@devosurf/tesser 0.1.0-alpha.0

package/dist/index.js

@@ -0,0 +1,2361 @@
+// packages/cli/src/index.ts
+import { execFile as execFile2 } from "node:child_process";
+import { readFileSync as readFileSync3 } from "node:fs";
+import { promisify as promisify2 } from "node:util";
+import { Command } from "commander";
+
+// packages/sdk/src/internal/codec.ts
+var NotSerializableError = class extends TypeError {
+  constructor(path, kind) {
+    super(
+      `value at ${path} is not serializable (${kind}); step results are journaled and must be plain data \u2014 string/number/boolean/null/bigint/Date/Array/Map/Set/Uint8Array/plain object`
+    );
+    this.path = path;
+    this.kind = kind;
+    this.name = "NotSerializableError";
+  }
+  path;
+  kind;
+};
+function describe(value) {
+  if (typeof value === "function") return "a function";
+  if (typeof value === "symbol") return "a symbol";
+  if (value instanceof Promise) return "a Promise \u2014 await it inside the step";
+  const proto = Object.getPrototypeOf(value);
+  const ctor = proto?.constructor?.name;
+  return ctor ? `a ${ctor} instance \u2014 a live handle` : "an exotic object";
+}
+function encodeJournal(value, path = "$") {
+  if (value === void 0) return { $t: "undef" };
+  if (value === null) return null;
+  const t = typeof value;
+  if (t === "string" || t === "boolean") return value;
+  if (t === "number") {
+    const n = value;
+    if (Number.isFinite(n)) return n;
+    return { $t: "num", v: String(n) };
+  }
+  if (t === "bigint") return { $t: "bigint", v: value.toString() };
+  if (t === "function" || t === "symbol") throw new NotSerializableError(path, describe(value));
+  if (value instanceof Date) {
+    const ms = value.getTime();
+    return { $t: "date", v: Number.isNaN(ms) ? null : value.toISOString() };
+  }
+  if (value instanceof Map) {
+    return {
+      $t: "map",
+      v: [...value.entries()].map(([k, v], i) => [
+        encodeJournal(k, `${path}.<key ${i}>`),
+        encodeJournal(v, `${path}.<entry ${i}>`)
+      ])
+    };
+  }
+  if (value instanceof Set) {
+    return {
+      $t: "set",
+      v: [...value.values()].map((v, i) => encodeJournal(v, `${path}.<item ${i}>`))
+    };
+  }
+  if (value instanceof Uint8Array) {
+    return { $t: "bytes", v: Buffer.from(value).toString("base64") };
+  }
+  if (Array.isArray(value)) {
+    return value.map((v, i) => encodeJournal(v, `${path}[${i}]`));
+  }
+  if (t === "object") {
+    const proto = Object.getPrototypeOf(value);
+    if (proto !== Object.prototype && proto !== null) {
+      throw new NotSerializableError(path, describe(value));
+    }
+    const obj = value;
+    const out = {};
+    for (const key of Object.keys(obj)) {
+      out[key] = encodeJournal(obj[key], `${path}.${key}`);
+    }
+    if (Object.prototype.hasOwnProperty.call(obj, "$t")) return { $t: "obj", v: out };
+    return out;
+  }
+  throw new NotSerializableError(path, describe(value));
+}
+function decodeJournal(json) {
+  if (json === null || typeof json !== "object") return json;
+  if (Array.isArray(json)) return json.map(decodeJournal);
+  const tag = json["$t"];
+  if (tag === void 0) {
+    const out = {};
+    for (const key of Object.keys(json)) out[key] = decodeJournal(json[key]);
+    return out;
+  }
+  const v = json["v"];
+  switch (tag) {
+    case "undef":
+      return void 0;
+    case "num":
+      return Number(v);
+    case "bigint":
+      return BigInt(v);
+    case "date":
+      return v === null ? /* @__PURE__ */ new Date(NaN) : new Date(v);
+    case "map":
+      return new Map(v.map((e) => {
+        const [k, val] = e;
+        return [decodeJournal(k), decodeJournal(val)];
+      }));
+    case "set":
+      return new Set(v.map(decodeJournal));
+    case "bytes":
+      return new Uint8Array(Buffer.from(v, "base64"));
+    case "obj": {
+      const out = {};
+      const inner = v;
+      for (const key of Object.keys(inner)) out[key] = decodeJournal(inner[key]);
+      return out;
+    }
+    default:
+      throw new TypeError(`journal codec: unknown tag "${String(tag)}"`);
+  }
+}
+
+// packages/sdk/src/internal/duration.ts
+var UNIT_MS = {
+  ms: 1,
+  s: 1e3,
+  m: 6e4,
+  h: 36e5,
+  d: 864e5,
+  w: 6048e5
+};
+var PART = /(\d+(?:\.\d+)?)(ms|s|m|h|d|w)/g;
+function parseDuration(input, what = "duration") {
+  if (typeof input === "number") {
+    if (!Number.isFinite(input) || input < 0) {
+      throw new TypeError(`${what}: expected a non-negative number of ms, got ${input}`);
+    }
+    return input;
+  }
+  const s = input.trim();
+  let total = 0;
+  let matchedLen = 0;
+  for (const m of s.matchAll(PART)) {
+    total += Number(m[1]) * UNIT_MS[m[2]];
+    matchedLen += m[0].length;
+  }
+  if (matchedLen === 0 || matchedLen !== s.replace(/\s+/g, "").length) {
+    throw new TypeError(
+      `${what}: "${input}" is not a duration \u2014 use forms like "250ms", "30s", "5m", "1h30m", "2d"`
+    );
+  }
+  return Math.round(total);
+}
+
+// packages/sdk/src/errors.ts
+var RETRYABLE = /* @__PURE__ */ Symbol.for("tesser.error.retryable");
+var TERMINAL = /* @__PURE__ */ Symbol.for("tesser.error.terminal");
+var RetryableError = class extends Error {
+  retryAfterMs;
+  constructor(message, options) {
+    super(message, options?.cause === void 0 ? void 0 : { cause: options.cause });
+    this.name = "RetryableError";
+    this.retryAfterMs = options?.retryAfterMs;
+    Object.defineProperty(this, RETRYABLE, { value: true });
+  }
+};
+var TerminalError = class extends Error {
+  constructor(message, options) {
+    super(message, options?.cause === void 0 ? void 0 : { cause: options.cause });
+    this.name = "TerminalError";
+    Object.defineProperty(this, TERMINAL, { value: true });
+  }
+};
+function isRetryableError(err) {
+  return err instanceof RetryableError || typeof err === "object" && err !== null && RETRYABLE in err;
+}
+function isTerminalError(err) {
+  return err instanceof TerminalError || typeof err === "object" && err !== null && TERMINAL in err;
+}
+
+// packages/sdk/src/internal/standard-schema.ts
+var SchemaValidationError = class extends TerminalError {
+  constructor(what, issues) {
+    super(
+      `${what} failed validation: ` + issues.map((i) => i.path === "$" ? i.message : `${i.path}: ${i.message}`).join("; ")
+    );
+    this.what = what;
+    this.issues = issues;
+    this.name = "SchemaValidationError";
+  }
+  what;
+  issues;
+};
+function pathToString(path) {
+  if (!path || path.length === 0) return "$";
+  return "$." + path.map((seg) => String(typeof seg === "object" && seg !== null && "key" in seg ? seg.key : seg)).join(".");
+}
+async function validateSchema(schema, value, what) {
+  let result = schema["~standard"].validate(value);
+  if (result instanceof Promise) result = await result;
+  if (result.issues) {
+    throw new SchemaValidationError(
+      what,
+      result.issues.map((i) => ({ message: i.message, path: pathToString(i.path) }))
+    );
+  }
+  return result.value;
+}
+
+// packages/sdk/src/internal/webhook-verify.ts
+import { createHmac, timingSafeEqual } from "node:crypto";
+var SLACK_TOLERANCE_MS = 5 * 60 * 1e3;
+
+// packages/sdk/src/internal/retry.ts
+var DEFAULT_STEP_RETRY = {
+  maxAttempts: 3,
+  type: "exponential",
+  baseMs: 1e3,
+  maxMs: 36e5,
+  jitter: true
+};
+function resolveRetryPolicy(policy, fallback = DEFAULT_STEP_RETRY) {
+  if (!policy) return fallback;
+  const backoff = policy.backoff;
+  if (backoff === void 0) return { ...fallback, maxAttempts: policy.maxAttempts };
+  if (typeof backoff === "string") {
+    return { ...fallback, maxAttempts: policy.maxAttempts, type: backoff };
+  }
+  return {
+    maxAttempts: policy.maxAttempts,
+    type: backoff.type,
+    baseMs: backoff.base !== void 0 ? parseDuration(backoff.base, "retry.backoff.base") : fallback.baseMs,
+    maxMs: backoff.max !== void 0 ? parseDuration(backoff.max, "retry.backoff.max") : fallback.maxMs,
+    jitter: backoff.jitter ?? fallback.jitter
+  };
+}
+function nextRetryDelayMs(policy, attempt, retryAfterMs, random = Math.random) {
+  if (attempt >= policy.maxAttempts) return null;
+  let delay = policy.type === "fixed" ? policy.baseMs : policy.baseMs * Math.pow(2, attempt - 1);
+  delay = Math.min(delay, policy.maxMs);
+  if (policy.jitter) delay = delay * (0.5 + random() * 0.5);
+  if (retryAfterMs !== void 0) delay = Math.max(delay, retryAfterMs);
+  return Math.round(delay);
+}
+
+// packages/sdk/src/connector/index.ts
+function isAction(node) {
+  return typeof node === "object" && node !== null && node.__action === true;
+}
+
+// packages/sdk/src/internal/client.ts
+function buildConnectorClient(connector, invoke) {
+  function walk(tree, path) {
+    const node = {};
+    for (const [key, child] of Object.entries(tree)) {
+      const childPath = [...path, key];
+      if (isAction(child)) {
+        node[key] = (input) => invoke(childPath, child, input);
+      } else {
+        node[key] = walk(child, childPath);
+      }
+    }
+    return Object.freeze(node);
+  }
+  return walk(connector.__connector.actions ?? {}, []);
+}
+function actionAtPath(connector, path) {
+  let node = connector.__connector.actions ?? {};
+  for (const key of path) {
+    if (node === void 0 || isAction(node)) return void 0;
+    node = node[key];
+  }
+  return node !== void 0 && isAction(node) ? node : void 0;
+}
+function isRetrySafe(def, connectorHasIdempotencyHeader) {
+  if (def.retrySafe !== void 0) return def.retrySafe;
+  if (def.safety === "read") return true;
+  return connectorHasIdempotencyHeader;
+}
+
+// packages/sdk/src/internal/manifest.ts
+var ManifestError = class extends TypeError {
+  constructor(automationId, message) {
+    super(`automation "${automationId}": ${message}`);
+    this.automationId = automationId;
+    this.name = "ManifestError";
+  }
+  automationId;
+};
+function extractAutomationManifest(def) {
+  const connections = {};
+  const connMap = def.connections ?? {};
+  for (const [key, conn] of Object.entries(connMap)) {
+    connections[key] = { connector: conn.id, scope: conn.scope ?? "workspace" };
+  }
+  const secrets2 = {};
+  const secretMap = def.secrets ?? {};
+  for (const [key, sec] of Object.entries(secretMap)) {
+    secrets2[key] = sec.describe !== void 0 ? { describe: sec.describe } : {};
+  }
+  let trigger;
+  const t = def.trigger;
+  switch (t.kind) {
+    case "schedule": {
+      const st = t;
+      trigger = { kind: "schedule", cron: st.cron, ...st.tz !== void 0 ? { tz: st.tz } : {} };
+      break;
+    }
+    case "webhook": {
+      const wt = t;
+      trigger = { kind: "webhook", respond: wt.respond, hasInputSchema: wt.input !== void 0 };
+      break;
+    }
+    case "event": {
+      const et = t;
+      trigger = { kind: "event", event: et.event.name };
+      break;
+    }
+    case "connector": {
+      const ct = t;
+      let key = ct.connectionKey;
+      if (key !== void 0) {
+        const bound = connections[key];
+        if (!bound) {
+          throw new ManifestError(def.id, `trigger names connection "${key}" but connections has no such entry`);
+        }
+        if (bound.connector !== ct.connectorId) {
+          throw new ManifestError(
+            def.id,
+            `trigger connection "${key}" is a ${bound.connector} connection, but the trigger belongs to ${ct.connectorId}`
+          );
+        }
+      } else {
+        const candidates = Object.entries(connections).filter(([, c]) => c.connector === ct.connectorId);
+        if (candidates.length === 0) {
+          throw new ManifestError(
+            def.id,
+            `trigger ${ct.connectorId}.triggers.${ct.triggerId} requires a ${ct.connectorId} entry in connections`
+          );
+        }
+        if (candidates.length > 1) {
+          throw new ManifestError(
+            def.id,
+            `trigger ${ct.connectorId}.triggers.${ct.triggerId} is ambiguous \u2014 name it: { connection: "<key>" } (candidates: ${candidates.map(([k]) => k).join(", ")})`
+          );
+        }
+        key = candidates[0][0];
+      }
+      let params;
+      try {
+        params = encodeJournal(ct.params);
+      } catch (err) {
+        throw new ManifestError(def.id, `trigger params must be plain data: ${err.message}`);
+      }
+      trigger = {
+        kind: "connector",
+        connector: ct.connectorId,
+        trigger: ct.triggerId,
+        params,
+        connection: key,
+        ...ct.every !== void 0 ? { every: ct.every } : {}
+      };
+      break;
+    }
+    default:
+      throw new ManifestError(def.id, `unknown trigger kind "${t.kind}"`);
+  }
+  const models = {};
+  const modelMap = def.models ?? {};
+  for (const [key, m] of Object.entries(modelMap)) {
+    const conn = connections[m.connection];
+    if (!conn) {
+      throw new ManifestError(def.id, `models.${key} names connection "${m.connection}" but connections has no such entry`);
+    }
+    const connector = connMap[m.connection];
+    if (!connector?.__connector.modelProvider) {
+      throw new ManifestError(def.id, `models.${key} uses connection "${m.connection}" but ${conn.connector} is not model-capable`);
+    }
+    models[key] = {
+      connection: m.connection,
+      connector: conn.connector,
+      alias: m.alias,
+      ...m.settings !== void 0 ? { settings: m.settings } : {}
+    };
+  }
+  const operators = {};
+  const operatorMap = def.operators ?? {};
+  for (const [key, op] of Object.entries(operatorMap)) {
+    if (!models[op.model]) {
+      throw new ManifestError(def.id, `operators.${key} references unknown model "${op.model}"`);
+    }
+    const tools = [];
+    for (const tool of op.tools) {
+      const [connKey, ...actionPath] = tool.split(".");
+      const conn = connections[connKey];
+      if (!conn) {
+        throw new ManifestError(def.id, `operators.${key} tool "${tool}" names undeclared connection "${connKey}"`);
+      }
+      const connector = connMap[connKey];
+      const action = connector ? actionAtPath(connector, actionPath) : void 0;
+      if (!action) {
+        throw new ManifestError(def.id, `operators.${key} tool "${tool}" is not a declared Action`);
+      }
+      tools.push({ path: tool, connection: connKey, action: actionPath.join("."), safety: action.safety });
+    }
+    operators[key] = { model: op.model, instructions: op.instructions, tools, maxTurns: op.maxTurns };
+  }
+  if (Object.keys(operators).length > 0 && !def.budget?.models) {
+    throw new ManifestError(def.id, `budget.models is required when operators are declared`);
+  }
+  const harnesses = {};
+  const harnessMap = def.harnesses ?? {};
+  for (const [key, h] of Object.entries(harnessMap)) {
+    const conn = connections[h.connection];
+    if (!conn) {
+      throw new ManifestError(def.id, `harnesses.${key} names connection "${h.connection}" but connections has no such entry`);
+    }
+    const connector = connMap[h.connection];
+    if (!connector?.__connector.harnessProvider) {
+      throw new ManifestError(def.id, `harnesses.${key} uses connection "${h.connection}" but ${conn.connector} is not harness-capable`);
+    }
+    harnesses[key] = {
+      connection: h.connection,
+      connector: conn.connector,
+      sandbox: h.sandbox,
+      permissions: h.permissions,
+      ...h.timeout !== void 0 ? { timeout: h.timeout } : {},
+      ...h.maxOutputBytes !== void 0 ? { maxOutputBytes: h.maxOutputBytes } : {}
+    };
+  }
+  return {
+    id: def.id,
+    trigger,
+    connections,
+    secrets: secrets2,
+    models,
+    operators,
+    harnesses,
+    ...def.budget !== void 0 ? { budget: def.budget } : {},
+    ...def.retry !== void 0 ? { retry: def.retry } : {},
+    ...def.concurrency !== void 0 ? {
+      concurrency: {
+        limit: def.concurrency.limit,
+        hasKey: typeof def.concurrency.key === "function",
+        onConflict: def.concurrency.onConflict ?? "queue"
+      }
+    } : {},
+    hasInputSchema: def.input !== void 0,
+    hasOutputSchema: def.output !== void 0
+  };
+}
+
+// packages/sdk/src/internal/operators.ts
+var approvalSchema = {
+  "~standard": {
+    version: 1,
+    vendor: "tesser",
+    validate(value) {
+      if (typeof value === "object" && value !== null && typeof value.approved === "boolean") {
+        const v = value;
+        return {
+          value: {
+            approved: v.approved,
+            ...typeof v.reason === "string" ? { reason: v.reason } : {}
+          }
+        };
+      }
+      return { issues: [{ message: "expected { approved: boolean }" }] };
+    }
+  }
+};
+function buildOperators(def, ctx, callModel) {
+  const usage = { tokens: 0, outputTokens: 0 };
+  const out = {};
+  for (const [operatorKey, op] of Object.entries(def.operators ?? {})) {
+    out[operatorKey] = (input) => executeOperator({ def, ctx, operatorKey, op, input, usage, callModel });
+  }
+  return Object.freeze(out);
+}
+async function executeOperator(opts) {
+  const { def, ctx, operatorKey, op } = opts;
+  const modelKey = op.model;
+  const model2 = def.models?.[modelKey];
+  if (!model2) throw new TerminalError(`operator.${operatorKey}: unknown model "${modelKey}"`);
+  const validatedInput = await validateSchema(op.input, opts.input, `operator.${operatorKey} input`);
+  const serialInput = toSerializable(validatedInput, `operator.${operatorKey} input`);
+  const tools = await resolveTools(def, op, operatorKey);
+  const messages = [{ role: "user", content: JSON.stringify(serialInput) }];
+  const outputJsonSchema = await schemaJson(op.output);
+  let tainted = true;
+  for (let turn = 1; turn <= op.maxTurns; turn++) {
+    assertBudget(def, model2, opts.usage, operatorKey);
+    const request = {
+      operatorKey,
+      modelKey,
+      alias: model2.alias,
+      instructions: op.instructions,
+      input: serialInput,
+      messages,
+      tools: tools.map((t) => t.descriptor),
+      ...model2.settings !== void 0 ? { settings: model2.settings } : {},
+      ...outputJsonSchema !== void 0 ? { outputJsonSchema } : {}
+    };
+    const response = await ctx.step(
+      `operator.${operatorKey}.model.${turn}`,
+      async () => toSerializable(
+        await opts.callModel({ automationId: def.id, operatorKey, modelKey, model: model2, request }),
+        `operator.${operatorKey} model response`
+      )
+    );
+    validateModelResponse(response, operatorKey, turn);
+    addUsage(opts.usage, response);
+    assertBudget(def, model2, opts.usage, operatorKey);
+    const toolCalls = response.toolCalls ?? [];
+    if (toolCalls.length > 0) {
+      messages.push({ role: "assistant", content: response.content ?? `requested ${toolCalls.length} tool call(s)` });
+      let index = 0;
+      for (const call of toolCalls) {
+        index++;
+        const tool = toolForCall(tools, call);
+        if (!tool) {
+          throw new TerminalError(`operator.${operatorKey}: model requested undeclared tool "${call.name}"`);
+        }
+        if (tool.action.safety === "write") {
+          const approval = await ctx.waitForSignal(`operator.${operatorKey}.approval`, {
+            schema: approvalSchema,
+            timeout: "1h"
+          });
+          if (approval === null) {
+            throw new TerminalError(`operator.${operatorKey}: approval timed out for write tool ${tool.descriptor.path}`);
+          }
+          if (!approval.approved) {
+            throw new TerminalError(`operator.${operatorKey}: approval denied for write tool ${tool.descriptor.path}`);
+          }
+        }
+        const toolResult = await ctx.step(`operator.${operatorKey}.tool.${turn}.${index}.${tool.descriptor.path}`, async () => {
+          const fn = actionFunction(ctx.connections, tool.connectionKey, tool.actionPath);
+          return toSerializable(await fn(call.input), `operator.${operatorKey} tool ${tool.descriptor.path} output`);
+        });
+        if (tool.action.safety === "read") tainted = true;
+        messages.push({
+          role: "tool",
+          toolCallId: call.id,
+          content: minimizeToolOutput(toolResult, { tainted })
+        });
+      }
+      continue;
+    }
+    const rawOutput = response.output !== void 0 ? response.output : parseJson(response.content, operatorKey, turn);
+    return validateSchema(op.output, rawOutput, `operator.${operatorKey} output`);
+  }
+  throw new TerminalError(`operator.${operatorKey}: exceeded maxTurns (${op.maxTurns})`);
+}
+async function resolveTools(def, op, operatorKey) {
+  const out = [];
+  const connections = def.connections ?? {};
+  for (const toolPath of op.tools) {
+    const [connectionKey, ...actionPath] = toolPath.split(".");
+    const connector = connections[connectionKey];
+    if (!connector) throw new TerminalError(`operator.${operatorKey}: undeclared tool connection "${connectionKey}"`);
+    const action = actionAtPath(connector, actionPath);
+    if (!action) throw new TerminalError(`operator.${operatorKey}: tool "${toolPath}" is not a declared Action`);
+    const inputSchema = await schemaJson(action.input);
+    out.push({
+      connectionKey,
+      actionPath,
+      action,
+      descriptor: {
+        name: toolName(toolPath),
+        path: toolPath,
+        ...action.describe !== void 0 ? { description: action.describe } : {},
+        ...inputSchema !== void 0 ? { inputSchema } : {}
+      }
+    });
+  }
+  return out;
+}
+function toolForCall(tools, call) {
+  return tools.find((t) => call.name === t.descriptor.name || call.name === t.descriptor.path);
+}
+function toolName(path) {
+  return path.replace(/[^A-Za-z0-9_-]/g, "__");
+}
+function actionFunction(connections, connectionKey, actionPath) {
+  let node = connections[connectionKey];
+  for (const seg of actionPath) node = node?.[seg];
+  if (typeof node !== "function") {
+    throw new TerminalError(`operator tool ${connectionKey}.${actionPath.join(".")} is not callable`);
+  }
+  return node;
+}
+function validateModelResponse(response, operatorKey, turn) {
+  if (typeof response !== "object" || response === null) {
+    throw new TerminalError(`operator.${operatorKey} turn ${turn}: model adapter returned a non-object response`);
+  }
+  if (!response.usage || typeof response.usage.inputTokens !== "number" || typeof response.usage.outputTokens !== "number") {
+    throw new TerminalError(`operator.${operatorKey} turn ${turn}: model response missing usage tokens`);
+  }
+}
+function addUsage(usage, response) {
+  usage.tokens += response.usage.inputTokens + response.usage.outputTokens + (response.usage.reasoningTokens ?? 0);
+  usage.outputTokens += response.usage.outputTokens;
+}
+function assertBudget(def, model2, usage, operatorKey) {
+  const budget = def.budget?.models;
+  if (!budget) throw new TerminalError(`operator.${operatorKey}: budget.models is required`);
+  if (usage.tokens >= budget.tokens) {
+    throw new TerminalError(`operator.${operatorKey}: model token budget exceeded (${usage.tokens}/${budget.tokens})`);
+  }
+  if (usage.outputTokens >= budget.outputTokens) {
+    throw new TerminalError(
+      `operator.${operatorKey}: model output-token budget exceeded (${usage.outputTokens}/${budget.outputTokens})`
+    );
+  }
+  const maxOut = model2.settings?.maxOutputTokens;
+  if (maxOut !== void 0 && maxOut > budget.outputTokens - usage.outputTokens) {
+    throw new TerminalError(`operator.${operatorKey}: model maxOutputTokens exceeds remaining output-token budget`);
+  }
+}
+function parseJson(content, operatorKey, turn) {
+  if (!content) throw new TerminalError(`operator.${operatorKey} turn ${turn}: model returned no output`);
+  const trimmed = content.trim().replace(/^```(?:json)?\s*/i, "").replace(/\s*```$/, "");
+  try {
+    return JSON.parse(trimmed);
+  } catch (cause) {
+    throw new TerminalError(`operator.${operatorKey} turn ${turn}: model output was not JSON`, { cause });
+  }
+}
+function toSerializable(value, what) {
+  try {
+    return decodeJournal(encodeJournal(value));
+  } catch (cause) {
+    throw new TerminalError(`${what} is not serializable`, { cause });
+  }
+}
+function minimizeToolOutput(value, opts) {
+  const raw = JSON.stringify({ tainted: opts.tainted, value: encodeJournal(value) });
+  return raw.length <= 4e3 ? raw : raw.slice(0, 3997) + "...";
+}
+async function schemaJson(schema) {
+  const std = schema["~standard"];
+  try {
+    let json;
+    const direct = schema;
+    if (typeof direct.toJSONSchema === "function") json = direct.toJSONSchema();
+    else if (std?.vendor === "zod") {
+      const zod = await import("zod");
+      const convert = zod.toJSONSchema ?? zod.z?.toJSONSchema;
+      if (convert) json = convert(schema, { unrepresentable: "any" });
+    }
+    if (json === void 0) return void 0;
+    return decodeJournal(encodeJournal(json));
+  } catch {
+    return void 0;
+  }
+}
+
+// packages/sdk/src/internal/harnesses.ts
+function buildHarnesses(def, _ctx, callHarness) {
+  const out = {};
+  const harnesses = def.harnesses ?? {};
+  for (const [harnessKey, h] of Object.entries(harnesses)) {
+    out[harnessKey] = {
+      run: async (request) => {
+        if (!request || typeof request.prompt !== "string" || request.prompt.length === 0) {
+          throw new TerminalError(`harness.${harnessKey}: prompt is required`);
+        }
+        if (!request.output) throw new TerminalError(`harness.${harnessKey}: output schema is required`);
+        const raw = await callHarness({ automationId: def.id, harnessKey, harness: h, request });
+        const serial = toSerializable2(raw, `harness.${harnessKey} result`);
+        const output = await validateSchema(request.output, serial.output, `harness.${harnessKey} output`);
+        return { ...serial, output: toSerializable2(output, `harness.${harnessKey} output`) };
+      }
+    };
+  }
+  return Object.freeze(out);
+}
+function toSerializable2(value, what) {
+  try {
+    return decodeJournal(encodeJournal(value));
+  } catch (cause) {
+    throw new TerminalError(`${what} is not serializable`, { cause });
+  }
+}
+
+// packages/cli/src/exit-codes.ts
+var EXIT = {
+  OK: 0,
+  /** Unexpected/internal error. */
+  ERROR: 1,
+  /** Usage error — bad arguments or no linked project. */
+  USAGE: 2,
+  /** Tests failed (machine-actionable detail on stdout with --json). */
+  TESTS_FAILED: 3,
+  /** Deploy halted: credentials needed — a connect link is on stdout. */
+  HALTED_CREDENTIALS: 4,
+  /** Could not reach or authenticate against the instance. */
+  AUTH: 5,
+  /** Resource not found. */
+  NOT_FOUND: 6,
+  /** Conflict / invalid state for the requested operation. */
+  CONFLICT: 7,
+  /** Deploy failed (build error or red test gate). */
+  DEPLOY_FAILED: 8
+};
+
+// packages/cli/src/output.ts
+var Output = class {
+  constructor(json) {
+    this.json = json;
+  }
+  json;
+  /** Emit the command's data result. `human` renders the no-JSON form. */
+  data(value, human) {
+    if (this.json) {
+      process.stdout.write(JSON.stringify(value, null, 2) + "\n");
+    } else {
+      process.stdout.write((human ? human(value) : JSON.stringify(value, null, 2)) + "\n");
+    }
+  }
+  /** Progress/notes → stderr, never stdout. */
+  log(msg) {
+    process.stderr.write(msg + "\n");
+  }
+  fail(code, message, extra) {
+    if (this.json) {
+      process.stdout.write(JSON.stringify({ error: { code, message, ...extra } }, null, 2) + "\n");
+    } else {
+      process.stderr.write(`error: ${message}
+`);
+      if (extra) process.stderr.write(JSON.stringify(extra, null, 2) + "\n");
+    }
+    process.exit(code);
+  }
+};
+var CliError = class extends Error {
+  constructor(code, message, extra) {
+    super(message);
+    this.code = code;
+    this.extra = extra;
+  }
+  code;
+  extra;
+};
+function toExit(err, out) {
+  if (err instanceof CliError) out.fail(err.code, err.message, err.extra);
+  out.fail(EXIT.ERROR, err instanceof Error ? err.message : String(err));
+}
+
+// packages/cli/src/client.ts
+var ApiClient = class {
+  constructor(baseUrl, token) {
+    this.baseUrl = baseUrl;
+    this.token = token;
+  }
+  baseUrl;
+  token;
+  async request(method, path, body) {
+    if (!this.token) {
+      throw new CliError(
+        EXIT.AUTH,
+        "no API token \u2014 run `tesser login --url <instance> --token <tsk_\u2026>` or set TESSER_TOKEN"
+      );
+    }
+    let res;
+    try {
+      res = await fetch(`${this.baseUrl}/api${path}`, {
+        method,
+        headers: {
+          authorization: `Bearer ${this.token}`,
+          ...body !== void 0 ? { "content-type": "application/json" } : {}
+        },
+        ...body !== void 0 ? { body: JSON.stringify(body) } : {}
+      });
+    } catch (cause) {
+      throw new CliError(EXIT.AUTH, `cannot reach instance at ${this.baseUrl} (${String(cause)})`);
+    }
+    const text = await res.text();
+    let parsed;
+    try {
+      parsed = text.length > 0 ? JSON.parse(text) : null;
+    } catch {
+      parsed = { raw: text };
+    }
+    if (!res.ok) {
+      const errBody = parsed;
+      const message = errBody?.error?.message ?? `instance responded ${res.status}`;
+      if (res.status === 401) throw new CliError(EXIT.AUTH, message);
+      if (res.status === 404) throw new CliError(EXIT.NOT_FOUND, message);
+      if (res.status === 400) throw new CliError(EXIT.USAGE, message);
+      if (res.status === 409) throw new CliError(EXIT.CONFLICT, message);
+      throw new CliError(EXIT.ERROR, message);
+    }
+    return parsed;
+  }
+  get(path) {
+    return this.request("GET", path);
+  }
+  post(path, body) {
+    return this.request("POST", path, body);
+  }
+  put(path, body) {
+    return this.request("PUT", path, body);
+  }
+  delete(path) {
+    return this.request("DELETE", path);
+  }
+};
+
+// packages/cli/src/config.ts
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { dirname, join } from "node:path";
+var CONFIG_PATH = join(
+  process.env["TESSER_CONFIG_DIR"] ?? join(homedir(), ".config", "tesser"),
+  "config.json"
+);
+function readConfig() {
+  try {
+    return JSON.parse(readFileSync(CONFIG_PATH, "utf8"));
+  } catch {
+    return {};
+  }
+}
+function writeConfig(config) {
+  mkdirSync(dirname(CONFIG_PATH), { recursive: true });
+  writeFileSync(CONFIG_PATH, JSON.stringify(config, null, 2) + "\n", { mode: 384 });
+}
+function activeProfile(config, name) {
+  const profileName = name ?? config.current ?? "default";
+  return config.profiles?.[profileName] ?? {};
+}
+function findProjectRoot(start = process.cwd()) {
+  let dir = start;
+  for (; ; ) {
+    if (existsSync(join(dir, "tesser.json"))) return dir;
+    const parent = dirname(dir);
+    if (parent === dir) return null;
+    dir = parent;
+  }
+}
+function readLinkManifest(root) {
+  try {
+    return JSON.parse(readFileSync(join(root, "tesser.json"), "utf8"));
+  } catch {
+    return null;
+  }
+}
+function resolveTarget(opts) {
+  const config = readConfig();
+  const profile = activeProfile(config, opts.profile);
+  const projectRoot = findProjectRoot();
+  const manifest = projectRoot ? readLinkManifest(projectRoot) : null;
+  return {
+    url: opts.url ?? manifest?.instance ?? process.env["TESSER_URL"] ?? profile.url ?? "http://localhost:8377",
+    token: opts.token ?? process.env["TESSER_TOKEN"] ?? profile.token,
+    project: manifest?.project,
+    projectRoot
+  };
+}
+
+// packages/cli/src/project.ts
+import { mkdtempSync, existsSync as existsSync2, readdirSync, statSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join as join2 } from "node:path";
+import { pathToFileURL } from "node:url";
+import { build } from "esbuild";
+function discoverLocalAutomations(projectRoot) {
+  const root = join2(projectRoot, "automations");
+  if (!existsSync2(root)) return [];
+  const out = [];
+  for (const name of readdirSync(root).sort()) {
+    const dir = join2(root, name);
+    if (!statSync(dir).isDirectory()) continue;
+    const entry = join2(dir, "index.ts");
+    if (!existsSync2(entry)) continue;
+    const hasTests = readdirSync(dir).some((f) => /\.test\.(ts|js|mts|mjs)$/.test(f));
+    out.push({ automationId: name, dir, entry, hasTests });
+  }
+  return out;
+}
+async function loadAutomationDef(entry) {
+  const outDir = mkdtempSync(join2(tmpdir(), "tesser-cli-"));
+  const outFile = join2(outDir, "bundle.mjs");
+  await build({
+    entryPoints: [entry],
+    outfile: outFile,
+    bundle: true,
+    platform: "node",
+    format: "esm",
+    target: "node20",
+    packages: "bundle",
+    logLevel: "silent"
+  });
+  const mod = await import(pathToFileURL(outFile).href);
+  if (!mod.default || typeof mod.default.run !== "function") {
+    throw new Error(`${entry}: no default export from defineAutomation`);
+  }
+  return mod.default;
+}
+
+// packages/cli/src/commands/auth.ts
+import { spawn } from "node:child_process";
+async function authClaudeCode(out, instanceUrl, opts) {
+  const mode = opts.mode ?? "subscription";
+  if (mode !== "subscription" && mode !== "apiKey") {
+    throw new CliError(EXIT.USAGE, "claude-code auth mode must be subscription or apiKey");
+  }
+  const token = opts.tokenStdin === true || opts.fromEnv !== void 0 ? await tokenFromPipeOrEnv(opts) : mode === "subscription" ? await runClaudeSetupToken(out, opts.bin ?? "claude") : await tokenFromPipeOrEnv({ ...opts, tokenStdin: true });
+  await postConnection({
+    instanceUrl,
+    connect: opts.connect,
+    connector: "claude-code",
+    mode,
+    scope: opts.scope ?? "workspace",
+    ...opts.endUserId !== void 0 ? { endUserId: opts.endUserId } : {},
+    fields: mode === "subscription" ? { oauth_token: token } : { api_key: token }
+  });
+  out.data({ connector: "claude-code", mode, connected: true }, () => `claude-code ${mode} connected \u2713`);
+}
+async function authPi(out, instanceUrl, opts) {
+  const mode = opts.mode ?? "anthropicOAuth";
+  if (mode !== "anthropicOAuth" && mode !== "anthropicApiKey") {
+    throw new CliError(EXIT.USAGE, "pi auth mode must be anthropicOAuth or anthropicApiKey");
+  }
+  const token = await tokenFromPipeOrEnv(opts);
+  await postConnection({
+    instanceUrl,
+    connect: opts.connect,
+    connector: "pi",
+    mode,
+    scope: opts.scope ?? "workspace",
+    ...opts.endUserId !== void 0 ? { endUserId: opts.endUserId } : {},
+    fields: mode === "anthropicOAuth" ? { oauth_token: token } : { api_key: token }
+  });
+  out.data({ connector: "pi", mode, connected: true }, () => `pi ${mode} connected \u2713`);
+}
+async function tokenFromPipeOrEnv(opts) {
+  if (opts.fromEnv !== void 0) {
+    const value2 = process.env[opts.fromEnv];
+    if (!value2) throw new CliError(EXIT.USAGE, `env ${opts.fromEnv} is empty or missing`);
+    return value2;
+  }
+  if (opts.tokenStdin !== true) {
+    throw new CliError(EXIT.USAGE, "pass --token-stdin or --from-env <NAME> so the token never appears in argv");
+  }
+  const chunks = [];
+  for await (const chunk of process.stdin) chunks.push(chunk);
+  const value = Buffer.concat(chunks).toString("utf8").trim();
+  if (value.length === 0) throw new CliError(EXIT.USAGE, "empty token on stdin");
+  return value;
+}
+async function runClaudeSetupToken(out, bin) {
+  out.log("starting `claude setup-token`; complete the browser login if prompted...");
+  const raw = await runInteractiveCapture(bin, ["setup-token"]);
+  const token = extractClaudeToken(raw);
+  if (!token) {
+    throw new CliError(
+      EXIT.ERROR,
+      "could not find a Claude Code OAuth token in `claude setup-token` output; rerun with `claude setup-token | tesser auth claude-code --connect <url> --token-stdin`"
+    );
+  }
+  return token;
+}
+function runInteractiveCapture(command, args) {
+  return new Promise((resolve, reject) => {
+    const child = spawn(command, args, { stdio: ["inherit", "pipe", "pipe"] });
+    let raw = "";
+    const onData = (buf) => {
+      const text = buf.toString("utf8");
+      raw += text;
+      process.stderr.write(sanitizeSetupOutput(text));
+    };
+    child.stdout.on("data", onData);
+    child.stderr.on("data", onData);
+    child.on("error", reject);
+    child.on("close", (code) => {
+      if (code === 0) resolve(raw);
+      else reject(new CliError(EXIT.ERROR, `${command} ${args.join(" ")} exited ${code ?? 1}`));
+    });
+  });
+}
+function extractClaudeToken(raw) {
+  const envMatch = raw.match(/CLAUDE_CODE_OAUTH_TOKEN\s*=\s*([^\s]+)/);
+  if (envMatch?.[1]) return envMatch[1].trim().replace(/^['"]|['"]$/g, "");
+  const candidates = raw.split(/\r?\n/).map((l) => l.trim()).filter((l) => /^[A-Za-z0-9._-]{40,}$/.test(l) && !/^https?:/i.test(l));
+  return candidates.at(-1) ?? null;
+}
+function sanitizeSetupOutput(text) {
+  return text.replace(/(CLAUDE_CODE_OAUTH_TOKEN\s*=\s*)[^\s]+/g, "$1[redacted]").replace(/\b[A-Za-z0-9._-]{64,}\b/g, "[redacted-token]");
+}
+async function postConnection(opts) {
+  const url = connectPostUrl(opts.instanceUrl, opts.connect);
+  const body = new URLSearchParams({ connector: opts.connector, mode: opts.mode, scope: opts.scope });
+  if (opts.endUserId !== void 0) body.set("end_user_id", opts.endUserId);
+  for (const [key, value] of Object.entries(opts.fields)) body.set(`field_${key}`, value);
+  const res = await fetch(url, {
+    method: "POST",
+    headers: { "content-type": "application/x-www-form-urlencoded" },
+    body: body.toString(),
+    redirect: "manual"
+  });
+  if (res.status >= 300 && res.status < 400) return;
+  const text = await res.text().catch(() => "");
+  throw new CliError(EXIT.ERROR, `connect page rejected ${opts.connector} ${opts.mode}: ${res.status}${text ? ` ${text}` : ""}`);
+}
+function connectPostUrl(instanceUrl, connect) {
+  if (/^https?:\/\//i.test(connect)) {
+    const u = new URL(connect);
+    const match = u.pathname.match(/\/connect\/([^/]+)/);
+    if (!match?.[1]) throw new CliError(EXIT.USAGE, "--connect must be a Tesser /connect/<token> URL or token");
+    return `${u.origin}/connect/${match[1]}/connection`;
+  }
+  const token = connect.replace(/^\/?connect\//, "");
+  if (!/^cl_[a-f0-9]+$/i.test(token)) throw new CliError(EXIT.USAGE, "--connect must be a Tesser /connect/<token> URL or token");
+  return `${instanceUrl.replace(/\/$/, "")}/connect/${token}/connection`;
+}
+
+// packages/cli/src/commands/deploy.ts
+async function deploy(out, api2, project, opts) {
+  await api2.post(`/projects/${project}/sync`, {
+    ...opts.ref !== void 0 ? { ref: opts.ref } : {},
+    ...opts.local !== void 0 ? { localPath: opts.local } : {}
+  });
+  out.log(`sync queued for ${project}${opts.local ? " (local tree)" : opts.ref ? ` @ ${opts.ref}` : ""}`);
+  if (opts.wait === false) {
+    out.data({ queued: true });
+    process.exit(EXIT.OK);
+  }
+  const deadline = Date.now() + (opts.timeoutMs ?? 10 * 6e4);
+  let last = {};
+  while (Date.now() < deadline) {
+    await new Promise((r) => setTimeout(r, 750));
+    last = await api2.get(`/projects/${project}/deploys/latest`);
+    const status = last.repo?.status;
+    if (status === "syncing" || status === "idle" || status === void 0) continue;
+    const report = last.repo?.report ?? {};
+    if (status === "halted-credentials") {
+      out.data(
+        { status, connectUrl: report.connectUrl, report },
+        () => `deploy HALTED \u2014 credentials needed.
+Open this link in a browser to connect:
+  ${report.connectUrl}
+Then rerun: tesser deploy${opts.local ? " --local" : ""}`
+      );
+      process.exit(EXIT.HALTED_CREDENTIALS);
+    }
+    if (status === "failed") {
+      out.data(
+        { status, report, error: last.repo?.error },
+        () => [
+          "deploy FAILED:",
+          ...(report.failed ?? []).map((f) => `  ${f.automation} [${f.stage}]: ${f.reason.split("\n")[0]}`),
+          ...last.repo?.error ? [`  ${last.repo.error}`] : []
+        ].join("\n")
+      );
+      process.exit(EXIT.DEPLOY_FAILED);
+    }
+    if (status === "synced") {
+      out.data(
+        { status, report, live: last.live },
+        () => [
+          `deploy OK @ ${report.sha?.slice(0, 8) ?? "?"} \u2192 ${report.env}`,
+          `  built:     ${report.built?.join(", ") || "(none)"}`,
+          `  unchanged: ${report.unchanged?.join(", ") || "(none)"}`,
+          ...report.removed?.length ? [`  removed:   ${report.removed.join(", ")}`] : []
+        ].join("\n")
+      );
+      process.exit(EXIT.OK);
+    }
+  }
+  throw new CliError(EXIT.ERROR, "timed out waiting for the deploy to settle", { last });
+}
+
+// packages/cli/src/commands/dev.ts
+import { randomBytes } from "node:crypto";
+import { spawn as spawn2 } from "node:child_process";
+import { existsSync as existsSync3, watch } from "node:fs";
+import { join as join3, dirname as dirname2 } from "node:path";
+function findServerBin(start) {
+  const envBin = process.env["TESSER_SERVER_BIN"];
+  if (envBin && existsSync3(envBin)) {
+    return envBin.endsWith(".mjs") || envBin.endsWith(".js") ? [process.execPath, envBin] : [envBin];
+  }
+  let dir = start;
+  for (; ; ) {
+    const entry = join3(dir, "node_modules", "@devosurf", "tesser-server", "bin", "tesser-server.mjs");
+    if (existsSync3(entry)) return [process.execPath, entry];
+    const shim = join3(dir, "node_modules", ".bin", "tesser-server");
+    if (existsSync3(shim)) return [shim];
+    const parent = dirname2(dir);
+    if (parent === dir) return null;
+    dir = parent;
+  }
+}
+async function dev(out, projectRoot, project, opts) {
+  const bin = findServerBin(projectRoot);
+  if (!bin) {
+    throw new CliError(
+      EXIT.USAGE,
+      "tesser-server binary not found \u2014 install @devosurf/tesser-server (pnpm add -D @devosurf/tesser-server) or set TESSER_SERVER_BIN"
+    );
+  }
+  const port = opts.port ?? 8377;
+  const token = `tsk_${randomBytes(24).toString("hex")}`;
+  const url = `http://localhost:${port}`;
+  out.log(`starting local instance on ${url} (embedded postgres at .tesser/pglite)`);
+  const child = spawn2(bin[0], bin.slice(1), {
+    env: {
+      ...process.env,
+      PORT: String(port),
+      TESSER_DATA_DIR: join3(projectRoot, ".tesser"),
+      TESSER_BOOTSTRAP_TOKEN: token,
+      TESSER_BASE_URL: url,
+      DATABASE_URL: ""
+    },
+    stdio: ["ignore", "inherit", "inherit"]
+  });
+  const stop = () => {
+    child.kill("SIGTERM");
+  };
+  process.on("SIGINT", () => {
+    stop();
+    process.exit(0);
+  });
+  process.on("SIGTERM", stop);
+  const api2 = new ApiClient(url, token);
+  const deadline = Date.now() + 3e4;
+  for (; ; ) {
+    try {
+      await api2.get("/health");
+      break;
+    } catch {
+      if (Date.now() > deadline) throw new CliError(EXIT.ERROR, "local instance did not come up");
+      await new Promise((r) => setTimeout(r, 300));
+    }
+  }
+  await api2.post("/projects", { name: project });
+  const syncOnce = async () => {
+    await api2.post(`/projects/${project}/sync`, { localPath: projectRoot });
+    for (let i = 0; i < 600; i++) {
+      await new Promise((r) => setTimeout(r, 500));
+      const state = await api2.get(
+        `/projects/${project}/deploys/latest`
+      );
+      const status = state.repo?.status;
+      if (status === "syncing") continue;
+      if (status === "halted-credentials") {
+        out.log(`HALTED \u2014 connect credentials in your browser:
+  ${state.repo?.report?.connectUrl}`);
+      } else if (status === "failed") {
+        out.log(`deploy failed: ${JSON.stringify(state.repo?.report?.failed ?? [])}`);
+      } else if (status === "synced") {
+        out.log(`deployed \u2713 \u2014 webhooks at ${url}/hooks/${project}/<automation>`);
+      }
+      return;
+    }
+  };
+  await syncOnce();
+  if (opts.watch !== false) {
+    let timer = null;
+    watch(join3(projectRoot, "automations"), { recursive: true }, () => {
+      if (timer) clearTimeout(timer);
+      timer = setTimeout(() => {
+        out.log("change detected \u2014 redeploying\u2026");
+        void syncOnce();
+      }, 400);
+    });
+    out.log("watching automations/ for changes (ctrl-c to stop)");
+    await new Promise(() => {
+    });
+  } else {
+    stop();
+  }
+}
+
+// packages/cli/src/commands/init.ts
+import { existsSync as existsSync4, mkdirSync as mkdirSync2, writeFileSync as writeFileSync2 } from "node:fs";
+import { join as join4 } from "node:path";
+var EXAMPLE_AUTOMATION = `import { defineAutomation, onWebhook } from "@devosurf/tesser-sdk";
+import { z } from "zod";
+
+export default defineAutomation({
+  id: "hello",
+  trigger: onWebhook({ input: z.object({ name: z.string().default("world") }) }),
+  output: z.object({ greeting: z.string() }),
+
+  run: async (input, ctx) => {
+    // Plain TypeScript. Durability ONLY from ctx.step() (every side effect goes inside one).
+    const greeting = await ctx.step("compose", async () => \`hello, \${input.name}!\`);
+    return { greeting };
+  },
+});
+`;
+var EXAMPLE_TEST = `import { createTest } from "@devosurf/tesser-testing";
+import automation from "./index";
+
+test("greets by name", async () => {
+  const t = createTest({ automation });
+  const { result } = await t.run({ input: { name: "tesser" } });
+  expect(result).toEqual({ greeting: "hello, tesser!" });
+});
+`;
+function init(out, name, opts) {
+  if (!/^[a-z][a-z0-9-]{0,63}$/.test(name)) {
+    throw new CliError(EXIT.USAGE, "project name must be kebab-case");
+  }
+  const root = join4(opts.dir ?? process.cwd(), name);
+  if (existsSync4(join4(root, "tesser.json"))) {
+    throw new CliError(EXIT.CONFLICT, `${root} is already a Tesser project`);
+  }
+  mkdirSync2(join4(root, "automations", "hello"), { recursive: true });
+  writeFileSync2(
+    join4(root, "tesser.json"),
+    JSON.stringify({ project: name, ...opts.instance !== void 0 ? { instance: opts.instance } : {} }, null, 2) + "\n"
+  );
+  writeFileSync2(
+    join4(root, "package.json"),
+    JSON.stringify(
+      {
+        name,
+        private: true,
+        type: "module",
+        packageManager: "pnpm@9.12.0",
+        scripts: { test: "tesser test", deploy: "tesser deploy", dev: "tesser dev" },
+        dependencies: { "@devosurf/tesser-sdk": "latest", "@devosurf/tesser-connectors": "latest", zod: "^4" },
+        devDependencies: {
+          "@devosurf/tesser": "latest",
+          "@devosurf/tesser-server": "latest",
+          "@devosurf/tesser-testing": "latest",
+          vitest: "^4"
+        }
+      },
+      null,
+      2
+    ) + "\n"
+  );
+  writeFileSync2(
+    join4(root, "tsconfig.json"),
+    JSON.stringify(
+      {
+        compilerOptions: {
+          target: "ES2022",
+          module: "ESNext",
+          moduleResolution: "Bundler",
+          strict: true,
+          skipLibCheck: true,
+          types: ["vitest/globals"]
+        },
+        include: ["automations"]
+      },
+      null,
+      2
+    ) + "\n"
+  );
+  writeFileSync2(
+    join4(root, "vitest.config.ts"),
+    `import { defineConfig } from "vitest/config";
+export default defineConfig({ test: { globals: true, include: ["automations/**/*.test.ts"] } });
+`
+  );
+  writeFileSync2(join4(root, ".gitignore"), "node_modules/\n.tesser/\n.env\n");
+  writeFileSync2(join4(root, "automations", "hello", "index.ts"), EXAMPLE_AUTOMATION);
+  writeFileSync2(join4(root, "automations", "hello", "index.test.ts"), EXAMPLE_TEST);
+  out.data(
+    { created: root, next: ["cd " + name, "git init && git add -A && git commit -m init", "npm install (or pnpm)", "tesser link", "tesser test"] },
+    () => `created ${root}
+next:
+  cd ${name}
+  git init && git add -A && git commit -m init
+  pnpm install
+  tesser link    # register on your instance
+  tesser test    # green in milliseconds`
+  );
+}
+
+// packages/cli/src/commands/replay.ts
+import { mkdirSync as mkdirSync3, writeFileSync as writeFileSync3, existsSync as existsSync5 } from "node:fs";
+import { join as join5 } from "node:path";
+async function replay(out, api2, projectRoot, runId) {
+  const { replay: run } = await api2.get(`/runs/${runId}/replay`);
+  const dir = join5(projectRoot, "automations", run.automation_id);
+  if (!existsSync5(dir)) {
+    throw new CliError(EXIT.NOT_FOUND, `automation directory not found locally: automations/${run.automation_id}`);
+  }
+  const shortId = run.id.slice(0, 8);
+  const fixtureDir = join5(dir, "__replays__");
+  mkdirSync3(fixtureDir, { recursive: true });
+  const fixturePath = join5(fixtureDir, `${shortId}.replay.json`);
+  writeFileSync3(
+    fixturePath,
+    JSON.stringify(
+      {
+        runId: run.id,
+        automation: run.automation_id,
+        recordedStatus: run.status,
+        trigger: run.trigger,
+        input: run.input,
+        output: run.output,
+        error: run.error,
+        steps: run.journal.filter((s) => !s.name.startsWith("$"))
+      },
+      null,
+      2
+    ) + "\n"
+  );
+  const testPath = join5(dir, `replay-${shortId}.test.ts`);
+  writeFileSync3(
+    testPath,
+    `// Regression frozen from run ${run.id} (recorded status: ${run.status}).
+// Generated by \`tesser replay\` \u2014 adjust the final assertion once the bug is fixed.
+import { createTest } from "@devosurf/tesser-testing";
+import automation from "./index";
+import replay from "./__replays__/${shortId}.replay.json";
+
+test("replays run ${shortId} exactly", async () => {
+  const t = createTest({ automation });
+  // Recorded step results replay through the journal \u2014 completed steps return their
+  // captured values without executing, exactly like durable recovery (ADR-0002).
+  const journal = replay.steps
+    .filter((s) => s.status === "completed")
+    .map((s) => ({ name: s.name, occurrence: s.occurrence, result: s.result }));
+  const result = await t.run({ input: replay.input ?? undefined, journal });
+
+  // Recorded behaviour at capture time \u2014 keep as the regression contract:
+  expect(result.status).toBe(${JSON.stringify(run.status === "completed" ? "completed" : "failed")});
+${run.status === "completed" ? `  expect(result.result).toEqual(replay.output);` : `  // This run FAILED in production. After fixing, flip the expectation to "completed".`}
+});
+`
+  );
+  out.data(
+    { fixture: fixturePath, test: testPath, recordedStatus: run.status },
+    () => `frozen run ${shortId} \u2192 ${testPath}
+fixture: ${fixturePath}
+run \`tesser test\` to execute it`
+  );
+}
+
+// packages/cli/src/commands/test.ts
+import { execFile } from "node:child_process";
+import { existsSync as existsSync6 } from "node:fs";
+import { join as join6 } from "node:path";
+import { promisify } from "node:util";
+
+// packages/testing/src/engine.ts
+import { AsyncLocalStorage } from "node:async_hooks";
+
+// packages/testing/src/spy.ts
+var order = 1;
+function createSpy(name) {
+  const mock = {
+    calls: [],
+    results: [],
+    instances: [],
+    contexts: [],
+    invocationCallOrder: [],
+    lastCall: void 0
+  };
+  const captured = [];
+  const fn = ((...args) => {
+    mock.calls.push(args);
+    mock.invocationCallOrder.push(order++);
+    mock.lastCall = args;
+  });
+  fn._isMockFunction = true;
+  fn.getMockName = () => name;
+  fn.mock = mock;
+  fn.captured = captured;
+  return fn;
+}
+function recordCall(spy, call) {
+  spy(...call.args);
+  spy.mock.results.push(
+    call.error !== void 0 ? { type: "throw", value: call.error } : { type: "return", value: call.result }
+  );
+  spy.captured.push(call);
+}
+
+// packages/testing/src/sample.ts
+function toJsonSchema(schema) {
+  const std = schema["~standard"];
+  if (!std) return void 0;
+  try {
+    if (std.vendor === "zod") {
+      const z = schema;
+      const anySchema = z;
+      if (typeof anySchema.toJSONSchema === "function") {
+        return anySchema.toJSONSchema();
+      }
+      return void 0;
+    }
+  } catch {
+    return void 0;
+  }
+  return void 0;
+}
+async function toJsonSchemaAsync(schema) {
+  const direct = toJsonSchema(schema);
+  if (direct) return direct;
+  const std = schema["~standard"];
+  if (std?.vendor === "zod") {
+    try {
+      const zod = await import("zod");
+      const convert = zod.toJSONSchema ?? zod.z?.toJSONSchema;
+      if (convert) return convert(schema, { unrepresentable: "any" });
+    } catch {
+      return void 0;
+    }
+  }
+  return void 0;
+}
+var SAMPLE_STRINGS = {
+  email: "sample@example.com",
+  uri: "https://example.com/sample",
+  url: "https://example.com/sample",
+  uuid: "00000000-0000-4000-8000-000000000000",
+  "date-time": "2026-01-01T00:00:00.000Z",
+  date: "2026-01-01",
+  time: "00:00:00"
+};
+function sampleFromJsonSchema(js, depth = 0) {
+  if (depth > 8) return null;
+  if (js.default !== void 0) return js.default;
+  if (js.const !== void 0) return js.const;
+  if (js.enum && js.enum.length > 0) return js.enum[0];
+  const variants = js.anyOf ?? js.oneOf;
+  if (variants && variants.length > 0) {
+    const pick = variants.find((v) => v.type !== "null") ?? variants[0];
+    return sampleFromJsonSchema(pick, depth + 1);
+  }
+  if (js.allOf && js.allOf.length > 0) {
+    return js.allOf.reduce((acc, part) => {
+      const piece = sampleFromJsonSchema(part, depth + 1);
+      return typeof piece === "object" && piece !== null ? { ...acc, ...piece } : acc;
+    }, {});
+  }
+  const type = Array.isArray(js.type) ? js.type[0] : js.type;
+  switch (type) {
+    case "string": {
+      if (js.format && SAMPLE_STRINGS[js.format]) return SAMPLE_STRINGS[js.format];
+      const min = js.minLength ?? 0;
+      const base = "sample";
+      return base.length >= min ? base : base + "x".repeat(min - base.length);
+    }
+    case "number":
+    case "integer": {
+      let n = 1;
+      if (js.minimum !== void 0) n = js.minimum;
+      if (js.exclusiveMinimum !== void 0) n = js.exclusiveMinimum + 1;
+      if (js.maximum !== void 0 && n > js.maximum) n = js.maximum;
+      return type === "integer" ? Math.round(n) : n;
+    }
+    case "boolean":
+      return true;
+    case "null":
+      return null;
+    case "array": {
+      const itemSchema = Array.isArray(js.items) ? js.items[0] : js.items;
+      const count = Math.max(js.minItems ?? 1, 1);
+      if (!itemSchema) return [];
+      return Array.from({ length: count }, () => sampleFromJsonSchema(itemSchema, depth + 1));
+    }
+    case "object":
+    default: {
+      if (js.properties) {
+        const out = {};
+        const required = new Set(js.required ?? Object.keys(js.properties));
+        for (const [key, prop] of Object.entries(js.properties)) {
+          if (required.has(key) || prop.default !== void 0) {
+            out[key] = sampleFromJsonSchema(prop, depth + 1);
+          }
+        }
+        return out;
+      }
+      if (type === "object" || type === void 0) return {};
+      return null;
+    }
+  }
+}
+async function sampleFromSchema(schema) {
+  const js = await toJsonSchemaAsync(schema);
+  if (!js) return void 0;
+  return sampleFromJsonSchema(js);
+}
+
+// packages/testing/src/engine.ts
+var TestConfigError = class extends Error {
+  constructor(message, hint) {
+    super(hint ? `${message}
+  hint: ${hint}` : message);
+    this.hint = hint;
+    this.name = "TestConfigError";
+  }
+  hint;
+};
+function serializeError(err) {
+  const e = err instanceof Error ? err : new Error(String(err));
+  return {
+    name: e.name,
+    message: e.message,
+    retryable: isRetryableError(err),
+    terminal: isTerminalError(err)
+  };
+}
+async function executeAutomation(def, opts = {}) {
+  const journal = [];
+  const journalByKey = /* @__PURE__ */ new Map();
+  for (const seeded of opts.journal ?? []) {
+    const occurrence = seeded.occurrence ?? 1;
+    const entry = {
+      kind: "step",
+      name: seeded.name,
+      occurrence,
+      status: "completed",
+      attempts: 1,
+      result: encodeJournal(seeded.result)
+    };
+    journalByKey.set(`step:${seeded.name}#${occurrence}`, entry);
+    journal.push(entry);
+  }
+  const emitted = [];
+  const slept = [];
+  const undone = [];
+  const logs = [];
+  const connectorCalls = [];
+  const undoStack = [];
+  const spies = /* @__PURE__ */ new Map();
+  const spyFor = (key) => {
+    let s = spies.get(key);
+    if (!s) {
+      s = createSpy(key);
+      spies.set(key, s);
+    }
+    return s;
+  };
+  for (const key of Object.keys(opts.mocks ?? {})) spyFor(key);
+  const calls = new Proxy({}, {
+    get: (_t, prop) => typeof prop === "string" ? spyFor(prop) : void 0,
+    has: () => true,
+    ownKeys: () => [...spies.keys()],
+    getOwnPropertyDescriptor: () => ({ enumerable: true, configurable: true })
+  });
+  const activeStep = new AsyncLocalStorage();
+  const logger = {
+    info: (msg, meta) => logs.push({ level: "info", msg, ...meta ? { meta } : {} }),
+    warn: (msg, meta) => logs.push({ level: "warn", msg, ...meta ? { meta } : {} }),
+    error: (msg, meta) => logs.push({ level: "error", msg, ...meta ? { meta } : {} })
+  };
+  const connections = {};
+  for (const [connKey, connector] of Object.entries(def.connections ?? {})) {
+    connections[connKey] = buildConnectorClient(connector, async (path, actionDef, rawInput) => {
+      const step = activeStep.getStore();
+      const actionPath = path.join(".");
+      const fullPath = `${connKey}.${actionPath}`;
+      if (!step) {
+        throw new TestConfigError(
+          `connector call ${fullPath} happened outside ctx.step()`,
+          `side effects must live inside a step (ADR-0002) \u2014 wrap the call: ctx.step("name", () => ctx.connections.${fullPath}(...))`
+        );
+      }
+      const input2 = await validateSchema(
+        actionDef.input,
+        rawInput ?? {},
+        `${fullPath} input`
+      );
+      if (!isRetrySafe(actionDef, connector.__connector.idempotencyHeader !== void 0)) {
+        step.sawUnsafeWrite = true;
+      }
+      const resolve = async () => {
+        const connMockRoot = opts.connections?.[connKey];
+        if (connMockRoot !== void 0) {
+          let node = connMockRoot;
+          for (const seg of path) node = node?.[seg];
+          if (node !== void 0) {
+            return {
+              value: typeof node === "function" ? await node(input2) : node,
+              validate: false
+            };
+          }
+        }
+        const stepMock = opts.mocks?.[step.name];
+        if (stepMock !== void 0) {
+          return {
+            value: typeof stepMock === "function" ? await stepMock(
+              input2,
+              { action: actionPath, connection: connKey }
+            ) : stepMock,
+            validate: false
+          };
+        }
+        const sample = connector.__connector.samples?.[actionPath];
+        if (sample !== void 0) return { value: sample, validate: true };
+        const derived = await sampleFromSchema(actionDef.output);
+        if (derived !== void 0) return { value: derived, validate: true };
+        throw new TestConfigError(
+          `no mock for connector call ${fullPath} in step "${step.name}"`,
+          `provide mocks: { "${step.name}": () => <result> } or connections: { ${connKey}: { ${actionPath.split(".").join(": { ")}: () => <result> ${"}".repeat(actionPath.split(".").length)} }`
+        );
+      };
+      try {
+        const { value, validate } = await resolve();
+        const result = validate ? await validateSchema(actionDef.output, value, `${fullPath} sample output`) : value;
+        const record = { args: [input2], step: step.name, action: fullPath, result };
+        recordCall(spyFor(step.name), record);
+        recordCall(spyFor(fullPath), record);
+        connectorCalls.push({ step: step.name, action: fullPath, input: input2 });
+        return result;
+      } catch (err) {
+        const record = { args: [input2], step: step.name, action: fullPath, error: String(err) };
+        recordCall(spyFor(step.name), record);
+        recordCall(spyFor(fullPath), record);
+        connectorCalls.push({ step: step.name, action: fullPath, input: input2 });
+        throw err;
+      }
+    });
+  }
+  const secretNames = Object.keys(def.secrets ?? {});
+  const secrets2 = {};
+  for (const name of secretNames) {
+    secrets2[name] = opts.secrets?.[name] ?? `test-secret-${name}`;
+  }
+  const stepOccurrence = /* @__PURE__ */ new Map();
+  const signalOccurrence = /* @__PURE__ */ new Map();
+  const defaultRetry = resolveRetryPolicy(def.retry);
+  const modelTurns = /* @__PURE__ */ new Map();
+  const harnessInvocations = /* @__PURE__ */ new Map();
+  const ctx = {
+    async step(name, fn, stepOpts) {
+      if (typeof name !== "string" || name.length === 0 || typeof fn !== "function") {
+        throw new TestConfigError(`ctx.step: expected (name, fn) \u2014 got name=${JSON.stringify(name)}`);
+      }
+      const occ = (stepOccurrence.get(name) ?? 0) + 1;
+      stepOccurrence.set(name, occ);
+      const key = `step:${name}#${occ}`;
+      const cached = journalByKey.get(key);
+      if (cached?.status === "completed") {
+        const value = decodeJournal(cached.result);
+        if (stepOpts?.undo) undoStack.push({ name, undo: () => stepOpts.undo(value) });
+        return value;
+      }
+      const policy = resolveRetryPolicy(stepOpts?.retry, defaultRetry);
+      const timeoutMs = stepOpts?.timeout !== void 0 ? parseDuration(stepOpts.timeout, "step timeout") : void 0;
+      const entry = { kind: "step", name, occurrence: occ, status: "failed", attempts: 0 };
+      journal.push(entry);
+      journalByKey.set(key, entry);
+      let lastError;
+      for (let attempt = 1; attempt <= policy.maxAttempts; attempt++) {
+        entry.attempts = attempt;
+        const state = { name, sawUnsafeWrite: false };
+        try {
+          let resultPromise = Promise.resolve(activeStep.run(state, () => fn()));
+          if (timeoutMs !== void 0) {
+            resultPromise = Promise.race([
+              resultPromise,
+              new Promise(
+                (_r, reject) => setTimeout(
+                  () => reject(new TestConfigError(`step "${name}" exceeded its ${stepOpts?.timeout} timeout`)),
+                  Math.min(timeoutMs, 5e3)
+                ).unref?.()
+              )
+            ]);
+          }
+          const result = await resultPromise;
+          const encoded = encodeJournal(result);
+          entry.status = "completed";
+          entry.result = encoded;
+          if (stepOpts?.undo) undoStack.push({ name, undo: () => stepOpts.undo(result) });
+          return result;
+        } catch (err) {
+          lastError = err;
+          entry.error = serializeError(err);
+          if (isTerminalError(err)) break;
+          if (state.sawUnsafeWrite && stepOpts?.retry === void 0) {
+            logger.warn(
+              `step "${name}" performed a non-retry-safe write and will not auto-retry \u2014 pass StepOpts.retry to opt in`
+            );
+            break;
+          }
+          const delay = nextRetryDelayMs(policy, attempt, isRetryableError(err) ? err.retryAfterMs : void 0);
+          if (delay === null) break;
+          slept.push(`retry:${name}#${occ}@${attempt}`);
+        }
+      }
+      entry.status = "failed";
+      throw lastError;
+    },
+    connections,
+    secrets: secrets2,
+    operators: {},
+    harnesses: {},
+    async sleep(duration) {
+      parseDuration(duration, "ctx.sleep");
+      slept.push(duration);
+    },
+    async waitForSignal(name, sOpts) {
+      const occ = (signalOccurrence.get(name) ?? 0) + 1;
+      signalOccurrence.set(name, occ);
+      const provided = opts.signals?.[name];
+      let value;
+      if (typeof provided === "function") value = provided(occ);
+      else if (Array.isArray(provided)) value = provided[occ - 1];
+      else value = provided;
+      const entry = { kind: "signal", name, occurrence: occ, status: "completed", attempts: 1 };
+      journal.push(entry);
+      if (value === void 0) {
+        if (sOpts.timeout !== void 0) {
+          parseDuration(sOpts.timeout, "waitForSignal timeout");
+          entry.status = "timed-out";
+          return null;
+        }
+        throw new TestConfigError(
+          `run is suspended waiting for signal "${name}" (occurrence ${occ}) with no timeout`,
+          `provide signals: { "${name}": <payload> } in t.run(...)`
+        );
+      }
+      const validated = await validateSchema(sOpts.schema, value, `signal "${name}" payload`);
+      entry.result = encodeJournal(validated);
+      return validated;
+    },
+    async emit(event, payload) {
+      const validated = await validateSchema(event.schema, payload, `event "${event.name}" payload`);
+      emitted.push({ event: event.name, payload: validated });
+    },
+    ...opts.request !== void 0 || def.trigger.kind === "webhook" ? {
+      request: opts.request ?? {
+        headers: { "content-type": "application/json" },
+        query: {},
+        rawBody: new TextEncoder().encode(JSON.stringify(opts.input ?? {}))
+      }
+    } : {},
+    logger,
+    run: { id: `test_${Math.random().toString(36).slice(2, 10)}`, attempt: 1, automationId: def.id }
+  };
+  ctx.operators = buildOperators(def, ctx, async ({ operatorKey, modelKey, request }) => {
+    const key = `${operatorKey}:${modelKey}`;
+    const turn = (modelTurns.get(key) ?? 0) + 1;
+    modelTurns.set(key, turn);
+    const script = opts.models?.[operatorKey]?.[modelKey];
+    if (script === void 0) {
+      throw new TestConfigError(
+        `unscripted model turn for operator "${operatorKey}" model "${modelKey}" (turn ${turn})`,
+        `provide models: { ${operatorKey}: { ${modelKey}: [{ output: <typed output>, usage: { inputTokens, outputTokens } }] } }`
+      );
+    }
+    const picked = Array.isArray(script) ? script[turn - 1] : script;
+    if (picked === void 0) {
+      throw new TestConfigError(`no scripted model response for operator "${operatorKey}" model "${modelKey}" turn ${turn}`);
+    }
+    const response = typeof picked === "function" ? await picked(request, { operatorKey, modelKey, turn }) : picked;
+    recordCall(spyFor(`operator.${operatorKey}.model`), { args: [request], result: response });
+    recordCall(spyFor(`operator.${operatorKey}.model.${turn}`), { args: [request], result: response });
+    return response;
+  });
+  ctx.harnesses = buildHarnesses(def, ctx, async ({ harnessKey, request }) => {
+    const step = activeStep.getStore();
+    if (!step) {
+      throw new TestConfigError(
+        `harness "${harnessKey}" ran outside ctx.step()`,
+        `Harnesses are durable Step runners \u2014 wrap the call: ctx.step("name", () => ctx.harnesses.${harnessKey}.run(...))`
+      );
+    }
+    const invocation = (harnessInvocations.get(harnessKey) ?? 0) + 1;
+    harnessInvocations.set(harnessKey, invocation);
+    const script = opts.harnesses?.[harnessKey];
+    if (script === void 0) {
+      throw new TestConfigError(
+        `unscripted Harness run for "${harnessKey}"`,
+        `provide harnesses: { ${harnessKey}: { output: <typed output>, status: "completed", artifacts: [], adapter: "test" } }`
+      );
+    }
+    const picked = Array.isArray(script) ? script[invocation - 1] : script;
+    if (picked === void 0) throw new TestConfigError(`no scripted Harness result for "${harnessKey}" invocation ${invocation}`);
+    const result = typeof picked === "function" ? await picked(request, { harnessKey, invocation }) : picked;
+    recordCall(spyFor(`harness.${harnessKey}`), { args: [request], step: step.name, result });
+    return result;
+  });
+  let input = opts.input;
+  const trigger = def.trigger;
+  let inputSchema = def.input ?? (trigger.kind === "webhook" ? trigger.input : trigger.kind === "event" ? trigger.event?.schema : void 0);
+  if (trigger.kind === "connector" && trigger.connectorId !== void 0) {
+    const connector = Object.values(
+      def.connections ?? {}
+    ).find((c) => c.id === trigger.connectorId);
+    const decl = connector?.__connector.triggers?.[trigger.triggerId ?? ""];
+    if (decl) {
+      inputSchema = def.input ?? decl.output;
+      if (input === void 0) {
+        input = connector?.__connector.samples?.[`trigger:${trigger.triggerId}`];
+      }
+    }
+  }
+  if (input === void 0 && inputSchema && trigger.kind !== "schedule") {
+    input = await sampleFromSchema(inputSchema);
+  }
+  if (inputSchema && input !== void 0) {
+    input = await validateSchema(inputSchema, input, `automation "${def.id}" input`);
+  }
+  const finish = (status, result, error) => {
+    const stepsByName = {};
+    for (const e of journal) {
+      if (e.kind !== "step" || e.status !== "completed") continue;
+      (stepsByName[e.name] ??= []).push(decodeJournal(e.result));
+    }
+    const steps = {};
+    for (const [name, results] of Object.entries(stepsByName)) {
+      steps[name] = results.length === 1 ? results[0] : results;
+    }
+    const failedEntry = journal.find((e) => e.kind === "step" && e.status === "failed");
+    return {
+      status,
+      ...result !== void 0 ? { result } : {},
+      ...error !== void 0 ? { error } : {},
+      steps,
+      journal,
+      calls,
+      emitted,
+      slept,
+      undone,
+      logs,
+      failure: () => status === "completed" ? null : {
+        automation: def.id,
+        status: "failed",
+        error,
+        ...failedEntry ? {
+          failedStep: {
+            name: failedEntry.name,
+            occurrence: failedEntry.occurrence,
+            attempts: failedEntry.attempts,
+            error: failedEntry.error
+          }
+        } : {},
+        steps: journal.filter((e) => e.kind === "step").map((e) => ({ name: e.name, occurrence: e.occurrence, status: e.status, attempts: e.attempts })),
+        connectorCalls,
+        ...failedEntry?.error?.terminal === false ? {} : failedEntry ? { suggestion: `step "${failedEntry.name}" failed terminally \u2014 fix the input or mark the error retryable` } : {}
+      }
+    };
+  };
+  try {
+    let output = await def.run(input, ctx);
+    if (def.output) {
+      output = await validateSchema(def.output, output, `automation "${def.id}" output`);
+    }
+    return finish("completed", output);
+  } catch (err) {
+    for (const item of [...undoStack].reverse()) {
+      try {
+        await item.undo();
+        undone.push(item.name);
+      } catch (undoErr) {
+        logger.error(`undo for step "${item.name}" failed: ${String(undoErr)}`);
+        undone.push(`${item.name} (failed)`);
+      }
+    }
+    const failedStep = journal.find((e) => e.kind === "step" && e.status === "failed");
+    return finish("failed", void 0, {
+      ...serializeError(err),
+      ...failedStep ? { step: failedStep.name } : {}
+    });
+  }
+}
+
+// packages/testing/src/smoke.ts
+async function smokeTest(def) {
+  try {
+    const models = await smokeModelScripts(def);
+    const result = await executeAutomation(def, Object.keys(models).length > 0 ? { models } : {});
+    if (result.status === "completed") {
+      return { automation: def.id, passed: true, result };
+    }
+    return {
+      automation: def.id,
+      passed: false,
+      result,
+      reason: result.error?.step !== void 0 ? `step "${result.error.step}" failed: ${result.error.message}` : result.error?.message ?? "run failed"
+    };
+  } catch (err) {
+    return {
+      automation: def.id,
+      passed: false,
+      result: {
+        status: "failed",
+        steps: {},
+        journal: [],
+        calls: {},
+        emitted: [],
+        slept: [],
+        undone: [],
+        logs: [],
+        error: { name: err.name, message: err.message, retryable: false, terminal: true },
+        failure: () => ({
+          automation: def.id,
+          status: "failed",
+          error: { name: err.name, message: err.message, retryable: false, terminal: true },
+          steps: [],
+          connectorCalls: []
+        })
+      },
+      reason: err.message
+    };
+  }
+}
+async function smokeModelScripts(def) {
+  const models = {};
+  const operators = def.operators ?? {};
+  for (const [operatorKey, op] of Object.entries(operators)) {
+    const sample = await sampleFromSchema(op.output).catch(() => void 0);
+    (models[operatorKey] ??= {})[op.model] = {
+      ...sample !== void 0 ? { output: sample } : { content: "{}" },
+      usage: { inputTokens: 1, outputTokens: 1 },
+      provider: "tesser-smoke",
+      model: op.model
+    };
+  }
+  return models;
+}
+
+// packages/testing/src/cassette.ts
+import { mkdirSync as mkdirSync4, readFileSync as readFileSync2, writeFileSync as writeFileSync4 } from "node:fs";
+import { dirname as dirname3 } from "node:path";
+import { createHash } from "node:crypto";
+
+// packages/cli/src/commands/test.ts
+var exec = promisify(execFile);
+function findVitest(projectRoot) {
+  let dir = projectRoot;
+  for (; ; ) {
+    const bin = join6(dir, "node_modules", ".bin", process.platform === "win32" ? "vitest.cmd" : "vitest");
+    if (existsSync6(bin)) return bin;
+    const parent = join6(dir, "..");
+    if (parent === dir) return null;
+    dir = parent;
+  }
+}
+async function runTests(out, projectRoot, opts) {
+  const automations = discoverLocalAutomations(projectRoot).filter(
+    (a) => opts.filter === void 0 || a.automationId === opts.filter
+  );
+  if (automations.length === 0) {
+    throw new CliError(EXIT.USAGE, `no automations found under ${join6(projectRoot, "automations")}`);
+  }
+  const report = {
+    passed: true,
+    colocated: { ran: 0, passed: 0, failed: 0 },
+    smoke: [],
+    failures: []
+  };
+  const withTests = automations.filter((a) => a.hasTests);
+  if (!opts.smokeOnly && withTests.length > 0) {
+    const vitestBin = findVitest(projectRoot);
+    if (!vitestBin) {
+      report.colocated.skippedNoRunner = true;
+      out.log("note: no test runner installed in the project \u2014 running smoke tests only");
+    } else {
+      const args = ["run", "--reporter=json", ...withTests.map((a) => a.dir)];
+      const res = await exec(vitestBin, args, {
+        cwd: projectRoot,
+        env: { ...process.env, CI: "1" },
+        maxBuffer: 64 * 1024 * 1024
+      }).catch((err) => ({
+        stdout: err.stdout ?? "",
+        stderr: err.stderr ?? ""
+      }));
+      const jsonLine = (res.stdout ?? "").split("\n").find((l) => l.trimStart().startsWith("{"));
+      if (!jsonLine) {
+        report.passed = false;
+        report.failures.push({ kind: "test", message: `test runner produced no JSON report: ${(res.stderr ?? "").slice(0, 800)}` });
+      } else {
+        const parsed = JSON.parse(jsonLine);
+        report.colocated.ran = parsed.numTotalTests;
+        report.colocated.passed = parsed.numPassedTests;
+        report.colocated.failed = parsed.numFailedTests;
+        if (parsed.numFailedTests > 0) {
+          report.passed = false;
+          for (const file of parsed.testResults) {
+            for (const t of file.assertionResults) {
+              if (t.status === "failed") {
+                report.failures.push({
+                  kind: "test",
+                  file: file.name,
+                  name: t.fullName,
+                  message: t.failureMessages.join("\n").slice(0, 2e3)
+                });
+              }
+            }
+          }
+        }
+      }
+    }
+  }
+  const smokeTargets = opts.smokeOnly ? automations : automations.filter((a) => !a.hasTests);
+  for (const auto of smokeTargets) {
+    try {
+      const def = await loadAutomationDef(auto.entry);
+      const outcome = await smokeTest(def);
+      report.smoke.push({
+        automation: auto.automationId,
+        passed: outcome.passed,
+        ...outcome.reason !== void 0 ? { reason: outcome.reason } : {},
+        ...outcome.passed ? {} : { failure: outcome.result.failure() }
+      });
+      if (!outcome.passed) {
+        report.passed = false;
+        report.failures.push({
+          kind: "smoke",
+          automation: auto.automationId,
+          message: outcome.reason ?? "smoke test failed"
+        });
+      }
+    } catch (err) {
+      report.passed = false;
+      report.smoke.push({ automation: auto.automationId, passed: false, reason: String(err) });
+      report.failures.push({ kind: "smoke", automation: auto.automationId, message: String(err).slice(0, 2e3) });
+    }
+  }
+  out.data(report, (r) => {
+    const lines = [
+      `colocated: ${r.colocated.passed}/${r.colocated.ran} passed${r.colocated.skippedNoRunner ? " (runner missing)" : ""}`,
+      ...r.smoke.map((s) => `smoke ${s.automation}: ${s.passed ? "\u2713" : `\u2717 ${s.reason ?? ""}`}`),
+      r.passed ? "PASS" : `FAIL (${r.failures.length} failure${r.failures.length === 1 ? "" : "s"})`
+    ];
+    return lines.join("\n");
+  });
+  process.exit(report.passed ? EXIT.OK : EXIT.TESTS_FAILED);
+}
+
+// packages/cli/src/index.ts
+var exec2 = promisify2(execFile2);
+var program = new Command();
+var VERSION = JSON.parse(readFileSync3(new URL("../package.json", import.meta.url), "utf8")).version;
+function setup() {
+  const opts = program.opts();
+  return { out: new Output(opts.json ?? false), opts };
+}
+function target(opts) {
+  return resolveTarget({
+    ...opts.url !== void 0 ? { url: opts.url } : {},
+    ...opts.token !== void 0 ? { token: opts.token } : {},
+    ...opts.profile !== void 0 ? { profile: opts.profile } : {}
+  });
+}
+function api(opts) {
+  const t = target(opts);
+  return new ApiClient(t.url, t.token);
+}
+function requireProject(opts) {
+  const t = target(opts);
+  if (!t.projectRoot || !t.project) {
+    throw new CliError(EXIT.USAGE, "not inside a Tesser project (no tesser.json) \u2014 run `tesser init <name>` or `tesser link`");
+  }
+  return { name: t.project, root: t.projectRoot };
+}
+program.name("tesser").version(VERSION).description("Code-first, agent-native automation. stdout = data, stderr = logs; --json everywhere.").option("--json", "machine output: one JSON document on stdout").option("--url <url>", "instance URL (overrides tesser.json / profile)").option("--token <token>", "API token (overrides TESSER_TOKEN / profile)").option("--profile <name>", "config profile");
+program.command("init").argument("<name>", "project name (kebab-case)").option("--dir <dir>", "parent directory").option("--instance <url>", "instance URL to write into tesser.json").description("scaffold a new Project (one repo of automations)").action((name, cmdOpts) => {
+  const { out } = setup();
+  try {
+    init(out, name, cmdOpts);
+  } catch (err) {
+    toExit(err, out);
+  }
+});
+program.command("login").option("--token <token>", "API token from the instance (printed at first boot)").option("--instance <url>", "instance URL", "http://localhost:8377").option("--save-profile <name>", "profile name", "default").description("store instance credentials in ~/.config/tesser (or use env TESSER_TOKEN)").action(async (cmdOpts) => {
+  const { out, opts } = setup();
+  try {
+    const token = cmdOpts.token ?? opts.token;
+    if (!token) throw new CliError(EXIT.USAGE, "missing required option '--token <token>'");
+    const client = new ApiClient(cmdOpts.instance, token);
+    await client.get("/health");
+    const config = readConfig();
+    config.profiles = { ...config.profiles, [cmdOpts.saveProfile]: { url: cmdOpts.instance, token } };
+    config.current = cmdOpts.saveProfile;
+    writeConfig(config);
+    out.data({ profile: cmdOpts.saveProfile, url: cmdOpts.instance }, () => `logged in to ${cmdOpts.instance} (profile "${cmdOpts.saveProfile}")`);
+  } catch (err) {
+    toExit(err, out);
+  }
+});
+program.command("link").option("--repo <url>", "git remote the instance should pull (defaults to origin)").description("register this Project on the instance and wire git-sync").action(async (cmdOpts) => {
+  const { out, opts } = setup();
+  try {
+    const { name } = requireProject(opts);
+    let repoUrl = cmdOpts.repo;
+    if (repoUrl === void 0) {
+      repoUrl = await exec2("git", ["remote", "get-url", "origin"]).then(
+        (r) => r.stdout.trim(),
+        () => void 0
+      );
+    }
+    const result = await api(opts).post("/projects", {
+      name,
+      ...repoUrl !== void 0 ? { repoUrl } : {}
+    });
+    out.data(
+      { ...result, repoUrl: repoUrl ?? null },
+      () => `linked project "${name}"${repoUrl ? ` \u2190 ${repoUrl}` : " (no git remote yet \u2014 deploy with --local or set --repo)"}
+deploy key: ${result.deployKeyPublic}
+webhook setup: ${result.webhookSetupUrl}`
+    );
+  } catch (err) {
+    toExit(err, out);
+  }
+});
+program.command("test").option("--smoke-only", "run only the auto-generated smoke tests").option("--automation <id>", "limit to one automation").description("fast in-process validation: colocated tests + auto smoke (ADR-0008)").action(async (cmdOpts) => {
+  const { out, opts } = setup();
+  try {
+    const t = target(opts);
+    const root = t.projectRoot ?? process.cwd();
+    await runTests(out, root, { ...cmdOpts.smokeOnly !== void 0 ? { smokeOnly: cmdOpts.smokeOnly } : {}, filter: cmdOpts.automation });
+  } catch (err) {
+    toExit(err, out);
+  }
+});
+program.command("build").description("build + statically extract every automation's manifest locally (CI check)").action(async () => {
+  const { out, opts } = setup();
+  try {
+    const t = target(opts);
+    const root = t.projectRoot ?? process.cwd();
+    const autos = discoverLocalAutomations(root);
+    if (autos.length === 0) throw new CliError(EXIT.USAGE, "no automations found");
+    const manifests = [];
+    for (const a of autos) {
+      const def = await loadAutomationDef(a.entry);
+      manifests.push(extractAutomationManifest(def));
+    }
+    out.data(
+      { automations: manifests },
+      () => manifests.map((m) => `${m.id}: trigger=${m.trigger.kind} connections=${Object.keys(m.connections).join(",") || "-"} secrets=${Object.keys(m.secrets).join(",") || "-"}`).join("\n")
+    );
+  } catch (err) {
+    toExit(err, out);
+  }
+});
+program.command("deploy").option("--ref <ref>", "git ref to deploy (default: the project's production branch)").option("--local", "deploy the local working tree (dev/dogfood lane, skips git)").option("--no-wait", "queue the sync and return immediately").description("git \u2192 instance: build changed, gate on tests, promote on green (ADR-0006)").action(async (cmdOpts) => {
+  const { out, opts } = setup();
+  try {
+    const { name, root } = requireProject(opts);
+    await deploy(out, api(opts), name, {
+      ref: cmdOpts.ref,
+      local: cmdOpts.local ? root : void 0,
+      ...cmdOpts.wait === false ? { wait: false } : {}
+    });
+  } catch (err) {
+    toExit(err, out);
+  }
+});
+program.command("dev").option("--port <port>", "port for the local instance", "8377").option("--no-watch", "deploy once and keep serving without watching").description("zero-setup local instance (embedded postgres) + deploy-on-change").action(async (cmdOpts) => {
+  const { out, opts } = setup();
+  try {
+    const { name, root } = requireProject(opts);
+    await dev(out, root, name, { port: Number(cmdOpts.port), ...cmdOpts.watch === false ? { watch: false } : {} });
+  } catch (err) {
+    toExit(err, out);
+  }
+});
+var auth = program.command("auth").description("agent-assisted Harness credential setup; values post directly to connect links");
+auth.command("claude-code").requiredOption("--connect <urlOrToken>", "Tesser /connect/<token> URL or token").option("--mode <mode>", "subscription or apiKey", "subscription").option("--token-stdin", "read token from stdin instead of running claude setup-token").option("--from-env <name>", "read token from an environment variable").option("--scope <scope>", "workspace or per_user", "workspace").option("--end-user-id <id>", "end-user id for per_user connections").option("--bin <path>", "claude binary", "claude").description("connect Claude Code as a brokered Harness; subscription mode runs claude setup-token").action(async (cmdOpts) => {
+  const { out, opts } = setup();
+  try {
+    await authClaudeCode(out, target(opts).url, cmdOpts);
+  } catch (err) {
+    toExit(err, out);
+  }
+});
+auth.command("pi").requiredOption("--connect <urlOrToken>", "Tesser /connect/<token> URL or token").option("--mode <mode>", "anthropicOAuth or anthropicApiKey", "anthropicOAuth").option("--token-stdin", "read token from stdin").option("--from-env <name>", "read token from an environment variable").option("--scope <scope>", "workspace or per_user", "workspace").option("--end-user-id <id>", "end-user id for per_user connections").description("connect Pi as a brokered Harness").action(async (cmdOpts) => {
+  const { out, opts } = setup();
+  try {
+    await authPi(out, target(opts).url, cmdOpts);
+  } catch (err) {
+    toExit(err, out);
+  }
+});
+program.command("connect").option("--wait", "poll until the human completes the link").option("--status <token>", "check an existing connect link").description("mint a connect link for missing credentials; the human completes it in a browser (ADR-0005)").action(async (cmdOpts) => {
+  const { out, opts } = setup();
+  try {
+    const client = api(opts);
+    if (cmdOpts.status) {
+      out.data(await client.get(`/connect-links/${cmdOpts.status}/status`));
+      return;
+    }
+    const { name } = requireProject(opts);
+    const minted = await client.post(
+      "/connect-links",
+      { project: name }
+    );
+    if (!minted.url) {
+      out.data({ url: null, requirements: [] }, () => "nothing missing \u2014 all requirements are satisfied");
+      return;
+    }
+    out.data(minted, () => `open in a browser to connect:
+  ${minted.url}`);
+    if (cmdOpts.wait) {
+      for (; ; ) {
+        await new Promise((r) => setTimeout(r, 2e3));
+        const status = await client.get(`/connect-links/${minted.token}/status`);
+        if (status.status === "completed") {
+          out.log("connect link completed \u2713");
+          return;
+        }
+        if (status.status === "expired") throw new CliError(EXIT.HALTED_CREDENTIALS, "connect link expired");
+      }
+    }
+    process.exit(EXIT.HALTED_CREDENTIALS);
+  } catch (err) {
+    toExit(err, out);
+  }
+});
+var secrets = program.command("secrets").description("workspace secrets \u2014 names only; values never echo");
+secrets.command("list").action(async () => {
+  const { out, opts } = setup();
+  try {
+    out.data(await api(opts).get("/secrets"));
+  } catch (err) {
+    toExit(err, out);
+  }
+});
+secrets.command("set").argument("<name>").option("--value-stdin", "read the value from stdin (pipe it; value never appears in argv)").description("set a secret value (human/CI lane: pipe via --value-stdin; agents mint connect links instead)").action(async (name, cmdOpts) => {
+  const { out, opts } = setup();
+  try {
+    if (!cmdOpts.valueStdin) {
+      throw new CliError(
+        EXIT.USAGE,
+        "refusing a value on argv \u2014 pipe it: `printenv MY_SECRET | tesser secrets set " + name + " --value-stdin` (or use a connect link)"
+      );
+    }
+    const chunks = [];
+    for await (const chunk of process.stdin) chunks.push(chunk);
+    const value = Buffer.concat(chunks).toString("utf8").replace(/\n$/, "");
+    if (value.length === 0) throw new CliError(EXIT.USAGE, "empty value on stdin");
+    await api(opts).put(`/secrets/${encodeURIComponent(name)}`, { value });
+    out.data({ set: name }, () => `secret "${name}" set \u2713`);
+  } catch (err) {
+    toExit(err, out);
+  }
+});
+secrets.command("rm").argument("<name>").action(async (name) => {
+  const { out, opts } = setup();
+  try {
+    out.data(await api(opts).delete(`/secrets/${encodeURIComponent(name)}`));
+  } catch (err) {
+    toExit(err, out);
+  }
+});
+var runs = program.command("runs").description("inspect and drive runs");
+runs.command("list").option("--automation <id>").option("--status <status>").option("--limit <n>", "max rows", "25").action(async (cmdOpts) => {
+  const { out, opts } = setup();
+  try {
+    const { name } = requireProject(opts);
+    const params = new URLSearchParams({ project: name, limit: cmdOpts.limit });
+    if (cmdOpts.automation) params.set("automation", cmdOpts.automation);
+    if (cmdOpts.status) params.set("status", cmdOpts.status);
+    const data = await api(opts).get(`/runs?${params}`);
+    out.data(
+      data,
+      (d) => d.runs.map((r) => `${r.id}  ${r.automation_id}  ${r.status}  (${r.trigger_kind})  ${r.created_at}`).join("\n") || "(no runs)"
+    );
+  } catch (err) {
+    toExit(err, out);
+  }
+});
+runs.command("show").argument("<runId>").action(async (runId) => {
+  const { out, opts } = setup();
+  try {
+    out.data(await api(opts).get(`/runs/${runId}`));
+  } catch (err) {
+    toExit(err, out);
+  }
+});
+runs.command("trigger").argument("<automation>").option("--input <json>", "input payload as JSON").option("--env <env>", "environment", "production").action(async (automation, cmdOpts) => {
+  const { out, opts } = setup();
+  try {
+    const { name } = requireProject(opts);
+    const body = { project: name, automation, env: cmdOpts.env };
+    if (cmdOpts.input !== void 0) body["input"] = JSON.parse(cmdOpts.input);
+    out.data(await api(opts).post("/runs", body));
+  } catch (err) {
+    toExit(err, out);
+  }
+});
+runs.command("signal").argument("<runId>").argument("<name>").option("--payload <json>", "signal payload as JSON").action(async (runId, name, cmdOpts) => {
+  const { out, opts } = setup();
+  try {
+    out.data(
+      await api(opts).post(`/runs/${runId}/signals/${encodeURIComponent(name)}`, {
+        ...cmdOpts.payload !== void 0 ? { payload: JSON.parse(cmdOpts.payload) } : {}
+      })
+    );
+  } catch (err) {
+    toExit(err, out);
+  }
+});
+runs.command("cancel").argument("<runId>").action(async (runId) => {
+  const { out, opts } = setup();
+  try {
+    out.data(await api(opts).post(`/runs/${runId}/cancel`));
+  } catch (err) {
+    toExit(err, out);
+  }
+});
+program.command("logs").argument("<runId>").option("--follow", "poll until the run settles").description("step logs for one run").action(async (runId, cmdOpts) => {
+  const { out, opts } = setup();
+  try {
+    const client = api(opts);
+    let printed = 0;
+    for (; ; ) {
+      const detail = await client.get(`/runs/${runId}`);
+      const fresh = detail.logs.slice(printed);
+      printed = detail.logs.length;
+      if (out.json && !cmdOpts.follow) {
+        out.data(detail);
+        return;
+      }
+      for (const l of fresh) out.log(`[${l.level}]${l.step ? ` (${l.step})` : ""} ${l.msg}`);
+      if (!cmdOpts.follow || ["completed", "failed", "cancelled"].includes(detail.run.status)) {
+        if (!out.json) out.log(`run ${detail.run.status}`);
+        else out.data(detail);
+        return;
+      }
+      await new Promise((r) => setTimeout(r, 1e3));
+    }
+  } catch (err) {
+    toExit(err, out);
+  }
+});
+program.command("replay").argument("<runId>").description("freeze a real run as a committed regression fixture + test (ADR-0008)").action(async (runId) => {
+  const { out, opts } = setup();
+  try {
+    const { root } = requireProject(opts);
+    await replay(out, api(opts), root, runId);
+  } catch (err) {
+    toExit(err, out);
+  }
+});
+program.command("rollback").argument("<automation>").requiredOption("--to <version>", "version number to re-point the alias at").option("--env <env>", "environment", "production").description("instant alias re-point to a prior immutable version (no rebuild)").action(async (automation, cmdOpts) => {
+  const { out, opts } = setup();
+  try {
+    const { name } = requireProject(opts);
+    out.data(
+      await api(opts).post(`/projects/${name}/rollback`, {
+        automation,
+        toVersion: Number(cmdOpts.to),
+        env: cmdOpts.env
+      })
+    );
+  } catch (err) {
+    toExit(err, out);
+  }
+});
+program.command("status").description("instance + project deploy status").action(async () => {
+  const { out, opts } = setup();
+  try {
+    const t = target(opts);
+    const client = api(opts);
+    const health = await client.get("/health");
+    const status = await client.get("/status");
+    const manifest = t.projectRoot ? readLinkManifest(t.projectRoot) : null;
+    const projectStatus = manifest ? await client.get(`/projects/${manifest.project}/deploys/latest`).catch(() => null) : null;
+    out.data({ instance: t.url, health, status, project: manifest?.project ?? null, deploy: projectStatus });
+  } catch (err) {
+    toExit(err, out);
+  }
+});
+program.parseAsync().catch((err) => {
+  const out = new Output(process.argv.includes("--json"));
+  toExit(err, out);
+});
+//# sourceMappingURL=index.js.map