@workflow/world-testing 4.1.0-beta.59 → 4.1.0-beta.60

package/dist/.well-known/workflow/v1/flow.js

@@ -2735,7 +2735,7 @@ var require_token_util = __commonJS({
             getTokenPayload: /* @__PURE__ */ __name(() => getTokenPayload, "getTokenPayload"),
             getVercelCliToken: /* @__PURE__ */ __name(() => getVercelCliToken, "getVercelCliToken"),
             getVercelDataDir: /* @__PURE__ */ __name(() => getVercelDataDir, "getVercelDataDir"),
-            getVercelOidcToken: /* @__PURE__ */ __name(() => getVercelOidcToken5, "getVercelOidcToken"),
+            getVercelOidcToken: /* @__PURE__ */ __name(() => getVercelOidcToken6, "getVercelOidcToken"),
             isExpired: /* @__PURE__ */ __name(() => isExpired, "isExpired"),
             loadToken: /* @__PURE__ */ __name(() => loadToken, "loadToken"),
             saveToken: /* @__PURE__ */ __name(() => saveToken, "saveToken")
@@ -2770,7 +2770,7 @@ var require_token_util = __commonJS({
             return JSON.parse(token).token;
         }
         __name(getVercelCliToken, "getVercelCliToken");
-        async function getVercelOidcToken5(authToken, projectId, teamId) {
+        async function getVercelOidcToken6(authToken, projectId, teamId) {
             try {
                 const url2 = `https://api.vercel.com/v1/projects/${projectId}/token?source=vercel-oidc-refresh${teamId ? `&teamId=${teamId}` : ""}`;
                 const res = await fetch(url2, {
@@ -2790,7 +2790,7 @@ var require_token_util = __commonJS({
                 throw new import_token_error.VercelOidcTokenError(`Failed to refresh OIDC token`, e);
             }
         }
-        __name(getVercelOidcToken5, "getVercelOidcToken");
+        __name(getVercelOidcToken6, "getVercelOidcToken");
         function assertVercelOidcTokenResponse(res) {
             if (!res || typeof res !== "object") {
                 throw new TypeError("Expected an object");
@@ -2948,13 +2948,13 @@ var require_get_vercel_oidc_token = __commonJS({
         var __toCommonJS2 = /* @__PURE__ */ __name((mod) => __copyProps2(__defProp2({}, "__esModule", { value: true }), mod), "__toCommonJS");
         var get_vercel_oidc_token_exports = {};
         __export2(get_vercel_oidc_token_exports, {
-            getVercelOidcToken: /* @__PURE__ */ __name(() => getVercelOidcToken5, "getVercelOidcToken"),
+            getVercelOidcToken: /* @__PURE__ */ __name(() => getVercelOidcToken6, "getVercelOidcToken"),
             getVercelOidcTokenSync: /* @__PURE__ */ __name(() => getVercelOidcTokenSync2, "getVercelOidcTokenSync")
         });
         module2.exports = __toCommonJS2(get_vercel_oidc_token_exports);
         var import_get_context = require_get_context();
         var import_token_error = require_token_error();
-        async function getVercelOidcToken5() {
+        async function getVercelOidcToken6() {
             let token = "";
             let err;
             try {
@@ -2982,7 +2982,7 @@ ${error45.message}`;
             }
             return token;
         }
-        __name(getVercelOidcToken5, "getVercelOidcToken");
+        __name(getVercelOidcToken6, "getVercelOidcToken");
         function getVercelOidcTokenSync2() {
             const token = (0, import_get_context.getContext)().headers?.["x-vercel-oidc-token"] ?? process.env.VERCEL_OIDC_TOKEN;
             if (!token) {
@@ -37329,6 +37329,18 @@ var WaitSchema = external_exports.object({
     updatedAt: external_exports.coerce.date(),
     specVersion: external_exports.number().optional()
 });
+// ../core/dist/encryption.js
+var KEY_LENGTH = 32;
+async function importKey(raw) {
+    if (raw.byteLength !== KEY_LENGTH) {
+        throw new Error(`Encryption key must be exactly ${KEY_LENGTH} bytes, got ${raw.byteLength}`);
+    }
+    return globalThis.crypto.subtle.importKey("raw", raw, "AES-GCM", false, [
+        "encrypt",
+        "decrypt"
+    ]);
+}
+__name(importKey, "importKey");
 // ../core/dist/global.js
 var WorkflowSuspension = class _WorkflowSuspension extends Error {
     static {
@@ -40909,10 +40921,85 @@ function createLocalWorld(args) {
     };
 }
 __name(createLocalWorld, "createLocalWorld");
+// ../world-vercel/dist/encryption.js
+var import_node_crypto2 = require("node:crypto");
+var import_oidc2 = __toESM(require_dist(), 1);
+var KEY_BYTES = 32;
+async function deriveRunKey(deploymentKey, projectId, runId) {
+    if (deploymentKey.length !== KEY_BYTES) {
+        throw new Error(`Invalid deployment key length: expected ${KEY_BYTES} bytes for AES-256, got ${deploymentKey.length} bytes`);
+    }
+    if (!projectId || typeof projectId !== "string") {
+        throw new Error("projectId must be a non-empty string");
+    }
+    const baseKey = await import_node_crypto2.webcrypto.subtle.importKey("raw", deploymentKey, "HKDF", false, ["deriveBits"]);
+    const info = new TextEncoder().encode(`${projectId}|${runId}`);
+    const derivedBits = await import_node_crypto2.webcrypto.subtle.deriveBits({
+        name: "HKDF",
+        hash: "SHA-256",
+        salt: new Uint8Array(32),
+        info
+    }, baseKey, KEY_BYTES * 8
+    // bits
+    );
+    return new Uint8Array(derivedBits);
+}
+__name(deriveRunKey, "deriveRunKey");
+async function fetchRunKey(deploymentId, projectId, runId, options) {
+    const oidcToken = await (0, import_oidc2.getVercelOidcToken)().catch(() => null);
+    const token = options?.token ?? oidcToken ?? process.env.VERCEL_TOKEN;
+    if (!token) {
+        throw new Error("Cannot fetch run key: no OIDC token or VERCEL_TOKEN available");
+    }
+    const params = new URLSearchParams({ projectId, runId });
+    const response = await fetch(`https://api.vercel.com/v1/workflow/run-key/${deploymentId}?${params}`, {
+        headers: {
+            Authorization: `Bearer ${token}`
+        }
+    });
+    if (!response.ok) {
+        throw new Error(`Failed to fetch run key for ${runId} (deployment ${deploymentId}): HTTP ${response.status}`);
+    }
+    const data = await response.json();
+    const result = object({ key: string2() }).safeParse(data);
+    if (!result.success) {
+        throw new Error('Invalid response from Vercel API, missing "key" field');
+    }
+    return Buffer.from(result.data.key, "base64");
+}
+__name(fetchRunKey, "fetchRunKey");
+function createGetEncryptionKeyForRun(projectId, token) {
+    if (!projectId)
+        return void 0;
+    const currentDeploymentId = process.env.VERCEL_DEPLOYMENT_ID;
+    let localDeploymentKey;
+    function getLocalDeploymentKey() {
+        if (localDeploymentKey)
+            return localDeploymentKey;
+        const deploymentKeyBase64 = process.env.VERCEL_DEPLOYMENT_KEY;
+        if (!deploymentKeyBase64)
+            return void 0;
+        localDeploymentKey = Buffer.from(deploymentKeyBase64, "base64");
+        return localDeploymentKey;
+    }
+    __name(getLocalDeploymentKey, "getLocalDeploymentKey");
+    return /* @__PURE__ */ __name(async function getEncryptionKeyForRun(run, context2) {
+        const runId = typeof run === "string" ? run : run.runId;
+        const deploymentId = typeof run === "string" ? context2?.deploymentId : run.deploymentId;
+        if (!deploymentId || deploymentId === currentDeploymentId) {
+            const localKey = getLocalDeploymentKey();
+            if (!localKey)
+                return void 0;
+            return deriveRunKey(localKey, projectId, runId);
+        }
+        return fetchRunKey(deploymentId, projectId, runId, { token });
+    }, "getEncryptionKeyForRun");
+}
+__name(createGetEncryptionKeyForRun, "createGetEncryptionKeyForRun");
 // ../../node_modules/.pnpm/@vercel+queue@0.0.0-alpha.38/node_modules/@vercel/queue/dist/web.mjs
 var fs2 = __toESM(require("fs"), 1);
 var path9 = __toESM(require("path"), 1);
-var import_oidc2 = __toESM(require_dist(), 1);
+var import_oidc3 = __toESM(require_dist(), 1);
 var MessageNotFoundError2 = class extends Error {
     static {
         __name(this, "MessageNotFoundError");
@@ -41347,7 +41434,7 @@ var QueueClient2 = class {
         if (this.providedToken) {
             return this.providedToken;
         }
-        const token = await (0, import_oidc2.getVercelOidcToken)();
+        const token = await (0, import_oidc3.getVercelOidcToken)();
         if (!token) {
             throw new Error("Failed to get OIDC token from Vercel Functions. Make sure you are running in a Vercel Function environment, or provide a token explicitly.\n\nTo set up your environment:\n1. Link your project: 'vercel link'\n2. Pull environment variables: 'vercel env pull'\n3. Run with environment: 'dotenv -e .env.local -- your-command'");
         }
@@ -42217,7 +42304,7 @@ __name(handleCallback2, "handleCallback2");
 // ../world-vercel/dist/utils.js
 var import_node_os = __toESM(require("node:os"), 1);
 var import_node_util2 = require("node:util");
-var import_oidc3 = __toESM(require_dist(), 1);
+var import_oidc4 = __toESM(require_dist(), 1);
 // ../../node_modules/.pnpm/cbor-x@1.6.0/node_modules/cbor-x/decode.js
 var decoder;
 try {
@@ -44781,7 +44868,7 @@ var RpcSystem3 = SemanticConvention3("rpc.system");
 var RpcService3 = SemanticConvention3("rpc.service");
 var RpcMethod3 = SemanticConvention3("rpc.method");
 // ../world-vercel/dist/version.js
-var version2 = "4.1.0-beta.33";
+var version2 = "4.1.0-beta.34";
 // ../world-vercel/dist/utils.js
 var WORKFLOW_SERVER_URL_OVERRIDE = "";
 var DEFAULT_RESOLVE_DATA_OPTION2 = "all";
@@ -44864,7 +44951,7 @@ var getHeaders = /* @__PURE__ */ __name((config3, options) => {
 async function getHttpConfig(config3) {
     const { baseUrl, usingProxy } = getHttpUrl(config3);
     const headers = getHeaders(config3, { usingProxy });
-    const token = config3?.token ?? await (0, import_oidc3.getVercelOidcToken)();
+    const token = config3?.token ?? await (0, import_oidc4.getVercelOidcToken)();
     if (token) {
         headers.set("Authorization", `Bearer ${token}`);
     }
@@ -45681,10 +45768,12 @@ function createStreamer2(config3) {
 __name(createStreamer2, "createStreamer");
 // ../world-vercel/dist/index.js
 function createVercelWorld(config3) {
+    const projectId = config3?.projectConfig?.projectId || process.env.VERCEL_PROJECT_ID;
     return {
         ...createQueue2(config3),
         ...createStorage2(config3),
-        ...createStreamer2(config3)
+        ...createStreamer2(config3),
+        getEncryptionKeyForRun: createGetEncryptionKeyForRun(projectId, config3?.token)
     };
 }
 __name(createVercelWorld, "createVercelWorld");
@@ -47513,11 +47602,15 @@ function extractTraceHeaders(traceCarrier) {
     return headers;
 }
 __name(extractTraceHeaders, "extractTraceHeaders");
-async function handleSuspension({ suspension, world, runId, workflowName, workflowStartedAt, span }) {
+async function handleSuspension({ suspension, world, run, span }) {
+    const runId = run.runId;
+    const workflowName = run.workflowName;
+    const workflowStartedAt = run.startedAt ? +run.startedAt : Date.now();
     const stepItems = suspension.steps.filter((item) => item.type === "step");
     const hookItems = suspension.steps.filter((item) => item.type === "hook");
     const waitItems = suspension.steps.filter((item) => item.type === "wait");
-    const encryptionKey = await world.getEncryptionKeyForRun?.(runId);
+    const rawKey = await world.getEncryptionKeyForRun?.(run);
+    const encryptionKey = rawKey ? await importKey(rawKey) : void 0;
     const hookEvents = await Promise.all(hookItems.map(async (queueItem) => {
         const hookMetadata = typeof queueItem.metadata === "undefined" ? void 0 : await dehydrateStepArguments(queueItem.metadata, runId, encryptionKey, suspension.globalThis);
         return {
@@ -49337,7 +49430,7 @@ var stepHandler = getWorldHandlers().createQueueHandler("__wkf_step_", async (me
                         return { timeoutSeconds: retryRetryAfter };
                     }
                     if (err.status === 410) {
-                        console.warn(`Workflow run "${workflowRunId}" has already completed, skipping step "${stepId}": ${err.message}`);
+                        runtimeLogger.info(`Workflow run "${workflowRunId}" has already completed, skipping step "${stepId}": ${err.message}`);
                         return;
                     }
                     if (err.status === 409) {
@@ -49405,15 +49498,29 @@ var stepHandler = getWorldHandlers().createQueueHandler("__wkf_step_", async (me
                     stepName,
                     retryCount
                 });
-                await world.events.create(workflowRunId, {
-                    eventType: "step_failed",
-                    specVersion: SPEC_VERSION_CURRENT,
-                    correlationId: stepId,
-                    eventData: {
-                        error: errorMessage,
-                        stack: step.error?.stack
+                try {
+                    await world.events.create(workflowRunId, {
+                        eventType: "step_failed",
+                        specVersion: SPEC_VERSION_CURRENT,
+                        correlationId: stepId,
+                        eventData: {
+                            error: errorMessage,
+                            stack: step.error?.stack
+                        }
+                    });
+                }
+                catch (err) {
+                    if (WorkflowAPIError.is(err) && err.status === 409) {
+                        runtimeLogger.warn("Tried failing step, but step has already finished.", {
+                            workflowRunId,
+                            stepId,
+                            stepName,
+                            message: err.message
+                        });
+                        return;
                     }
-                });
+                    throw err;
+                }
                 span?.setAttributes({
                     ...StepStatus("failed"),
                     ...StepRetryExhausted(true)
@@ -49432,7 +49539,8 @@ var stepHandler = getWorldHandlers().createQueueHandler("__wkf_step_", async (me
                 }
                 const stepStartedAt = step.startedAt;
                 const ops = [];
-                const encryptionKey = await world.getEncryptionKeyForRun?.(workflowRunId);
+                const rawKey = await world.getEncryptionKeyForRun?.(workflowRunId);
+                const encryptionKey = rawKey ? await importKey(rawKey) : void 0;
                 const hydratedInput = await trace2("step.hydrate", {}, async (hydrateSpan) => {
                     const startTime = Date.now();
                     const result2 = await hydrateStepArguments(step.input, workflowRunId, encryptionKey, ops);
@@ -49483,6 +49591,7 @@ var stepHandler = getWorldHandlers().createQueueHandler("__wkf_step_", async (me
                     if (!isAbortError)
                         throw err;
                 }));
+                let stepCompleted409 = false;
                 const [, traceCarrier] = await Promise.all([
                     withServerErrorRetry(() => world.events.create(workflowRunId, {
                         eventType: "step_completed",
@@ -49491,9 +49600,24 @@ var stepHandler = getWorldHandlers().createQueueHandler("__wkf_step_", async (me
                         eventData: {
                             result
                         }
-                    })),
+                    })).catch((err) => {
+                        if (WorkflowAPIError.is(err) && err.status === 409) {
+                            runtimeLogger.warn("Tried completing step, but step has already finished.", {
+                                workflowRunId,
+                                stepId,
+                                stepName,
+                                message: err.message
+                            });
+                            stepCompleted409 = true;
+                            return;
+                        }
+                        throw err;
+                    }),
                     serializeTraceCarrier()
                 ]);
+                if (stepCompleted409) {
+                    return;
+                }
                 span?.setAttributes({
                     ...StepStatus("completed"),
                     ...StepResultType(typeof result)
@@ -49547,15 +49671,29 @@ var stepHandler = getWorldHandlers().createQueueHandler("__wkf_step_", async (me
                         stepName,
                         errorStack: normalizedStack
                     });
-                    await withServerErrorRetry(() => world.events.create(workflowRunId, {
-                        eventType: "step_failed",
-                        specVersion: SPEC_VERSION_CURRENT,
-                        correlationId: stepId,
-                        eventData: {
-                            error: normalizedError.message,
-                            stack: normalizedStack
+                    try {
+                        await withServerErrorRetry(() => world.events.create(workflowRunId, {
+                            eventType: "step_failed",
+                            specVersion: SPEC_VERSION_CURRENT,
+                            correlationId: stepId,
+                            eventData: {
+                                error: normalizedError.message,
+                                stack: normalizedStack
+                            }
+                        }));
+                    }
+                    catch (stepFailErr) {
+                        if (WorkflowAPIError.is(stepFailErr) && stepFailErr.status === 409) {
+                            runtimeLogger.warn("Tried failing step, but step has already finished.", {
+                                workflowRunId,
+                                stepId,
+                                stepName,
+                                message: stepFailErr.message
+                            });
+                            return;
                         }
-                    }));
+                        throw stepFailErr;
+                    }
                     span?.setAttributes({
                         ...StepStatus("failed"),
                         ...StepFatalError(true)
@@ -49578,15 +49716,29 @@ var stepHandler = getWorldHandlers().createQueueHandler("__wkf_step_", async (me
                             errorStack: normalizedStack
                         });
                         const errorMessage = `Step "${stepName}" failed after ${maxRetries2} ${pluralize("retry", "retries", maxRetries2)}: ${normalizedError.message}`;
-                        await withServerErrorRetry(() => world.events.create(workflowRunId, {
-                            eventType: "step_failed",
-                            specVersion: SPEC_VERSION_CURRENT,
-                            correlationId: stepId,
-                            eventData: {
-                                error: errorMessage,
-                                stack: normalizedStack
+                        try {
+                            await withServerErrorRetry(() => world.events.create(workflowRunId, {
+                                eventType: "step_failed",
+                                specVersion: SPEC_VERSION_CURRENT,
+                                correlationId: stepId,
+                                eventData: {
+                                    error: errorMessage,
+                                    stack: normalizedStack
+                                }
+                            }));
+                        }
+                        catch (stepFailErr) {
+                            if (WorkflowAPIError.is(stepFailErr) && stepFailErr.status === 409) {
+                                runtimeLogger.warn("Tried failing step, but step has already finished.", {
+                                    workflowRunId,
+                                    stepId,
+                                    stepName,
+                                    message: stepFailErr.message
+                                });
+                                return;
                             }
-                        }));
+                            throw stepFailErr;
+                        }
                         span?.setAttributes({
                             ...StepStatus("failed"),
                             ...StepRetryExhausted(true)
@@ -49609,18 +49761,32 @@ var stepHandler = getWorldHandlers().createQueueHandler("__wkf_step_", async (me
                                 errorStack: normalizedStack
                             });
                         }
-                        await withServerErrorRetry(() => world.events.create(workflowRunId, {
-                            eventType: "step_retrying",
-                            specVersion: SPEC_VERSION_CURRENT,
-                            correlationId: stepId,
-                            eventData: {
-                                error: normalizedError.message,
-                                stack: normalizedStack,
-                                ...RetryableError.is(err) && {
-                                    retryAfter: err.retryAfter
+                        try {
+                            await withServerErrorRetry(() => world.events.create(workflowRunId, {
+                                eventType: "step_retrying",
+                                specVersion: SPEC_VERSION_CURRENT,
+                                correlationId: stepId,
+                                eventData: {
+                                    error: normalizedError.message,
+                                    stack: normalizedStack,
+                                    ...RetryableError.is(err) && {
+                                        retryAfter: err.retryAfter
+                                    }
                                 }
+                            }));
+                        }
+                        catch (stepRetryErr) {
+                            if (WorkflowAPIError.is(stepRetryErr) && stepRetryErr.status === 409) {
+                                runtimeLogger.warn("Tried retrying step, but step has already finished.", {
+                                    workflowRunId,
+                                    stepId,
+                                    stepName,
+                                    message: stepRetryErr.message
+                                });
+                                return;
                             }
-                        }));
+                            throw stepRetryErr;
+                        }
                         const timeoutSeconds = Math.max(1, RetryableError.is(err) ? Math.ceil((+err.retryAfter.getTime() - Date.now()) / 1e3) : 1);
                         span?.setAttributes({
                             ...StepRetryTimeoutSeconds(timeoutSeconds),
@@ -49674,8 +49840,8 @@ function workflowEntrypoint(workflowCode2) {
                     });
                     return await withThrottleRetry(async () => {
                         let workflowStartedAt = -1;
+                        let workflowRun = await world.runs.get(runId);
                         try {
-                            let workflowRun = await world.runs.get(runId);
                             if (workflowRun.status === "pending") {
                                 const result2 = await world.events.create(runId, {
                                     eventType: "run_started",
@@ -49729,7 +49895,8 @@ function workflowEntrypoint(workflowCode2) {
                                 replaySpan?.setAttributes({
                                     ...WorkflowEventsCount(events.length)
                                 });
-                                const encryptionKey = await world.getEncryptionKeyForRun?.(runId);
+                                const rawKey = await world.getEncryptionKeyForRun?.(workflowRun);
+                                const encryptionKey = rawKey ? await importKey(rawKey) : void 0;
                                 return await runWorkflow(workflowCode2, workflowRun, events, encryptionKey);
                             });
                             try {
@@ -49767,9 +49934,7 @@ function workflowEntrypoint(workflowCode2) {
                                 const result = await handleSuspension({
                                     suspension: err,
                                     world,
-                                    runId,
-                                    workflowName,
-                                    workflowStartedAt,
+                                    run: workflowRun,
                                     span
                                 });
                                 if (result.timeoutSeconds !== void 0) {
@@ -50098,7 +50263,7 @@ function getWritable(options = {}) {
 __name(getWritable, "getWritable");
 
 // ../workflow/dist/stdlib.js
-var fetch = globalThis[Symbol.for("WORKFLOW_USE_STEP")]("step//workflow@4.1.0-beta.58//fetch");
+var fetch = globalThis[Symbol.for("WORKFLOW_USE_STEP")]("step//workflow@4.1.0-beta.59//fetch");
 
 // ../../node_modules/.pnpm/zod@4.1.11/node_modules/zod/v4/core/core.js
 var NEVER = Object.freeze({