@cargo-ai/cdk 0.1.1

package/build/src/deploy/readers.live.js

@@ -0,0 +1,273 @@
+// Live readers — bind the refresh engine's `LiveReaders` to @cargo-ai/api. Each
+// reader fetches a deployed resource by its state uuid and projects its
+// user-editable config into a fingerprint, so `refresh` can compare it against
+// the fingerprint captured at the last apply and flag out-of-band changes.
+//
+// A reader returns { exists:false } ONLY on a confirmed not-found; any other
+// error propagates so detectDrift records "unknown" rather than a false deletion.
+import { fingerprint } from "./refresh.js";
+const GONE = { exists: false };
+// Keys stripped anywhere in a projection before hashing: per-resource volatile
+// ids and canvas coordinates that change without being user edits.
+const VOLATILE = new Set([
+    "temporalScheduleWorkflowId",
+    "temporalWorkflowId",
+    "position",
+    "createdAt",
+    "updatedAt",
+    "deletedAt",
+]);
+function deepOmit(value) {
+    if (Array.isArray(value))
+        return value.map(deepOmit);
+    if (value !== null && typeof value === "object") {
+        const out = {};
+        for (const [key, inner] of Object.entries(value)) {
+            if (VOLATILE.has(key))
+                continue;
+            out[key] = deepOmit(inner);
+        }
+        return out;
+    }
+    return value;
+}
+function present(config) {
+    return { exists: true, fingerprint: fingerprint(deepOmit(config)) };
+}
+function isNotFound(error) {
+    const reason = error.reason;
+    if (typeof reason === "string" && /notfound/i.test(reason))
+        return true;
+    const message = error instanceof Error ? error.message : String(error);
+    return /not found/i.test(message);
+}
+// Re-throw unless it's a not-found, in which case the caller treats it as gone.
+function goneOrThrow(error) {
+    if (isNotFound(error))
+        return GONE;
+    throw error;
+}
+const pick = (o, keys) => {
+    const out = {};
+    for (const key of keys)
+        out[key] = o[key];
+    return out;
+};
+export function liveReaders(api) {
+    // The deployed AI release holds an agent's behaviour config; returns null when
+    // nothing is deployed yet.
+    async function agentRelease(agentUuid) {
+        try {
+            const { release } = await api.ai.release.getDeployed({ agentUuid });
+            return pick(release, [
+                "systemPrompt",
+                "languageModelSlug",
+                "integrationSlug",
+                "connectorUuid",
+                "withReasoning",
+                "temperature",
+                "maxSteps",
+                "actions",
+                "resources",
+                "capabilities",
+                "mcpClients",
+                "output",
+                "heartbeat",
+                "evaluator",
+            ]);
+        }
+        catch (error) {
+            if (isNotFound(error))
+                return null;
+            throw error;
+        }
+    }
+    // The deployed orchestration release holds a play/tool's workflow graph.
+    async function workflowNodes(workflowUuid) {
+        if (workflowUuid === undefined)
+            return null;
+        try {
+            const { release } = await api.orchestration.release.getDeployed({
+                workflowUuid,
+            });
+            return {
+                nodes: release["nodes"],
+                formFields: release["formFields"],
+            };
+        }
+        catch (error) {
+            if (isNotFound(error))
+                return null;
+            throw error;
+        }
+    }
+    return {
+        async connector(entry) {
+            try {
+                const { connector } = await api.connection.connector.get({
+                    uuid: entry.uuid,
+                });
+                return present(pick(connector, [
+                    "name",
+                    "slug",
+                    "integrationSlug",
+                    "config",
+                    "useCredits",
+                    "rateLimit",
+                    "cacheTtlMilliseconds",
+                ]));
+            }
+            catch (error) {
+                return goneOrThrow(error);
+            }
+        },
+        async model(entry) {
+            try {
+                const { model } = await api.storage.model.get(entry.uuid);
+                return present(pick(model, [
+                    "name",
+                    "slug",
+                    "description",
+                    "extractorSlug",
+                    "config",
+                    "schedule",
+                    "unification",
+                    "folderUuid",
+                    "kind",
+                    "connectorUuid",
+                ]));
+            }
+            catch (error) {
+                return goneOrThrow(error);
+            }
+        },
+        async agent(entry) {
+            let row;
+            try {
+                const { agent } = await api.ai.agent.get(entry.uuid);
+                row = pick(agent, [
+                    "name",
+                    "icon",
+                    "description",
+                    "triggers",
+                    "folderUuid",
+                ]);
+            }
+            catch (error) {
+                return goneOrThrow(error);
+            }
+            return present({ row, release: await agentRelease(entry.uuid) });
+        },
+        async play(entry) {
+            const { plays } = await api.orchestration.play.list();
+            const play = plays.find((p) => p["uuid"] === entry.uuid);
+            if (play === undefined)
+                return GONE;
+            const row = pick(play, [
+                "name",
+                "description",
+                "isEnabled",
+                "modelUuid",
+                "changeKinds",
+                "runCreationRule",
+                "schedule",
+                "folderUuid",
+            ]);
+            const wf = entry.outputs["workflowUuid"];
+            return present({ row, workflow: await workflowNodes(wf) });
+        },
+        async tool(entry) {
+            const { tools } = await api.orchestration.tool.all();
+            const tool = tools.find((t) => t["uuid"] === entry.uuid);
+            if (tool === undefined)
+                return GONE;
+            const row = pick(tool, [
+                "name",
+                "icon",
+                "description",
+                "triggers",
+                "publicForm",
+                "folderUuid",
+            ]);
+            const wf = entry.outputs["workflowUuid"];
+            return present({ row, workflow: await workflowNodes(wf) });
+        },
+        async mcpServer(entry) {
+            try {
+                const { mcpServer } = await api.ai.mcpServer.get(entry.uuid);
+                return present(pick(mcpServer, [
+                    "name",
+                    "description",
+                    "actions",
+                    "resources",
+                    "folderUuid",
+                ]));
+            }
+            catch (error) {
+                return goneOrThrow(error);
+            }
+        },
+        async folder(entry) {
+            try {
+                const { folder } = await api.workspaceManagement.folder.get(entry.uuid);
+                // Only fingerprint what the folder executor can actually reconcile
+                // (name + emojiSlug); kind/parentUuid aren't updatable from the CDK, so
+                // including them would flag drift that can never converge.
+                return present(pick(folder, ["name", "emojiSlug"]));
+            }
+            catch (error) {
+                return goneOrThrow(error);
+            }
+        },
+        async file(entry) {
+            try {
+                const { file } = await api.content.file.get(entry.uuid);
+                return present(pick(file, ["name", "folderUuid"]));
+            }
+            catch (error) {
+                return goneOrThrow(error);
+            }
+        },
+        async worker(entry) {
+            try {
+                const { worker } = await api.hosting.worker.get(entry.uuid);
+                const w = worker;
+                const promoted = w["promotedDeployment"];
+                const meta = promoted === null || promoted === undefined
+                    ? undefined
+                    : promoted["meta"];
+                return present({
+                    ...pick(w, ["name", "description", "slug", "folderUuid"]),
+                    bundle: meta === undefined ? undefined : meta["bundleSha256"],
+                    outboundAllowlist: meta === undefined ? undefined : meta["outboundAllowlist"],
+                });
+            }
+            catch (error) {
+                return goneOrThrow(error);
+            }
+        },
+        async app(entry) {
+            try {
+                const { app } = await api.hosting.app.get(entry.uuid);
+                const a = app;
+                const promoted = a["promotedDeployment"];
+                return present({
+                    ...pick(a, ["name", "description", "slug", "folderUuid"]),
+                    // app deployments carry no bundle hash — the promoted deployment uuid
+                    // is the only "what's deployed" marker.
+                    promoted: promoted === null || promoted === undefined
+                        ? undefined
+                        : promoted["uuid"],
+                });
+            }
+            catch (error) {
+                return goneOrThrow(error);
+            }
+        },
+        // Context is a repo of files (not a uuid resource) — no live fingerprint, so
+        // refresh reports it "unknown" rather than fabricating drift.
+        async context(_entry) {
+            return present({});
+        },
+    };
+}

package/build/src/deploy/refresh.d.ts

@@ -0,0 +1,32 @@
+import type { ResourceKind } from "../core.js";
+import type { State, StateEntry } from "./compile.js";
+export type LiveRead = {
+    exists: boolean;
+    fingerprint?: string;
+};
+export type LiveReader = (entry: StateEntry) => Promise<LiveRead>;
+export type LiveReaders = Record<ResourceKind, LiveReader>;
+export type DriftStatus = "unchanged" | "modified" | "deleted" | "unknown";
+export type DriftEntry = {
+    id: string;
+    kind: ResourceKind;
+    status: DriftStatus;
+};
+/** Hash an arbitrary projection of a resource into a comparable fingerprint. */
+export declare function fingerprint(value: unknown): string;
+/**
+ * Read every state-tracked resource live and classify drift:
+ * - deleted   — gone from the workspace (re-deploy would recreate it)
+ * - modified  — its live fingerprint differs from the one captured at apply
+ * - unchanged — live matches the last apply
+ * - unknown   — no baseline fingerprint, or the kind has no live reader
+ */
+export declare function detectDrift(state: State, readers: LiveReaders): Promise<DriftEntry[]>;
+/**
+ * Return a copy of `state` adjusted so the next compile re-applies drifted
+ * resources: a `modified` resource gets its code-hash invalidated (→ update,
+ * overwriting the out-of-band edit); a `deleted` one is dropped (→ create).
+ * `unchanged`/`unknown` are left as-is.
+ */
+export declare function reconcileDrift(state: State, drift: DriftEntry[]): State;
+//# sourceMappingURL=refresh.d.ts.map

package/build/src/deploy/refresh.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"refresh.d.ts","sourceRoot":"","sources":["../../../src/deploy/refresh.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC/C,OAAO,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAKtD,MAAM,MAAM,QAAQ,GAAG;IAAE,MAAM,EAAE,OAAO,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAKjE,MAAM,MAAM,UAAU,GAAG,CAAC,KAAK,EAAE,UAAU,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;AAClE,MAAM,MAAM,WAAW,GAAG,MAAM,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC;AAE3D,MAAM,MAAM,WAAW,GAAG,WAAW,GAAG,UAAU,GAAG,SAAS,GAAG,SAAS,CAAC;AAE3E,MAAM,MAAM,UAAU,GAAG;IACvB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,YAAY,CAAC;IACnB,MAAM,EAAE,WAAW,CAAC;CACrB,CAAC;AAEF,gFAAgF;AAChF,wBAAgB,WAAW,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAQlD;AAMD;;;;;;GAMG;AACH,wBAAsB,WAAW,CAC/B,KAAK,EAAE,KAAK,EACZ,OAAO,EAAE,WAAW,GACnB,OAAO,CAAC,UAAU,EAAE,CAAC,CA4BvB;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,KAAK,CAavE"}

package/build/src/deploy/refresh.js

@@ -0,0 +1,76 @@
+// Out-of-band drift detection. The deploy engine only compares code against the
+// committed state, so a resource edited or deleted directly in the Cargo UI goes
+// unnoticed. `refresh` re-reads each state-tracked resource through a per-kind
+// LiveReader and compares a fingerprint of its live config against the one
+// captured at the last apply (StateEntry.live) — surfacing changes the CDK
+// didn't make.
+import { createHash } from "node:crypto";
+/** Hash an arbitrary projection of a resource into a comparable fingerprint. */
+export function fingerprint(value) {
+    return ("fp:" +
+        createHash("sha256")
+            .update(JSON.stringify(value))
+            .digest("hex")
+            .slice(0, 16));
+}
+function kindOf(id) {
+    return id.slice(0, id.indexOf(":"));
+}
+/**
+ * Read every state-tracked resource live and classify drift:
+ * - deleted   — gone from the workspace (re-deploy would recreate it)
+ * - modified  — its live fingerprint differs from the one captured at apply
+ * - unchanged — live matches the last apply
+ * - unknown   — no baseline fingerprint, or the kind has no live reader
+ */
+export async function detectDrift(state, readers) {
+    const drift = [];
+    for (const [id, entry] of Object.entries(state.resources)) {
+        const kind = kindOf(id);
+        const reader = readers[kind];
+        // A read error (network, auth, unexpected) must NOT look like a deletion —
+        // record it as "unknown" so `deploy --refresh` never mass-recreates on a
+        // transient failure.
+        let live;
+        try {
+            live = reader === undefined ? { exists: true } : await reader(entry);
+        }
+        catch {
+            drift.push({ id, kind, status: "unknown" });
+            continue;
+        }
+        let status;
+        if (!live.exists) {
+            status = "deleted";
+        }
+        else if (entry.live === undefined || live.fingerprint === undefined) {
+            status = "unknown";
+        }
+        else {
+            status = live.fingerprint === entry.live ? "unchanged" : "modified";
+        }
+        drift.push({ id, kind, status });
+    }
+    return drift;
+}
+/**
+ * Return a copy of `state` adjusted so the next compile re-applies drifted
+ * resources: a `modified` resource gets its code-hash invalidated (→ update,
+ * overwriting the out-of-band edit); a `deleted` one is dropped (→ create).
+ * `unchanged`/`unknown` are left as-is.
+ */
+export function reconcileDrift(state, drift) {
+    const resources = { ...state.resources };
+    for (const entry of drift) {
+        if (entry.status === "deleted") {
+            delete resources[entry.id];
+        }
+        else if (entry.status === "modified") {
+            const prior = resources[entry.id];
+            if (prior !== undefined) {
+                resources[entry.id] = { ...prior, hash: "drifted" };
+            }
+        }
+    }
+    return { ...state, resources };
+}

package/build/src/deploy/state.d.ts

@@ -0,0 +1,23 @@
+import type { State } from "./compile.js";
+/**
+ * Snapshot the current cargo.state.json to cargo.state.bak.json before a
+ * mutating command, so `cdk rollback` can restore the prior state. No-op when no
+ * state exists yet (first deploy). Returns whether a snapshot was taken.
+ */
+export declare function snapshotState(root: string): boolean;
+/**
+ * Restore the snapshot taken before the last mutating command. Returns whether a
+ * backup existed to restore.
+ */
+export declare function restoreSnapshot(root: string): boolean;
+/** Read a repo's cargo.state.json, or undefined on the first deploy. */
+export declare function readState(root: string): State | undefined;
+/** Write cargo.state.json — pretty-printed + trailing newline (it's committed).
+ * Writes to a per-process temp file, fsyncs it, then atomically renames over the
+ * target and fsyncs the directory — so a crash or power loss mid-write can't
+ * truncate the committed state (which would orphan every uuid-only resource),
+ * and two concurrent writers can't clobber a shared temp file. */
+export declare function writeState(root: string, state: State): void;
+/** A fresh, empty state bound to a workspace (used on the first deploy). */
+export declare function emptyState(workspaceUuid: string): State;
+//# sourceMappingURL=state.d.ts.map

package/build/src/deploy/state.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"state.d.ts","sourceRoot":"","sources":["../../../src/deploy/state.ts"],"names":[],"mappings":"AAyBA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,cAAc,CAAC;AAgB1C;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAKnD;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAKrD;AAED,wEAAwE;AACxE,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,KAAK,GAAG,SAAS,CAIzD;AAED;;;;kEAIkE;AAClE,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,GAAG,IAAI,CAuB3D;AAkBD,4EAA4E;AAC5E,wBAAgB,UAAU,CAAC,aAAa,EAAE,MAAM,GAAG,KAAK,CAEvD"}

package/build/src/deploy/state.js

@@ -0,0 +1,107 @@
+// Deploy state — the committed `cargo.state.json`. It maps each code resource
+// ("kind:slug") to the real uuid Cargo assigned it, plus that resource's outputs
+// and the content hash of the spec that produced it.
+//
+// State is the authoritative link from code to deployed infra. For connector and
+// model it is rebuildable (their slug is addressable via exists-by-slug + list);
+// for play and agent — which have NO slug and non-unique names — the stored uuid
+// is the ONLY way to re-find the resource, so a lost entry orphans it. The file
+// is committed, so it is written pretty-printed for clean diffs, and it stores
+// only uuids/hashes/outputs — never secret values.
+import { randomBytes } from "node:crypto";
+import { closeSync, copyFileSync, existsSync, fsyncSync, openSync, readFileSync, renameSync, unlinkSync, writeFileSync, } from "node:fs";
+import { dirname, isAbsolute, join, resolve } from "node:path";
+const STATE_VERSION = 1;
+const STATE_FILE = "cargo.state.json";
+const BACKUP_FILE = "cargo.state.bak.json";
+function statePath(root) {
+    const rootDir = isAbsolute(root) ? root : resolve(process.cwd(), root);
+    return join(rootDir, STATE_FILE);
+}
+function backupPath(root) {
+    const rootDir = isAbsolute(root) ? root : resolve(process.cwd(), root);
+    return join(rootDir, BACKUP_FILE);
+}
+/**
+ * Snapshot the current cargo.state.json to cargo.state.bak.json before a
+ * mutating command, so `cdk rollback` can restore the prior state. No-op when no
+ * state exists yet (first deploy). Returns whether a snapshot was taken.
+ */
+export function snapshotState(root) {
+    const path = statePath(root);
+    if (!existsSync(path))
+        return false;
+    copyFileSync(path, backupPath(root));
+    return true;
+}
+/**
+ * Restore the snapshot taken before the last mutating command. Returns whether a
+ * backup existed to restore.
+ */
+export function restoreSnapshot(root) {
+    const backup = backupPath(root);
+    if (!existsSync(backup))
+        return false;
+    copyFileSync(backup, statePath(root));
+    return true;
+}
+/** Read a repo's cargo.state.json, or undefined on the first deploy. */
+export function readState(root) {
+    const path = statePath(root);
+    if (!existsSync(path))
+        return undefined;
+    return JSON.parse(readFileSync(path, "utf8"));
+}
+/** Write cargo.state.json — pretty-printed + trailing newline (it's committed).
+ * Writes to a per-process temp file, fsyncs it, then atomically renames over the
+ * target and fsyncs the directory — so a crash or power loss mid-write can't
+ * truncate the committed state (which would orphan every uuid-only resource),
+ * and two concurrent writers can't clobber a shared temp file. */
+export function writeState(root, state) {
+    const path = statePath(root);
+    // Unique per process (+ random) so a racing writer never shares this temp.
+    const tmp = `${path}.${String(process.pid)}.${randomBytes(4).toString("hex")}.tmp`;
+    const data = `${JSON.stringify(state, null, 2)}\n`;
+    try {
+        const fd = openSync(tmp, "w");
+        try {
+            writeFileSync(fd, data);
+            fsyncSync(fd); // flush file data before the rename makes it visible
+        }
+        finally {
+            closeSync(fd);
+        }
+        renameSync(tmp, path);
+    }
+    catch (error) {
+        try {
+            unlinkSync(tmp);
+        }
+        catch {
+            // temp may not exist if openSync failed — nothing to clean up
+        }
+        throw error;
+    }
+    fsyncDir(dirname(path)); // make the rename itself durable
+}
+// Best-effort directory fsync — durably commits the rename. Some platforms
+// (notably Windows) don't permit fsync on a directory handle; there the data
+// fsync + atomic rename already prevent a truncated/partial state file.
+function fsyncDir(dir) {
+    try {
+        const fd = openSync(dir, "r");
+        try {
+            fsyncSync(fd);
+        }
+        finally {
+            closeSync(fd);
+        }
+    }
+    catch {
+        // directory fsync unsupported — acceptable
+    }
+}
+/** A fresh, empty state bound to a workspace (used on the first deploy). */
+export function emptyState(workspaceUuid) {
+    return { version: STATE_VERSION, workspaceUuid, resources: {} };
+}

package/build/src/index.d.ts

@@ -0,0 +1,30 @@
+export type { ActionOptions, AgentHandle, AgentSpec, AgentUse, ConnectorActionSpec, ModelOptions, ModelUse, ToolUse, } from "./resources/agent.js";
+export { defineAgent } from "./resources/agent.js";
+export type { AppHandle, AppSpec } from "./resources/app.js";
+export { defineApp } from "./resources/app.js";
+export type { ConnectorConfigs, ConnectorHandle, ConnectorSpec, } from "./resources/connector.js";
+export { defineConnector } from "./resources/connector.js";
+export type { ContextHandle, ContextSpec } from "./resources/context.js";
+export { defineContext } from "./resources/context.js";
+export type { FileHandle, FileSpec } from "./resources/file.js";
+export { defineFile } from "./resources/file.js";
+export type { FolderHandle, FolderKind, FolderSpec, } from "./resources/folder.js";
+export { defineFolder } from "./resources/folder.js";
+export type { McpServerHandle, McpServerSpec } from "./resources/mcpServer.js";
+export { defineMcpServer } from "./resources/mcpServer.js";
+export type { ExtractorConfigs, ModelHandle, ModelSpec, } from "./resources/model.js";
+export { defineModel } from "./resources/model.js";
+export type { PlayHandle, PlaySpec } from "./resources/play.js";
+export { definePlay } from "./resources/play.js";
+export type { ToolHandle, ToolSpec, ToolTriggerSpec, WorkflowDefinition, } from "./resources/tool.js";
+export { defineTool } from "./resources/tool.js";
+export type { WorkerHandle, WorkerSpec } from "./resources/worker.js";
+export { defineWorker } from "./resources/worker.js";
+export { createWorker, OpenAPIRoute } from "@cargo-ai/worker-sdk";
+export { agentRef, defineWorkflow, toolRef, type WorkflowResourceRef, } from "@cargo-ai/workflow-sdk";
+export type { EncryptionRef, ResourceKind, ResourceNode, SecretRef, Token, } from "./core.js";
+export { env, isSecret, isToken, resolveSecrets, secret, token, } from "./core.js";
+export type { AgentRef, ConnectorRef, DatasetRef, FolderRef, ModelRef, PlayRef, ResourceRef, ToolRef, } from "./refs.js";
+export { connectorRef, datasetRef, folderRef, modelRef, playRef, refUuid, } from "./refs.js";
+export * from "./deploy/index.js";
+//# sourceMappingURL=index.d.ts.map

package/build/src/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAUA,YAAY,EACV,aAAa,EACb,WAAW,EACX,SAAS,EACT,QAAQ,EACR,mBAAmB,EACnB,YAAY,EACZ,QAAQ,EACR,OAAO,GACR,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACnD,YAAY,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAC7D,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,YAAY,EACV,gBAAgB,EAChB,eAAe,EACf,aAAa,GACd,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAC3D,YAAY,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACzE,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AACvD,YAAY,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAChE,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AACjD,YAAY,EACV,YAAY,EACZ,UAAU,EACV,UAAU,GACX,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACrD,YAAY,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAC/E,OAAO,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAC3D,YAAY,EACV,gBAAgB,EAChB,WAAW,EACX,SAAS,GACV,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACnD,YAAY,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAChE,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AACjD,YAAY,EACV,UAAU,EACV,QAAQ,EACR,eAAe,EACf,kBAAkB,GACnB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AACjD,YAAY,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AACtE,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACrD,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAMlE,OAAO,EACL,QAAQ,EACR,cAAc,EACd,OAAO,EACP,KAAK,mBAAmB,GACzB,MAAM,wBAAwB,CAAC;AAGhC,YAAY,EACV,aAAa,EACb,YAAY,EACZ,YAAY,EACZ,SAAS,EACT,KAAK,GACN,MAAM,WAAW,CAAC;AACnB,OAAO,EACL,GAAG,EACH,QAAQ,EACR,OAAO,EACP,cAAc,EACd,MAAM,EACN,KAAK,GACN,MAAM,WAAW,CAAC;AAGnB,YAAY,EACV,QAAQ,EACR,YAAY,EACZ,UAAU,EACV,SAAS,EACT,QAAQ,EACR,OAAO,EACP,WAAW,EACX,OAAO,GACR,MAAM,WAAW,CAAC;AACnB,OAAO,EACL,YAAY,EACZ,UAAU,EACV,SAAS,EACT,QAAQ,EACR,OAAO,EACP,OAAO,GACR,MAAM,WAAW,CAAC;AAGnB,cAAc,mBAAmB,CAAC"}

package/build/src/index.js

@@ -0,0 +1,30 @@
+// @cargo-ai/cdk
+//
+// The Cargo framework: one package, one import, to DEFINE every Cargo resource
+// and to DEPLOY it. `define*` registers a resource and returns a handle whose
+// outputs are deferred tokens; wire resources by passing handles (`defineModel(
+// "c", { datasetUuid: connector.datasetUuid })`). `plan`/`apply`/`deploy`
+// reconcile the graph. The heavier, independently-published workflow + worker
+// SDKs are re-exported so they're reachable from the same import.
+export { defineAgent } from "./resources/agent.js";
+export { defineApp } from "./resources/app.js";
+export { defineConnector } from "./resources/connector.js";
+export { defineContext } from "./resources/context.js";
+export { defineFile } from "./resources/file.js";
+export { defineFolder } from "./resources/folder.js";
+export { defineMcpServer } from "./resources/mcpServer.js";
+export { defineModel } from "./resources/model.js";
+export { definePlay } from "./resources/play.js";
+export { defineTool } from "./resources/tool.js";
+export { defineWorker } from "./resources/worker.js";
+export { createWorker, OpenAPIRoute } from "@cargo-ai/worker-sdk";
+// The workflow-authoring surface a CDK user needs, re-exported so `@cargo-ai/cdk`
+// is the only import: `defineWorkflow` for tool/play bodies, and `toolRef` /
+// `agentRef` (+ their `WorkflowResourceRef` type) to reference a tool or agent by
+// literal uuid inside a body's `uses` map. The lower-level wire-format/codegen
+// types stay in `@cargo-ai/workflow-sdk`.
+export { agentRef, defineWorkflow, toolRef, } from "@cargo-ai/workflow-sdk";
+export { env, isSecret, isToken, resolveSecrets, secret, token, } from "./core.js";
+export { connectorRef, datasetRef, folderRef, modelRef, playRef, refUuid, } from "./refs.js";
+// ── deployment: plan + apply ─────────────────────────────────────────────────
+export * from "./deploy/index.js";

package/build/src/refs.d.ts

@@ -0,0 +1,28 @@
+import type { Token } from "./core.js";
+export type ResourceKindRef = "connector" | "dataset" | "model" | "folder" | "play" | "tool" | "agent";
+export type ResourceRef<K extends ResourceKindRef = ResourceKindRef> = {
+    readonly uuid: Token | string;
+    readonly resource: K;
+};
+export type ConnectorRef = ResourceRef<"connector">;
+export type DatasetRef = ResourceRef<"dataset">;
+export type ModelRef = ResourceRef<"model">;
+export type FolderRef = ResourceRef<"folder">;
+export type PlayRef = ResourceRef<"play">;
+export type ToolRef = ResourceRef<"tool">;
+export type AgentRef = ResourceRef<"agent">;
+/** Reference a connector by uuid (e.g. an adopted OAuth connector). */
+export declare const connectorRef: (uuid: string) => ConnectorRef;
+/** Reference a connector's auto-created dataset by uuid, for `defineModel`. */
+export declare const datasetRef: (uuid: string) => DatasetRef;
+/** Reference a data model by uuid. */
+export declare const modelRef: (uuid: string) => ModelRef;
+/** Reference a folder by uuid. */
+export declare const folderRef: (uuid: string) => FolderRef;
+/** Reference a play by uuid (e.g. a `dependency` schedule's upstream play). */
+export declare const playRef: (uuid: string) => PlayRef;
+/** Extract the uuid from a handle or ref (both carry `uuid`). */
+export declare const refUuid: (ref: {
+    uuid: Token | string;
+}) => Token | string;
+//# sourceMappingURL=refs.d.ts.map

package/build/src/refs.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"refs.d.ts","sourceRoot":"","sources":["../../src/refs.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,WAAW,CAAC;AAEvC,MAAM,MAAM,eAAe,GACvB,WAAW,GACX,SAAS,GACT,OAAO,GACP,QAAQ,GACR,MAAM,GACN,MAAM,GACN,OAAO,CAAC;AAEZ,MAAM,MAAM,WAAW,CAAC,CAAC,SAAS,eAAe,GAAG,eAAe,IAAI;IACrE,QAAQ,CAAC,IAAI,EAAE,KAAK,GAAG,MAAM,CAAC;IAC9B,QAAQ,CAAC,QAAQ,EAAE,CAAC,CAAC;CACtB,CAAC;AAEF,MAAM,MAAM,YAAY,GAAG,WAAW,CAAC,WAAW,CAAC,CAAC;AACpD,MAAM,MAAM,UAAU,GAAG,WAAW,CAAC,SAAS,CAAC,CAAC;AAChD,MAAM,MAAM,QAAQ,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;AAC5C,MAAM,MAAM,SAAS,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAC;AAC9C,MAAM,MAAM,OAAO,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC;AAC1C,MAAM,MAAM,OAAO,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC;AAC1C,MAAM,MAAM,QAAQ,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;AAE5C,uEAAuE;AACvE,eAAO,MAAM,YAAY,SAAU,MAAM,KAAG,YAG1C,CAAC;AACH,+EAA+E;AAC/E,eAAO,MAAM,UAAU,SAAU,MAAM,KAAG,UAGxC,CAAC;AACH,sCAAsC;AACtC,eAAO,MAAM,QAAQ,SAAU,MAAM,KAAG,QAGtC,CAAC;AACH,kCAAkC;AAClC,eAAO,MAAM,SAAS,SAAU,MAAM,KAAG,SAGvC,CAAC;AACH,+EAA+E;AAC/E,eAAO,MAAM,OAAO,SAAU,MAAM,KAAG,OAAuC,CAAC;AAK/E,iEAAiE;AACjE,eAAO,MAAM,OAAO,QAAS;IAAE,IAAI,EAAE,KAAK,GAAG,MAAM,CAAA;CAAE,KAAG,KAAK,GAAG,MACtD,CAAC"}

package/build/src/refs.js

@@ -0,0 +1,34 @@
+// Resource references — how one resource points at another.
+//
+// Every `define*` handle carries `{ uuid, resource }`, and each `xxRef("uuid")`
+// helper produces the same shape for a resource you didn't define in code (a
+// literal uuid). Builders accept a handle OR a ref anywhere they reference
+// another resource — mirroring `defineWorkflow`'s `uses`, so you never write
+// `.uuid` at the call site. `resource` brands the kind, so a model can't be
+// passed where a connector is expected.
+/** Reference a connector by uuid (e.g. an adopted OAuth connector). */
+export const connectorRef = (uuid) => ({
+    uuid,
+    resource: "connector",
+});
+/** Reference a connector's auto-created dataset by uuid, for `defineModel`. */
+export const datasetRef = (uuid) => ({
+    uuid,
+    resource: "dataset",
+});
+/** Reference a data model by uuid. */
+export const modelRef = (uuid) => ({
+    uuid,
+    resource: "model",
+});
+/** Reference a folder by uuid. */
+export const folderRef = (uuid) => ({
+    uuid,
+    resource: "folder",
+});
+/** Reference a play by uuid (e.g. a `dependency` schedule's upstream play). */
+export const playRef = (uuid) => ({ uuid, resource: "play" });
+// `toolRef` / `agentRef` are re-exported from `@cargo-ai/workflow-sdk` — their
+// `WorkflowResourceRef` is structurally a `ResourceRef<"tool" | "agent">`.
+/** Extract the uuid from a handle or ref (both carry `uuid`). */
+export const refUuid = (ref) => ref.uuid;