@workflow/world-testing 4.1.0-beta.59 → 4.1.0-beta.60

package/dist/.well-known/workflow/v1/step.js

@@ -4182,7 +4182,7 @@ var require_token_util = __commonJS({
             getTokenPayload: /* @__PURE__ */ __name(() => getTokenPayload, "getTokenPayload"),
             getVercelCliToken: /* @__PURE__ */ __name(() => getVercelCliToken, "getVercelCliToken"),
             getVercelDataDir: /* @__PURE__ */ __name(() => getVercelDataDir, "getVercelDataDir"),
-            getVercelOidcToken: /* @__PURE__ */ __name(() => getVercelOidcToken5, "getVercelOidcToken"),
+            getVercelOidcToken: /* @__PURE__ */ __name(() => getVercelOidcToken6, "getVercelOidcToken"),
             isExpired: /* @__PURE__ */ __name(() => isExpired, "isExpired"),
             loadToken: /* @__PURE__ */ __name(() => loadToken, "loadToken"),
             saveToken: /* @__PURE__ */ __name(() => saveToken, "saveToken")
@@ -4217,7 +4217,7 @@ var require_token_util = __commonJS({
             return JSON.parse(token).token;
         }
         __name(getVercelCliToken, "getVercelCliToken");
-        async function getVercelOidcToken5(authToken, projectId, teamId) {
+        async function getVercelOidcToken6(authToken, projectId, teamId) {
             try {
                 const url2 = `https://api.vercel.com/v1/projects/${projectId}/token?source=vercel-oidc-refresh${teamId ? `&teamId=${teamId}` : ""}`;
                 const res = await fetch(url2, {
@@ -4237,7 +4237,7 @@ var require_token_util = __commonJS({
                 throw new import_token_error.VercelOidcTokenError(`Failed to refresh OIDC token`, e);
             }
         }
-        __name(getVercelOidcToken5, "getVercelOidcToken");
+        __name(getVercelOidcToken6, "getVercelOidcToken");
         function assertVercelOidcTokenResponse(res) {
             if (!res || typeof res !== "object") {
                 throw new TypeError("Expected an object");
@@ -4417,13 +4417,13 @@ var require_get_vercel_oidc_token = __commonJS({
         }), mod), "__toCommonJS");
         var get_vercel_oidc_token_exports = {};
         __export2(get_vercel_oidc_token_exports, {
-            getVercelOidcToken: /* @__PURE__ */ __name(() => getVercelOidcToken5, "getVercelOidcToken"),
+            getVercelOidcToken: /* @__PURE__ */ __name(() => getVercelOidcToken6, "getVercelOidcToken"),
             getVercelOidcTokenSync: /* @__PURE__ */ __name(() => getVercelOidcTokenSync2, "getVercelOidcTokenSync")
         });
         module2.exports = __toCommonJS2(get_vercel_oidc_token_exports);
         var import_get_context = require_get_context2();
         var import_token_error = require_token_error();
-        async function getVercelOidcToken5() {
+        async function getVercelOidcToken6() {
             let token = "";
             let err;
             try {
@@ -4451,7 +4451,7 @@ ${error45.message}`;
             }
             return token;
         }
-        __name(getVercelOidcToken5, "getVercelOidcToken");
+        __name(getVercelOidcToken6, "getVercelOidcToken");
         function getVercelOidcTokenSync2() {
             const token = (0, import_get_context.getContext)().headers?.["x-vercel-oidc-token"] ?? process.env.VERCEL_OIDC_TOKEN;
             if (!token) {
@@ -25191,7 +25191,7 @@ async function fetch2(...args) {
     return globalThis.fetch(...args);
 }
 __name(fetch2, "fetch");
-registerStepFunction("step//workflow@4.1.0-beta.58//fetch", fetch2);
+registerStepFunction("step//workflow@4.1.0-beta.59//fetch", fetch2);
 // workflows/addition.ts
 async function add(num, num2) {
     return num + num2;
@@ -39600,6 +39600,18 @@ var WaitSchema = external_exports.object({
     updatedAt: external_exports.coerce.date(),
     specVersion: external_exports.number().optional()
 });
+// ../core/dist/encryption.js
+var KEY_LENGTH = 32;
+async function importKey(raw) {
+    if (raw.byteLength !== KEY_LENGTH) {
+        throw new Error(`Encryption key must be exactly ${KEY_LENGTH} bytes, got ${raw.byteLength}`);
+    }
+    return globalThis.crypto.subtle.importKey("raw", raw, "AES-GCM", false, [
+        "encrypt",
+        "decrypt"
+    ]);
+}
+__name(importKey, "importKey");
 // ../serde/dist/index.js
 var WORKFLOW_SERIALIZE = Symbol.for("workflow-serialize");
 var WORKFLOW_DESERIALIZE = Symbol.for("workflow-deserialize");
@@ -44042,10 +44054,94 @@ function createLocalWorld(args) {
     };
 }
 __name(createLocalWorld, "createLocalWorld");
+// ../world-vercel/dist/encryption.js
+var import_node_crypto2 = require("node:crypto");
+var import_oidc2 = __toESM(require_dist(), 1);
+var KEY_BYTES = 32;
+async function deriveRunKey(deploymentKey, projectId, runId) {
+    if (deploymentKey.length !== KEY_BYTES) {
+        throw new Error(`Invalid deployment key length: expected ${KEY_BYTES} bytes for AES-256, got ${deploymentKey.length} bytes`);
+    }
+    if (!projectId || typeof projectId !== "string") {
+        throw new Error("projectId must be a non-empty string");
+    }
+    const baseKey = await import_node_crypto2.webcrypto.subtle.importKey("raw", deploymentKey, "HKDF", false, [
+        "deriveBits"
+    ]);
+    const info = new TextEncoder().encode(`${projectId}|${runId}`);
+    const derivedBits = await import_node_crypto2.webcrypto.subtle.deriveBits({
+        name: "HKDF",
+        hash: "SHA-256",
+        salt: new Uint8Array(32),
+        info
+    }, baseKey, KEY_BYTES * 8
+    // bits
+    );
+    return new Uint8Array(derivedBits);
+}
+__name(deriveRunKey, "deriveRunKey");
+async function fetchRunKey(deploymentId, projectId, runId, options) {
+    const oidcToken = await (0, import_oidc2.getVercelOidcToken)().catch(() => null);
+    const token = options?.token ?? oidcToken ?? process.env.VERCEL_TOKEN;
+    if (!token) {
+        throw new Error("Cannot fetch run key: no OIDC token or VERCEL_TOKEN available");
+    }
+    const params = new URLSearchParams({
+        projectId,
+        runId
+    });
+    const response = await fetch(`https://api.vercel.com/v1/workflow/run-key/${deploymentId}?${params}`, {
+        headers: {
+            Authorization: `Bearer ${token}`
+        }
+    });
+    if (!response.ok) {
+        throw new Error(`Failed to fetch run key for ${runId} (deployment ${deploymentId}): HTTP ${response.status}`);
+    }
+    const data = await response.json();
+    const result = object({
+        key: string2()
+    }).safeParse(data);
+    if (!result.success) {
+        throw new Error('Invalid response from Vercel API, missing "key" field');
+    }
+    return Buffer.from(result.data.key, "base64");
+}
+__name(fetchRunKey, "fetchRunKey");
+function createGetEncryptionKeyForRun(projectId, token) {
+    if (!projectId)
+        return void 0;
+    const currentDeploymentId = process.env.VERCEL_DEPLOYMENT_ID;
+    let localDeploymentKey;
+    function getLocalDeploymentKey() {
+        if (localDeploymentKey)
+            return localDeploymentKey;
+        const deploymentKeyBase64 = process.env.VERCEL_DEPLOYMENT_KEY;
+        if (!deploymentKeyBase64)
+            return void 0;
+        localDeploymentKey = Buffer.from(deploymentKeyBase64, "base64");
+        return localDeploymentKey;
+    }
+    __name(getLocalDeploymentKey, "getLocalDeploymentKey");
+    return /* @__PURE__ */ __name(async function getEncryptionKeyForRun(run, context) {
+        const runId = typeof run === "string" ? run : run.runId;
+        const deploymentId = typeof run === "string" ? context?.deploymentId : run.deploymentId;
+        if (!deploymentId || deploymentId === currentDeploymentId) {
+            const localKey = getLocalDeploymentKey();
+            if (!localKey)
+                return void 0;
+            return deriveRunKey(localKey, projectId, runId);
+        }
+        return fetchRunKey(deploymentId, projectId, runId, {
+            token
+        });
+    }, "getEncryptionKeyForRun");
+}
+__name(createGetEncryptionKeyForRun, "createGetEncryptionKeyForRun");
 // ../../node_modules/.pnpm/@vercel+queue@0.0.0-alpha.38/node_modules/@vercel/queue/dist/web.mjs
 var fs2 = __toESM(require("fs"), 1);
 var path9 = __toESM(require("path"), 1);
-var import_oidc2 = __toESM(require_dist(), 1);
+var import_oidc3 = __toESM(require_dist(), 1);
 var MessageNotFoundError2 = class extends Error {
     static {
         __name(this, "MessageNotFoundError");
@@ -44480,7 +44576,7 @@ var QueueClient2 = class {
         if (this.providedToken) {
             return this.providedToken;
         }
-        const token = await (0, import_oidc2.getVercelOidcToken)();
+        const token = await (0, import_oidc3.getVercelOidcToken)();
         if (!token) {
             throw new Error("Failed to get OIDC token from Vercel Functions. Make sure you are running in a Vercel Function environment, or provide a token explicitly.\n\nTo set up your environment:\n1. Link your project: 'vercel link'\n2. Pull environment variables: 'vercel env pull'\n3. Run with environment: 'dotenv -e .env.local -- your-command'");
         }
@@ -45386,7 +45482,7 @@ __name(handleCallback2, "handleCallback2");
 // ../world-vercel/dist/utils.js
 var import_node_os = __toESM(require("node:os"), 1);
 var import_node_util2 = require("node:util");
-var import_oidc3 = __toESM(require_dist(), 1);
+var import_oidc4 = __toESM(require_dist(), 1);
 // ../../node_modules/.pnpm/cbor-x@1.6.0/node_modules/cbor-x/decode.js
 var decoder;
 try {
@@ -48005,7 +48101,7 @@ var RpcSystem3 = SemanticConvention3("rpc.system");
 var RpcService3 = SemanticConvention3("rpc.service");
 var RpcMethod3 = SemanticConvention3("rpc.method");
 // ../world-vercel/dist/version.js
-var version2 = "4.1.0-beta.33";
+var version2 = "4.1.0-beta.34";
 // ../world-vercel/dist/utils.js
 var WORKFLOW_SERVER_URL_OVERRIDE = "";
 var DEFAULT_RESOLVE_DATA_OPTION2 = "all";
@@ -48093,7 +48189,7 @@ async function getHttpConfig(config3) {
     const headers = getHeaders(config3, {
         usingProxy
     });
-    const token = config3?.token ?? await (0, import_oidc3.getVercelOidcToken)();
+    const token = config3?.token ?? await (0, import_oidc4.getVercelOidcToken)();
     if (token) {
         headers.set("Authorization", `Bearer ${token}`);
     }
@@ -48991,10 +49087,12 @@ function createStreamer2(config3) {
 __name(createStreamer2, "createStreamer");
 // ../world-vercel/dist/index.js
 function createVercelWorld(config3) {
+    const projectId = config3?.projectConfig?.projectId || process.env.VERCEL_PROJECT_ID;
     return {
         ...createQueue2(config3),
         ...createStorage2(config3),
-        ...createStreamer2(config3)
+        ...createStreamer2(config3),
+        getEncryptionKeyForRun: createGetEncryptionKeyForRun(projectId, config3?.token)
     };
 }
 __name(createVercelWorld, "createVercelWorld");
@@ -49883,12 +49981,15 @@ __name(withServerErrorRetry, "withServerErrorRetry");
 async function getHookByTokenWithKey(token) {
     const world = getWorld();
     const hook = await world.hooks.getByToken(token);
-    const encryptionKey = await world.getEncryptionKeyForRun?.(hook.runId);
+    const run = await world.runs.get(hook.runId);
+    const rawKey = await world.getEncryptionKeyForRun?.(run);
+    const encryptionKey = rawKey ? await importKey(rawKey) : void 0;
     if (typeof hook.metadata !== "undefined") {
         hook.metadata = await hydrateStepArguments(hook.metadata, hook.runId, encryptionKey);
     }
     return {
         hook,
+        run,
         encryptionKey
     };
 }
@@ -49899,15 +50000,24 @@ async function resumeHook(tokenOrHook, payload, encryptionKeyOverride) {
             const world = getWorld();
             try {
                 let hook;
+                let workflowRun;
                 let encryptionKey;
                 if (typeof tokenOrHook === "string") {
                     const result = await getHookByTokenWithKey(tokenOrHook);
                     hook = result.hook;
+                    workflowRun = result.run;
                     encryptionKey = encryptionKeyOverride ?? result.encryptionKey;
                 }
                 else {
                     hook = tokenOrHook;
-                    encryptionKey = encryptionKeyOverride ?? await world.getEncryptionKeyForRun?.(hook.runId);
+                    workflowRun = await world.runs.get(hook.runId);
+                    if (encryptionKeyOverride) {
+                        encryptionKey = encryptionKeyOverride;
+                    }
+                    else {
+                        const rawKey = await world.getEncryptionKeyForRun?.(workflowRun);
+                        encryptionKey = rawKey ? await importKey(rawKey) : void 0;
+                    }
                 }
                 span?.setAttributes({
                     ...HookToken(hook.token),
@@ -49931,7 +50041,6 @@ async function resumeHook(tokenOrHook, payload, encryptionKeyOverride) {
                 }, {
                     v1Compat
                 });
-                const workflowRun = await world.runs.get(hook.runId);
                 span?.setAttributes({
                     ...WorkflowName(workflowRun.workflowName)
                 });
@@ -50241,7 +50350,7 @@ var stepHandler = getWorldHandlers().createQueueHandler("__wkf_step_", async (me
                         };
                     }
                     if (err.status === 410) {
-                        console.warn(`Workflow run "${workflowRunId}" has already completed, skipping step "${stepId}": ${err.message}`);
+                        runtimeLogger.info(`Workflow run "${workflowRunId}" has already completed, skipping step "${stepId}": ${err.message}`);
                         return;
                     }
                     if (err.status === 409) {
@@ -50311,15 +50420,29 @@ var stepHandler = getWorldHandlers().createQueueHandler("__wkf_step_", async (me
                     stepName,
                     retryCount
                 });
-                await world.events.create(workflowRunId, {
-                    eventType: "step_failed",
-                    specVersion: SPEC_VERSION_CURRENT,
-                    correlationId: stepId,
-                    eventData: {
-                        error: errorMessage,
-                        stack: step.error?.stack
+                try {
+                    await world.events.create(workflowRunId, {
+                        eventType: "step_failed",
+                        specVersion: SPEC_VERSION_CURRENT,
+                        correlationId: stepId,
+                        eventData: {
+                            error: errorMessage,
+                            stack: step.error?.stack
+                        }
+                    });
+                }
+                catch (err) {
+                    if (WorkflowAPIError.is(err) && err.status === 409) {
+                        runtimeLogger.warn("Tried failing step, but step has already finished.", {
+                            workflowRunId,
+                            stepId,
+                            stepName,
+                            message: err.message
+                        });
+                        return;
                     }
-                });
+                    throw err;
+                }
                 span?.setAttributes({
                     ...StepStatus("failed"),
                     ...StepRetryExhausted(true)
@@ -50338,7 +50461,8 @@ var stepHandler = getWorldHandlers().createQueueHandler("__wkf_step_", async (me
                 }
                 const stepStartedAt = step.startedAt;
                 const ops = [];
-                const encryptionKey = await world.getEncryptionKeyForRun?.(workflowRunId);
+                const rawKey = await world.getEncryptionKeyForRun?.(workflowRunId);
+                const encryptionKey = rawKey ? await importKey(rawKey) : void 0;
                 const hydratedInput = await trace("step.hydrate", {}, async (hydrateSpan) => {
                     const startTime = Date.now();
                     const result2 = await hydrateStepArguments(step.input, workflowRunId, encryptionKey, ops);
@@ -50389,6 +50513,7 @@ var stepHandler = getWorldHandlers().createQueueHandler("__wkf_step_", async (me
                     if (!isAbortError)
                         throw err;
                 }));
+                let stepCompleted409 = false;
                 const [, traceCarrier] = await Promise.all([
                     withServerErrorRetry(() => world.events.create(workflowRunId, {
                         eventType: "step_completed",
@@ -50397,9 +50522,24 @@ var stepHandler = getWorldHandlers().createQueueHandler("__wkf_step_", async (me
                         eventData: {
                             result
                         }
-                    })),
+                    })).catch((err) => {
+                        if (WorkflowAPIError.is(err) && err.status === 409) {
+                            runtimeLogger.warn("Tried completing step, but step has already finished.", {
+                                workflowRunId,
+                                stepId,
+                                stepName,
+                                message: err.message
+                            });
+                            stepCompleted409 = true;
+                            return;
+                        }
+                        throw err;
+                    }),
                     serializeTraceCarrier()
                 ]);
+                if (stepCompleted409) {
+                    return;
+                }
                 span?.setAttributes({
                     ...StepStatus("completed"),
                     ...StepResultType(typeof result)
@@ -50453,15 +50593,29 @@ var stepHandler = getWorldHandlers().createQueueHandler("__wkf_step_", async (me
                         stepName,
                         errorStack: normalizedStack
                     });
-                    await withServerErrorRetry(() => world.events.create(workflowRunId, {
-                        eventType: "step_failed",
-                        specVersion: SPEC_VERSION_CURRENT,
-                        correlationId: stepId,
-                        eventData: {
-                            error: normalizedError.message,
-                            stack: normalizedStack
+                    try {
+                        await withServerErrorRetry(() => world.events.create(workflowRunId, {
+                            eventType: "step_failed",
+                            specVersion: SPEC_VERSION_CURRENT,
+                            correlationId: stepId,
+                            eventData: {
+                                error: normalizedError.message,
+                                stack: normalizedStack
+                            }
+                        }));
+                    }
+                    catch (stepFailErr) {
+                        if (WorkflowAPIError.is(stepFailErr) && stepFailErr.status === 409) {
+                            runtimeLogger.warn("Tried failing step, but step has already finished.", {
+                                workflowRunId,
+                                stepId,
+                                stepName,
+                                message: stepFailErr.message
+                            });
+                            return;
                         }
-                    }));
+                        throw stepFailErr;
+                    }
                     span?.setAttributes({
                         ...StepStatus("failed"),
                         ...StepFatalError(true)
@@ -50484,15 +50638,29 @@ var stepHandler = getWorldHandlers().createQueueHandler("__wkf_step_", async (me
                             errorStack: normalizedStack
                         });
                         const errorMessage = `Step "${stepName}" failed after ${maxRetries2} ${pluralize("retry", "retries", maxRetries2)}: ${normalizedError.message}`;
-                        await withServerErrorRetry(() => world.events.create(workflowRunId, {
-                            eventType: "step_failed",
-                            specVersion: SPEC_VERSION_CURRENT,
-                            correlationId: stepId,
-                            eventData: {
-                                error: errorMessage,
-                                stack: normalizedStack
+                        try {
+                            await withServerErrorRetry(() => world.events.create(workflowRunId, {
+                                eventType: "step_failed",
+                                specVersion: SPEC_VERSION_CURRENT,
+                                correlationId: stepId,
+                                eventData: {
+                                    error: errorMessage,
+                                    stack: normalizedStack
+                                }
+                            }));
+                        }
+                        catch (stepFailErr) {
+                            if (WorkflowAPIError.is(stepFailErr) && stepFailErr.status === 409) {
+                                runtimeLogger.warn("Tried failing step, but step has already finished.", {
+                                    workflowRunId,
+                                    stepId,
+                                    stepName,
+                                    message: stepFailErr.message
+                                });
+                                return;
                             }
-                        }));
+                            throw stepFailErr;
+                        }
                         span?.setAttributes({
                             ...StepStatus("failed"),
                             ...StepRetryExhausted(true)
@@ -50515,18 +50683,32 @@ var stepHandler = getWorldHandlers().createQueueHandler("__wkf_step_", async (me
                                 errorStack: normalizedStack
                             });
                         }
-                        await withServerErrorRetry(() => world.events.create(workflowRunId, {
-                            eventType: "step_retrying",
-                            specVersion: SPEC_VERSION_CURRENT,
-                            correlationId: stepId,
-                            eventData: {
-                                error: normalizedError.message,
-                                stack: normalizedStack,
-                                ...RetryableError.is(err) && {
-                                    retryAfter: err.retryAfter
+                        try {
+                            await withServerErrorRetry(() => world.events.create(workflowRunId, {
+                                eventType: "step_retrying",
+                                specVersion: SPEC_VERSION_CURRENT,
+                                correlationId: stepId,
+                                eventData: {
+                                    error: normalizedError.message,
+                                    stack: normalizedStack,
+                                    ...RetryableError.is(err) && {
+                                        retryAfter: err.retryAfter
+                                    }
                                 }
+                            }));
+                        }
+                        catch (stepRetryErr) {
+                            if (WorkflowAPIError.is(stepRetryErr) && stepRetryErr.status === 409) {
+                                runtimeLogger.warn("Tried retrying step, but step has already finished.", {
+                                    workflowRunId,
+                                    stepId,
+                                    stepName,
+                                    message: stepRetryErr.message
+                                });
+                                return;
                             }
-                        }));
+                            throw stepRetryErr;
+                        }
                         const timeoutSeconds = Math.max(1, RetryableError.is(err) ? Math.ceil((+err.retryAfter.getTime() - Date.now()) / 1e3) : 1);
                         span?.setAttributes({
                             ...StepRetryTimeoutSeconds(timeoutSeconds),