@theokit/sdk 2.26.0 → 2.28.0

package/dist/filesystem/types.d.ts

@@ -0,0 +1,118 @@
+/**
+ * Filesystem backend protocol — a pluggable file *storage* provider for agent
+ * tools, the storage-side twin of {@link SandboxBackend} (execution-side).
+ *
+ * SE31 (Mastra Workspaces comparison). Mirrors `SandboxBackend`'s shape: a small
+ * set of abstract methods (`readFile` / `writeFile` / `stat` / `list`) with
+ * `exists()` derived on the base class, a boundary `basePath`, a `readOnly`
+ * flag, and typed errors. Unlike `SandboxBackend` (whose file ops shell out via
+ * `execute`, requiring command execution and giving NO structured `stat`), a
+ * `FilesystemBackend` serves a *filesystem-only* workspace with no sandbox and
+ * exposes a real `stat().mtimeMs` — the primitive SE32's read-before-write
+ * safety compares against. See ADR 0011.
+ *
+ * New backends (S3, GCS, in-memory) implement the four abstract methods; higher
+ * level helpers derive on the base. This is the backend *seam* — it does NOT
+ * ship agent-facing tools nor a bundled workspace (bring-your-own-tools stands).
+ *
+ * @public
+ */
+/** Structured file metadata. `mtimeMs` is the read-before-write oracle (SE32). */
+export interface FileStat {
+    readonly size: number;
+    readonly mtimeMs: number;
+    readonly isFile: boolean;
+    readonly isDirectory: boolean;
+}
+/** Options a write may carry. SE32 adds `expectedMtime` (stale-write guard). */
+export interface WriteFileOptions {
+    /**
+     * SE32 — when set, the write fails with {@link StaleFileError} if the file's
+     * current `mtimeMs` differs (someone changed it since it was last read).
+     */
+    readonly expectedMtime?: number;
+}
+export interface FilesystemConfig {
+    /** Boundary root. Every path is resolved within it; escapes are rejected. */
+    readonly basePath?: string;
+    /** When true, every write throws {@link FilesystemReadOnlyError}. */
+    readonly readOnly?: boolean;
+}
+/** A path escaped the backend's `basePath` (traversal or symlink). */
+export declare class FilesystemSecurityError extends Error {
+    readonly code: "filesystem_security";
+    constructor(message: string);
+}
+/** A write was attempted on a read-only backend. */
+export declare class FilesystemReadOnlyError extends Error {
+    readonly code: "filesystem_readonly";
+    constructor(message: string);
+}
+/** A read/stat targeted a path that does not exist. */
+export declare class FileNotFoundError extends Error {
+    readonly path: string;
+    readonly code: "filesystem_not_found";
+    constructor(path: string);
+}
+/**
+ * A filesystem I/O operation failed for a reason other than not-found /
+ * read-only / stale / security (e.g. `ENOTDIR` — a path component is a file, or
+ * `EACCES` / `ENOSPC`). Carries the original error as `cause` so no raw,
+ * untyped Node `SystemError` ever escapes the backend (Unbreakable Rule 8).
+ */
+export declare class FilesystemError extends Error {
+    readonly path: string;
+    readonly code: "filesystem_io";
+    constructor(path: string, cause: unknown);
+}
+/**
+ * SE32 — a write's `expectedMtime` did not match the file's current mtime: the
+ * file changed since it was last read, so the write would silently clobber.
+ */
+export declare class StaleFileError extends Error {
+    readonly path: string;
+    readonly expectedMtime: number;
+    readonly actualMtime: number;
+    readonly code: "filesystem_stale";
+    constructor(path: string, expectedMtime: number, actualMtime: number);
+}
+/**
+ * Pluggable filesystem backend. Implement the four abstract methods; `exists()`
+ * and the `readOnly`/`basePath` accessors derive on the base class.
+ *
+ * @public
+ */
+export declare abstract class FilesystemBackend {
+    protected readonly _basePath: string;
+    protected readonly _readOnly: boolean;
+    constructor(config?: FilesystemConfig);
+    /** Read a boundary-relative file as UTF-8. Throws {@link FileNotFoundError}. */
+    abstract readFile(path: string): Promise<string>;
+    /**
+     * Write UTF-8 content to a boundary-relative path (creating parents). Returns
+     * the new {@link FileStat}. Throws {@link FilesystemReadOnlyError} on a
+     * read-only backend and {@link StaleFileError} when `opts.expectedMtime`
+     * mismatches (SE32).
+     */
+    abstract writeFile(path: string, content: string, opts?: WriteFileOptions): Promise<FileStat>;
+    /** Structured metadata for a path. Throws {@link FileNotFoundError}. */
+    abstract stat(path: string): Promise<FileStat>;
+    /** Directory entry names (not recursive). Throws {@link FileNotFoundError}. */
+    abstract list(path: string): Promise<string[]>;
+    /** Derived — true iff `stat(path)` resolves (absent ⇒ false). */
+    exists(path: string): Promise<boolean>;
+    /** Throw {@link FilesystemReadOnlyError} when the backend is read-only. */
+    protected assertWritable(): void;
+    get readOnly(): boolean;
+    get basePath(): string;
+}
+/**
+ * A backend OR a per-request resolver of one. A resolver runs at tool-execution
+ * time (the request scope), so multi-tenant / multi-role agents get a distinct
+ * root or permission set per request without a shared mutable backend.
+ *
+ * @public
+ */
+export type FilesystemProvider<Ctx = unknown> = FilesystemBackend | ((ctx: Ctx) => FilesystemBackend | Promise<FilesystemBackend>);
+/** Resolve a {@link FilesystemProvider} to a concrete backend for `ctx`. */
+export declare function resolveFilesystem<Ctx>(provider: FilesystemProvider<Ctx>, ctx: Ctx): Promise<FilesystemBackend>;

package/dist/index.cjs

@@ -4336,7 +4336,7 @@ var init_batch = __esm({
 });
 
 // src/types/workflow.ts
-var WorkflowDuplicateStepIdError, WorkflowAlreadyRunningError, WorkflowSnapshotNotFoundError, WorkflowMaxIterationsExceededError, WorkflowNotSerializableError, WorkflowResumeStepNotFoundError, WorkflowParallelError, WorkflowCompensateNotImplementedError;
+var WorkflowDuplicateStepIdError, WorkflowInputError, WorkflowOutputError, WorkflowStateError, WorkflowAlreadyRunningError, WorkflowSnapshotNotFoundError, WorkflowMaxIterationsExceededError, WorkflowNotSerializableError, WorkflowResumeStepNotFoundError, WorkflowParallelError, WorkflowCompensateNotImplementedError;
 var init_workflow = __esm({
   "src/types/workflow.ts"() {
     WorkflowDuplicateStepIdError = class extends Error {
@@ -4347,6 +4347,36 @@ var init_workflow = __esm({
       stepId;
       name = "WorkflowDuplicateStepIdError";
     };
+    WorkflowInputError = class extends Error {
+      constructor(workflowName, detail) {
+        super(`Workflow "${workflowName}" input failed schema validation: ${detail}`);
+        this.workflowName = workflowName;
+        this.detail = detail;
+      }
+      workflowName;
+      detail;
+      name = "WorkflowInputError";
+    };
+    WorkflowOutputError = class extends Error {
+      constructor(workflowName, detail) {
+        super(`Workflow "${workflowName}" output failed schema validation: ${detail}`);
+        this.workflowName = workflowName;
+        this.detail = detail;
+      }
+      workflowName;
+      detail;
+      name = "WorkflowOutputError";
+    };
+    WorkflowStateError = class extends Error {
+      constructor(workflowName, detail) {
+        super(`Workflow "${workflowName}" state failed schema validation: ${detail}`);
+        this.workflowName = workflowName;
+        this.detail = detail;
+      }
+      workflowName;
+      detail;
+      name = "WorkflowStateError";
+    };
     WorkflowAlreadyRunningError = class extends Error {
       constructor(workflowName, runId) {
         super(`Workflow "${workflowName}" run "${runId}" already in-flight.`);
@@ -4539,7 +4569,7 @@ var init_snapshot_store = __esm({
 });
 
 // src/internal/workflow/ctx.ts
-function makeStepContext(runId, signal) {
+function makeStepContext(runId, signal, state4) {
   return {
     runId,
     signal,
@@ -4550,7 +4580,13 @@ function makeStepContext(runId, signal) {
     },
     suspend: async (payload) => {
       throw new WorkflowSuspendedSentinel(payload);
-    }
+    },
+    // SE29 — read reflects the current shared state; write goes through the
+    // controller (which validates against `stateSchema`).
+    get state() {
+      return state4.getState();
+    },
+    setState: (next) => state4.setState(next)
   };
 }
 function emit(level, runId, msg, attrs) {
@@ -4603,6 +4639,57 @@ var init_error_shape = __esm({
   }
 });
 
+// src/internal/workflow/executor-helpers.ts
+function assembleRun(params) {
+  return {
+    id: params.runId,
+    name: params.name,
+    status: params.status,
+    startedAt: params.startedAt,
+    endedAt: Date.now(),
+    stepResults: params.stepResults,
+    ...params.output !== void 0 ? { output: params.output } : {},
+    ...params.error !== void 0 ? { error: params.error } : {}
+  };
+}
+function abortRun(name, runId, startedAt, stepResults, signal) {
+  return assembleRun({
+    runId,
+    name,
+    status: "cancelled",
+    stepResults,
+    startedAt,
+    error: { name: "AbortError", message: String(signal.reason ?? "Aborted") }
+  });
+}
+function validateWorkflowSchema(schema, value) {
+  if (schema === void 0) return void 0;
+  let parsed;
+  try {
+    parsed = schema.safeParse(value);
+  } catch {
+    return "schema uses async refinements, which whole-workflow validation does not support (use a synchronous Zod schema)";
+  }
+  if (parsed.success) return void 0;
+  return parsed.error.issues.map((issue) => `${issue.path.join(".") || "(root)"}: ${issue.message}`).join("; ");
+}
+function makeStateController(options, initial) {
+  let current = initial;
+  return {
+    getState: () => current,
+    setState: (next) => {
+      const issues = validateWorkflowSchema(options.stateSchema, next);
+      if (issues !== void 0) throw new WorkflowStateError(options.name, issues);
+      current = next;
+    }
+  };
+}
+var init_executor_helpers = __esm({
+  "src/internal/workflow/executor-helpers.ts"() {
+    init_workflow();
+  }
+});
+
 // src/internal/workflow/run-id.ts
 function mintRunId() {
   return `wfr-${globalThis.crypto.randomUUID().replace(/-/g, "").slice(0, 8)}`;
@@ -5269,6 +5356,8 @@ async function handleSuspend(err, ctx) {
       suspendedPayload: err.payload,
       stepResults: ctx.stepResults,
       accumulatedInput: ctx.acc,
+      state: ctx.stepCtx.state,
+      // SE29 — capture the shared state at suspend
       options: ctx.options
     });
   } catch (snapErr) {
@@ -5320,7 +5409,7 @@ async function runOneStep(args) {
     result = await dispatchStep(args.step, args.acc, args.ctx, args.options, args.stepResults);
   } catch (err) {
     if (err instanceof WorkflowSuspendedSentinel) {
-      const outcome = await handleSuspend(err, { ...args, stepSpan });
+      const outcome = await handleSuspend(err, { ...args, stepSpan, stepCtx: args.ctx });
       return { kind: "terminal", run: outcome.run };
     }
     result = {
@@ -5337,22 +5426,42 @@ async function runOneStep(args) {
   stepSpan.end();
   return { kind: "ok", result };
 }
-function abortRun(name, runId, startedAt, stepResults, signal) {
-  return assembleRun({
-    runId,
-    name,
-    status: "cancelled",
-    stepResults,
-    startedAt,
-    error: { name: "AbortError", message: String(signal.reason ?? "Aborted") }
-  });
+function handleStepOutcome(outcome, step, loop, onStepEvent) {
+  if (outcome.kind === "terminal") {
+    if (outcome.run.status === "suspended") {
+      onStepEvent?.({ type: "workflow_suspended", stepId: step.id });
+    }
+    return { terminal: outcome.run };
+  }
+  loop.stepResults.push(outcome.result);
+  if (outcome.result.status === "failed") {
+    onStepEvent?.({
+      type: "step_failed",
+      stepId: step.id,
+      error: outcome.result.error ?? { name: "WorkflowStepError", message: "step failed" }
+    });
+    return {
+      terminal: assembleRun({
+        runId: loop.runId,
+        name: loop.name,
+        status: "failed",
+        stepResults: loop.stepResults,
+        startedAt: loop.startedAt,
+        error: outcome.result.error
+      })
+    };
+  }
+  onStepEvent?.({ type: "step_completed", stepId: step.id, output: outcome.result.output });
+  return { acc: outcome.result.output };
 }
 async function runStepsLoop(params) {
-  const { options, steps, ctx, runId, startedAt, signal } = params;
+  const { options, steps, ctx, runId, startedAt, signal, onStepEvent } = params;
   const stepResults = [...params.initialStepResults ?? []];
+  const loop = { stepResults, runId, name: options.name, startedAt };
   let acc = params.input;
   for (const step of steps) {
     if (signal.aborted) return abortRun(options.name, runId, startedAt, stepResults, signal);
+    onStepEvent?.({ type: "step_started", stepId: step.id });
     const outcome = await runOneStep({
       step,
       acc,
@@ -5363,20 +5472,22 @@ async function runStepsLoop(params) {
       name: options.name,
       startedAt
     });
-    if (outcome.kind === "terminal") return outcome.run;
-    stepResults.push(outcome.result);
-    if (outcome.result.status === "failed") {
-      return assembleRun({
-        runId,
-        name: options.name,
-        status: "failed",
-        stepResults,
-        startedAt,
-        error: outcome.result.error
-      });
-    }
-    acc = outcome.result.output;
+    const handled = handleStepOutcome(outcome, step, loop, onStepEvent);
+    if ("terminal" in handled) return handled.terminal;
+    acc = handled.acc;
+  }
+  const outputIssues = validateWorkflowSchema(options.outputSchema, acc);
+  if (outputIssues !== void 0) {
+    return assembleRun({
+      runId,
+      name: options.name,
+      status: "failed",
+      stepResults,
+      startedAt,
+      error: errToShape(new WorkflowOutputError(options.name, outputIssues))
+    });
   }
+  onStepEvent?.({ type: "workflow_completed" });
   return assembleRun({
     runId,
     name: options.name,
@@ -5399,8 +5510,33 @@ async function executeWorkflow(options, steps, input, runOpts) {
     runSpan.end();
     return abortRun(options.name, runId, startedAt, [], signal);
   }
-  const ctx = makeStepContext(runId, signal);
+  const internal = runOpts;
+  const seededState = internal?.restoredState !== void 0 ? internal.restoredState : options.initialState;
+  const stateController = makeStateController(options, seededState);
+  const ctx = makeStepContext(runId, signal, stateController);
   try {
+    const inputIssues = validateWorkflowSchema(options.inputSchema, input);
+    if (inputIssues !== void 0) {
+      return assembleRun({
+        runId,
+        name: options.name,
+        status: "failed",
+        stepResults: [],
+        startedAt,
+        error: errToShape(new WorkflowInputError(options.name, inputIssues))
+      });
+    }
+    const stateIssues = seededState !== void 0 ? validateWorkflowSchema(options.stateSchema, seededState) : void 0;
+    if (stateIssues !== void 0) {
+      return assembleRun({
+        runId,
+        name: options.name,
+        status: "failed",
+        stepResults: [],
+        startedAt,
+        error: errToShape(new WorkflowStateError(options.name, stateIssues))
+      });
+    }
     return await runStepsLoop({
       options,
       steps,
@@ -5409,7 +5545,8 @@ async function executeWorkflow(options, steps, input, runOpts) {
       runId,
       startedAt,
       signal,
-      ...runOpts?.initialStepResults !== void 0 ? { initialStepResults: runOpts.initialStepResults } : {}
+      ...internal?.initialStepResults !== void 0 ? { initialStepResults: internal.initialStepResults } : {},
+      ...internal?.onStepEvent !== void 0 ? { onStepEvent: internal.onStepEvent } : {}
     });
   } finally {
     runSpan.end();
@@ -5440,28 +5577,17 @@ async function dispatchStep(step, input, ctx, options, prevStepResults) {
     }
   }
 }
-function assembleRun(params) {
-  const endedAt = Date.now();
-  return {
-    id: params.runId,
-    name: params.name,
-    status: params.status,
-    startedAt: params.startedAt,
-    endedAt,
-    stepResults: params.stepResults,
-    ...params.output !== void 0 ? { output: params.output } : {},
-    ...params.error !== void 0 ? { error: params.error } : {}
-  };
-}
 async function saveSnapshot(p) {
   const snapshot = {
-    _schemaVersion: 1,
+    _schemaVersion: 2,
+    // SE29 — carries `state`
     runId: p.runId,
     workflowName: p.workflowName,
     currentStepId: p.currentStepId,
     suspendedPayload: p.suspendedPayload,
     stepResults: p.stepResults,
     accumulatedInput: p.accumulatedInput,
+    ...p.state !== void 0 ? { state: p.state } : {},
     suspendedAt: Date.now()
   };
   const store = getSnapshotStoreFor(p.options);
@@ -5494,7 +5620,10 @@ async function resumeWorkflow(opts) {
     signal: opts.signal,
     runId: opts.runId,
     // M3 #62 — restore prior step outputs so the resumed run is not lossy (internal seam).
-    initialStepResults: snapshot.stepResults
+    initialStepResults: snapshot.stepResults,
+    // SE29 — restore shared state (v2 snapshot). A v1 snapshot has no `state` →
+    // executeWorkflow falls back to `options.initialState`.
+    ...snapshot.state !== void 0 ? { restoredState: snapshot.state } : {}
   });
 }
 var init_executor = __esm({
@@ -5502,6 +5631,7 @@ var init_executor = __esm({
     init_workflow();
     init_ctx();
     init_error_shape();
+    init_executor_helpers();
     init_run_id();
     init_single_flight();
     init_snapshot_store();
@@ -21031,6 +21161,45 @@ var PersistenceSchema = zod.z.object({
 
 // src/workflow.ts
 init_path_guard();
+
+// src/internal/workflow/event-stream.ts
+function createEventStream() {
+  const buffer = [];
+  const waiters = [];
+  let ended = false;
+  const stream = {
+    push(event) {
+      if (ended) return;
+      const waiter = waiters.shift();
+      if (waiter !== void 0) waiter({ value: event, done: false });
+      else buffer.push(event);
+    },
+    end() {
+      if (ended) return;
+      ended = true;
+      for (const waiter of waiters.splice(0)) waiter({ value: void 0, done: true });
+    },
+    next() {
+      const buffered = buffer.shift();
+      if (buffered !== void 0) return Promise.resolve({ value: buffered, done: false });
+      if (ended) return Promise.resolve({ value: void 0, done: true });
+      return new Promise((resolve3) => waiters.push(resolve3));
+    },
+    // `for await` calls return() on break/throw — close early so events stop
+    // buffering in memory for a consumer that stopped iterating.
+    return() {
+      stream.end();
+      buffer.length = 0;
+      return Promise.resolve({ value: void 0, done: true });
+    },
+    [Symbol.asyncIterator]() {
+      return stream;
+    }
+  };
+  return stream;
+}
+
+// src/workflow.ts
 init_workflow();
 var RetryPolicySchema = zod.z.object({
   // EC-3 absorbed: maxAttempts MUST be a finite int in [1, 20].
@@ -21042,7 +21211,12 @@ var RetryPolicySchema = zod.z.object({
 });
 var WorkflowOptionsSchema = zod.z.object({
   name: zod.z.string().min(1).max(128),
-  persistence: PersistenceSchema
+  persistence: PersistenceSchema,
+  // SE27 — declared so a future `new WorkflowBuilder(parsed)` refactor cannot
+  // silently drop them (create() passes the ORIGINAL options today, but the
+  // schema is also the documentation of the shape).
+  inputSchema: zod.z.custom().optional(),
+  outputSchema: zod.z.custom().optional()
 });
 var WorkflowBuilder = class {
   /** @internal */
@@ -21219,6 +21393,36 @@ var Workflow = class {
     }
     return result;
   }
+  /**
+   * SE28 — run the workflow and STREAM step-level events as they happen. Returns
+   * an async iterator of {@link WorkflowEvent}s (`step_started` / `step_completed`
+   * / `step_failed` / `workflow_suspended` / `workflow_completed`, top-level
+   * steps) plus a `result` promise resolving to the same terminal
+   * {@link WorkflowRun} `run()` returns. Iterate for progress; await `result` for
+   * the outcome. The stream ends when the run terminates.
+   *
+   * `result` is the AUTHORITATIVE terminal status. Not every terminal state has a
+   * closing event: a step failure emits `step_failed`, but an `outputSchema`
+   * rejection (SE27) or an abort ends the stream WITHOUT `workflow_completed` —
+   * always `await result` to read the final `status`. Consuming order is free:
+   * awaiting `result` without draining, or draining without awaiting `result`,
+   * both work (breaking out of `for await` stops the buffering early).
+   */
+  stream(input, opts) {
+    const queue = createEventStream();
+    const result = (async () => {
+      const { executeWorkflow: executeWorkflow2 } = await Promise.resolve().then(() => (init_executor(), executor_exports));
+      try {
+        return await executeWorkflow2(this._options, this._steps, input, {
+          ...opts,
+          onStepEvent: (event) => queue.push(event)
+        });
+      } finally {
+        queue.end();
+      }
+    })();
+    return Object.assign(queue, { result });
+  }
   /**
    * Resume a suspended workflow from its snapshot. Throws
    * `WorkflowSnapshotNotFoundError` if `runId` is unknown.