@loopstack/secrets-examples 0.1.1

package/README.md

@@ -0,0 +1,148 @@
+---
+title: Secrets Examples
+description: Workflow examples for secrets management in Loopstack — deterministic request/verify flow and an agentic LLM flow using get_secret_keys and request_secrets_task tools
+---
+
+# @loopstack/secrets-examples
+
+> Secrets workflow examples for the [Loopstack](https://loopstack.ai) automation framework.
+
+Two ways to manage workspace secrets: a scripted request/verify flow, and an agent loop where the LLM decides when to ask the user for credentials.
+
+## Install as Source (Recommended)
+
+Examples are meant to be read, copied, and adapted. Pull the source straight into your project with [giget](https://github.com/unjs/giget):
+
+```bash
+npx giget@latest gh:loopstack-ai/loopstack/registry/examples/secrets-examples src/secrets-examples
+```
+
+After copying, register the module in your app:
+
+```typescript
+import { Module } from '@nestjs/common';
+import { LoopstackModule } from '@loopstack/loopstack-module';
+import { SecretsExamplesModule } from './secrets-examples/secrets-examples.module';
+
+@Module({
+  imports: [LoopstackModule.forRoot(), SecretsExamplesModule],
+})
+export class AppModule {}
+```
+
+## Install as a Dependency
+
+```bash
+npm install @loopstack/secrets-examples
+```
+
+```typescript
+import { SecretsExamplesModule } from '@loopstack/secrets-examples';
+```
+
+## Environment
+
+The agentic example requires Claude credentials:
+
+```bash
+ANTHROPIC_API_KEY=sk-ant-...
+```
+
+## Examples
+
+| Example                         | Studio title                      | Description                                                          |
+| ------------------------------- | --------------------------------- | -------------------------------------------------------------------- |
+| [Deterministic](#deterministic) | `Secrets - Deterministic Example` | Scripted request/verify flow — no LLM involved                       |
+| [Agentic](#agentic)             | `Secrets - Agentic Example`       | LLM agent that checks, requests, and verifies secrets via tool calls |
+
+---
+
+## Deterministic
+
+A scripted workflow that requests two secrets from the user, waits for them to be stored, then verifies they were saved. No LLM involved.
+
+### What it demonstrates
+
+- Calling `RequestSecretsTool` with a list of expected keys
+- Persisting a `SecretRequestDocument` so the user sees the prompt in Studio
+- A `wait: true` transition that resumes once the user submits the secrets
+- Reading current key availability via `GetSecretKeysTool`
+
+### Key code
+
+```ts
+@Transition({ to: 'requesting_secrets' })
+async requestSecretsFromUser() {
+  await this.requestSecrets.call({
+    variables: [{ key: 'EXAMPLE_API_KEY' }, { key: 'EXAMPLE_SECRET' }],
+  });
+  await this.documentStore.save(SecretRequestDocument, {
+    variables: [{ key: 'EXAMPLE_API_KEY' }, { key: 'EXAMPLE_SECRET' }],
+  });
+}
+
+@Transition({ from: 'requesting_secrets', to: 'verifying', wait: true })
+async secretsSubmitted() {
+  const result = await this.getSecretKeys.call();
+  this.assignState({ secretKeys: result.data });
+}
+```
+
+### Files
+
+- `deterministic-example.workflow.ts` — workflow class
+- `templates/secretsVerified.md` — Handlebars summary template
+
+## Agentic
+
+An agent workflow where the LLM decides when to check for existing secrets and when to request new ones. The user can also send follow-up messages mid-loop.
+
+### What it demonstrates
+
+- Configuring an LLM call with allowed tools via `config: { tools: ['get_secret_keys', 'request_secrets_task'] }`
+- A delegate/tool-result loop using `LlmDelegateToolCallsTool` + `LlmUpdateToolResultTool`
+- Guard-based routing on `stopReason === 'tool_use'` vs end-of-turn
+- A `prompt-input` widget that lets the user inject messages while the agent runs
+
+### Key code
+
+```ts
+@Transition({ from: 'ready', to: 'prompt_executed' })
+async llmTurn() {
+  const result = await this.llmGenerateText.call(
+    {},
+    {
+      config: {
+        provider: 'claude',
+        model: 'claude-haiku-4-5-20251001',
+        tools: ['get_secret_keys', 'request_secrets_task'],
+        system: this.render(join(__dirname, 'templates', 'system.md')),
+      },
+    },
+  );
+  this.assignState({ llmResult: result.data });
+}
+
+@Transition({ from: 'prompt_executed', to: 'awaiting_tools', priority: 10 })
+@Guard('hasToolCalls')
+async executeToolCalls(state) {
+  const result = await this.llmDelegateToolCalls.call({
+    message: state.llmResult!.message,
+    callback: { transition: 'toolResultReceived' },
+  });
+  this.assignState({ delegateResult: result.data });
+}
+```
+
+### Files
+
+- `agentic-example.workflow.ts` — workflow class
+- `agentic-example.ui.yaml` — `prompt-input` widget for follow-up messages
+- `templates/system.md` — system prompt
+- `templates/systemMessage.md` — initial user/context message
+
+## About
+
+Author: [Jakob Klippel](https://www.linkedin.com/in/jakob-klippel/)
+
+License: MIT

package/dist/index.d.ts

@@ -0,0 +1,4 @@
+export * from './secrets-examples.module';
+export * from './workflows/deterministic/deterministic-example.workflow';
+export * from './workflows/agentic/agentic-example.workflow';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,2BAA2B,CAAC;AAC1C,cAAc,0DAA0D,CAAC;AACzE,cAAc,8CAA8C,CAAC"}

package/dist/index.js

@@ -0,0 +1,20 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./secrets-examples.module"), exports);
+__exportStar(require("./workflows/deterministic/deterministic-example.workflow"), exports);
+__exportStar(require("./workflows/agentic/agentic-example.workflow"), exports);
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,4DAA0C;AAC1C,2FAAyE;AACzE,+EAA6D"}

package/dist/secrets-examples.module.d.ts

@@ -0,0 +1,3 @@
+export declare class SecretsExamplesModule {
+}
+//# sourceMappingURL=secrets-examples.module.d.ts.map

package/dist/secrets-examples.module.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets-examples.module.d.ts","sourceRoot":"","sources":["../src/secrets-examples.module.ts"],"names":[],"mappings":"AAOA,qBASa,qBAAqB;CAAG"}

package/dist/secrets-examples.module.js

@@ -0,0 +1,30 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SecretsExamplesModule = void 0;
+const common_1 = require("@nestjs/common");
+const claude_module_1 = require("@loopstack/claude-module");
+const common_2 = require("@loopstack/common");
+const secrets_module_1 = require("@loopstack/secrets-module");
+const agentic_example_workflow_1 = require("./workflows/agentic/agentic-example.workflow");
+const deterministic_example_workflow_1 = require("./workflows/deterministic/deterministic-example.workflow");
+let SecretsExamplesModule = class SecretsExamplesModule {
+};
+exports.SecretsExamplesModule = SecretsExamplesModule;
+exports.SecretsExamplesModule = SecretsExamplesModule = __decorate([
+    (0, common_2.StudioApp)({
+        title: 'Secrets Examples',
+        workflows: [deterministic_example_workflow_1.DeterministicExampleWorkflow, agentic_example_workflow_1.AgenticExampleWorkflow],
+    }),
+    (0, common_1.Module)({
+        imports: [claude_module_1.ClaudeModule, secrets_module_1.SecretsModule.forFeature()],
+        providers: [deterministic_example_workflow_1.DeterministicExampleWorkflow, agentic_example_workflow_1.AgenticExampleWorkflow],
+        exports: [deterministic_example_workflow_1.DeterministicExampleWorkflow, agentic_example_workflow_1.AgenticExampleWorkflow],
+    })
+], SecretsExamplesModule);
+//# sourceMappingURL=secrets-examples.module.js.map

package/dist/secrets-examples.module.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets-examples.module.js","sourceRoot":"","sources":["../src/secrets-examples.module.ts"],"names":[],"mappings":";;;;;;;;;AAAA,2CAAwC;AACxC,4DAAwD;AACxD,8CAA8C;AAC9C,8DAA0D;AAC1D,2FAAsF;AACtF,6GAAwG;AAWjG,IAAM,qBAAqB,GAA3B,MAAM,qBAAqB;CAAG,CAAA;AAAxB,sDAAqB;gCAArB,qBAAqB;IATjC,IAAA,kBAAS,EAAC;QACT,KAAK,EAAE,kBAAkB;QACzB,SAAS,EAAE,CAAC,6DAA4B,EAAE,iDAAsB,CAAC;KAClE,CAAC;IACD,IAAA,eAAM,EAAC;QACN,OAAO,EAAE,CAAC,4BAAY,EAAE,8BAAa,CAAC,UAAU,EAAE,CAAC;QACnD,SAAS,EAAE,CAAC,6DAA4B,EAAE,iDAAsB,CAAC;QACjE,OAAO,EAAE,CAAC,6DAA4B,EAAE,iDAAsB,CAAC;KAChE,CAAC;GACW,qBAAqB,CAAG"}

package/dist/workflows/agentic/agentic-example.ui.yaml

@@ -0,0 +1,6 @@
+widget: prompt-input
+enabledWhen:
+  - waiting_for_user
+options:
+  transition: userMessage
+  label: Send Message

package/dist/workflows/agentic/agentic-example.workflow.d.ts

@@ -0,0 +1,29 @@
+import { BaseWorkflow } from '@loopstack/common';
+import type { TransitionInput } from '@loopstack/common';
+import type { LlmDelegateResult, LlmGenerateTextResult } from '@loopstack/llm-provider-module';
+import { LlmDelegateToolCallsTool, LlmGenerateTextTool, LlmUpdateToolResultTool } from '@loopstack/llm-provider-module';
+import { GetSecretKeysTool, RequestSecretsTask, SecretsRequestWorkflow } from '@loopstack/secrets-module';
+interface AgenticState {
+    llmResult?: LlmGenerateTextResult;
+    delegateResult?: LlmDelegateResult;
+}
+export declare class AgenticExampleWorkflow extends BaseWorkflow {
+    private readonly llmGenerateText;
+    private readonly llmDelegateToolCalls;
+    private readonly llmUpdateToolResult;
+    private readonly requestSecrets;
+    private readonly getSecretKeys;
+    private readonly secretsRequest;
+    constructor(llmGenerateText: LlmGenerateTextTool, llmDelegateToolCalls: LlmDelegateToolCallsTool, llmUpdateToolResult: LlmUpdateToolResultTool, requestSecrets: RequestSecretsTask, getSecretKeys: GetSecretKeysTool, secretsRequest: SecretsRequestWorkflow);
+    setup(_state: AgenticState): Promise<void>;
+    llmTurn(_state: AgenticState): Promise<void>;
+    executeToolCalls(state: AgenticState): Promise<void>;
+    hasToolCalls(state: AgenticState): boolean;
+    toolResultReceived(state: AgenticState, input: TransitionInput<Record<string, unknown>>): Promise<void>;
+    allToolsCompleteTransition(_state: AgenticState): void;
+    allToolsComplete(state: AgenticState): boolean;
+    userMessage(state: AgenticState, input: TransitionInput<string>): Promise<void>;
+    respond(_state: AgenticState): void;
+}
+export {};
+//# sourceMappingURL=agentic-example.workflow.d.ts.map

package/dist/workflows/agentic/agentic-example.workflow.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"agentic-example.workflow.d.ts","sourceRoot":"","sources":["../../../src/workflows/agentic/agentic-example.workflow.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,YAAY,EAA+B,MAAM,mBAAmB,CAAC;AAC9E,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACzD,OAAO,KAAK,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,MAAM,gCAAgC,CAAC;AAC/F,OAAO,EAEL,wBAAwB,EACxB,mBAAmB,EAEnB,uBAAuB,EACxB,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,sBAAsB,EAAE,MAAM,2BAA2B,CAAC;AAE1G,UAAU,YAAY;IACpB,SAAS,CAAC,EAAE,qBAAqB,CAAC;IAClC,cAAc,CAAC,EAAE,iBAAiB,CAAC;CACpC;AAED,qBAMa,sBAAuB,SAAQ,YAAY;IAEpD,OAAO,CAAC,QAAQ,CAAC,eAAe;IAChC,OAAO,CAAC,QAAQ,CAAC,oBAAoB;IACrC,OAAO,CAAC,QAAQ,CAAC,mBAAmB;IACpC,OAAO,CAAC,QAAQ,CAAC,cAAc;IAC/B,OAAO,CAAC,QAAQ,CAAC,aAAa;IAC9B,OAAO,CAAC,QAAQ,CAAC,cAAc;gBALd,eAAe,EAAE,mBAAmB,EACpC,oBAAoB,EAAE,wBAAwB,EAC9C,mBAAmB,EAAE,uBAAuB,EAC5C,cAAc,EAAE,kBAAkB,EAClC,aAAa,EAAE,iBAAiB,EAChC,cAAc,EAAE,sBAAsB;IAMnD,KAAK,CAAC,MAAM,EAAE,YAAY;IAQ1B,OAAO,CAAC,MAAM,EAAE,YAAY;IAiB5B,gBAAgB,CAAC,KAAK,EAAE,YAAY;IAQ1C,YAAY,CAAC,KAAK,EAAE,YAAY,GAAG,OAAO;IAKpC,kBAAkB,CAAC,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,eAAe,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAU7F,0BAA0B,CAAC,MAAM,EAAE,YAAY;IAE/C,gBAAgB,CAAC,KAAK,EAAE,YAAY,GAAG,OAAO;IAKxC,WAAW,CAAC,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,eAAe,CAAC,MAAM,CAAC;IAKrE,OAAO,CAAC,MAAM,EAAE,YAAY;CAC7B"}

package/dist/workflows/agentic/agentic-example.workflow.js

@@ -0,0 +1,135 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AgenticExampleWorkflow = void 0;
+const node_path_1 = require("node:path");
+const zod_1 = require("zod");
+const common_1 = require("@loopstack/common");
+const llm_provider_module_1 = require("@loopstack/llm-provider-module");
+const secrets_module_1 = require("@loopstack/secrets-module");
+let AgenticExampleWorkflow = class AgenticExampleWorkflow extends common_1.BaseWorkflow {
+    llmGenerateText;
+    llmDelegateToolCalls;
+    llmUpdateToolResult;
+    requestSecrets;
+    getSecretKeys;
+    secretsRequest;
+    constructor(llmGenerateText, llmDelegateToolCalls, llmUpdateToolResult, requestSecrets, getSecretKeys, secretsRequest) {
+        super();
+        this.llmGenerateText = llmGenerateText;
+        this.llmDelegateToolCalls = llmDelegateToolCalls;
+        this.llmUpdateToolResult = llmUpdateToolResult;
+        this.requestSecrets = requestSecrets;
+        this.getSecretKeys = getSecretKeys;
+        this.secretsRequest = secretsRequest;
+    }
+    async setup(_state) {
+        await this.documentStore.save(llm_provider_module_1.LlmContextDocument, {
+            role: 'user',
+            text: this.render((0, node_path_1.join)(__dirname, 'templates', 'systemMessage.md')),
+        });
+    }
+    async llmTurn(_state) {
+        const result = await this.llmGenerateText.call({}, {
+            config: {
+                provider: 'claude',
+                model: 'claude-haiku-4-5-20251001',
+                tools: ['get_secret_keys', 'request_secrets_task'],
+                system: this.render((0, node_path_1.join)(__dirname, 'templates', 'system.md')),
+            },
+        });
+        this.assignState({ llmResult: result.data });
+    }
+    async executeToolCalls(state) {
+        const result = await this.llmDelegateToolCalls.call({
+            message: state.llmResult.message,
+            callback: { transition: 'toolResultReceived' },
+        });
+        this.assignState({ delegateResult: result.data });
+    }
+    hasToolCalls(state) {
+        return state.llmResult?.message.stopReason === 'tool_use';
+    }
+    async toolResultReceived(state, input) {
+        const result = await this.llmUpdateToolResult.call({
+            delegateResult: state.delegateResult,
+            completedTool: input,
+        });
+        this.assignState({ delegateResult: result.data });
+    }
+    allToolsCompleteTransition(_state) { }
+    allToolsComplete(state) {
+        return state.delegateResult?.allCompleted ?? false;
+    }
+    async userMessage(state, input) {
+        await this.documentStore.save(llm_provider_module_1.LlmMessageDocument, { role: 'user', text: input.data });
+    }
+    respond(_state) { }
+};
+exports.AgenticExampleWorkflow = AgenticExampleWorkflow;
+__decorate([
+    (0, common_1.Transition)({ to: 'ready' }),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], AgenticExampleWorkflow.prototype, "setup", null);
+__decorate([
+    (0, common_1.Transition)({ from: 'ready', to: 'prompt_executed' }),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], AgenticExampleWorkflow.prototype, "llmTurn", null);
+__decorate([
+    (0, common_1.Transition)({ from: 'prompt_executed', to: 'awaiting_tools', priority: 10 }),
+    (0, common_1.Guard)('hasToolCalls'),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], AgenticExampleWorkflow.prototype, "executeToolCalls", null);
+__decorate([
+    (0, common_1.Transition)({ from: 'awaiting_tools', to: 'awaiting_tools', wait: true, schema: zod_1.z.record(zod_1.z.string(), zod_1.z.unknown()) }),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object, Object]),
+    __metadata("design:returntype", Promise)
+], AgenticExampleWorkflow.prototype, "toolResultReceived", null);
+__decorate([
+    (0, common_1.Transition)({ from: 'awaiting_tools', to: 'ready' }),
+    (0, common_1.Guard)('allToolsComplete'),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", void 0)
+], AgenticExampleWorkflow.prototype, "allToolsCompleteTransition", null);
+__decorate([
+    (0, common_1.Transition)({ from: 'waiting_for_user', to: 'ready', wait: true, schema: zod_1.z.string() }),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object, Object]),
+    __metadata("design:returntype", Promise)
+], AgenticExampleWorkflow.prototype, "userMessage", null);
+__decorate([
+    (0, common_1.Transition)({ from: 'prompt_executed', to: 'end' }),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", void 0)
+], AgenticExampleWorkflow.prototype, "respond", null);
+exports.AgenticExampleWorkflow = AgenticExampleWorkflow = __decorate([
+    (0, common_1.Workflow)({
+        title: 'Secrets - Agentic Example',
+        description: 'An agent workflow where the LLM autonomously manages secrets by calling getSecretKeys and requestSecrets tools. The user can send follow-up messages.',
+        widget: './agentic-example.ui.yaml',
+    }),
+    __metadata("design:paramtypes", [llm_provider_module_1.LlmGenerateTextTool,
+        llm_provider_module_1.LlmDelegateToolCallsTool,
+        llm_provider_module_1.LlmUpdateToolResultTool,
+        secrets_module_1.RequestSecretsTask,
+        secrets_module_1.GetSecretKeysTool,
+        secrets_module_1.SecretsRequestWorkflow])
+], AgenticExampleWorkflow);
+//# sourceMappingURL=agentic-example.workflow.js.map

package/dist/workflows/agentic/agentic-example.workflow.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"agentic-example.workflow.js","sourceRoot":"","sources":["../../../src/workflows/agentic/agentic-example.workflow.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,yCAAiC;AACjC,6BAAwB;AACxB,8CAA8E;AAG9E,wEAMwC;AACxC,8DAA0G;AAanG,IAAM,sBAAsB,GAA5B,MAAM,sBAAuB,SAAQ,qBAAY;IAEnC;IACA;IACA;IACA;IACA;IACA;IANnB,YACmB,eAAoC,EACpC,oBAA8C,EAC9C,mBAA4C,EAC5C,cAAkC,EAClC,aAAgC,EAChC,cAAsC;QAEvD,KAAK,EAAE,CAAC;QAPS,oBAAe,GAAf,eAAe,CAAqB;QACpC,yBAAoB,GAApB,oBAAoB,CAA0B;QAC9C,wBAAmB,GAAnB,mBAAmB,CAAyB;QAC5C,mBAAc,GAAd,cAAc,CAAoB;QAClC,kBAAa,GAAb,aAAa,CAAmB;QAChC,mBAAc,GAAd,cAAc,CAAwB;IAGzD,CAAC;IAGK,AAAN,KAAK,CAAC,KAAK,CAAC,MAAoB;QAC9B,MAAM,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,wCAAkB,EAAE;YAChD,IAAI,EAAE,MAAM;YACZ,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,IAAA,gBAAI,EAAC,SAAS,EAAE,WAAW,EAAE,kBAAkB,CAAC,CAAC;SACpE,CAAC,CAAC;IACL,CAAC;IAGK,AAAN,KAAK,CAAC,OAAO,CAAC,MAAoB;QAChC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,IAAI,CAC5C,EAAE,EACF;YACE,MAAM,EAAE;gBACN,QAAQ,EAAE,QAAQ;gBAClB,KAAK,EAAE,2BAA2B;gBAClC,KAAK,EAAE,CAAC,iBAAiB,EAAE,sBAAsB,CAAC;gBAClD,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,IAAA,gBAAI,EAAC,SAAS,EAAE,WAAW,EAAE,WAAW,CAAC,CAAC;aAC/D;SACF,CACF,CAAC;QACF,IAAI,CAAC,WAAW,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;IAC/C,CAAC;IAIK,AAAN,KAAK,CAAC,gBAAgB,CAAC,KAAmB;QACxC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC;YAClD,OAAO,EAAE,KAAK,CAAC,SAAU,CAAC,OAAO;YACjC,QAAQ,EAAE,EAAE,UAAU,EAAE,oBAAoB,EAAE;SAC/C,CAAC,CAAC;QACH,IAAI,CAAC,WAAW,CAAC,EAAE,cAAc,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;IACpD,CAAC;IAED,YAAY,CAAC,KAAmB;QAC9B,OAAO,KAAK,CAAC,SAAS,EAAE,OAAO,CAAC,UAAU,KAAK,UAAU,CAAC;IAC5D,CAAC;IAGK,AAAN,KAAK,CAAC,kBAAkB,CAAC,KAAmB,EAAE,KAA+C;QAC3F,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC;YACjD,cAAc,EAAE,KAAK,CAAC,cAAe;YACrC,aAAa,EAAE,KAAK;SACrB,CAAC,CAAC;QACH,IAAI,CAAC,WAAW,CAAC,EAAE,cAAc,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;IACpD,CAAC;IAID,0BAA0B,CAAC,MAAoB,IAAG,CAAC;IAEnD,gBAAgB,CAAC,KAAmB;QAClC,OAAO,KAAK,CAAC,cAAc,EAAE,YAAY,IAAI,KAAK,CAAC;IACrD,CAAC;IAGK,AAAN,KAAK,CAAC,WAAW,CAAC,KAAmB,EAAE,KAA8B;QACnE,MAAM,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,wCAAkB,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;IACxF,CAAC;IAGD,OAAO,CAAC,MAAoB,IAAG,CAAC;CACjC,CAAA;AA1EY,wDAAsB;AAa3B;IADL,IAAA,mBAAU,EAAC,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC;;;;mDAM3B;AAGK;IADL,IAAA,mBAAU,EAAC,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,iBAAiB,EAAE,CAAC;;;;qDAcpD;AAIK;IAFL,IAAA,mBAAU,EAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,EAAE,EAAE,gBAAgB,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;IAC3E,IAAA,cAAK,EAAC,cAAc,CAAC;;;;8DAOrB;AAOK;IADL,IAAA,mBAAU,EAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,EAAE,EAAE,gBAAgB,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,OAAC,CAAC,MAAM,CAAC,OAAC,CAAC,MAAM,EAAE,EAAE,OAAC,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC;;;;gEAOnH;AAID;IAFC,IAAA,mBAAU,EAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC;IACnD,IAAA,cAAK,EAAC,kBAAkB,CAAC;;;;wEACyB;AAO7C;IADL,IAAA,mBAAU,EAAC,EAAE,IAAI,EAAE,kBAAkB,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,OAAC,CAAC,MAAM,EAAE,EAAE,CAAC;;;;yDAGrF;AAGD;IADC,IAAA,mBAAU,EAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC;;;;qDACnB;iCAzErB,sBAAsB;IANlC,IAAA,iBAAQ,EAAC;QACR,KAAK,EAAE,2BAA2B;QAClC,WAAW,EACT,uJAAuJ;QACzJ,MAAM,EAAE,2BAA2B;KACpC,CAAC;qCAGoC,yCAAmB;QACd,8CAAwB;QACzB,6CAAuB;QAC5B,mCAAkB;QACnB,kCAAiB;QAChB,uCAAsB;GAP9C,sBAAsB,CA0ElC"}

package/dist/workflows/agentic/templates/system.md

@@ -0,0 +1,7 @@
+You are a helpful assistant that manages workspace secrets.
+Use getSecretKeys to check existing secrets, and requestSecrets to ask the user for new ones.
+
+IMPORTANT: When using requestSecrets, it must be the ONLY tool call in your response.
+Do not combine it with other tool calls.
+
+When all secrets are available, respond with one sentence including a list of the requested secrets.

package/dist/workflows/agentic/templates/systemMessage.md

@@ -0,0 +1,3 @@
+Check what secrets are available in the workspace using getSecretKeys.
+If EXAMPLE_API_KEY and EXAMPLE_SECRET are not yet stored, request them from the user.
+After secrets are stored, verify by listing them again and summarize.

package/dist/workflows/deterministic/deterministic-example.workflow.d.ts

@@ -0,0 +1,18 @@
+import { BaseWorkflow } from '@loopstack/common';
+import { GetSecretKeysTool, RequestSecretsTool } from '@loopstack/secrets-module';
+interface DeterministicState {
+    secretKeys?: Array<{
+        key: string;
+        hasValue: boolean;
+    }>;
+}
+export declare class DeterministicExampleWorkflow extends BaseWorkflow {
+    private readonly requestSecrets;
+    private readonly getSecretKeys;
+    constructor(requestSecrets: RequestSecretsTool, getSecretKeys: GetSecretKeysTool);
+    requestSecretsFromUser(_state: DeterministicState): Promise<void>;
+    secretsSubmitted(_state: DeterministicState): Promise<void>;
+    showResult(state: DeterministicState): Promise<void>;
+}
+export {};
+//# sourceMappingURL=deterministic-example.workflow.d.ts.map

package/dist/workflows/deterministic/deterministic-example.workflow.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"deterministic-example.workflow.d.ts","sourceRoot":"","sources":["../../../src/workflows/deterministic/deterministic-example.workflow.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAA0C,MAAM,mBAAmB,CAAC;AACzF,OAAO,EAAE,iBAAiB,EAAE,kBAAkB,EAAyB,MAAM,2BAA2B,CAAC;AAEzG,UAAU,kBAAkB;IAC1B,UAAU,CAAC,EAAE,KAAK,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;CACxD;AAED,qBAKa,4BAA6B,SAAQ,YAAY;IAE1D,OAAO,CAAC,QAAQ,CAAC,cAAc;IAC/B,OAAO,CAAC,QAAQ,CAAC,aAAa;gBADb,cAAc,EAAE,kBAAkB,EAClC,aAAa,EAAE,iBAAiB;IAM7C,sBAAsB,CAAC,MAAM,EAAE,kBAAkB;IAWjD,gBAAgB,CAAC,MAAM,EAAE,kBAAkB;IAM3C,UAAU,CAAC,KAAK,EAAE,kBAAkB;CAO3C"}

package/dist/workflows/deterministic/deterministic-example.workflow.js

@@ -0,0 +1,71 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DeterministicExampleWorkflow = void 0;
+const node_path_1 = require("node:path");
+const common_1 = require("@loopstack/common");
+const secrets_module_1 = require("@loopstack/secrets-module");
+let DeterministicExampleWorkflow = class DeterministicExampleWorkflow extends common_1.BaseWorkflow {
+    requestSecrets;
+    getSecretKeys;
+    constructor(requestSecrets, getSecretKeys) {
+        super();
+        this.requestSecrets = requestSecrets;
+        this.getSecretKeys = getSecretKeys;
+    }
+    async requestSecretsFromUser(_state) {
+        await this.requestSecrets.call({
+            variables: [{ key: 'EXAMPLE_API_KEY' }, { key: 'EXAMPLE_SECRET' }],
+        });
+        await this.documentStore.save(secrets_module_1.SecretRequestDocument, {
+            variables: [{ key: 'EXAMPLE_API_KEY' }, { key: 'EXAMPLE_SECRET' }],
+        });
+    }
+    async secretsSubmitted(_state) {
+        const result = await this.getSecretKeys.call();
+        this.assignState({ secretKeys: result.data });
+    }
+    async showResult(state) {
+        await this.documentStore.save(common_1.MarkdownDocument, {
+            markdown: this.render((0, node_path_1.join)(__dirname, 'templates', 'secretsVerified.md'), {
+                secretKeys: state.secretKeys,
+            }),
+        });
+    }
+};
+exports.DeterministicExampleWorkflow = DeterministicExampleWorkflow;
+__decorate([
+    (0, common_1.Transition)({ to: 'requesting_secrets' }),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], DeterministicExampleWorkflow.prototype, "requestSecretsFromUser", null);
+__decorate([
+    (0, common_1.Transition)({ from: 'requesting_secrets', to: 'verifying', wait: true }),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], DeterministicExampleWorkflow.prototype, "secretsSubmitted", null);
+__decorate([
+    (0, common_1.Transition)({ from: 'verifying', to: 'end' }),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], DeterministicExampleWorkflow.prototype, "showResult", null);
+exports.DeterministicExampleWorkflow = DeterministicExampleWorkflow = __decorate([
+    (0, common_1.Workflow)({
+        title: 'Secrets - Deterministic Example',
+        description: 'A scripted workflow that requests two secrets from the user, waits for them to be stored, then verifies the result. No LLM involved.',
+    }),
+    __metadata("design:paramtypes", [secrets_module_1.RequestSecretsTool,
+        secrets_module_1.GetSecretKeysTool])
+], DeterministicExampleWorkflow);
+//# sourceMappingURL=deterministic-example.workflow.js.map

package/dist/workflows/deterministic/deterministic-example.workflow.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"deterministic-example.workflow.js","sourceRoot":"","sources":["../../../src/workflows/deterministic/deterministic-example.workflow.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,yCAAiC;AACjC,8CAAyF;AACzF,8DAAyG;AAWlG,IAAM,4BAA4B,GAAlC,MAAM,4BAA6B,SAAQ,qBAAY;IAEzC;IACA;IAFnB,YACmB,cAAkC,EAClC,aAAgC;QAEjD,KAAK,EAAE,CAAC;QAHS,mBAAc,GAAd,cAAc,CAAoB;QAClC,kBAAa,GAAb,aAAa,CAAmB;IAGnD,CAAC;IAGK,AAAN,KAAK,CAAC,sBAAsB,CAAC,MAA0B;QACrD,MAAM,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC;YAC7B,SAAS,EAAE,CAAC,EAAE,GAAG,EAAE,iBAAiB,EAAE,EAAE,EAAE,GAAG,EAAE,gBAAgB,EAAE,CAAC;SACnE,CAAC,CAAC;QAEH,MAAM,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,sCAAqB,EAAE;YACnD,SAAS,EAAE,CAAC,EAAE,GAAG,EAAE,iBAAiB,EAAE,EAAE,EAAE,GAAG,EAAE,gBAAgB,EAAE,CAAC;SACnE,CAAC,CAAC;IACL,CAAC;IAGK,AAAN,KAAK,CAAC,gBAAgB,CAAC,MAA0B;QAC/C,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,IAAI,EAAE,CAAC;QAC/C,IAAI,CAAC,WAAW,CAAC,EAAE,UAAU,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;IAChD,CAAC;IAGK,AAAN,KAAK,CAAC,UAAU,CAAC,KAAyB;QACxC,MAAM,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,yBAAgB,EAAE;YAC9C,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,IAAA,gBAAI,EAAC,SAAS,EAAE,WAAW,EAAE,oBAAoB,CAAC,EAAE;gBACxE,UAAU,EAAE,KAAK,CAAC,UAAU;aAC7B,CAAC;SACH,CAAC,CAAC;IACL,CAAC;CACF,CAAA;AAjCY,oEAA4B;AASjC;IADL,IAAA,mBAAU,EAAC,EAAE,EAAE,EAAE,oBAAoB,EAAE,CAAC;;;;0EASxC;AAGK;IADL,IAAA,mBAAU,EAAC,EAAE,IAAI,EAAE,oBAAoB,EAAE,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;;;;oEAIvE;AAGK;IADL,IAAA,mBAAU,EAAC,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC;;;;8DAO5C;uCAhCU,4BAA4B;IALxC,IAAA,iBAAQ,EAAC;QACR,KAAK,EAAE,iCAAiC;QACxC,WAAW,EACT,sIAAsI;KACzI,CAAC;qCAGmC,mCAAkB;QACnB,kCAAiB;GAHxC,4BAA4B,CAiCxC"}

package/dist/workflows/deterministic/templates/secretsVerified.md

@@ -0,0 +1,8 @@
+# Secrets Verified
+
+The following secrets are now stored:
+
+{{#each secretKeys}}
+
+- **{{this.key}}**: {{#if this.hasValue}}has value{{else}}no value{{/if}}
+  {{/each}}

package/package.json

@@ -0,0 +1,48 @@
+{
+  "name": "@loopstack/secrets-examples",
+  "displayName": "Loopstack Secrets Examples",
+  "description": "Workflow examples for secrets management in Loopstack — deterministic request/verify flow and an agentic LLM flow that calls secrets tools.",
+  "keywords": [
+    "loopstack",
+    "example",
+    "secrets",
+    "workflow"
+  ],
+  "version": "0.1.1",
+  "license": "MIT",
+  "author": {
+    "name": "Jakob Klippel",
+    "url": "https://www.linkedin.com/in/jakob-klippel/"
+  },
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "exports": {
+    ".": "./dist/index.js",
+    "./src/*": "./src/*"
+  },
+  "scripts": {
+    "build": "nest build",
+    "compile": "tsc --noEmit",
+    "format": "prettier --write .",
+    "lint": "eslint .",
+    "test": "vitest run --passWithNoTests",
+    "watch": "nest build --watch"
+  },
+  "dependencies": {
+    "@loopstack/claude-module": "*",
+    "@loopstack/common": "*",
+    "@loopstack/llm-provider-module": "*",
+    "@loopstack/secrets-module": "*",
+    "@nestjs/common": "^11.1.19",
+    "zod": "^4.3.6"
+  },
+  "files": [
+    "dist",
+    "src"
+  ],
+  "devDependencies": {
+    "vitest": "^4.1.6",
+    "@swc/core": "^1.15.33",
+    "unplugin-swc": "^1.5.9"
+  }
+}

package/src/index.ts

@@ -0,0 +1,3 @@
+export * from './secrets-examples.module';
+export * from './workflows/deterministic/deterministic-example.workflow';
+export * from './workflows/agentic/agentic-example.workflow';

package/src/secrets-examples.module.ts

@@ -0,0 +1,17 @@
+import { Module } from '@nestjs/common';
+import { ClaudeModule } from '@loopstack/claude-module';
+import { StudioApp } from '@loopstack/common';
+import { SecretsModule } from '@loopstack/secrets-module';
+import { AgenticExampleWorkflow } from './workflows/agentic/agentic-example.workflow';
+import { DeterministicExampleWorkflow } from './workflows/deterministic/deterministic-example.workflow';
+
+@StudioApp({
+  title: 'Secrets Examples',
+  workflows: [DeterministicExampleWorkflow, AgenticExampleWorkflow],
+})
+@Module({
+  imports: [ClaudeModule, SecretsModule.forFeature()],
+  providers: [DeterministicExampleWorkflow, AgenticExampleWorkflow],
+  exports: [DeterministicExampleWorkflow, AgenticExampleWorkflow],
+})
+export class SecretsExamplesModule {}

package/src/workflows/agentic/agentic-example.ui.yaml

@@ -0,0 +1,6 @@
+widget: prompt-input
+enabledWhen:
+  - waiting_for_user
+options:
+  transition: userMessage
+  label: Send Message

package/src/workflows/agentic/agentic-example.workflow.ts

@@ -0,0 +1,100 @@
+import { join } from 'node:path';
+import { z } from 'zod';
+import { BaseWorkflow, Guard, Transition, Workflow } from '@loopstack/common';
+import type { TransitionInput } from '@loopstack/common';
+import type { LlmDelegateResult, LlmGenerateTextResult } from '@loopstack/llm-provider-module';
+import {
+  LlmContextDocument,
+  LlmDelegateToolCallsTool,
+  LlmGenerateTextTool,
+  LlmMessageDocument,
+  LlmUpdateToolResultTool,
+} from '@loopstack/llm-provider-module';
+import { GetSecretKeysTool, RequestSecretsTask, SecretsRequestWorkflow } from '@loopstack/secrets-module';
+
+interface AgenticState {
+  llmResult?: LlmGenerateTextResult;
+  delegateResult?: LlmDelegateResult;
+}
+
+@Workflow({
+  title: 'Secrets - Agentic Example',
+  description:
+    'An agent workflow where the LLM autonomously manages secrets by calling getSecretKeys and requestSecrets tools. The user can send follow-up messages.',
+  widget: './agentic-example.ui.yaml',
+})
+export class AgenticExampleWorkflow extends BaseWorkflow {
+  constructor(
+    private readonly llmGenerateText: LlmGenerateTextTool,
+    private readonly llmDelegateToolCalls: LlmDelegateToolCallsTool,
+    private readonly llmUpdateToolResult: LlmUpdateToolResultTool,
+    private readonly requestSecrets: RequestSecretsTask,
+    private readonly getSecretKeys: GetSecretKeysTool,
+    private readonly secretsRequest: SecretsRequestWorkflow,
+  ) {
+    super();
+  }
+
+  @Transition({ to: 'ready' })
+  async setup(_state: AgenticState) {
+    await this.documentStore.save(LlmContextDocument, {
+      role: 'user',
+      text: this.render(join(__dirname, 'templates', 'systemMessage.md')),
+    });
+  }
+
+  @Transition({ from: 'ready', to: 'prompt_executed' })
+  async llmTurn(_state: AgenticState) {
+    const result = await this.llmGenerateText.call(
+      {},
+      {
+        config: {
+          provider: 'claude',
+          model: 'claude-haiku-4-5-20251001',
+          tools: ['get_secret_keys', 'request_secrets_task'],
+          system: this.render(join(__dirname, 'templates', 'system.md')),
+        },
+      },
+    );
+    this.assignState({ llmResult: result.data });
+  }
+
+  @Transition({ from: 'prompt_executed', to: 'awaiting_tools', priority: 10 })
+  @Guard('hasToolCalls')
+  async executeToolCalls(state: AgenticState) {
+    const result = await this.llmDelegateToolCalls.call({
+      message: state.llmResult!.message,
+      callback: { transition: 'toolResultReceived' },
+    });
+    this.assignState({ delegateResult: result.data });
+  }
+
+  hasToolCalls(state: AgenticState): boolean {
+    return state.llmResult?.message.stopReason === 'tool_use';
+  }
+
+  @Transition({ from: 'awaiting_tools', to: 'awaiting_tools', wait: true, schema: z.record(z.string(), z.unknown()) })
+  async toolResultReceived(state: AgenticState, input: TransitionInput<Record<string, unknown>>) {
+    const result = await this.llmUpdateToolResult.call({
+      delegateResult: state.delegateResult!,
+      completedTool: input,
+    });
+    this.assignState({ delegateResult: result.data });
+  }
+
+  @Transition({ from: 'awaiting_tools', to: 'ready' })
+  @Guard('allToolsComplete')
+  allToolsCompleteTransition(_state: AgenticState) {}
+
+  allToolsComplete(state: AgenticState): boolean {
+    return state.delegateResult?.allCompleted ?? false;
+  }
+
+  @Transition({ from: 'waiting_for_user', to: 'ready', wait: true, schema: z.string() })
+  async userMessage(state: AgenticState, input: TransitionInput<string>) {
+    await this.documentStore.save(LlmMessageDocument, { role: 'user', text: input.data });
+  }
+
+  @Transition({ from: 'prompt_executed', to: 'end' })
+  respond(_state: AgenticState) {}
+}

package/src/workflows/agentic/templates/system.md

@@ -0,0 +1,7 @@
+You are a helpful assistant that manages workspace secrets.
+Use getSecretKeys to check existing secrets, and requestSecrets to ask the user for new ones.
+
+IMPORTANT: When using requestSecrets, it must be the ONLY tool call in your response.
+Do not combine it with other tool calls.
+
+When all secrets are available, respond with one sentence including a list of the requested secrets.

package/src/workflows/agentic/templates/systemMessage.md

@@ -0,0 +1,3 @@
+Check what secrets are available in the workspace using getSecretKeys.
+If EXAMPLE_API_KEY and EXAMPLE_SECRET are not yet stored, request them from the user.
+After secrets are stored, verify by listing them again and summarize.

package/src/workflows/deterministic/deterministic-example.workflow.ts

@@ -0,0 +1,47 @@
+import { join } from 'node:path';
+import { BaseWorkflow, MarkdownDocument, Transition, Workflow } from '@loopstack/common';
+import { GetSecretKeysTool, RequestSecretsTool, SecretRequestDocument } from '@loopstack/secrets-module';
+
+interface DeterministicState {
+  secretKeys?: Array<{ key: string; hasValue: boolean }>;
+}
+
+@Workflow({
+  title: 'Secrets - Deterministic Example',
+  description:
+    'A scripted workflow that requests two secrets from the user, waits for them to be stored, then verifies the result. No LLM involved.',
+})
+export class DeterministicExampleWorkflow extends BaseWorkflow {
+  constructor(
+    private readonly requestSecrets: RequestSecretsTool,
+    private readonly getSecretKeys: GetSecretKeysTool,
+  ) {
+    super();
+  }
+
+  @Transition({ to: 'requesting_secrets' })
+  async requestSecretsFromUser(_state: DeterministicState) {
+    await this.requestSecrets.call({
+      variables: [{ key: 'EXAMPLE_API_KEY' }, { key: 'EXAMPLE_SECRET' }],
+    });
+
+    await this.documentStore.save(SecretRequestDocument, {
+      variables: [{ key: 'EXAMPLE_API_KEY' }, { key: 'EXAMPLE_SECRET' }],
+    });
+  }
+
+  @Transition({ from: 'requesting_secrets', to: 'verifying', wait: true })
+  async secretsSubmitted(_state: DeterministicState) {
+    const result = await this.getSecretKeys.call();
+    this.assignState({ secretKeys: result.data });
+  }
+
+  @Transition({ from: 'verifying', to: 'end' })
+  async showResult(state: DeterministicState) {
+    await this.documentStore.save(MarkdownDocument, {
+      markdown: this.render(join(__dirname, 'templates', 'secretsVerified.md'), {
+        secretKeys: state.secretKeys,
+      }),
+    });
+  }
+}

package/src/workflows/deterministic/templates/secretsVerified.md

@@ -0,0 +1,8 @@
+# Secrets Verified
+
+The following secrets are now stored:
+
+{{#each secretKeys}}
+
+- **{{this.key}}**: {{#if this.hasValue}}has value{{else}}no value{{/if}}
+  {{/each}}