@xyne/workflow-sdk 1.0.0

package/dist/types/workflow-config.d.ts

@@ -0,0 +1,122 @@
+import { z } from 'zod';
+import type { TriggerType } from './trigger-types.js';
+import type { StepType } from './step-types.js';
+import { BuiltinStepType } from './known-types.js';
+import type { ControlFlowStepType } from './known-types.js';
+import type { ConditionOperator } from './operators.js';
+/**
+ * Wraps a Zod schema to also accept a `{{...}}` variable reference string.
+ * Used in step config schemas — e.g. `variableRef(z.string())` accepts
+ * either a literal string or a `{{trigger.someField}}` reference.
+ */
+export declare function variableRef<T extends z.ZodTypeAny>(inner: T): z.ZodUnion<[T, z.ZodString]>;
+/**
+ * Given a schema that may be a variableRef union, extract the inner (non-ref) schema.
+ * Returns null if the schema is not a variableRef union.
+ */
+export declare function getVariableRefInnerSchema(schema: z.ZodTypeAny): z.ZodTypeAny | null;
+export interface LeafCondition {
+    variable: string;
+    operator: ConditionOperator;
+    value?: unknown;
+}
+export type Condition = LeafCondition | {
+    all: Condition[];
+} | {
+    any: Condition[];
+};
+export declare const LeafConditionSchema: z.ZodType<LeafCondition>;
+export declare const ConditionSchema: z.ZodType<Condition>;
+/**
+ * What happens after a step completes successfully.
+ * - `continue` (default): move to the next step
+ * - `review`: pause the execution and wait for a human to approve, retry with feedback, or abort
+ */
+export type StepCompletionGate = 'continue' | 'review';
+export interface ActionStepConfig {
+    id: string;
+    type: Exclude<StepType, ControlFlowStepType>;
+    config: Record<string, unknown>;
+    /** Defaults to 'continue' when omitted. */
+    onComplete?: StepCompletionGate;
+}
+export interface ConditionalStepConfig {
+    id: string;
+    type: BuiltinStepType.CONDITIONAL;
+    config: {
+        condition: Condition;
+        if_true: WorkflowStepConfig[];
+        if_false?: WorkflowStepConfig[];
+    };
+    onComplete?: StepCompletionGate;
+}
+export interface SwitchCaseEntry {
+    condition: Condition;
+    label?: string;
+    steps: WorkflowStepConfig[];
+}
+export interface SwitchStepConfig {
+    id: string;
+    type: BuiltinStepType.SWITCH;
+    config: {
+        /**
+         * Cases evaluated top-to-bottom; the first whose condition is true wins.
+         * May be empty when the step is first created — `default` always runs in that case.
+         */
+        cases: SwitchCaseEntry[];
+        /**
+         * Fallback branch — always present, executed when no case matches.
+         * May be empty (`[]`) to no-op the fallback.
+         */
+        default: WorkflowStepConfig[];
+    };
+    onComplete?: StepCompletionGate;
+}
+export type WorkflowStepConfig = ActionStepConfig | ConditionalStepConfig | SwitchStepConfig;
+export declare const WorkflowSettingsSchema: z.ZodObject<{
+    onError: z.ZodDefault<z.ZodEnum<["stop", "continue"]>>;
+    retry: z.ZodOptional<z.ZodObject<{
+        maxAttempts: z.ZodNumber;
+        intervalMs: z.ZodNumber;
+    }, "strip", z.ZodTypeAny, {
+        maxAttempts: number;
+        intervalMs: number;
+    }, {
+        maxAttempts: number;
+        intervalMs: number;
+    }>>;
+}, "strip", z.ZodTypeAny, {
+    onError: "continue" | "stop";
+    retry?: {
+        maxAttempts: number;
+        intervalMs: number;
+    } | undefined;
+}, {
+    onError?: "continue" | "stop" | undefined;
+    retry?: {
+        maxAttempts: number;
+        intervalMs: number;
+    } | undefined;
+}>;
+export type WorkflowSettings = z.infer<typeof WorkflowSettingsSchema>;
+/**
+ * The complete configuration for a workflow.
+ *
+ * - `trigger` — what starts the workflow (host-defined type + config)
+ * - `steps` — the tree of steps to execute
+ * - `settings` — error handling, retry, timeout (optional — defaults to stop-on-error)
+ */
+export interface WorkflowConfig {
+    trigger: {
+        type: TriggerType;
+        config: Record<string, unknown>;
+    };
+    steps: WorkflowStepConfig[];
+    settings?: WorkflowSettings;
+}
+/**
+ * Read a dotted path from a nested object.
+ * `readDottedPath({ a: { b: 1 } }, 'a.b')` → `1`
+ */
+export declare function readDottedPath(payload: Record<string, unknown>, path: string): unknown;
+//# sourceMappingURL=workflow-config.d.ts.map

package/dist/types/workflow-config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"workflow-config.d.ts","sourceRoot":"","sources":["../../src/types/workflow-config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAChD,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAE5D,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAYxD;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,CAAC,SAAS,CAAC,CAAC,UAAU,EAChD,KAAK,EAAE,CAAC,GACP,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,CAM9B;AAED;;;GAGG;AACH,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,CAAC,CAAC,UAAU,GACnB,CAAC,CAAC,UAAU,GAAG,IAAI,CAWrB;AAID,MAAM,WAAW,aAAa;IAC5B,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,iBAAiB,CAAC;IAC5B,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED,MAAM,MAAM,SAAS,GACjB,aAAa,GACb;IAAE,GAAG,EAAE,SAAS,EAAE,CAAA;CAAE,GACpB;IAAE,GAAG,EAAE,SAAS,EAAE,CAAA;CAAE,CAAC;AAEzB,eAAO,MAAM,mBAAmB,EAAE,CAAC,CAAC,OAAO,CAAC,aAAa,CAIvD,CAAC;AAEH,eAAO,MAAM,eAAe,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,CAMhD,CAAC;AAIF;;;;GAIG;AACH,MAAM,MAAM,kBAAkB,GAAG,UAAU,GAAG,QAAQ,CAAC;AAEvD,MAAM,WAAW,gBAAgB;IAC/B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,OAAO,CAAC,QAAQ,EAAE,mBAAmB,CAAC,CAAC;IAC7C,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAChC,2CAA2C;IAC3C,UAAU,CAAC,EAAE,kBAAkB,CAAC;CACjC;AAED,MAAM,WAAW,qBAAqB;IACpC,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,eAAe,CAAC,WAAW,CAAC;IAClC,MAAM,EAAE;QACN,SAAS,EAAE,SAAS,CAAC;QACrB,OAAO,EAAE,kBAAkB,EAAE,CAAC;QAC9B,QAAQ,CAAC,EAAE,kBAAkB,EAAE,CAAC;KACjC,CAAC;IACF,UAAU,CAAC,EAAE,kBAAkB,CAAC;CACjC;AAED,MAAM,WAAW,eAAe;IAC9B,SAAS,EAAE,SAAS,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,kBAAkB,EAAE,CAAC;CAC7B;AAED,MAAM,WAAW,gBAAgB;IAC/B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,eAAe,CAAC,MAAM,CAAC;IAC7B,MAAM,EAAE;QACN;;;WAGG;QACH,KAAK,EAAE,eAAe,EAAE,CAAC;QACzB;;;WAGG;QACH,OAAO,EAAE,kBAAkB,EAAE,CAAC;KAC/B,CAAC;IACF,UAAU,CAAC,EAAE,kBAAkB,CAAC;CACjC;AAED,MAAM,MAAM,kBAAkB,GAC1B,gBAAgB,GAChB,qBAAqB,GACrB,gBAAgB,CAAC;AAIrB,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;;;;;;;EAQjC,CAAC;AAEH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAItE;;;;;;GAMG;AACH,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE;QACP,IAAI,EAAE,WAAW,CAAC;QAClB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;KACjC,CAAC;IACF,KAAK,EAAE,kBAAkB,EAAE,CAAC;IAC5B,QAAQ,CAAC,EAAE,gBAAgB,CAAC;CAC7B;AAID;;;GAGG;AACH,wBAAgB,cAAc,CAC5B,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAChC,IAAI,EAAE,MAAM,GACX,OAAO,CAcT"}

package/dist/types/workflow-config.js

@@ -0,0 +1,71 @@
+import { z } from 'zod';
+import { BuiltinStepType } from './known-types.js';
+import { ConditionOperatorSchema } from './operators.js';
+import { VARIABLE_REF_REGEX, VARIABLE_REF_DESCRIPTION_PREFIX, } from '../util/variable-ref.js';
+// ─── Variable Reference Helpers ───
+const variableRefStringSchema = z
+    .string()
+    .regex(VARIABLE_REF_REGEX, 'Must be a {{context.<path>}} reference');
+/**
+ * Wraps a Zod schema to also accept a `{{...}}` variable reference string.
+ * Used in step config schemas — e.g. `variableRef(z.string())` accepts
+ * either a literal string or a `{{trigger.someField}}` reference.
+ */
+export function variableRef(inner) {
+    return z
+        .union([inner, variableRefStringSchema])
+        .describe(`${VARIABLE_REF_DESCRIPTION_PREFIX}${inner.description ?? inner._def.typeName}`);
+}
+/**
+ * Given a schema that may be a variableRef union, extract the inner (non-ref) schema.
+ * Returns null if the schema is not a variableRef union.
+ */
+export function getVariableRefInnerSchema(schema) {
+    if (schema instanceof z.ZodUnion &&
+        typeof schema.description === 'string' &&
+        schema.description.startsWith(VARIABLE_REF_DESCRIPTION_PREFIX)) {
+        const options = schema._def
+            .options;
+        return options[0] ?? null;
+    }
+    return null;
+}
+export const LeafConditionSchema = z.object({
+    variable: variableRefStringSchema,
+    operator: ConditionOperatorSchema,
+    value: z.unknown().optional(),
+});
+export const ConditionSchema = z.lazy(() => z.union([
+    LeafConditionSchema,
+    z.object({ all: z.array(ConditionSchema) }),
+    z.object({ any: z.array(ConditionSchema) }),
+]));
+// ─── Workflow Settings ───
+export const WorkflowSettingsSchema = z.object({
+    onError: z.enum(['stop', 'continue']).default('stop'),
+    retry: z
+        .object({
+        maxAttempts: z.number().int().min(1).max(10),
+        intervalMs: z.number().int().min(1000),
+    })
+        .optional(),
+});
+// ─── Utility ───
+/**
+ * Read a dotted path from a nested object.
+ * `readDottedPath({ a: { b: 1 } }, 'a.b')` → `1`
+ */
+export function readDottedPath(payload, path) {
+    const parts = path.split('.');
+    let current = payload;
+    for (const part of parts) {
+        if (current === null ||
+            current === undefined ||
+            typeof current !== 'object') {
+            return undefined;
+        }
+        current = current[part];
+    }
+    return current;
+}
+//# sourceMappingURL=workflow-config.js.map

package/dist/types/workflow-config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"workflow-config.js","sourceRoot":"","sources":["../../src/types/workflow-config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAEnD,OAAO,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AAEzD,OAAO,EACL,kBAAkB,EAClB,+BAA+B,GAChC,MAAM,yBAAyB,CAAC;AAEjC,qCAAqC;AAErC,MAAM,uBAAuB,GAAG,CAAC;KAC9B,MAAM,EAAE;KACR,KAAK,CAAC,kBAAkB,EAAE,wCAAwC,CAAC,CAAC;AAEvE;;;;GAIG;AACH,MAAM,UAAU,WAAW,CACzB,KAAQ;IAER,OAAO,CAAC;SACL,KAAK,CAAC,CAAC,KAAK,EAAE,uBAAuB,CAAC,CAAC;SACvC,QAAQ,CACP,GAAG,+BAA+B,GAAG,KAAK,CAAC,WAAW,IAAI,KAAK,CAAC,IAAI,CAAC,QAAQ,EAAE,CAChD,CAAC;AACtC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,yBAAyB,CACvC,MAAoB;IAEpB,IACE,MAAM,YAAY,CAAC,CAAC,QAAQ;QAC5B,OAAO,MAAM,CAAC,WAAW,KAAK,QAAQ;QACtC,MAAM,CAAC,WAAW,CAAC,UAAU,CAAC,+BAA+B,CAAC,EAC9D,CAAC;QACD,MAAM,OAAO,GAAI,MAAmD,CAAC,IAAI;aACtE,OAAO,CAAC;QACX,OAAO,OAAO,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;IAC5B,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAeD,MAAM,CAAC,MAAM,mBAAmB,GAA6B,CAAC,CAAC,MAAM,CAAC;IACpE,QAAQ,EAAE,uBAAuB;IACjC,QAAQ,EAAE,uBAAuB;IACjC,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CAC9B,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,eAAe,GAAyB,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAC/D,CAAC,CAAC,KAAK,CAAC;IACN,mBAAmB;IACnB,CAAC,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,eAAe,CAAC,EAAE,CAAC;IAC3C,CAAC,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,eAAe,CAAC,EAAE,CAAC;CAC5C,CAAC,CACH,CAAC;AA2DF,4BAA4B;AAE5B,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7C,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;IACrD,KAAK,EAAE,CAAC;SACL,MAAM,CAAC;QACN,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;QAC5C,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC;KACvC,CAAC;SACD,QAAQ,EAAE;CACd,CAAC,CAAC;AAsBH,kBAAkB;AAElB;;;GAGG;AACH,MAAM,UAAU,cAAc,CAC5B,OAAgC,EAChC,IAAY;IAEZ,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC9B,IAAI,OAAO,GAAY,OAAO,CAAC;IAC/B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IACE,OAAO,KAAK,IAAI;YAChB,OAAO,KAAK,SAAS;YACrB,OAAO,OAAO,KAAK,QAAQ,EAC3B,CAAC;YACD,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,OAAO,GAAI,OAAmC,CAAC,IAAI,CAAC,CAAC;IACvD,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/util/executable-check.d.ts

@@ -0,0 +1,42 @@
+/**
+ * Executable upload safety check.
+ *
+ * Allow-by-default with a deny-list of known dangerous types — covers the
+ * common attack surface (native binaries, scripts that auto-run, installers,
+ * macro-enabled Office docs) without forcing workflow authors to enumerate
+ * every safe MIME type.
+ *
+ * Two checks run in parallel so spoofed MIME types alone can't bypass:
+ *   1. MIME type matches the deny-list
+ *   2. Filename extension matches the deny-list
+ *
+ * Either match blocks the upload. To accept executables (e.g. a security-
+ * analysis workflow that intentionally examines binaries), the host opts
+ * in via `RuntimeOptions.allowExecutableUploads = true`.
+ */
+/**
+ * MIME types treated as executable / unsafe (lowercase — input is also
+ * lowercased before comparison).
+ */
+export declare const BLOCKED_EXECUTABLE_MIME_TYPES: ReadonlySet<string>;
+/**
+ * File extensions treated as executable / unsafe (case-insensitive, no dot).
+ * The check uses the LAST extension so `report.exe.txt` is treated as text
+ * (Windows shows the trailing extension, which is what the user actually sees).
+ */
+export declare const BLOCKED_EXECUTABLE_EXTENSIONS: ReadonlySet<string>;
+/**
+ * Extract the lowercase extension (no dot) from a filename, or '' if none.
+ * A leading dot doesn't count — `.bashrc` has no extension, not "bashrc".
+ */
+export declare function extensionOf(name: string): string;
+/**
+ * Returns a human-readable reason if the file should be blocked as
+ * executable, or `null` if it's safe.
+ *
+ * Always check both the MIME type and the filename — clients can spoof one
+ * but rarely both. This is defense-in-depth, not authoritative malware
+ * detection (run real AV at the storage layer for that).
+ */
+export declare function isExecutable(mimeType: string, name: string): string | null;
+//# sourceMappingURL=executable-check.d.ts.map

package/dist/util/executable-check.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"executable-check.d.ts","sourceRoot":"","sources":["../../src/util/executable-check.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH;;;GAGG;AACH,eAAO,MAAM,6BAA6B,EAAE,WAAW,CAAC,MAAM,CAwC5D,CAAC;AAEH;;;;GAIG;AACH,eAAO,MAAM,6BAA6B,EAAE,WAAW,CAAC,MAAM,CAmB5D,CAAC;AAEH;;;GAGG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAIhD;AAED;;;;;;;GAOG;AACH,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAS1E"}

package/dist/util/executable-check.js

@@ -0,0 +1,115 @@
+/**
+ * Executable upload safety check.
+ *
+ * Allow-by-default with a deny-list of known dangerous types — covers the
+ * common attack surface (native binaries, scripts that auto-run, installers,
+ * macro-enabled Office docs) without forcing workflow authors to enumerate
+ * every safe MIME type.
+ *
+ * Two checks run in parallel so spoofed MIME types alone can't bypass:
+ *   1. MIME type matches the deny-list
+ *   2. Filename extension matches the deny-list
+ *
+ * Either match blocks the upload. To accept executables (e.g. a security-
+ * analysis workflow that intentionally examines binaries), the host opts
+ * in via `RuntimeOptions.allowExecutableUploads = true`.
+ */
+/**
+ * MIME types treated as executable / unsafe (lowercase — input is also
+ * lowercased before comparison).
+ */
+export const BLOCKED_EXECUTABLE_MIME_TYPES = new Set([
+    // Native binaries
+    'application/x-msdownload',
+    'application/x-msdos-program',
+    'application/x-executable',
+    'application/x-mach-binary',
+    'application/vnd.microsoft.portable-executable',
+    'application/x-msi',
+    'application/x-ms-installer',
+    // Shell + Windows scripts
+    'application/x-sh',
+    'application/x-shellscript',
+    'application/x-bat',
+    'application/x-csh',
+    'application/x-cmd',
+    'application/x-msmetafile',
+    // JavaScript / ECMAScript
+    'text/javascript',
+    'application/javascript',
+    'application/ecmascript',
+    'application/x-javascript',
+    // Java / Flash
+    'application/java-archive',
+    'application/x-java-archive',
+    'application/x-java-jnlp-file',
+    'application/x-shockwave-flash',
+    // Installer / package formats that bundle executables
+    'application/vnd.android.package-archive',
+    'application/x-debian-package',
+    'application/x-rpm',
+    // Macro-enabled Office documents (lowercased — IANA tokens are case-insensitive)
+    'application/vnd.ms-word.document.macroenabled.12',
+    'application/vnd.ms-word.template.macroenabled.12',
+    'application/vnd.ms-excel.sheet.macroenabled.12',
+    'application/vnd.ms-excel.template.macroenabled.12',
+    'application/vnd.ms-excel.addin.macroenabled.12',
+    'application/vnd.ms-excel.sheet.binary.macroenabled.12',
+    'application/vnd.ms-powerpoint.presentation.macroenabled.12',
+    'application/vnd.ms-powerpoint.template.macroenabled.12',
+    'application/vnd.ms-powerpoint.addin.macroenabled.12',
+]);
+/**
+ * File extensions treated as executable / unsafe (case-insensitive, no dot).
+ * The check uses the LAST extension so `report.exe.txt` is treated as text
+ * (Windows shows the trailing extension, which is what the user actually sees).
+ */
+export const BLOCKED_EXECUTABLE_EXTENSIONS = new Set([
+    // Windows
+    'exe', 'msi', 'com', 'scr', 'cmd', 'bat', 'ps1', 'psm1',
+    'vbs', 'vbe', 'wsf', 'wsh', 'hta', 'cpl', 'lnk',
+    'dll', 'sys', 'drv', 'ocx',
+    // macOS / Unix
+    'app', 'dmg', 'pkg',
+    'sh', 'bash', 'zsh', 'fish', 'csh', 'ksh', 'command', 'tool',
+    // Java / Flash
+    'jar', 'war', 'jnlp', 'swf',
+    // Mobile installers
+    'apk', 'ipa', 'xap',
+    // Linux installers
+    'deb', 'rpm', 'run', 'bin',
+    // JavaScript (auto-executes in browser / Node contexts)
+    'js', 'mjs', 'cjs',
+    // Macro-enabled Office
+    'docm', 'dotm', 'xlsm', 'xltm', 'xlam', 'xlsb',
+    'pptm', 'potm', 'ppam', 'ppsm', 'sldm',
+]);
+/**
+ * Extract the lowercase extension (no dot) from a filename, or '' if none.
+ * A leading dot doesn't count — `.bashrc` has no extension, not "bashrc".
+ */
+export function extensionOf(name) {
+    const dot = name.lastIndexOf('.');
+    if (dot <= 0 || dot === name.length - 1)
+        return '';
+    return name.slice(dot + 1).toLowerCase();
+}
+/**
+ * Returns a human-readable reason if the file should be blocked as
+ * executable, or `null` if it's safe.
+ *
+ * Always check both the MIME type and the filename — clients can spoof one
+ * but rarely both. This is defense-in-depth, not authoritative malware
+ * detection (run real AV at the storage layer for that).
+ */
+export function isExecutable(mimeType, name) {
+    if (BLOCKED_EXECUTABLE_MIME_TYPES.has(mimeType.toLowerCase())) {
+        return `Executable MIME type "${mimeType}" is not allowed.`;
+    }
+    const ext = extensionOf(name);
+    if (ext && BLOCKED_EXECUTABLE_EXTENSIONS.has(ext)) {
+        return `Files with .${ext} extension are not allowed.`;
+    }
+    return null;
+}
+//# sourceMappingURL=executable-check.js.map

package/dist/util/executable-check.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"executable-check.js","sourceRoot":"","sources":["../../src/util/executable-check.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH;;;GAGG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAwB,IAAI,GAAG,CAAC;IACxE,kBAAkB;IAClB,0BAA0B;IAC1B,6BAA6B;IAC7B,0BAA0B;IAC1B,2BAA2B;IAC3B,+CAA+C;IAC/C,mBAAmB;IACnB,4BAA4B;IAC5B,0BAA0B;IAC1B,kBAAkB;IAClB,2BAA2B;IAC3B,mBAAmB;IACnB,mBAAmB;IACnB,mBAAmB;IACnB,0BAA0B;IAC1B,0BAA0B;IAC1B,iBAAiB;IACjB,wBAAwB;IACxB,wBAAwB;IACxB,0BAA0B;IAC1B,eAAe;IACf,0BAA0B;IAC1B,4BAA4B;IAC5B,8BAA8B;IAC9B,+BAA+B;IAC/B,sDAAsD;IACtD,yCAAyC;IACzC,8BAA8B;IAC9B,mBAAmB;IACnB,iFAAiF;IACjF,kDAAkD;IAClD,kDAAkD;IAClD,gDAAgD;IAChD,mDAAmD;IACnD,gDAAgD;IAChD,uDAAuD;IACvD,4DAA4D;IAC5D,wDAAwD;IACxD,qDAAqD;CACtD,CAAC,CAAC;AAEH;;;;GAIG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAwB,IAAI,GAAG,CAAC;IACxE,UAAU;IACV,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM;IACvD,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK;IAC/C,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK;IAC1B,eAAe;IACf,KAAK,EAAE,KAAK,EAAE,KAAK;IACnB,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM;IAC5D,eAAe;IACf,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK;IAC3B,oBAAoB;IACpB,KAAK,EAAE,KAAK,EAAE,KAAK;IACnB,mBAAmB;IACnB,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK;IAC1B,wDAAwD;IACxD,IAAI,EAAE,KAAK,EAAE,KAAK;IAClB,uBAAuB;IACvB,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM;IAC9C,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM;CACvC,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,UAAU,WAAW,CAAC,IAAY;IACtC,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IAClC,IAAI,GAAG,IAAI,CAAC,IAAI,GAAG,KAAK,IAAI,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,EAAE,CAAC;IACnD,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;AAC3C,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,YAAY,CAAC,QAAgB,EAAE,IAAY;IACzD,IAAI,6BAA6B,CAAC,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;QAC9D,OAAO,yBAAyB,QAAQ,mBAAmB,CAAC;IAC9D,CAAC;IACD,MAAM,GAAG,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;IAC9B,IAAI,GAAG,IAAI,6BAA6B,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;QAClD,OAAO,eAAe,GAAG,6BAA6B,CAAC;IACzD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/util/schema-convert.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Thin wrapper around `zod-to-json-schema` for registry descriptors.
+ *
+ * Centralised so the conversion options stay consistent across the SDK.
+ */
+import type { z } from 'zod';
+/**
+ * Convert a Zod schema to a plain JSON Schema object.
+ *
+ * Returns `Record<string, unknown>` so callers don't need to
+ * depend on the `zod-to-json-schema` package directly.
+ */
+export declare function zodToJsonSchemaRecord(schema: z.ZodTypeAny): Record<string, unknown>;
+//# sourceMappingURL=schema-convert.d.ts.map

package/dist/util/schema-convert.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema-convert.d.ts","sourceRoot":"","sources":["../../src/util/schema-convert.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,KAAK,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAE7B;;;;;GAKG;AACH,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,CAAC,CAAC,UAAU,GACnB,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAEzB"}

package/dist/util/schema-convert.js

@@ -0,0 +1,16 @@
+/**
+ * Thin wrapper around `zod-to-json-schema` for registry descriptors.
+ *
+ * Centralised so the conversion options stay consistent across the SDK.
+ */
+import { zodToJsonSchema } from 'zod-to-json-schema';
+/**
+ * Convert a Zod schema to a plain JSON Schema object.
+ *
+ * Returns `Record<string, unknown>` so callers don't need to
+ * depend on the `zod-to-json-schema` package directly.
+ */
+export function zodToJsonSchemaRecord(schema) {
+    return zodToJsonSchema(schema);
+}
+//# sourceMappingURL=schema-convert.js.map

package/dist/util/schema-convert.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema-convert.js","sourceRoot":"","sources":["../../src/util/schema-convert.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAGrD;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CACnC,MAAoB;IAEpB,OAAO,eAAe,CAAC,MAAM,CAA4B,CAAC;AAC5D,CAAC"}

package/dist/util/variable-ref.d.ts

@@ -0,0 +1,52 @@
+/**
+ * Single source of truth for the `{{...}}` variable reference wire format.
+ *
+ * Both the engine (runtime resolver) and UI (picker/autocomplete) consume this.
+ * The `context.` prefix is optional for backward compatibility — both
+ * `{{context.trigger.x}}` and `{{trigger.x}}` are recognized.
+ */
+/**
+ * Matches a *pure* single reference (the entire string is a ref).
+ * The `context.` prefix is optional.
+ */
+export declare const VARIABLE_REF_REGEX: RegExp;
+/**
+ * Sentinel prefix for Zod `.describe()` — lets JSON Schema consumers detect
+ * "this is a variableRef-wrapped field" without inspecting the Zod tree.
+ */
+export declare const VARIABLE_REF_DESCRIPTION_PREFIX = "__variableRef__";
+export type VariableRefToken = {
+    kind: 'literal';
+    text: string;
+} | {
+    kind: 'ref';
+    path: string;
+    raw: string;
+};
+/**
+ * Tokenize a string into literal segments and variable references.
+ *
+ *   "hello"                     → [literal('hello')]
+ *   "{{trigger.x}}"             → [ref('trigger.x')]
+ *   "Hi {{trigger.user.name}}!" → [literal('Hi '), ref('trigger.user.name'), literal('!')]
+ */
+export declare function tokenize(input: string): VariableRefToken[];
+/** True iff `value` is exactly one reference with no surrounding text. */
+export declare function isPureRef(value: string): boolean;
+/**
+ * Extract the dotted path from a pure reference: `{{trigger.x}}` → `trigger.x`.
+ * Returns null if `value` isn't a pure reference.
+ */
+export declare function extractRefPath(value: string): string | null;
+export interface FoundRef {
+    /** The dotted path inside the ref, e.g. `trigger.ticket.id`. */
+    refPath: string;
+    /** JSON-pointer-style location in the config object where the ref string lives. */
+    location: string;
+}
+/**
+ * Collect every `{{...}}` reference found anywhere in a nested config object
+ * (strings, arrays, objects). Used by the config validator to flag unresolvable refs.
+ */
+export declare function collectRefs(value: unknown, prefix: string): FoundRef[];
+//# sourceMappingURL=variable-ref.d.ts.map

package/dist/util/variable-ref.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"variable-ref.d.ts","sourceRoot":"","sources":["../../src/util/variable-ref.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH;;;GAGG;AACH,eAAO,MAAM,kBAAkB,QAAkC,CAAC;AAElE;;;GAGG;AACH,eAAO,MAAM,+BAA+B,oBAAoB,CAAC;AAEjE,MAAM,MAAM,gBAAgB,GACxB;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GACjC;IAAE,IAAI,EAAE,KAAK,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC;AAK/C;;;;;;GAMG;AACH,wBAAgB,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,gBAAgB,EAAE,CAoB1D;AAED,0EAA0E;AAC1E,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAEhD;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAG3D;AAED,MAAM,WAAW,QAAQ;IACvB,gEAAgE;IAChE,OAAO,EAAE,MAAM,CAAC;IAChB,mFAAmF;IACnF,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;;GAGG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,GAAG,QAAQ,EAAE,CAItE"}

package/dist/util/variable-ref.js

@@ -0,0 +1,89 @@
+/**
+ * Single source of truth for the `{{...}}` variable reference wire format.
+ *
+ * Both the engine (runtime resolver) and UI (picker/autocomplete) consume this.
+ * The `context.` prefix is optional for backward compatibility — both
+ * `{{context.trigger.x}}` and `{{trigger.x}}` are recognized.
+ */
+/**
+ * Matches a *pure* single reference (the entire string is a ref).
+ * The `context.` prefix is optional.
+ */
+export const VARIABLE_REF_REGEX = /^\{\{(?:context\.)?[^}]+\}\}$/;
+/**
+ * Sentinel prefix for Zod `.describe()` — lets JSON Schema consumers detect
+ * "this is a variableRef-wrapped field" without inspecting the Zod tree.
+ */
+export const VARIABLE_REF_DESCRIPTION_PREFIX = '__variableRef__';
+/** Global regex — captures the dotted path inside `{{...}}`. */
+const TOKEN_REGEX = /\{\{(?:context\.)?([^}]+)\}\}/g;
+/**
+ * Tokenize a string into literal segments and variable references.
+ *
+ *   "hello"                     → [literal('hello')]
+ *   "{{trigger.x}}"             → [ref('trigger.x')]
+ *   "Hi {{trigger.user.name}}!" → [literal('Hi '), ref('trigger.user.name'), literal('!')]
+ */
+export function tokenize(input) {
+    const tokens = [];
+    let lastIndex = 0;
+    TOKEN_REGEX.lastIndex = 0;
+    let match;
+    while ((match = TOKEN_REGEX.exec(input)) !== null) {
+        if (match.index > lastIndex) {
+            tokens.push({
+                kind: 'literal',
+                text: input.slice(lastIndex, match.index),
+            });
+        }
+        tokens.push({ kind: 'ref', path: match[1], raw: match[0] });
+        lastIndex = TOKEN_REGEX.lastIndex;
+    }
+    if (lastIndex < input.length) {
+        tokens.push({ kind: 'literal', text: input.slice(lastIndex) });
+    }
+    return tokens;
+}
+/** True iff `value` is exactly one reference with no surrounding text. */
+export function isPureRef(value) {
+    return VARIABLE_REF_REGEX.test(value);
+}
+/**
+ * Extract the dotted path from a pure reference: `{{trigger.x}}` → `trigger.x`.
+ * Returns null if `value` isn't a pure reference.
+ */
+export function extractRefPath(value) {
+    const m = /^\{\{(?:context\.)?([^}]+)\}\}$/.exec(value);
+    return m?.[1] ?? null;
+}
+/**
+ * Collect every `{{...}}` reference found anywhere in a nested config object
+ * (strings, arrays, objects). Used by the config validator to flag unresolvable refs.
+ */
+export function collectRefs(value, prefix) {
+    const out = [];
+    walk(value, prefix, out);
+    return out;
+}
+function walk(value, prefix, out) {
+    if (typeof value === 'string') {
+        TOKEN_REGEX.lastIndex = 0;
+        let match;
+        while ((match = TOKEN_REGEX.exec(value)) !== null) {
+            out.push({ refPath: match[1], location: prefix });
+        }
+        return;
+    }
+    if (Array.isArray(value)) {
+        for (let i = 0; i < value.length; i++) {
+            walk(value[i], `${prefix}[${i}]`, out);
+        }
+        return;
+    }
+    if (value !== null && typeof value === 'object') {
+        for (const [k, v] of Object.entries(value)) {
+            walk(v, prefix ? `${prefix}.${k}` : k, out);
+        }
+    }
+}
+//# sourceMappingURL=variable-ref.js.map

package/dist/util/variable-ref.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"variable-ref.js","sourceRoot":"","sources":["../../src/util/variable-ref.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH;;;GAGG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,+BAA+B,CAAC;AAElE;;;GAGG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAAG,iBAAiB,CAAC;AAMjE,gEAAgE;AAChE,MAAM,WAAW,GAAG,gCAAgC,CAAC;AAErD;;;;;;GAMG;AACH,MAAM,UAAU,QAAQ,CAAC,KAAa;IACpC,MAAM,MAAM,GAAuB,EAAE,CAAC;IACtC,IAAI,SAAS,GAAG,CAAC,CAAC;IAClB,WAAW,CAAC,SAAS,GAAG,CAAC,CAAC;IAE1B,IAAI,KAA6B,CAAC;IAClC,OAAO,CAAC,KAAK,GAAG,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QAClD,IAAI,KAAK,CAAC,KAAK,GAAG,SAAS,EAAE,CAAC;YAC5B,MAAM,CAAC,IAAI,CAAC;gBACV,IAAI,EAAE,SAAS;gBACf,IAAI,EAAE,KAAK,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC;aAC1C,CAAC,CAAC;QACL,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,CAAE,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAC7D,SAAS,GAAG,WAAW,CAAC,SAAS,CAAC;IACpC,CAAC;IACD,IAAI,SAAS,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC;QAC7B,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IACjE,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,SAAS,CAAC,KAAa;IACrC,OAAO,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AACxC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,KAAa;IAC1C,MAAM,CAAC,GAAG,iCAAiC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACxD,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;AACxB,CAAC;AASD;;;GAGG;AACH,MAAM,UAAU,WAAW,CAAC,KAAc,EAAE,MAAc;IACxD,MAAM,GAAG,GAAe,EAAE,CAAC;IAC3B,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC;IACzB,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,IAAI,CAAC,KAAc,EAAE,MAAc,EAAE,GAAe;IAC3D,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,WAAW,CAAC,SAAS,GAAG,CAAC,CAAC;QAC1B,IAAI,KAA6B,CAAC;QAClC,OAAO,CAAC,KAAK,GAAG,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YAClD,GAAG,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC,CAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;QACrD,CAAC;QACD,OAAO;IACT,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACtC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,GAAG,MAAM,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACzC,CAAC;QACD,OAAO;IACT,CAAC;IACD,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAChD,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC,EAAE,CAAC;YACtE,IAAI,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QAC9C,CAAC;IACH,CAAC;AACH,CAAC"}

package/package.json

@@ -0,0 +1,97 @@
+{
+  "name": "@xyne/workflow-sdk",
+  "version": "1.0.0",
+  "description": "Workflow engine SDK — steps, triggers, executor, agents, and a framework-agnostic HTTP router.",
+  "license": "UNLICENSED",
+  "repository": {
+    "type": "git",
+    "url": "git+ssh://git@ssh.bitbucket.juspay.net/xyne/xyne-spaces.git",
+    "directory": "packages/workflow-sdk"
+  },
+  "type": "module",
+  "files": [
+    "dist"
+  ],
+  "publishConfig": {
+    "access": "public"
+  },
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    },
+    "./types": {
+      "types": "./dist/types/index.d.ts",
+      "import": "./dist/types/index.js"
+    },
+    "./common": {
+      "types": "./dist/common/index.d.ts",
+      "import": "./dist/common/index.js"
+    },
+    "./testing": {
+      "types": "./dist/testing/index.d.ts",
+      "import": "./dist/testing/index.js"
+    },
+    "./agents": {
+      "types": "./dist/agents/index.d.ts",
+      "import": "./dist/agents/index.js"
+    },
+    "./runtime": {
+      "types": "./dist/runtime/types.d.ts",
+      "import": "./dist/runtime/types.js"
+    },
+    "./router": {
+      "types": "./dist/router/types.d.ts",
+      "import": "./dist/router/types.js"
+    },
+    "./client": {
+      "types": "./dist/client/index.d.ts",
+      "import": "./dist/client/index.js"
+    },
+    "./builder": {
+      "types": "./dist/builder/index.d.ts",
+      "import": "./dist/builder/index.js"
+    }
+  },
+  "peerDependencies": {
+    "@earendil-works/pi-agent-core": ">=0.79.0",
+    "@earendil-works/pi-ai": ">=0.79.0",
+    "typebox": ">=1.1.0"
+  },
+  "peerDependenciesMeta": {
+    "@earendil-works/pi-agent-core": {
+      "optional": true
+    },
+    "@earendil-works/pi-ai": {
+      "optional": true
+    },
+    "typebox": {
+      "optional": true
+    }
+  },
+  "scripts": {
+    "build": "tsc",
+    "watch": "tsc --watch",
+    "typecheck": "tsc --noEmit",
+    "test": "vitest run",
+    "test:watch": "vitest",
+    "test:coverage": "vitest run --coverage",
+    "prepublishOnly": "npm run build && npm test"
+  },
+  "dependencies": {
+    "zod": "^3.25.76",
+    "zod-to-json-schema": "^3.25.2"
+  },
+  "devDependencies": {
+    "@earendil-works/pi-agent-core": "^0.79.0",
+    "@earendil-works/pi-ai": "^0.79.0",
+    "@types/node": "^22.0.0",
+    "@vitest/coverage-v8": "^3.2.1",
+    "typebox": "^1.1.38",
+    "typescript": "^5.8.0",
+    "vitest": "^3.2.1"
+  },
+  "engines": {
+    "node": ">=20.0.0"
+  }
+}