBsb3ltZW50SWQsXG4gICAgICAgIHNwZWNWZXJzaW9uOiBydW4uc3BlY1ZlcnNpb24sXG4gICAgICAgIGRlcGxveW1lbnRNaXNtYXRjaFJldHJ5Q291bnQ6IGF0dGVtcHQsXG4gICAgICAgIGRlbGF5U2Vjb25kcyxcbiAgICAgIH0pO1xuICAgICAgcnVudGltZUxvZ2dlci53YXJuKFxuICAgICAgICAnV29ya2Zsb3cgcnVuIHJlY2VpdmVkIGJ5IGEgZGVwbG95bWVudCBpdCBpcyBub3QgcGlubmVkIHRvOyByZS1yb3V0aW5nIHRvIGl0cyBvd24gZGVwbG95bWVudCcsXG4gICAgICAgIHsgLi4ubG9nQ29udGV4dCwgYXR0ZW1wdCwgZGVsYXlTZWNvbmRzIH1cbiAgICAgICk7XG4gICAgICByZXR1cm4gcmVzdWx0KCdyZXJvdXRlZCcsIHJ1bi5kZXBsb3ltZW50SWQsIGF0dGVtcHQpO1xuICAgIH0gY2F0Y2ggKHJlZW5xdWV1ZUVycm9yKSB7XG4gICAgICAvLyBBIGdlbmVyaWMgc2VuZCBmYWlsdXJlIGNhbiBiZSB0cmFuc2llbnQgKDQyOSwgNXh4LCBjb25uZWN0L0ROUykuIERvIG5vdFxuICAgICAgLy8gdHVybiBvbmUgaW5mcmFzdHJ1Y3R1cmUgYmxpcCBpbnRvIGEgdGVybWluYWwgcnVuIGZhaWx1cmU6IHJlamVjdCB0aGVcbiAgICAgIC8vIGhhbmRsZXIgc28gdGhlIGN1cnJlbnQgbWVzc2FnZSByZW1haW5zIHVuYWNrZWQgYW5kIGlzIHJlZGVsaXZlcmVkLlxuICAgICAgaWYgKCFpc0RlcGxveW1lbnRVbmF2YWlsYWJsZUVycm9yPy4ocmVlbnF1ZXVlRXJyb3IpKSB7XG4gICAgICAgIHRocm93IHJlZW5xdWV1ZUVycm9yO1xuICAgICAgfVxuXG4gICAgICAvLyBUaGUgV29ybGQgZXhwbGljaXRseSBjbGFzc2lmaWVkIHRoZSB0YXJnZXQgYXMgdW5hdmFpbGFibGUg4oCUIGRlbGV0ZWQsXG4gICAgICAvLyBhZ2VkIG91dCBvZiBpdHMgcmV0ZW50aW9uIHdpbmRvdywgb3Igb3RoZXJ3aXNlIHVuZGlzY292ZXJhYmxlLiBCdXJuaW5nXG4gICAgICAvLyB0aGUgcmVzdCBvZiB0aGUgYnVkZ2V0IG9uIGEgZGVwbG95bWVudCB0aGF0IHByb3ZhYmx5IGNhbm5vdCBiZSByZWFjaGVkXG4gICAgICAvLyBvbmx5IGRlbGF5cyB0aGUgZmFpbHVyZSwgc28gZmFpbCBub3cuXG4gICAgICBydW50aW1lTG9nZ2VyLmVycm9yKFxuICAgICAgICAnQ2Fubm90IHJlLXJvdXRlIGEgbWlzcm91dGVkIHdvcmtmbG93IHJ1biB0byBpdHMgb3duIGRlcGxveW1lbnQ7IGZhaWxpbmcgdGhlIHJ1bicsXG4gICAgICAgIHtcbiAgICAgICAgICAuLi5sb2dDb250ZXh0LFxuICAgICAgICAgIGF0dGVtcHQsXG4gICAgICAgICAgZXJyb3JNZXNzYWdlOlxuICAgICAgICAgICAgcmVlbnF1ZXVlRXJyb3IgaW5zdGFuY2VvZiBFcnJvclxuICAgICAgICAgICAgICA/IHJlZW5xdWV1ZUVycm9yLm1lc3NhZ2VcbiAgICAgICAgICAgICAgOiBTdHJpbmcocmVlbnF1ZXVlRXJyb3IpLFxuICAgICAgICB9XG4gICAgICApO1xuICAgICAgLy8gUmVjb3ZlcnkgbmV2ZXIgYWN0dWFsbHkgaGFwcGVuZWQsIHNvIHJlcG9ydCAwIGF0dGVtcHRzIGFuZCBsZXQgYGNhdXNlYFxuICAgICAgLy8gZXhwbGFpbiB3aHkuXG4gICAgICByZXR1cm4gZmFpbFJ1bigwLCByZWVucXVldWVFcnJvcik7XG4gICAgfVxuICB9XG5cbiAgcnVudGltZUxvZ2dlci5lcnJvcihcbiAgICByZXRyeUNvdW50ID4gMFxuICAgICAgPyAnV29ya2Zsb3cgcnVuIGtlcHQgYXJyaXZpbmcgYXQgYSBkZXBsb3ltZW50IGl0IGlzIG5vdCBwaW5uZWQgdG8gYWZ0ZXIgcmUtcm91dGluZzsgZmFpbGluZyB0aGUgcnVuJ1xuICAgICAgOiAnV29ya2Zsb3cgcnVuIHJlY2VpdmVkIGJ5IGEgZGVwbG95bWVudCBpdCBpcyBub3QgcGlubmVkIHRvOyBmYWlsaW5nIHRoZSBydW4nLFxuICAgIGxvZ0NvbnRleHRcbiAgKTtcbiAgcmV0dXJuIGZhaWxSdW4ocmV0cnlDb3VudCk7XG59XG4iXX0=

package/dist/runtime/get-port-lazy.d.ts

@@ -0,0 +1,25 @@
+/**
+ * Lazy loader for getPort that prevents bundlers (Turbopack, esbuild)
+ * from statically tracing @workflow/utils/get-port and its filesystem
+ * operations (readdir, readFile, readlink) into the flow route bundle.
+ *
+ * Uses createRequire with a dynamically constructed specifier so the
+ * dependency is invisible to bundler static analysis.
+ */
+export declare function getPortLazy(): Promise<number | undefined>;
+/**
+ * Resets the per-process port cache. Intended for tests; not used on the hot
+ * path. Callers must let any in-flight lookup settle (await the pending
+ * `getPortLazy()` call) before resetting: clearing `_inFlight` here does not
+ * cancel an already-scheduled resolution, so a late `.then` could otherwise
+ * repopulate `_cachedPort` after the reset and bleed into the next test.
+ */
+export declare function resetPortCacheForTesting(): void;
+/**
+ * Installs a fake port resolver and clears the cache. Test-only seam: the real
+ * resolver is loaded via `createRequire` with a runtime-built specifier (to
+ * hide it from bundlers), which also defeats module mocking, so injection is
+ * the only deterministic way to exercise the caching contract.
+ */
+export declare function setPortResolverForTesting(fn: () => Promise<number | undefined>): void;
+//# sourceMappingURL=get-port-lazy.d.ts.map

package/dist/runtime/get-port-lazy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"get-port-lazy.d.ts","sourceRoot":"","sources":["../../src/runtime/get-port-lazy.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAuBH,wBAAsB,WAAW,IAAI,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CA4C/D;AAED;;;;;;GAMG;AACH,wBAAgB,wBAAwB,IAAI,IAAI,CAI/C;AAED;;;;;GAKG;AACH,wBAAgB,yBAAyB,CACvC,EAAE,EAAE,MAAM,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,GACpC,IAAI,CAIN"}

package/dist/runtime/get-port-lazy.js

@@ -0,0 +1,92 @@
+/**
+ * Lazy loader for getPort that prevents bundlers (Turbopack, esbuild)
+ * from statically tracing @workflow/utils/get-port and its filesystem
+ * operations (readdir, readFile, readlink) into the flow route bundle.
+ *
+ * Uses createRequire with a dynamically constructed specifier so the
+ * dependency is invisible to bundler static analysis.
+ */
+import { createRequire } from 'node:module';
+import { pathToFileURL } from 'node:url';
+let _getPort;
+// Per-process cache of the resolved port. The workflow server listens on a
+// stable port for the lifetime of the process, but `getPort()` rediscovers it
+// on every call by querying the OS for the process's listening sockets — on
+// macOS that shells out to `lsof` (~60ms), which the runtime pays on EVERY
+// workflow replay or step invocation. Since the port does not change within a
+// process, resolve it once and reuse it. `_inFlight`
+// dedupes concurrent first calls so discovery never runs more than once.
+//
+// The first concrete port is pinned for the lifetime of the process — there is
+// no per-call re-resolution. This is safe because the runtime only runs inside
+// the already-listening dev-server process, and `getPort()` -> `getAllPorts()`
+// returns a deterministic order, so repeated calls would resolve the same port
+// anyway.
+let _cachedPort;
+let _inFlight;
+export async function getPortLazy() {
+    // Fast path: already resolved a concrete port for this process.
+    if (_cachedPort !== undefined) {
+        return _cachedPort;
+    }
+    // A discovery is already running — share it rather than starting a second.
+    if (_inFlight) {
+        return _inFlight;
+    }
+    if (!_getPort) {
+        try {
+            // Construct specifier at runtime to defeat bundler static analysis.
+            const spec = ['@workflow/utils', 'get-port'].join('/');
+            // Use process.cwd()-based createRequire for CJS/ESM compatibility.
+            // import.meta.url is unavailable in CJS re-bundled outputs.
+            const _require = createRequire(pathToFileURL(process.cwd() + '/package.json').href);
+            const mod = _require(spec);
+            _getPort = mod.getPort;
+        }
+        catch {
+            // Module not available (e.g., in a browser or minimal bundle)
+            _getPort = async () => undefined;
+        }
+    }
+    // `_getPort` is always assigned by the block above; the fallback keeps the
+    // type non-nullable without a non-null assertion.
+    const resolver = _getPort ?? (async () => undefined);
+    _inFlight = resolver()
+        .then((port) => {
+        // Only cache a concrete port. A transient `undefined` (e.g. the server is
+        // not listening yet on the very first replay) must not poison the cache —
+        // leaving it unset lets the next call retry discovery.
+        if (typeof port === 'number') {
+            _cachedPort = port;
+        }
+        return port;
+    })
+        .finally(() => {
+        _inFlight = undefined;
+    });
+    return _inFlight;
+}
+/**
+ * Resets the per-process port cache. Intended for tests; not used on the hot
+ * path. Callers must let any in-flight lookup settle (await the pending
+ * `getPortLazy()` call) before resetting: clearing `_inFlight` here does not
+ * cancel an already-scheduled resolution, so a late `.then` could otherwise
+ * repopulate `_cachedPort` after the reset and bleed into the next test.
+ */
+export function resetPortCacheForTesting() {
+    _getPort = undefined;
+    _cachedPort = undefined;
+    _inFlight = undefined;
+}
+/**
+ * Installs a fake port resolver and clears the cache. Test-only seam: the real
+ * resolver is loaded via `createRequire` with a runtime-built specifier (to
+ * hide it from bundlers), which also defeats module mocking, so injection is
+ * the only deterministic way to exercise the caching contract.
+ */
+export function setPortResolverForTesting(fn) {
+    _getPort = fn;
+    _cachedPort = undefined;
+    _inFlight = undefined;
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiZ2V0LXBvcnQtbGF6eS5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3NyYy9ydW50aW1lL2dldC1wb3J0LWxhenkudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUE7Ozs7Ozs7R0FPRztBQUVILE9BQU8sRUFBRSxhQUFhLEVBQUUsTUFBTSxhQUFhLENBQUM7QUFDNUMsT0FBTyxFQUFFLGFBQWEsRUFBRSxNQUFNLFVBQVUsQ0FBQztBQUV6QyxJQUFJLFFBQXlELENBQUM7QUFFOUQsMkVBQTJFO0FBQzNFLDhFQUE4RTtBQUM5RSw0RUFBNEU7QUFDNUUsMkVBQTJFO0FBQzNFLDhFQUE4RTtBQUM5RSxxREFBcUQ7QUFDckQseUVBQXlFO0FBQ3pFLEVBQUU7QUFDRiwrRUFBK0U7QUFDL0UsK0VBQStFO0FBQy9FLCtFQUErRTtBQUMvRSwrRUFBK0U7QUFDL0UsVUFBVTtBQUNWLElBQUksV0FBK0IsQ0FBQztBQUNwQyxJQUFJLFNBQWtELENBQUM7QUFFdkQsTUFBTSxDQUFDLEtBQUssVUFBVSxXQUFXO0lBQy9CLGdFQUFnRTtJQUNoRSxJQUFJLFdBQVcsS0FBSyxTQUFTLEVBQUUsQ0FBQztRQUM5QixPQUFPLFdBQVcsQ0FBQztJQUNyQixDQUFDO0lBQ0QsMkVBQTJFO0lBQzNFLElBQUksU0FBUyxFQUFFLENBQUM7UUFDZCxPQUFPLFNBQVMsQ0FBQztJQUNuQixDQUFDO0lBRUQsSUFBSSxDQUFDLFFBQVEsRUFBRSxDQUFDO1FBQ2QsSUFBSSxDQUFDO1lBQ0gsb0VBQW9FO1lBQ3BFLE1BQU0sSUFBSSxHQUFHLENBQUMsaUJBQWlCLEVBQUUsVUFBVSxDQUFDLENBQUMsSUFBSSxDQUFDLEdBQUcsQ0FBQyxDQUFDO1lBQ3ZELG1FQUFtRTtZQUNuRSw0REFBNEQ7WUFDNUQsTUFBTSxRQUFRLEdBQUcsYUFBYSxDQUM1QixhQUFhLENBQUMsT0FBTyxDQUFDLEdBQUcsRUFBRSxHQUFHLGVBQWUsQ0FBQyxDQUFDLElBQUksQ0FDcEQsQ0FBQztZQUNGLE1BQU0sR0FBRyxHQUFHLFFBQVEsQ0FBQyxJQUFJLENBQUMsQ0FBQztZQUMzQixRQUFRLEdBQUcsR0FBRyxDQUFDLE9BQU8sQ0FBQztRQUN6QixDQUFDO1FBQUMsTUFBTSxDQUFDO1lBQ1AsOERBQThEO1lBQzlELFFBQVEsR0FBRyxLQUFLLElBQUksRUFBRSxDQUFDLFNBQVMsQ0FBQztRQUNuQyxDQUFDO0lBQ0gsQ0FBQztJQUVELDJFQUEyRTtJQUMzRSxrREFBa0Q7SUFDbEQsTUFBTSxRQUFRLEdBQUcsUUFBUSxJQUFJLENBQUMsS0FBSyxJQUFJLEVBQUUsQ0FBQyxTQUFTLENBQUMsQ0FBQztJQUNyRCxTQUFTLEdBQUcsUUFBUSxFQUFFO1NBQ25CLElBQUksQ0FBQyxDQUFDLElBQUksRUFBRSxFQUFFO1FBQ2IsMEVBQTBFO1FBQzFFLDBFQUEwRTtRQUMxRSx1REFBdUQ7UUFDdkQsSUFBSSxPQUFPLElBQUksS0FBSyxRQUFRLEVBQUUsQ0FBQztZQUM3QixXQUFXLEdBQUcsSUFBSSxDQUFDO1FBQ3JCLENBQUM7UUFDRCxPQUFPLElBQUksQ0FBQztJQUNkLENBQUMsQ0FBQztTQUNELE9BQU8sQ0FBQyxHQUFHLEVBQUU7UUFDWixTQUFTLEdBQUcsU0FBUyxDQUFDO0lBQ3hCLENBQUMsQ0FBQyxDQUFDO0lBQ0wsT0FBTyxTQUFTLENBQUM7QUFDbkIsQ0FBQztBQUVEOzs7Ozs7R0FNRztBQUNILE1BQU0sVUFBVSx3QkFBd0I7SUFDdEMsUUFBUSxHQUFHLFNBQVMsQ0FBQztJQUNyQixXQUFXLEdBQUcsU0FBUyxDQUFDO0lBQ3hCLFNBQVMsR0FBRyxTQUFTLENBQUM7QUFDeEIsQ0FBQztBQUVEOzs7OztHQUtHO0FBQ0gsTUFBTSxVQUFVLHlCQUF5QixDQUN2QyxFQUFxQztJQUVyQyxRQUFRLEdBQUcsRUFBRSxDQUFDO0lBQ2QsV0FBVyxHQUFHLFNBQVMsQ0FBQztJQUN4QixTQUFTLEdBQUcsU0FBUyxDQUFDO0FBQ3hCLENBQUMiLCJzb3VyY2VzQ29udGVudCI6WyIvKipcbiAqIExhenkgbG9hZGVyIGZvciBnZXRQb3J0IHRoYXQgcHJldmVudHMgYnVuZGxlcnMgKFR1cmJvcGFjaywgZXNidWlsZClcbiAqIGZyb20gc3RhdGljYWxseSB0cmFjaW5nIEB3b3JrZmxvdy91dGlscy9nZXQtcG9ydCBhbmQgaXRzIGZpbGVzeXN0ZW1cbiAqIG9wZXJhdGlvbnMgKHJlYWRkaXIsIHJlYWRGaWxlLCByZWFkbGluaykgaW50byB0aGUgZmxvdyByb3V0ZSBidW5kbGUuXG4gKlxuICogVXNlcyBjcmVhdGVSZXF1aXJlIHdpdGggYSBkeW5hbWljYWxseSBjb25zdHJ1Y3RlZCBzcGVjaWZpZXIgc28gdGhlXG4gKiBkZXBlbmRlbmN5IGlzIGludmlzaWJsZSB0byBidW5kbGVyIHN0YXRpYyBhbmFseXNpcy5cbiAqL1xuXG5pbXBvcnQgeyBjcmVhdGVSZXF1aXJlIH0gZnJvbSAnbm9kZTptb2R1bGUnO1xuaW1wb3J0IHsgcGF0aFRvRmlsZVVSTCB9IGZyb20gJ25vZGU6dXJsJztcblxubGV0IF9nZXRQb3J0OiAoKCkgPT4gUHJvbWlzZTxudW1iZXIgfCB1bmRlZmluZWQ+KSB8IHVuZGVmaW5lZDtcblxuLy8gUGVyLXByb2Nlc3MgY2FjaGUgb2YgdGhlIHJlc29sdmVkIHBvcnQuIFRoZSB3b3JrZmxvdyBzZXJ2ZXIgbGlzdGVucyBvbiBhXG4vLyBzdGFibGUgcG9ydCBmb3IgdGhlIGxpZmV0aW1lIG9mIHRoZSBwcm9jZXNzLCBidXQgYGdldFBvcnQoKWAgcmVkaXNjb3ZlcnMgaXRcbi8vIG9uIGV2ZXJ5IGNhbGwgYnkgcXVlcnlpbmcgdGhlIE9TIGZvciB0aGUgcHJvY2VzcydzIGxpc3RlbmluZyBzb2NrZXRzIOKAlCBvblxuLy8gbWFjT1MgdGhhdCBzaGVsbHMgb3V0IHRvIGBsc29mYCAofjYwbXMpLCB3aGljaCB0aGUgcnVudGltZSBwYXlzIG9uIEVWRVJZXG4vLyB3b3JrZmxvdyByZXBsYXkgb3Igc3RlcCBpbnZvY2F0aW9uLiBTaW5jZSB0aGUgcG9ydCBkb2VzIG5vdCBjaGFuZ2Ugd2l0aGluIGFcbi8vIHByb2Nlc3MsIHJlc29sdmUgaXQgb25jZSBhbmQgcmV1c2UgaXQuIGBfaW5GbGlnaHRgXG4vLyBkZWR1cGVzIGNvbmN1cnJlbnQgZmlyc3QgY2FsbHMgc28gZGlzY292ZXJ5IG5ldmVyIHJ1bnMgbW9yZSB0aGFuIG9uY2UuXG4vL1xuLy8gVGhlIGZpcnN0IGNvbmNyZXRlIHBvcnQgaXMgcGlubmVkIGZvciB0aGUgbGlmZXRpbWUgb2YgdGhlIHByb2Nlc3Mg4oCUIHRoZXJlIGlzXG4vLyBubyBwZXItY2FsbCByZS1yZXNvbHV0aW9uLiBUaGlzIGlzIHNhZmUgYmVjYXVzZSB0aGUgcnVudGltZSBvbmx5IHJ1bnMgaW5zaWRlXG4vLyB0aGUgYWxyZWFkeS1saXN0ZW5pbmcgZGV2LXNlcnZlciBwcm9jZXNzLCBhbmQgYGdldFBvcnQoKWAgLT4gYGdldEFsbFBvcnRzKClgXG4vLyByZXR1cm5zIGEgZGV0ZXJtaW5pc3RpYyBvcmRlciwgc28gcmVwZWF0ZWQgY2FsbHMgd291bGQgcmVzb2x2ZSB0aGUgc2FtZSBwb3J0XG4vLyBhbnl3YXkuXG5sZXQgX2NhY2hlZFBvcnQ6IG51bWJlciB8IHVuZGVmaW5lZDtcbmxldCBfaW5GbGlnaHQ6IFByb21pc2U8bnVtYmVyIHwgdW5kZWZpbmVkPiB8IHVuZGVmaW5lZDtcblxuZXhwb3J0IGFzeW5jIGZ1bmN0aW9uIGdldFBvcnRMYXp5KCk6IFByb21pc2U8bnVtYmVyIHwgdW5kZWZpbmVkPiB7XG4gIC8vIEZhc3QgcGF0aDogYWxyZWFkeSByZXNvbHZlZCBhIGNvbmNyZXRlIHBvcnQgZm9yIHRoaXMgcHJvY2Vzcy5cbiAgaWYgKF9jYWNoZWRQb3J0ICE9PSB1bmRlZmluZWQpIHtcbiAgICByZXR1cm4gX2NhY2hlZFBvcnQ7XG4gIH1cbiAgLy8gQSBkaXNjb3ZlcnkgaXMgYWxyZWFkeSBydW5uaW5nIOKAlCBzaGFyZSBpdCByYXRoZXIgdGhhbiBzdGFydGluZyBhIHNlY29uZC5cbiAgaWYgKF9pbkZsaWdodCkge1xuICAgIHJldHVybiBfaW5GbGlnaHQ7XG4gIH1cblxuICBpZiAoIV9nZXRQb3J0KSB7XG4gICAgdHJ5IHtcbiAgICAgIC8vIENvbnN0cnVjdCBzcGVjaWZpZXIgYXQgcnVudGltZSB0byBkZWZlYXQgYnVuZGxlciBzdGF0aWMgYW5hbHlzaXMuXG4gICAgICBjb25zdCBzcGVjID0gWydAd29ya2Zsb3cvdXRpbHMnLCAnZ2V0LXBvcnQnXS5qb2luKCcvJyk7XG4gICAgICAvLyBVc2UgcHJvY2Vzcy5jd2QoKS1iYXNlZCBjcmVhdGVSZXF1aXJlIGZvciBDSlMvRVNNIGNvbXBhdGliaWxpdHkuXG4gICAgICAvLyBpbXBvcnQubWV0YS51cmwgaXMgdW5hdmFpbGFibGUgaW4gQ0pTIHJlLWJ1bmRsZWQgb3V0cHV0cy5cbiAgICAgIGNvbnN0IF9yZXF1aXJlID0gY3JlYXRlUmVxdWlyZShcbiAgICAgICAgcGF0aFRvRmlsZVVSTChwcm9jZXNzLmN3ZCgpICsgJy9wYWNrYWdlLmpzb24nKS5ocmVmXG4gICAgICApO1xuICAgICAgY29uc3QgbW9kID0gX3JlcXVpcmUoc3BlYyk7XG4gICAgICBfZ2V0UG9ydCA9IG1vZC5nZXRQb3J0O1xuICAgIH0gY2F0Y2gge1xuICAgICAgLy8gTW9kdWxlIG5vdCBhdmFpbGFibGUgKGUuZy4sIGluIGEgYnJvd3NlciBvciBtaW5pbWFsIGJ1bmRsZSlcbiAgICAgIF9nZXRQb3J0ID0gYXN5bmMgKCkgPT4gdW5kZWZpbmVkO1xuICAgIH1cbiAgfVxuXG4gIC8vIGBfZ2V0UG9ydGAgaXMgYWx3YXlzIGFzc2lnbmVkIGJ5IHRoZSBibG9jayBhYm92ZTsgdGhlIGZhbGxiYWNrIGtlZXBzIHRoZVxuICAvLyB0eXBlIG5vbi1udWxsYWJsZSB3aXRob3V0IGEgbm9uLW51bGwgYXNzZXJ0aW9uLlxuICBjb25zdCByZXNvbHZlciA9IF9nZXRQb3J0ID8/IChhc3luYyAoKSA9PiB1bmRlZmluZWQpO1xuICBfaW5GbGlnaHQgPSByZXNvbHZlcigpXG4gICAgLnRoZW4oKHBvcnQpID0+IHtcbiAgICAgIC8vIE9ubHkgY2FjaGUgYSBjb25jcmV0ZSBwb3J0LiBBIHRyYW5zaWVudCBgdW5kZWZpbmVkYCAoZS5nLiB0aGUgc2VydmVyIGlzXG4gICAgICAvLyBub3QgbGlzdGVuaW5nIHlldCBvbiB0aGUgdmVyeSBmaXJzdCByZXBsYXkpIG11c3Qgbm90IHBvaXNvbiB0aGUgY2FjaGUg4oCUXG4gICAgICAvLyBsZWF2aW5nIGl0IHVuc2V0IGxldHMgdGhlIG5leHQgY2FsbCByZXRyeSBkaXNjb3ZlcnkuXG4gICAgICBpZiAodHlwZW9mIHBvcnQgPT09ICdudW1iZXInKSB7XG4gICAgICAgIF9jYWNoZWRQb3J0ID0gcG9ydDtcbiAgICAgIH1cbiAgICAgIHJldHVybiBwb3J0O1xuICAgIH0pXG4gICAgLmZpbmFsbHkoKCkgPT4ge1xuICAgICAgX2luRmxpZ2h0ID0gdW5kZWZpbmVkO1xuICAgIH0pO1xuICByZXR1cm4gX2luRmxpZ2h0O1xufVxuXG4vKipcbiAqIFJlc2V0cyB0aGUgcGVyLXByb2Nlc3MgcG9ydCBjYWNoZS4gSW50ZW5kZWQgZm9yIHRlc3RzOyBub3QgdXNlZCBvbiB0aGUgaG90XG4gKiBwYXRoLiBDYWxsZXJzIG11c3QgbGV0IGFueSBpbi1mbGlnaHQgbG9va3VwIHNldHRsZSAoYXdhaXQgdGhlIHBlbmRpbmdcbiAqIGBnZXRQb3J0TGF6eSgpYCBjYWxsKSBiZWZvcmUgcmVzZXR0aW5nOiBjbGVhcmluZyBgX2luRmxpZ2h0YCBoZXJlIGRvZXMgbm90XG4gKiBjYW5jZWwgYW4gYWxyZWFkeS1zY2hlZHVsZWQgcmVzb2x1dGlvbiwgc28gYSBsYXRlIGAudGhlbmAgY291bGQgb3RoZXJ3aXNlXG4gKiByZXBvcHVsYXRlIGBfY2FjaGVkUG9ydGAgYWZ0ZXIgdGhlIHJlc2V0IGFuZCBibGVlZCBpbnRvIHRoZSBuZXh0IHRlc3QuXG4gKi9cbmV4cG9ydCBmdW5jdGlvbiByZXNldFBvcnRDYWNoZUZvclRlc3RpbmcoKTogdm9pZCB7XG4gIF9nZXRQb3J0ID0gdW5kZWZpbmVkO1xuICBfY2FjaGVkUG9ydCA9IHVuZGVmaW5lZDtcbiAgX2luRmxpZ2h0ID0gdW5kZWZpbmVkO1xufVxuXG4vKipcbiAqIEluc3RhbGxzIGEgZmFrZSBwb3J0IHJlc29sdmVyIGFuZCBjbGVhcnMgdGhlIGNhY2hlLiBUZXN0LW9ubHkgc2VhbTogdGhlIHJlYWxcbiAqIHJlc29sdmVyIGlzIGxvYWRlZCB2aWEgYGNyZWF0ZVJlcXVpcmVgIHdpdGggYSBydW50aW1lLWJ1aWx0IHNwZWNpZmllciAodG9cbiAqIGhpZGUgaXQgZnJvbSBidW5kbGVycyksIHdoaWNoIGFsc28gZGVmZWF0cyBtb2R1bGUgbW9ja2luZywgc28gaW5qZWN0aW9uIGlzXG4gKiB0aGUgb25seSBkZXRlcm1pbmlzdGljIHdheSB0byBleGVyY2lzZSB0aGUgY2FjaGluZyBjb250cmFjdC5cbiAqL1xuZXhwb3J0IGZ1bmN0aW9uIHNldFBvcnRSZXNvbHZlckZvclRlc3RpbmcoXG4gIGZuOiAoKSA9PiBQcm9taXNlPG51bWJlciB8IHVuZGVmaW5lZD5cbik6IHZvaWQge1xuICBfZ2V0UG9ydCA9IGZuO1xuICBfY2FjaGVkUG9ydCA9IHVuZGVmaW5lZDtcbiAgX2luRmxpZ2h0ID0gdW5kZWZpbmVkO1xufVxuIl19

package/dist/runtime/get-world-lazy.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Lazy accessor for the World singleton via globalThis symbols.
+ *
+ * This module exists to break the static import chain from step-side
+ * modules (serialization, run, helpers, start) to world.ts. Without it,
+ * esbuild bundles world.ts (and its transitive deps: world-local,
+ * world-vercel, process.cwd(), etc.) into the step registrations bundle,
+ * which triggers Turbopack NFT tracing errors in the V2 combined flow route.
+ *
+ * Resolution order, in priority:
+ *
+ * 1. `globalThis[WorldCacheKey]` — populated by a successful prior
+ *    `getWorld()` call. This is the steady-state hot path.
+ * 2. `globalThis[GetWorldFnKey]` — populated by the module-load side
+ *    effect at the bottom of `./world.ts`. Fires on every server bundle
+ *    that reaches this file via `workflow` or `workflow/api` (which import
+ *    `./world-init.ts` for its side effect; see that file for the full
+ *    rationale). This is the cold-start path for routes that consume host
+ *    helpers without any prior workflow run.
+ */
+import type { World } from '@workflow/world';
+export declare function getWorldLazy(): Promise<World>;
+//# sourceMappingURL=get-world-lazy.d.ts.map

package/dist/runtime/get-world-lazy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"get-world-lazy.d.ts","sourceRoot":"","sources":["../../src/runtime/get-world-lazy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,iBAAiB,CAAC;AAa7C,wBAAsB,YAAY,IAAI,OAAO,CAAC,KAAK,CAAC,CAsBnD"}

package/dist/runtime/get-world-lazy.js

@@ -0,0 +1,46 @@
+/**
+ * Lazy accessor for the World singleton via globalThis symbols.
+ *
+ * This module exists to break the static import chain from step-side
+ * modules (serialization, run, helpers, start) to world.ts. Without it,
+ * esbuild bundles world.ts (and its transitive deps: world-local,
+ * world-vercel, process.cwd(), etc.) into the step registrations bundle,
+ * which triggers Turbopack NFT tracing errors in the V2 combined flow route.
+ *
+ * Resolution order, in priority:
+ *
+ * 1. `globalThis[WorldCacheKey]` — populated by a successful prior
+ *    `getWorld()` call. This is the steady-state hot path.
+ * 2. `globalThis[GetWorldFnKey]` — populated by the module-load side
+ *    effect at the bottom of `./world.ts`. Fires on every server bundle
+ *    that reaches this file via `workflow` or `workflow/api` (which import
+ *    `./world-init.ts` for its side effect; see that file for the full
+ *    rationale). This is the cold-start path for routes that consume host
+ *    helpers without any prior workflow run.
+ */
+import { assertWorldSupportsRuntimeProtocol } from './world-compatibility.js';
+const WorldCacheKey = Symbol.for('@workflow/world//cache');
+const WorldCachePromiseKey = Symbol.for('@workflow/world//cachePromise');
+const GetWorldFnKey = Symbol.for('@workflow/world//getWorldFn');
+export async function getWorldLazy() {
+    const g = globalThis;
+    if (g[WorldCacheKey]) {
+        assertWorldSupportsRuntimeProtocol(g[WorldCacheKey]);
+        return g[WorldCacheKey];
+    }
+    if (g[WorldCachePromiseKey]) {
+        g[WorldCacheKey] = await g[WorldCachePromiseKey];
+        assertWorldSupportsRuntimeProtocol(g[WorldCacheKey]);
+        return g[WorldCacheKey];
+    }
+    // world-init statically imports world.ts in host bundles, which registers
+    // getWorld on globalThis at module load.
+    const getWorldFn = g[GetWorldFnKey];
+    if (getWorldFn) {
+        const world = await getWorldFn();
+        assertWorldSupportsRuntimeProtocol(world);
+        return world;
+    }
+    throw new Error('Workflow world runtime was not initialized. Import from the host workflow entrypoints (`workflow`, `workflow/api`, or `workflow/runtime`) so @workflow/core/runtime/world-init can register getWorld before getWorldLazy() is used.');
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiZ2V0LXdvcmxkLWxhenkuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zcmMvcnVudGltZS9nZXQtd29ybGQtbGF6eS50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQTs7Ozs7Ozs7Ozs7Ozs7Ozs7OztHQW1CRztBQUdILE9BQU8sRUFBRSxrQ0FBa0MsRUFBRSxNQUFNLDBCQUEwQixDQUFDO0FBRTlFLE1BQU0sYUFBYSxHQUFHLE1BQU0sQ0FBQyxHQUFHLENBQUMsd0JBQXdCLENBQUMsQ0FBQztBQUMzRCxNQUFNLG9CQUFvQixHQUFHLE1BQU0sQ0FBQyxHQUFHLENBQUMsK0JBQStCLENBQUMsQ0FBQztBQUN6RSxNQUFNLGFBQWEsR0FBRyxNQUFNLENBQUMsR0FBRyxDQUFDLDZCQUE2QixDQUFDLENBQUM7QUFRaEUsTUFBTSxDQUFDLEtBQUssVUFBVSxZQUFZO0lBQ2hDLE1BQU0sQ0FBQyxHQUFHLFVBQThCLENBQUM7SUFDekMsSUFBSSxDQUFDLENBQUMsYUFBYSxDQUFDLEVBQUUsQ0FBQztRQUNyQixrQ0FBa0MsQ0FBQyxDQUFDLENBQUMsYUFBYSxDQUFDLENBQUMsQ0FBQztRQUNyRCxPQUFPLENBQUMsQ0FBQyxhQUFhLENBQUMsQ0FBQztJQUMxQixDQUFDO0lBQ0QsSUFBSSxDQUFDLENBQUMsb0JBQW9CLENBQUMsRUFBRSxDQUFDO1FBQzVCLENBQUMsQ0FBQyxhQUFhLENBQUMsR0FBRyxNQUFNLENBQUMsQ0FBQyxvQkFBb0IsQ0FBQyxDQUFDO1FBQ2pELGtDQUFrQyxDQUFDLENBQUMsQ0FBQyxhQUFhLENBQUMsQ0FBQyxDQUFDO1FBQ3JELE9BQU8sQ0FBQyxDQUFDLGFBQWEsQ0FBQyxDQUFDO0lBQzFCLENBQUM7SUFDRCwwRUFBMEU7SUFDMUUseUNBQXlDO0lBQ3pDLE1BQU0sVUFBVSxHQUFHLENBQUMsQ0FBQyxhQUFhLENBQUMsQ0FBQztJQUNwQyxJQUFJLFVBQVUsRUFBRSxDQUFDO1FBQ2YsTUFBTSxLQUFLLEdBQUcsTUFBTSxVQUFVLEVBQUUsQ0FBQztRQUNqQyxrQ0FBa0MsQ0FBQyxLQUFLLENBQUMsQ0FBQztRQUMxQyxPQUFPLEtBQUssQ0FBQztJQUNmLENBQUM7SUFDRCxNQUFNLElBQUksS0FBSyxDQUNiLHFPQUFxTyxDQUN0TyxDQUFDO0FBQ0osQ0FBQyIsInNvdXJjZXNDb250ZW50IjpbIi8qKlxuICogTGF6eSBhY2Nlc3NvciBmb3IgdGhlIFdvcmxkIHNpbmdsZXRvbiB2aWEgZ2xvYmFsVGhpcyBzeW1ib2xzLlxuICpcbiAqIFRoaXMgbW9kdWxlIGV4aXN0cyB0byBicmVhayB0aGUgc3RhdGljIGltcG9ydCBjaGFpbiBmcm9tIHN0ZXAtc2lkZVxuICogbW9kdWxlcyAoc2VyaWFsaXphdGlvbiwgcnVuLCBoZWxwZXJzLCBzdGFydCkgdG8gd29ybGQudHMuIFdpdGhvdXQgaXQsXG4gKiBlc2J1aWxkIGJ1bmRsZXMgd29ybGQudHMgKGFuZCBpdHMgdHJhbnNpdGl2ZSBkZXBzOiB3b3JsZC1sb2NhbCxcbiAqIHdvcmxkLXZlcmNlbCwgcHJvY2Vzcy5jd2QoKSwgZXRjLikgaW50byB0aGUgc3RlcCByZWdpc3RyYXRpb25zIGJ1bmRsZSxcbiAqIHdoaWNoIHRyaWdnZXJzIFR1cmJvcGFjayBORlQgdHJhY2luZyBlcnJvcnMgaW4gdGhlIFYyIGNvbWJpbmVkIGZsb3cgcm91dGUuXG4gKlxuICogUmVzb2x1dGlvbiBvcmRlciwgaW4gcHJpb3JpdHk6XG4gKlxuICogMS4gYGdsb2JhbFRoaXNbV29ybGRDYWNoZUtleV1gIOKAlCBwb3B1bGF0ZWQgYnkgYSBzdWNjZXNzZnVsIHByaW9yXG4gKiAgICBgZ2V0V29ybGQoKWAgY2FsbC4gVGhpcyBpcyB0aGUgc3RlYWR5LXN0YXRlIGhvdCBwYXRoLlxuICogMi4gYGdsb2JhbFRoaXNbR2V0V29ybGRGbktleV1gIOKAlCBwb3B1bGF0ZWQgYnkgdGhlIG1vZHVsZS1sb2FkIHNpZGVcbiAqICAgIGVmZmVjdCBhdCB0aGUgYm90dG9tIG9mIGAuL3dvcmxkLnRzYC4gRmlyZXMgb24gZXZlcnkgc2VydmVyIGJ1bmRsZVxuICogICAgdGhhdCByZWFjaGVzIHRoaXMgZmlsZSB2aWEgYHdvcmtmbG93YCBvciBgd29ya2Zsb3cvYXBpYCAod2hpY2ggaW1wb3J0XG4gKiAgICBgLi93b3JsZC1pbml0LnRzYCBmb3IgaXRzIHNpZGUgZWZmZWN0OyBzZWUgdGhhdCBmaWxlIGZvciB0aGUgZnVsbFxuICogICAgcmF0aW9uYWxlKS4gVGhpcyBpcyB0aGUgY29sZC1zdGFydCBwYXRoIGZvciByb3V0ZXMgdGhhdCBjb25zdW1lIGhvc3RcbiAqICAgIGhlbHBlcnMgd2l0aG91dCBhbnkgcHJpb3Igd29ya2Zsb3cgcnVuLlxuICovXG5cbmltcG9ydCB0eXBlIHsgV29ybGQgfSBmcm9tICdAd29ya2Zsb3cvd29ybGQnO1xuaW1wb3J0IHsgYXNzZXJ0V29ybGRTdXBwb3J0c1J1bnRpbWVQcm90b2NvbCB9IGZyb20gJy4vd29ybGQtY29tcGF0aWJpbGl0eS5qcyc7XG5cbmNvbnN0IFdvcmxkQ2FjaGVLZXkgPSBTeW1ib2wuZm9yKCdAd29ya2Zsb3cvd29ybGQvL2NhY2hlJyk7XG5jb25zdCBXb3JsZENhY2hlUHJvbWlzZUtleSA9IFN5bWJvbC5mb3IoJ0B3b3JrZmxvdy93b3JsZC8vY2FjaGVQcm9taXNlJyk7XG5jb25zdCBHZXRXb3JsZEZuS2V5ID0gU3ltYm9sLmZvcignQHdvcmtmbG93L3dvcmxkLy9nZXRXb3JsZEZuJyk7XG5cbnR5cGUgR2xvYmFsV29ybGRDYWNoZSA9IHR5cGVvZiBnbG9iYWxUaGlzICYge1xuICBbV29ybGRDYWNoZUtleV0/OiBXb3JsZDtcbiAgW1dvcmxkQ2FjaGVQcm9taXNlS2V5XT86IFByb21pc2U8V29ybGQ+O1xuICBbR2V0V29ybGRGbktleV0/OiAoKSA9PiBQcm9taXNlPFdvcmxkPjtcbn07XG5cbmV4cG9ydCBhc3luYyBmdW5jdGlvbiBnZXRXb3JsZExhenkoKTogUHJvbWlzZTxXb3JsZD4ge1xuICBjb25zdCBnID0gZ2xvYmFsVGhpcyBhcyBHbG9iYWxXb3JsZENhY2hlO1xuICBpZiAoZ1tXb3JsZENhY2hlS2V5XSkge1xuICAgIGFzc2VydFdvcmxkU3VwcG9ydHNSdW50aW1lUHJvdG9jb2woZ1tXb3JsZENhY2hlS2V5XSk7XG4gICAgcmV0dXJuIGdbV29ybGRDYWNoZUtleV07XG4gIH1cbiAgaWYgKGdbV29ybGRDYWNoZVByb21pc2VLZXldKSB7XG4gICAgZ1tXb3JsZENhY2hlS2V5XSA9IGF3YWl0IGdbV29ybGRDYWNoZVByb21pc2VLZXldO1xuICAgIGFzc2VydFdvcmxkU3VwcG9ydHNSdW50aW1lUHJvdG9jb2woZ1tXb3JsZENhY2hlS2V5XSk7XG4gICAgcmV0dXJuIGdbV29ybGRDYWNoZUtleV07XG4gIH1cbiAgLy8gd29ybGQtaW5pdCBzdGF0aWNhbGx5IGltcG9ydHMgd29ybGQudHMgaW4gaG9zdCBidW5kbGVzLCB3aGljaCByZWdpc3RlcnNcbiAgLy8gZ2V0V29ybGQgb24gZ2xvYmFsVGhpcyBhdCBtb2R1bGUgbG9hZC5cbiAgY29uc3QgZ2V0V29ybGRGbiA9IGdbR2V0V29ybGRGbktleV07XG4gIGlmIChnZXRXb3JsZEZuKSB7XG4gICAgY29uc3Qgd29ybGQgPSBhd2FpdCBnZXRXb3JsZEZuKCk7XG4gICAgYXNzZXJ0V29ybGRTdXBwb3J0c1J1bnRpbWVQcm90b2NvbCh3b3JsZCk7XG4gICAgcmV0dXJuIHdvcmxkO1xuICB9XG4gIHRocm93IG5ldyBFcnJvcihcbiAgICAnV29ya2Zsb3cgd29ybGQgcnVudGltZSB3YXMgbm90IGluaXRpYWxpemVkLiBJbXBvcnQgZnJvbSB0aGUgaG9zdCB3b3JrZmxvdyBlbnRyeXBvaW50cyAoYHdvcmtmbG93YCwgYHdvcmtmbG93L2FwaWAsIG9yIGB3b3JrZmxvdy9ydW50aW1lYCkgc28gQHdvcmtmbG93L2NvcmUvcnVudGltZS93b3JsZC1pbml0IGNhbiByZWdpc3RlciBnZXRXb3JsZCBiZWZvcmUgZ2V0V29ybGRMYXp5KCkgaXMgdXNlZC4nXG4gICk7XG59XG4iXX0=