eve 0.26.2 → 0.27.1

package/dist/src/compiled/@vercel/sandbox/network-policy.d.ts

@@ -54,24 +54,32 @@ type NetworkPolicyMatch = {
  */
 type NetworkPolicyRule = {
   /**
-   * Optional request matcher. When provided, transforms only apply to requests
-   * that match every specified dimension.
+   * Optional request matcher. When provided, transforms and forwarding rules
+   * only apply to requests that match every specified dimension.
    */
   match?: NetworkPolicyMatch;
+} & ({
   /**
    * Transforms to apply to matching requests.
+   *
+   * `transform` cannot be used together with `forwardURL`.
    */
-  transform?: NetworkTransformer[];
+  transform: NetworkTransformer[];
+  forwardURL?: never;
+} | {
+  transform?: never;
   /**
    * HTTPS proxy URL to forward matching requests to. Must not include query string or fragment.
    *
    * You can use the `defineSandboxProxy` helper from `@vercel/sandbox/proxy` to implement the proxy handler
    * automatically, which handles authorization and extracts metadata about the request and sandbox.
    *
+   * `forwardURL` cannot be used together with `transform`.
+   *
    * @see https://vercel.com/docs/vercel-sandbox/concepts/firewall#requests-proxying
    */
-  forwardURL?: string;
-};
+  forwardURL: string;
+});
 /**
  * Network policy to define network restrictions for the sandbox.
  *

package/dist/src/compiled/@vercel/sandbox/sandbox-user.d.ts

@@ -0,0 +1,212 @@
+import { Command, CommandFinished } from "./command.js";
+import { ExecutionContext } from "./execution-context.js";
+import { RunCommandParams } from "./session.js";
+import { Sandbox } from "./sandbox.js";
+
+//#region src/sandbox-user.d.ts
+
+/**
+ * Thrown when {@link Sandbox.createUser} is called for an existing username.
+ */
+declare class SandboxUserAlreadyExistsError extends Error {
+  readonly username: string;
+  constructor(username: string);
+}
+/**
+ * A user context within a sandbox.
+ *
+ * All file and command operations default to running as this user.
+ * Created via {@link Sandbox.createUser} or {@link Sandbox.asUser}.
+ *
+ * @hideconstructor
+ */
+declare class SandboxUser implements ExecutionContext {
+  /**
+   * The Linux username.
+   */
+  readonly username: string;
+  /**
+   * The user's home directory (e.g., `/home/alice`).
+   */
+  readonly homeDir: string;
+  private readonly sandbox;
+  /**
+   * Memoized lookup of this user's primary group.
+   * See {@link SandboxUser.primaryGroup}.
+   */
+  private primaryGroupPromise?;
+  constructor({
+    sandbox,
+    username
+  }: {
+    sandbox: Sandbox;
+    username: string;
+  });
+  /**
+   * Build the wrapped command args to run as this user via `sudo -u`.
+   *
+   * When `env` is provided, injects `env KEY=VAL ...` so that environment
+   * variables survive the `sudo -u` transition.
+   */
+  private buildUserCommand;
+  /**
+   * Resolve a path relative to this user's home directory.
+   * Absolute paths are returned as-is.
+   */
+  private resolvePath;
+  /**
+   * Start executing a command as this user.
+   *
+   * @param command - The command to execute.
+   * @param args - Arguments to pass to the command.
+   * @param opts - Optional parameters.
+   * @returns A {@link CommandFinished} result once execution is done.
+   */
+  runCommand(command: string, args?: string[], opts?: {
+    signal?: AbortSignal;
+    timeoutMs?: number;
+  }): Promise<CommandFinished>;
+  /**
+   * Start executing a command as this user in detached mode.
+   *
+   * @param params - The command parameters.
+   * @returns A {@link Command} instance for the running command.
+   */
+  runCommand(params: RunCommandParams & {
+    detached: true;
+  }): Promise<Command>;
+  /**
+   * Start executing a command as this user.
+   *
+   * @param params - The command parameters.
+   * @returns A {@link CommandFinished} result once execution is done.
+   */
+  runCommand(params: RunCommandParams): Promise<CommandFinished>;
+  /**
+   * Write files to this user's home directory (or absolute paths).
+   * Files are written via the sandbox HTTP API then chowned to this user.
+   *
+   * The HTTP API can write to user home dirs because they are group-owned
+   * by the sandbox's default user group with `770` permissions.
+   *
+   * @param files - Array of files with path, content, and optional mode
+   * @param opts - Optional parameters.
+   */
+  writeFiles(files: {
+    path: string;
+    content: string | Uint8Array;
+    mode?: number;
+  }[], opts?: {
+    signal?: AbortSignal;
+  }): Promise<void>;
+  /**
+   * Read a file from this user's context as a stream.
+   *
+   * @param file - File to read, with path and optional cwd
+   * @param opts - Optional parameters.
+   * @returns A ReadableStream of the file contents, or null if not found
+   */
+  readFile(file: {
+    path: string;
+    cwd?: string;
+  }, opts?: {
+    signal?: AbortSignal;
+  }): Promise<NodeJS.ReadableStream | null>;
+  /**
+   * Read a file from this user's context as a Buffer.
+   *
+   * @param file - File to read, with path and optional cwd
+   * @param opts - Optional parameters.
+   * @returns The file contents as a Buffer, or null if not found
+   */
+  readFileToBuffer(file: {
+    path: string;
+    cwd?: string;
+  }, opts?: {
+    signal?: AbortSignal;
+  }): Promise<Buffer | null>;
+  /**
+   * Download a file from this user's context to the local filesystem.
+   *
+   * @param src - Source file in the sandbox
+   * @param dst - Destination on the local machine
+   * @param opts - Optional parameters.
+   * @returns The absolute path to the written file, or null if not found
+   */
+  downloadFile(src: {
+    path: string;
+    cwd?: string;
+  }, dst: {
+    path: string;
+    cwd?: string;
+  }, opts?: {
+    mkdirRecursive?: boolean;
+    signal?: AbortSignal;
+  }): Promise<string | null>;
+  /**
+   * Read a file as this user and return its bytes, or null if it does not
+   * exist.
+   *
+   * Reads via `sudo -u <user> base64` rather than the HTTP file API: on stock
+   * runtimes the API runs as `vercel-sandbox` and cannot read files this user
+   * has kept private (e.g. mode `600`), whereas reading as the user always
+   * honours the user's own permissions. The payload is base64-encoded because
+   * the command output channel is UTF-8 only and would otherwise corrupt
+   * binary files.
+   */
+  private catAsUser;
+  /**
+   * Create a directory owned by this user.
+   *
+   * @param path - Path of the directory to create
+   * @param opts - Optional parameters.
+   */
+  mkDir(path: string, opts?: {
+    signal?: AbortSignal;
+  }): Promise<void>;
+  /**
+   * This user's primary group. Users created via {@link Sandbox.createUser}
+   * get a group named after them, but {@link Sandbox.asUser} accepts
+   * pre-existing users whose primary group can differ (e.g. system users), so
+   * we resolve it from the sandbox rather than assuming `<username>`.
+   *
+   * The result is memoized for the lifetime of this instance.
+   */
+  private primaryGroup;
+  private resolvePrimaryGroup;
+  /**
+   * Run `chown <ownership> <paths...>` as root, throwing on failure.
+   */
+  private chownOrThrow;
+  /**
+   * Run `chmod <mode> <paths...>` as root, throwing on failure.
+   */
+  private chmodOrThrow;
+  /**
+   * Given absolute leaf paths, return the directories strictly between this
+   * user's home directory and each leaf. The home dir itself is excluded, as
+   * are any paths that fall outside the home dir.
+   */
+  private ancestorDirsUnderHome;
+  /**
+   * Add this user to a group.
+   *
+   * @param groupname - Name of the group to join
+   * @param opts - Optional parameters.
+   */
+  addToGroup(groupname: string, opts?: {
+    signal?: AbortSignal;
+  }): Promise<void>;
+  /**
+   * Remove this user from a group.
+   *
+   * @param groupname - Name of the group to leave
+   * @param opts - Optional parameters.
+   */
+  removeFromGroup(groupname: string, opts?: {
+    signal?: AbortSignal;
+  }): Promise<void>;
+}
+//#endregion
+export { SandboxUser, SandboxUserAlreadyExistsError };
+//# sourceMappingURL=sandbox-user.d.ts.map

package/dist/src/compiled/@vercel/sandbox/sandbox.d.ts

@@ -9,8 +9,10 @@ import { Credentials } from "./utils/get-credentials.js";
 import { Command, CommandFinished } from "./command.js";
 import { Snapshot } from "./snapshot.js";
 import { SandboxSnapshot } from "./utils/sandbox-snapshot.js";
+import { ExecutionContext } from "./execution-context.js";
 import { RunCommandParams, Session } from "./session.js";
 import { FileSystem } from "./filesystem.js";
+import { SandboxUser } from "./sandbox-user.js";
 import { WORKFLOW_DESERIALIZE, WORKFLOW_SERIALIZE } from "./_workflow-serde.js";
 
 //#region src/sandbox.d.ts
@@ -236,7 +238,7 @@ interface SerializedSandbox {
  * Use {@link Sandbox.create} or {@link Sandbox.get} to construct.
  * @hideconstructor
  */
-declare class Sandbox {
+declare class Sandbox implements ExecutionContext {
   private _client;
   private readonly projectId;
   /**
@@ -255,6 +257,11 @@ declare class Sandbox {
    * Hook that will be executed when a new session is created during resume.
    */
   private readonly onResume?;
+  /**
+   * Memoized lookup of the sandbox's default user and its primary group.
+   * See {@link Sandbox.getDefaultUser}.
+   */
+  private defaultUserPromise?;
   /**
    * A `node:fs/promises`-compatible API for interacting with the sandbox filesystem.
    *
@@ -295,8 +302,17 @@ declare class Sandbox {
    * Memory allocated in MB.
    */
   get memory(): number | undefined;
-  /** Runtime identifier (e.g. "node24", "python3.13"). */
+  /**
+   * Runtime identifier (e.g. "node24", "python3.13").
+   * Mutually exclusive with {@link Sandbox.image}.
+   */
   get runtime(): string | undefined;
+  /**
+   * Digest-pinned reference of the container image the sandbox was created
+   * from, when it was created from an image (`"{repository}@{manifestDigest}"`).
+   * Mutually exclusive with {@link Sandbox.runtime}.
+   */
+  get image(): string | undefined;
   /**
    * Cumulative egress bytes across all sessions.
    */
@@ -342,6 +358,10 @@ declare class Sandbox {
    * The default timeout of this sandbox in milliseconds.
    */
   get timeout(): number | undefined;
+  /**
+   * When the currently running session will time out.
+   */
+  get expiresAt(): Date | undefined;
   /**
    * Key-value tags attached to the sandbox.
    */
@@ -408,6 +428,7 @@ declare class Sandbox {
       vcpus?: number | undefined;
       memory?: number | undefined;
       runtime?: string | undefined;
+      image?: string | undefined;
       timeout?: number | undefined;
       networkPolicy?: {
         [x: string]: unknown;
@@ -499,6 +520,7 @@ declare class Sandbox {
       totalIngressBytes?: number | undefined;
       totalActiveCpuDurationMs?: number | undefined;
       totalDurationMs?: number | undefined;
+      expiresAt?: number | undefined;
       currentSnapshotId?: string | undefined;
       statusUpdatedAt?: number | undefined;
       cwd?: string | undefined;
@@ -867,6 +889,112 @@ declare class Sandbox {
   extendTimeout(duration: number, opts?: {
     signal?: AbortSignal;
   }): Promise<void>;
+  /**
+   * The user that non-`sudo` commands and the HTTP file API run as, together
+   * with that user's primary group. This depends on the sandbox image: stock
+   * runtimes default to `vercel-sandbox`, while Ubuntu-based images default to
+   * `root`. The multi-user helpers group-own home and shared directories by
+   * this user's group so the file API can traverse them, so we resolve it from
+   * the running sandbox rather than assuming a fixed name.
+   *
+   * The result is memoized for the lifetime of this instance.
+   *
+   * @internal
+   */
+  getDefaultUser(opts?: {
+    signal?: AbortSignal;
+  }): Promise<{
+    username: string;
+    group: string;
+  }>;
+  private resolveDefaultUser;
+  /**
+   * Create a new Linux user in this sandbox with an isolated home directory.
+   *
+   * The home directory is group-owned by the sandbox's default user group with
+   * `770` permissions, so the SDK's HTTP file API can read/write directly.
+   * Other users cannot access this user's home directory since they are not in
+   * that group.
+   *
+   * @param username - Linux username (lowercase letters, digits, hyphens, underscores)
+   * @param opts - Optional parameters.
+   * @param opts.signal - An AbortSignal to cancel the operation.
+   * @returns A {@link SandboxUser} instance for the created user.
+   *
+   * @example
+   * const alice = await sandbox.createUser("alice");
+   * await alice.runCommand("whoami"); // "alice"
+   * await alice.writeFiles([{ path: "hello.txt", content: Buffer.from("hi") }]);
+   */
+  createUser(username: string, opts?: {
+    signal?: AbortSignal;
+  }): Promise<SandboxUser>;
+  /**
+   * Get a user handle without creating the user.
+   * Assumes the user already exists in the sandbox.
+   *
+   * @param username - Linux username
+   * @returns A {@link SandboxUser} instance.
+   *
+   * @example
+   * const root = sandbox.asUser("root");
+   * await root.runCommand("whoami"); // "root"
+   */
+  asUser(username: "root" | (string & {})): SandboxUser;
+  /**
+   * Create a new Linux group with a shared directory.
+   *
+   * Creates a shared directory at `/shared/<groupname>` with setgid permissions
+   * (`2770`), so files created inside it automatically inherit the group.
+   * All group members can read and write files in the shared directory.
+   *
+   * @param groupname - Group name (lowercase letters, digits, hyphens, underscores)
+   * @param opts - Optional parameters.
+   * @param opts.signal - An AbortSignal to cancel the operation.
+   * @returns An object with the group name and shared directory path.
+   *
+   * @example
+   * const devs = await sandbox.createGroup("devs");
+   * console.log(devs.sharedDir); // "/shared/devs"
+   * await sandbox.addUserToGroup("alice", "devs");
+   */
+  createGroup(groupname: string, opts?: {
+    signal?: AbortSignal;
+  }): Promise<{
+    groupname: string;
+    sharedDir: string;
+  }>;
+  /**
+   * Add a user to a group.
+   *
+   * After joining, the user can read and write files in the group's
+   * shared directory at `/shared/<groupname>`.
+   *
+   * @param username - The user to add
+   * @param groupname - The group to add the user to
+   * @param opts - Optional parameters.
+   * @param opts.signal - An AbortSignal to cancel the operation.
+   *
+   * @example
+   * await sandbox.addUserToGroup("alice", "devs");
+   */
+  addUserToGroup(username: string, groupname: string, opts?: {
+    signal?: AbortSignal;
+  }): Promise<void>;
+  /**
+   * Remove a user from a group.
+   *
+   * @param username - The user to remove
+   * @param groupname - The group to remove the user from
+   * @param opts - Optional parameters.
+   * @param opts.signal - An AbortSignal to cancel the operation.
+   *
+   * @example
+   * await sandbox.removeUserFromGroup("alice", "devs");
+   */
+  removeUserFromGroup(username: string, groupname: string, opts?: {
+    signal?: AbortSignal;
+  }): Promise<void>;
   /**
    * Create a snapshot from this currently running sandbox. New sandboxes can
    * then be created from this snapshot using {@link Sandbox.createFromSnapshot}.
@@ -888,6 +1016,9 @@ declare class Sandbox {
    * When `ports` is provided, it is treated as the full desired port list:
    * any currently exposed port omitted from the array will be deregistered.
    *
+   * When `timeout` is increased and a session is currently running, the running
+   * session's deadline is also extended.
+   *
    * @param params - Fields to update.
    * @param opts - Optional abort signal.
    */

package/dist/src/compiled/@vercel/sandbox/session.d.ts

@@ -5,6 +5,7 @@ import "./api-client/index.js";
 import { Command, CommandFinished } from "./command.js";
 import { Snapshot } from "./snapshot.js";
 import { SandboxSnapshot } from "./utils/sandbox-snapshot.js";
+import { ExecutionContext } from "./execution-context.js";
 import { WORKFLOW_DESERIALIZE, WORKFLOW_SERIALIZE } from "./_workflow-serde.js";
 import { Writable } from "stream";
 
@@ -66,7 +67,7 @@ interface RunCommandParams {
  *
  * Obtain a session via {@link Sandbox.currentSession}.
  */
-declare class Session {
+declare class Session implements ExecutionContext {
   private _client;
   /**
    * Lazily resolve credentials and construct an API client.

package/dist/src/compiled/@vercel/sandbox/snapshot.d.ts

@@ -212,7 +212,7 @@ declare class Snapshot {
    * @param params - Get parameters and optional credentials.
    * @returns A promise resolving to the {@link Sandbox}.
    */
-  static get(params: GetSnapshotParams | (GetSnapshotParams & Credentials)): Promise<Snapshot>;
+  static get(params: (GetSnapshotParams | (GetSnapshotParams & Credentials)) & WithFetchOptions): Promise<Snapshot>;
   /**
    * Delete this snapshot.
    *

package/dist/src/compiled/@workflow/core/create-hook.d.ts

@@ -1,3 +1,4 @@
+import type { StringValue } from './_ms.js';
 import type { Run } from './runtime/run.js';
 import type { Serializable } from './schemas.js';
 /**
@@ -26,28 +27,16 @@ export interface Hook<T = any> extends AsyncIterable<T>, Thenable<T> {
      */
     token: string;
     /**
-     * Returns a promise that resolves with the conflicting {@link Run} if
-     * another active hook already owns this hook's token, or `null` once
-     * the hook has been registered and is ready to receive payloads.
+     * Returns the {@link Run} already using this token, or `null` when this Hook
+     * registers successfully.
      *
      * Calling `createHook()` alone does not register the hook — registration
      * only happens when the workflow suspends. Awaiting `getConflict()`
-     * suspends the workflow to commit the hook registration, so it can be
-     * used to claim the token (and detect token conflicts early) without
-     * waiting for payload data.
-     *
-     * When a conflict is detected, the resolved `Run` is the run that
-     * currently owns the token. The workflow can decide how to handle the
-     * duplicate in code: return or log `conflict.runId`, inspect
-     * `await conflict.status`, await `conflict.returnValue`, or cancel the
-     * owner with `await conflict.cancel()` and continue in the current run.
-     *
-     * Note that awaiting the hook's payload (`await hook`) when the token is
-     * already owned by another active hook still rejects with
-     * `HookConflictError`. In the rare case where the conflicting run cannot
-     * be identified (a `hook_conflict` event persisted by an old world that
-     * did not record the owning run's ID), `getConflict()` also rejects with
-     * `HookConflictError` rather than resolving with an incomplete value.
+     * suspends the workflow to commit the hook registration without waiting for
+     * payload data.
+     *
+     * If it returns a run, this Hook was not created. Awaiting the Hook instead
+     * rejects with `HookConflictError`.
      *
      * @example
      * ```ts
@@ -55,9 +44,9 @@ export interface Hook<T = any> extends AsyncIterable<T>, Thenable<T> {
      * const conflict = await hook.getConflict();
      * if (conflict) {
      *   // another run already owns this token
-     *   return { dedupedTo: conflict.runId };
+     *   return { status: 'duplicate', runId: conflict.runId };
      * }
-     * // token is now claimed, without waiting for payload data
+     * // this Hook registered without waiting for payload data
      * ```
      */
     getConflict(): Promise<Run<unknown> | null>;
@@ -137,6 +126,36 @@ export interface HookOptions {
      * ```
      */
     token?: string;
+    /**
+     * **Experimental.** Keeps this Hook's token unavailable for at least the
+     * configured time after `createHook()` runs.
+     *
+     * Accepts the same values as `sleep()`: a duration string, a number of
+     * milliseconds, or an absolute `Date`. Relative durations start when
+     * `createHook()` runs, not when the workflow ends.
+     *
+     * The Hook remains active until the workflow ends, even if the configured
+     * time passes first. Another Hook can use the token only after both the run
+     * has ended and the configured time has passed.
+     * After the run ends, the Hook can still be found with `getHookByToken()`
+     * until retention ends, but it cannot be resumed.
+     *
+     * Calling `dispose()` (including through `using`) releases the token
+     * immediately.
+     *
+     * `createHook()` throws if the configured World does not support this
+     * experimental option.
+     *
+     * @example
+     *
+     * ```ts
+     * const hook = createHook({
+     *   token: `order:${orderId}`,
+     *   experimental_minRetention: '30d',
+     * });
+     * ```
+     */
+    experimental_minRetention?: StringValue | Date | number;
     /**
      * Additional user-defined data to include with the hook payload.
      *
@@ -166,7 +185,7 @@ export interface HookOptions {
      */
     isWebhook?: boolean;
 }
-export interface WebhookOptions extends Omit<HookOptions, 'token' | 'isWebhook'> {
+export interface WebhookOptions extends Omit<HookOptions, 'token' | 'isWebhook' | 'experimental_minRetention'> {
     /**
      * If set to a `Response` object, the webhook will automatically
      * respond with the specified response.

package/dist/src/compiled/@workflow/core/flushable-stream.d.ts

@@ -1,4 +1,33 @@
 import { type PromiseWithResolvers } from './_workflow-utils.js';
+/**
+ * Flow-control knob: upper bound on chunks read-but-not-yet-durably-written
+ * while coalescing. Once this many chunks are outstanding the producer stops
+ * reading until the consumer drains a batch, so a fast producer paired with a
+ * slow server can't grow the in-memory queue without bound. Override:
+ * `WORKFLOW_STREAM_MAX_INFLIGHT_CHUNKS`.
+ *
+ * This is deliberately distinct from the per-request batch caps below: this
+ * bounds how much is *buffered*, those bound how much goes out in one
+ * `writeMulti`. Raising this must never let a single request exceed a wire
+ * limit — batch sizing enforces that independently.
+ */
+export declare const MAX_INFLIGHT_CHUNKS = 1000;
+/**
+ * Wire limit: maximum number of chunks in a single coalesced `writeMulti`.
+ * The server enforces a per-multi-write chunk cap (1,000 today); a batch is
+ * split at this bound so it can never be rejected wholesale, independently of
+ * the backpressure knob above. Override: `WORKFLOW_STREAM_MAX_CHUNKS_PER_BATCH`.
+ */
+export declare const MAX_CHUNKS_PER_BATCH = 1000;
+/**
+ * Wire limit: maximum cumulative bytes in a single coalesced `writeMulti`.
+ * Chunk *count* alone is not enough — 1,000 small chunks are ~100KB but 1,000
+ * file-sized chunks can be hundreds of MB, which platform request-body limits
+ * reject long before the count cap matters. A batch is split once adding the
+ * next chunk would exceed this (a single chunk larger than the cap still goes
+ * out alone). Default 1 MiB. Override: `WORKFLOW_STREAM_MAX_BYTES_PER_BATCH`.
+ */
+export declare const MAX_BYTES_PER_BATCH: number;
 /**
  * Polling interval (in ms) for lock release detection.
  *

package/dist/src/compiled/@workflow/core/global.d.ts

@@ -33,6 +33,8 @@ export interface HookInvocationQueueItem {
     type: 'hook';
     correlationId: string;
     token: string;
+    /** Earliest time the token can be reused after the run ends. */
+    tokenRetentionUntil?: Date;
     metadata?: Serializable;
     hasCreatedEvent?: boolean;
     /** Whether the workflow is awaiting `hook.getConflict()` for this hook */

package/dist/src/compiled/@workflow/core/index.js

@@ -1,2 +1,2 @@
-import{i as e,l as t}from"../../_chunks/workflow/dist-BYo8Gno2.js";import{An as n,B as r,D as i,Dn as a,Fn as o,In as s,Pn as c,T as l,V as u,_ as d,_n as f,gn as p,jn as m,kn as h,t as g,vn as _}from"../../_chunks/workflow/attribute-changes-CXiYB8h9.js";import"../../_chunks/workflow/dist-CSfKNxQW.js";import{n as v}from"../../_chunks/workflow/resume-hook-CHXbXuRZ.js";import{t as y}from"../../_chunks/workflow/sleep-BJAv0MFP.js";function b(e){o(`createHook()`,`https://workflow-sdk.dev/docs/api-reference/workflow/create-hook`,b)}function x(e){o(`createWebhook()`,`https://workflow-sdk.dev/docs/api-reference/workflow/create-webhook`,x)}function S({schema:e}={}){function t(e){o(`defineHook().create()`,`https://workflow-sdk.dev/docs/api-reference/workflow/define-hook`,t)}return{create:t,async resume(t,n){if(!e?.[`~standard`])return await v(t,n);let r=e[`~standard`].validate(n);if(r instanceof Promise&&(r=await r),r.issues){let e=r.issues.map(e=>{let t=e.path?.map(e=>String(typeof e==`object`&&e?e.key:e)).join(`.`);return t?`  at "${t}": ${e.message}`:`  ${e.message}`});throw Error(`Hook payload did not match the defined schema:\n${e.join(`
-`)}`)}return await v(t,r.value)}}}async function C(t,n={}){let r=u.getStore(),i=r?.workflowMetadata?.workflowRunId;if(!i)throw new e(`setAttributes() must be called from a 'use workflow' or 'use step' function. Calling it from plain host code is not supported.`);let o=g(t,n);if(o.length!==0){if(r.runReadyBarrier)try{await r.runReadyBarrier}catch{}await(await a()).events.create(i,{eventType:`attr_set`,specVersion:5,eventData:{changes:o,writer:{type:`step`,stepId:r.stepMetadata.stepId,attempt:r.stepMetadata.attempt},...n.allowReservedAttributes===!0?{allowReservedAttributes:!0}:{}}})}}const w=C;function T(){let e=u.getStore();return e||c(`getStepMetadata()`,`https://workflow-sdk.dev/docs/api-reference/workflow/get-step-metadata`,T),e.stepMetadata}function E(){let e=u.getStore();return e||s(`getWorkflowMetadata()`,`https://workflow-sdk.dev/docs/api-reference/workflow/get-workflow-metadata`,E),e.workflowMetadata}function D(e={}){let t=u.getStore();t||s(`getWritable()`,`https://workflow-sdk.dev/docs/api-reference/workflow/get-writable`,D);let{namespace:a}=e,o=t.workflowMetadata.workflowRunId,c=r(o,a),g=t.writables??=new Map,v=g.get(c);if(v)return v.writable;let y=i(l(globalThis,t.ops,o,t.encryptionKey,!0,t.runReadyBarrier),t.encryptionKey),b=new d(o,c,t.runReadyBarrier),x=h();return t.ops.push(x.promise),n(y.readable,b,x).catch(()=>{}),m(y.writable,x),Object.defineProperty(y.writable,p,{value:c,writable:!1}),Object.defineProperty(y.writable,_,{value:o,writable:!1}),t.workflowDeploymentId&&Object.defineProperty(y.writable,f,{value:t.workflowDeploymentId,writable:!1}),g.set(c,{writable:y.writable,state:x}),y.writable}export{e as FatalError,t as RetryableError,b as createHook,x as createWebhook,S as defineHook,w as experimental_setAttributes,T as getStepMetadata,E as getWorkflowMetadata,D as getWritable,C as setAttributes,y as sleep};
+import{i as e,u as t}from"../../_chunks/workflow/dist-B3qkUnLJ.js";import{Dn as n,E as r,En as i,H as a,In as o,Ln as s,O as c,Rn as l,Sn as u,Tn as d,U as f,bn as p,t as m,v as h,vn as g,xn as _}from"../../_chunks/workflow/attribute-changes-Dk1fP6vt.js";import"../../_chunks/workflow/dist-BX517Nmz.js";import{n as v}from"../../_chunks/workflow/resume-hook-czpG5xnP.js";import{t as y}from"../../_chunks/workflow/sleep-B2u06FWc.js";function b(e){s(`createHook()`,`https://workflow-sdk.dev/docs/api-reference/workflow/create-hook`,b)}function x(e){s(`createWebhook()`,`https://workflow-sdk.dev/docs/api-reference/workflow/create-webhook`,x)}function S({schema:e}={}){function t(e){s(`defineHook().create()`,`https://workflow-sdk.dev/docs/api-reference/workflow/define-hook`,t)}return{create:t,async resume(t,n){if(!e?.[`~standard`])return await v(t,n);let r=e[`~standard`].validate(n);if(r instanceof Promise&&(r=await r),r.issues){let e=r.issues.map(e=>{let t=e.path?.map(e=>String(typeof e==`object`&&e?e.key:e)).join(`.`);return t?`  at "${t}": ${e.message}`:`  ${e.message}`});throw Error(`Hook payload did not match the defined schema:\n${e.join(`
+`)}`)}return await v(t,r.value)}}}async function C(t,n={}){let r=f.getStore(),i=r?.workflowMetadata?.workflowRunId;if(!i)throw new e(`setAttributes() must be called from a 'use workflow' or 'use step' function. Calling it from plain host code is not supported.`);let a=m(t,n);if(a.length!==0){if(r.runReadyBarrier)try{await r.runReadyBarrier}catch{}await(await g()).events.create(i,{eventType:`attr_set`,specVersion:5,eventData:{changes:a,writer:{type:`step`,stepId:r.stepMetadata.stepId,attempt:r.stepMetadata.attempt},...n.allowReservedAttributes===!0?{allowReservedAttributes:!0}:{}}})}}const w=C;function T(){let e=f.getStore();return e||o(`getStepMetadata()`,`https://workflow-sdk.dev/docs/api-reference/workflow/get-step-metadata`,T),e.stepMetadata}function E(){let e=f.getStore();return e||l(`getWorkflowMetadata()`,`https://workflow-sdk.dev/docs/api-reference/workflow/get-workflow-metadata`,E),e.workflowMetadata}function D(e={}){let t=f.getStore();t||l(`getWritable()`,`https://workflow-sdk.dev/docs/api-reference/workflow/get-writable`,D);let{namespace:o}=e,s=t.workflowMetadata.workflowRunId,m=a(s,o),g=t.writables??=new Map,v=g.get(m);if(v)return v.writable;let y=c(r(globalThis,t.ops,s,t.encryptionKey,!0,t.runReadyBarrier),t.encryptionKey),b=new h(s,m,t.runReadyBarrier),x=p();return t.ops.push(x.promise),_(y.readable,b,x).catch(()=>{}),u(y.writable,x),Object.defineProperty(y.writable,d,{value:m,writable:!1}),Object.defineProperty(y.writable,n,{value:s,writable:!1}),t.workflowDeploymentId&&Object.defineProperty(y.writable,i,{value:t.workflowDeploymentId,writable:!1}),g.set(m,{writable:y.writable,state:x}),y.writable}export{e as FatalError,t as RetryableError,b as createHook,x as createWebhook,S as defineHook,w as experimental_setAttributes,T as getStepMetadata,E as getWorkflowMetadata,D as getWritable,C as setAttributes,y as sleep};