@harborclient/team-hub 0.4.0 → 0.4.2

package/dist/cli.js

@@ -364,6 +364,7 @@ var REQUESTS_COLLECTION = "requests";
 var AUDIT_LOG_COLLECTION = "auditLog";
 var LLM_USAGE_COLLECTION = "llmUsage";
 var LLM_USAGE_LOG_COLLECTION = "llmUsageLog";
+var RUN_RESULTS_COLLECTION = "runResults";
 var WRITE_BATCH_LIMIT = 500;
 
 // src/db/systemUsers.ts
@@ -400,7 +401,7 @@ var firestoreConfigSchema = z2.object({
 
 // src/db/firestore/utils.ts
 function parseAuditEntityType(value) {
-  if (value === "user" || value === "api_token" || value === "collection" || value === "environment" || value === "snippet" || value === "folder" || value === "request") {
+  if (value === "user" || value === "api_token" || value === "collection" || value === "environment" || value === "snippet" || value === "folder" || value === "request" || value === "run_result") {
     return value;
   }
   throw new Error(`Invalid audit entity type: ${value}`);
@@ -544,6 +545,19 @@ function mapFirestoreRequest(id, data) {
     updatedByUserId: data.updatedByUserId ?? null
   };
 }
+function mapFirestoreRunResult(id, data) {
+  return {
+    id,
+    kind: data.kind,
+    label: data.label,
+    collectionName: data.collectionName,
+    requestName: data.requestName,
+    summary: data.summary,
+    payload: data.payload,
+    createdAt: data.createdAt,
+    createdByUserId: data.createdByUserId ?? null
+  };
+}
 function mapFirestoreAuditLog(id, data) {
   return {
     id,
@@ -557,6 +571,53 @@ function mapFirestoreAuditLog(id, data) {
   };
 }
 
+// src/db/runResultPayload.ts
+function isRecord(value) {
+  return value != null && typeof value === "object" && !Array.isArray(value);
+}
+function summarizeResultRows(results) {
+  let passed = 0;
+  let failed = 0;
+  let skipped = 0;
+  for (const row of results) {
+    if (!isRecord(row)) {
+      continue;
+    }
+    const status = row.status;
+    if (status === "passed") {
+      passed += 1;
+    } else if (status === "failed") {
+      failed += 1;
+    } else if (status === "skipped") {
+      skipped += 1;
+    }
+  }
+  return { passed, failed, skipped };
+}
+function buildDefaultRunResultLabel(metadata) {
+  const target = metadata.requestName ?? metadata.collectionName ?? "Run";
+  const timestamp = (/* @__PURE__ */ new Date()).toISOString().replace("T", " ").slice(0, 19);
+  return `${target} \u2014 ${timestamp}`;
+}
+function parseRunResultPayload(payload) {
+  const kind = payload.harborclientExport;
+  if (kind !== "collection-run-results" && kind !== "request-run-results") {
+    throw new Error("Invalid run result payload: harborclientExport is required");
+  }
+  const results = payload.results;
+  if (!Array.isArray(results) || results.length === 0) {
+    throw new Error("Invalid run result payload: results are required");
+  }
+  const collection = isRecord(payload.collection) ? payload.collection : void 0;
+  const request = isRecord(payload.request) ? payload.request : void 0;
+  return {
+    kind,
+    collectionName: typeof collection?.name === "string" ? collection.name : null,
+    requestName: typeof request?.name === "string" ? request.name : null,
+    summary: summarizeResultRows(results)
+  };
+}
+
 // src/db/trimRequiredName.ts
 function trimRequiredName(name, label) {
   const trimmed = name.trim();
@@ -1822,6 +1883,78 @@ var FirestoreDatabase = class _FirestoreDatabase {
     }
     return usage;
   }
+  /**
+   * Lists run results saved by the given user, newest first.
+   *
+   * @param userId - Owning user identifier.
+   */
+  async listRunResultsForUser(userId) {
+    const snapshot = await this.requireClient().collection(RUN_RESULTS_COLLECTION).where("createdByUserId", "==", userId).orderBy("createdAt", "desc").get();
+    return snapshot.docs.map(
+      (doc) => mapFirestoreRunResult(doc.id, doc.data())
+    );
+  }
+  /**
+   * Lists all run results for admin inspection, newest first.
+   */
+  async listAllRunResults() {
+    const snapshot = await this.requireClient().collection(RUN_RESULTS_COLLECTION).orderBy("createdAt", "desc").get();
+    return snapshot.docs.map(
+      (doc) => mapFirestoreRunResult(doc.id, doc.data())
+    );
+  }
+  /**
+   * Creates a standalone run result snapshot.
+   *
+   * @param input - HarborClient export payload and optional label.
+   * @param actingUserId - User performing the create action.
+   */
+  async createRunResult(input, actingUserId) {
+    const metadata = parseRunResultPayload(input.payload);
+    const label = input.label?.trim() || buildDefaultRunResultLabel(metadata);
+    const id = randomUUID2();
+    const now = /* @__PURE__ */ new Date();
+    const data = {
+      kind: metadata.kind,
+      label,
+      collectionName: metadata.collectionName,
+      requestName: metadata.requestName,
+      summary: metadata.summary,
+      payload: input.payload,
+      createdAt: now,
+      createdByUserId: actingUserId
+    };
+    await this.requireClient().collection(RUN_RESULTS_COLLECTION).doc(id).set(data);
+    await this.recordAuditEntry(actingUserId, "create", "run_result", id);
+    return mapFirestoreRunResult(id, data);
+  }
+  /**
+   * Finds a run result by stable identifier.
+   *
+   * @param id - Run result ID to look up.
+   */
+  async findRunResultById(id) {
+    const snapshot = await this.requireClient().collection(RUN_RESULTS_COLLECTION).doc(id).get();
+    if (!snapshot.exists) {
+      return null;
+    }
+    return mapFirestoreRunResult(id, snapshot.data());
+  }
+  /**
+   * Deletes a run result.
+   *
+   * @param id - Run result ID to delete.
+   * @param actingUserId - User performing the delete action.
+   */
+  async deleteRunResult(id, actingUserId) {
+    const docRef = this.requireClient().collection(RUN_RESULTS_COLLECTION).doc(id);
+    const snapshot = await docRef.get();
+    if (!snapshot.exists) {
+      throw new Error("Run result not found");
+    }
+    await this.recordAuditEntry(actingUserId, "delete", "run_result", id);
+    await docRef.delete();
+  }
   /**
    * Inserts a per-request LLM usage log entry.
    *
@@ -1976,7 +2109,7 @@ function parseAuditAction(value) {
   throw new Error(`Invalid audit action: ${value}`);
 }
 function parseAuditEntityType2(value) {
-  if (value === "user" || value === "api_token" || value === "collection" || value === "environment" || value === "snippet" || value === "folder" || value === "request") {
+  if (value === "user" || value === "api_token" || value === "collection" || value === "environment" || value === "snippet" || value === "folder" || value === "request" || value === "run_result") {
     return value;
   }
   throw new Error(`Invalid audit entity type: ${value}`);
@@ -2073,6 +2206,23 @@ function mapSnippetSqlRow(row) {
     deletionLocked: Boolean(row.deletion_locked)
   };
 }
+function mapRunResultSqlRow(row) {
+  return {
+    id: row.id,
+    kind: row.kind,
+    label: row.label,
+    collectionName: row.collection_name,
+    requestName: row.request_name,
+    summary: {
+      passed: row.summary_passed,
+      failed: row.summary_failed,
+      skipped: row.summary_skipped
+    },
+    payload: parseJson(row.payload, {}),
+    createdAt: row.created_at,
+    createdByUserId: row.created_by_user_id ?? null
+  };
+}
 function mapFolderSqlRow(row) {
   return {
     id: row.id,
@@ -2349,6 +2499,22 @@ WHERE role = 'user'
   AND snippet_access = '[]'
   AND collection_access LIKE '%"*"%';
 `.trim();
+var RUN_RESULTS_MIGRATION_SQL = `
+CREATE TABLE IF NOT EXISTS run_results (
+  id VARCHAR(36) PRIMARY KEY,
+  kind VARCHAR(64) NOT NULL,
+  label VARCHAR(512) NOT NULL,
+  collection_name VARCHAR(512),
+  request_name VARCHAR(512),
+  summary_passed INT NOT NULL DEFAULT 0,
+  summary_failed INT NOT NULL DEFAULT 0,
+  summary_skipped INT NOT NULL DEFAULT 0,
+  payload LONGTEXT NOT NULL,
+  created_at DATETIME NOT NULL,
+  created_by_user_id VARCHAR(36),
+  INDEX run_results_created_idx (created_at)
+)
+`.trim();
 var MYSQL_MIGRATIONS = [
   USERS_MIGRATION_SQL,
   API_TOKENS_MIGRATION_SQL,
@@ -2374,7 +2540,8 @@ var MYSQL_MIGRATIONS = [
   COLLECTIONS_DELETION_LOCKED_MIGRATION_SQL,
   ENVIRONMENTS_DELETION_LOCKED_MIGRATION_SQL,
   USERS_SNIPPET_ACCESS_MIGRATION_SQL,
-  USERS_SNIPPET_ACCESS_BACKFILL_SQL
+  USERS_SNIPPET_ACCESS_BACKFILL_SQL,
+  RUN_RESULTS_MIGRATION_SQL
 ];
 
 // src/db/mysql/schemas.ts
@@ -2478,6 +2645,8 @@ var LLM_USAGE_SELECT_COLUMNS = `id, user_id, period, prompt_tokens, completion_t
 var COLLECTION_SELECT = `SELECT ${COLLECTION_SELECT_COLUMNS} FROM collections`;
 var ENVIRONMENT_SELECT = `SELECT ${ENVIRONMENT_SELECT_COLUMNS} FROM environments`;
 var SNIPPET_SELECT = `SELECT ${SNIPPET_SELECT_COLUMNS} FROM snippets`;
+var RUN_RESULT_SELECT_COLUMNS = "id, kind, label, collection_name, request_name, summary_passed, summary_failed, summary_skipped, payload, created_at, created_by_user_id";
+var RUN_RESULT_SELECT = `SELECT ${RUN_RESULT_SELECT_COLUMNS} FROM run_results`;
 var USER_SELECT = `SELECT ${USER_SELECT_COLUMNS} FROM users`;
 var API_TOKEN_SELECT = `SELECT ${API_TOKEN_SELECT_COLUMNS} FROM api_tokens`;
 var FOLDER_SELECT = `SELECT ${FOLDER_SELECT_COLUMNS} FROM folders`;
@@ -3883,6 +4052,93 @@ var MysqlDatabase = class _MysqlDatabase {
     );
     return rows.map(mapLlmUsageLogSqlRow);
   }
+  /**
+   * Lists run results saved by the given user, newest first.
+   */
+  async listRunResultsForUser(userId) {
+    const rows = await this.queryRows(
+      `${RUN_RESULT_SELECT} WHERE created_by_user_id = ? ORDER BY created_at DESC`,
+      [userId]
+    );
+    return rows.map(mapRunResultSqlRow);
+  }
+  /**
+   * Lists all run results for admin inspection, newest first.
+   */
+  async listAllRunResults() {
+    const rows = await this.queryRows(
+      `${RUN_RESULT_SELECT} ORDER BY created_at DESC`
+    );
+    return rows.map(mapRunResultSqlRow);
+  }
+  /**
+   * Creates a standalone run result snapshot.
+   */
+  async createRunResult(input, actingUserId) {
+    const metadata = parseRunResultPayload(input.payload);
+    const label = input.label?.trim() || buildDefaultRunResultLabel(metadata);
+    const id = randomUUID3();
+    const now = /* @__PURE__ */ new Date();
+    await this.executeStatement(
+      `INSERT INTO run_results (
+        id,
+        kind,
+        label,
+        collection_name,
+        request_name,
+        summary_passed,
+        summary_failed,
+        summary_skipped,
+        payload,
+        created_at,
+        created_by_user_id
+      ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
+      [
+        id,
+        metadata.kind,
+        label,
+        metadata.collectionName,
+        metadata.requestName,
+        metadata.summary.passed,
+        metadata.summary.failed,
+        metadata.summary.skipped,
+        JSON.stringify(input.payload),
+        now,
+        actingUserId
+      ]
+    );
+    const rows = await this.queryRows(
+      `${RUN_RESULT_SELECT} WHERE id = ?`,
+      [id]
+    );
+    const row = rows[0];
+    if (!row) {
+      throw new Error("Run result not found after insert");
+    }
+    await this.recordAuditEntry(actingUserId, "create", "run_result", id);
+    return mapRunResultSqlRow(row);
+  }
+  /**
+   * Finds a run result by id.
+   */
+  async findRunResultById(id) {
+    const rows = await this.queryRows(
+      `${RUN_RESULT_SELECT} WHERE id = ?`,
+      [id]
+    );
+    const row = rows[0];
+    return row ? mapRunResultSqlRow(row) : null;
+  }
+  /**
+   * Deletes a run result by id.
+   */
+  async deleteRunResult(id, actingUserId) {
+    const result = await this.executeStatement("DELETE FROM run_results WHERE id = ?", [id]);
+    if (result.affectedRows === 0) {
+      throw new Error("Run result not found");
+    }
+    await this.recordAuditEntry(actingUserId, "delete", "run_result", id);
+  }
   /**
    * Ensures the internal system user exists and caches its identifier.
    */
@@ -4229,6 +4485,22 @@ WHERE role = 'user'
   AND snippet_access = '[]'
   AND collection_access LIKE '%"*"%';
 `.trim();
+var RUN_RESULTS_MIGRATION_SQL2 = `
+CREATE TABLE IF NOT EXISTS run_results (
+  id TEXT PRIMARY KEY,
+  kind TEXT NOT NULL CHECK (kind IN ('collection-run-results', 'request-run-results')),
+  label TEXT NOT NULL,
+  collection_name TEXT,
+  request_name TEXT,
+  summary_passed INT NOT NULL DEFAULT 0,
+  summary_failed INT NOT NULL DEFAULT 0,
+  summary_skipped INT NOT NULL DEFAULT 0,
+  payload TEXT NOT NULL,
+  created_at TIMESTAMPTZ NOT NULL,
+  created_by_user_id TEXT REFERENCES users(id) ON DELETE SET NULL
+);
+CREATE INDEX IF NOT EXISTS run_results_created_idx ON run_results (created_at DESC);
+`.trim();
 var POSTGRES_MIGRATIONS = [
   USERS_MIGRATION_SQL2,
   API_TOKENS_MIGRATION_SQL2,
@@ -4254,7 +4526,8 @@ var POSTGRES_MIGRATIONS = [
   COLLECTIONS_DELETION_LOCKED_MIGRATION_SQL2,
   ENVIRONMENTS_DELETION_LOCKED_MIGRATION_SQL2,
   USERS_SNIPPET_ACCESS_MIGRATION_SQL2,
-  USERS_SNIPPET_ACCESS_BACKFILL_SQL2
+  USERS_SNIPPET_ACCESS_BACKFILL_SQL2,
+  RUN_RESULTS_MIGRATION_SQL2
 ];
 
 // src/db/postgres/schemas.ts
@@ -4279,6 +4552,8 @@ var { Pool } = pg;
 var COLLECTION_SELECT2 = `SELECT ${COLLECTION_SELECT_COLUMNS} FROM collections`;
 var ENVIRONMENT_SELECT2 = `SELECT ${ENVIRONMENT_SELECT_COLUMNS} FROM environments`;
 var SNIPPET_SELECT2 = `SELECT ${SNIPPET_SELECT_COLUMNS} FROM snippets`;
+var RUN_RESULT_SELECT_COLUMNS2 = "id, kind, label, collection_name, request_name, summary_passed, summary_failed, summary_skipped, payload, created_at, created_by_user_id";
+var RUN_RESULT_SELECT2 = `SELECT ${RUN_RESULT_SELECT_COLUMNS2} FROM run_results`;
 var USER_SELECT2 = `SELECT ${USER_SELECT_COLUMNS} FROM users`;
 var API_TOKEN_SELECT2 = `SELECT ${API_TOKEN_SELECT_COLUMNS} FROM api_tokens`;
 var FOLDER_SELECT2 = `SELECT ${FOLDER_SELECT_COLUMNS} FROM folders`;
@@ -5629,6 +5904,87 @@ var PostgresDatabase = class _PostgresDatabase {
     );
     return result.rows.map(mapLlmUsageLogSqlRow);
   }
+  /**
+   * Lists run results saved by the given user, newest first.
+   */
+  async listRunResultsForUser(userId) {
+    const result = await this.query(
+      `${RUN_RESULT_SELECT2} WHERE created_by_user_id = $1 ORDER BY created_at DESC`,
+      [userId]
+    );
+    return result.rows.map(mapRunResultSqlRow);
+  }
+  /**
+   * Lists all run results for admin inspection, newest first.
+   */
+  async listAllRunResults() {
+    const result = await this.query(
+      `${RUN_RESULT_SELECT2} ORDER BY created_at DESC`
+    );
+    return result.rows.map(mapRunResultSqlRow);
+  }
+  /**
+   * Creates a standalone run result snapshot.
+   */
+  async createRunResult(input, actingUserId) {
+    const metadata = parseRunResultPayload(input.payload);
+    const label = input.label?.trim() || buildDefaultRunResultLabel(metadata);
+    const id = randomUUID4();
+    const now = /* @__PURE__ */ new Date();
+    const result = await this.query(
+      `INSERT INTO run_results (
+        id,
+        kind,
+        label,
+        collection_name,
+        request_name,
+        summary_passed,
+        summary_failed,
+        summary_skipped,
+        payload,
+        created_at,
+        created_by_user_id
+      ) VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11)
+      RETURNING ${RUN_RESULT_SELECT_COLUMNS2}`,
+      [
+        id,
+        metadata.kind,
+        label,
+        metadata.collectionName,
+        metadata.requestName,
+        metadata.summary.passed,
+        metadata.summary.failed,
+        metadata.summary.skipped,
+        JSON.stringify(input.payload),
+        now,
+        actingUserId
+      ]
+    );
+    const row = result.rows[0];
+    if (!row) {
+      throw new Error("Run result not found after insert");
+    }
+    await this.recordAuditEntry(actingUserId, "create", "run_result", id);
+    return mapRunResultSqlRow(row);
+  }
+  /**
+   * Finds a run result by id.
+   */
+  async findRunResultById(id) {
+    const result = await this.query(`${RUN_RESULT_SELECT2} WHERE id = $1`, [id]);
+    const row = result.rows[0];
+    return row ? mapRunResultSqlRow(row) : null;
+  }
+  /**
+   * Deletes a run result by id.
+   */
+  async deleteRunResult(id, actingUserId) {
+    const result = await this.query("DELETE FROM run_results WHERE id = $1", [id]);
+    if ((result.rowCount ?? 0) === 0) {
+      throw new Error("Run result not found");
+    }
+    await this.recordAuditEntry(actingUserId, "delete", "run_result", id);
+  }
   /**
    * Returns the active pool or throws when connect has not been called.
    *
@@ -6655,6 +7011,9 @@ function canListEnvironments(user) {
 function canListSnippets(user) {
   return canUseDataApi(user) || canUseManagementApi(user);
 }
+function canListRunResults(user) {
+  return canUseDataApi(user) || canUseManagementApi(user);
+}
 function hasWildcardAccess(access) {
   return access.includes("*");
 }
@@ -6691,6 +7050,9 @@ function canDeleteCollection(user, collection) {
 function canDeleteRequest(user, request) {
   return canUseDataApi(user) && canAccessCollection(user, request.collectionId) && request.createdByUserId === user.id;
 }
+function canDeleteRunResult(user, runResult) {
+  return canUseDataApi(user) && runResult.createdByUserId === user.id;
+}
 function canCreateCollection(user) {
   return user.role === "user" && hasWildcardAccess(user.collectionAccess);
 }
@@ -6865,7 +7227,7 @@ function denyUnlessAllowed(reply, allowed) {
 }
 
 // src/server/routes/schemas/admin.ts
-import { z as z8 } from "zod/v4";
+import { z as z9 } from "zod/v4";
 
 // src/server/routes/schemas/auth.ts
 import { z as z6 } from "zod/v4";
@@ -6932,316 +7294,381 @@ var llmUsageSummaryResponseSchema = z7.object({
   limit: z7.number().int().positive().nullable()
 });
 
-// src/server/routes/schemas/admin.ts
-var adminResourceOptionSchema = z8.object({
+// src/server/routes/schemas/entities.ts
+import { z as z8 } from "zod/v4";
+var collectionRecordSchema = z8.object({
   id: z8.string(),
   name: z8.string(),
+  variables: z8.array(variableSchema),
+  headers: z8.array(keyValueSchema),
+  auth: authConfigSchema,
+  preRequestScript: z8.string(),
+  postRequestScript: z8.string(),
+  createdAt: timestampSchema,
+  updatedAt: timestampSchema,
+  createdByUserId: z8.string().nullable(),
+  updatedByUserId: z8.string().nullable(),
   deletionLocked: z8.boolean()
 });
-var adminEntityConfigSchema = z8.object({
+var environmentRecordSchema = z8.object({
   id: z8.string(),
   name: z8.string(),
+  variables: z8.array(variableSchema),
+  createdAt: timestampSchema,
+  updatedAt: timestampSchema,
+  createdByUserId: z8.string().nullable(),
+  updatedByUserId: z8.string().nullable(),
   deletionLocked: z8.boolean()
 });
-var updateAdminCollectionBodySchema = z8.object({
-  deletionLocked: z8.boolean()
-});
-var updateAdminEnvironmentBodySchema = z8.object({
-  deletionLocked: z8.boolean()
-});
-var updateAdminSnippetBodySchema = z8.object({
+var snippetScopeSchema = z8.enum(["pre-request", "post-request", "any"]);
+var snippetRecordSchema = z8.object({
+  id: z8.string(),
+  name: z8.string(),
+  code: z8.string(),
+  scope: snippetScopeSchema,
+  sortOrder: z8.number().int(),
+  createdAt: timestampSchema,
+  updatedAt: timestampSchema,
+  createdByUserId: z8.string().nullable(),
+  updatedByUserId: z8.string().nullable(),
   deletionLocked: z8.boolean()
 });
-var listAdminCollectionsResponseSchema = z8.object({
-  collections: z8.array(adminResourceOptionSchema)
-});
-var listAdminEnvironmentsResponseSchema = z8.object({
-  environments: z8.array(adminResourceOptionSchema)
-});
-var listAdminSnippetsResponseSchema = z8.object({
-  snippets: z8.array(adminResourceOptionSchema)
+var folderRecordSchema = z8.object({
+  id: z8.string(),
+  collectionId: z8.string(),
+  name: z8.string(),
+  sortOrder: z8.number().int(),
+  createdAt: timestampSchema,
+  updatedAt: timestampSchema,
+  createdByUserId: z8.string().nullable(),
+  updatedByUserId: z8.string().nullable()
 });
-var listAdminLlmModelsResponseSchema = listLlmModelsResponseSchema;
-var hubUserRecordSchema = z8.object({
+var savedRequestRecordSchema = z8.object({
   id: z8.string(),
+  collectionId: z8.string(),
   name: z8.string(),
-  role: userRoleSchema,
-  collectionAccess: z8.array(z8.string()),
-  environmentAccess: z8.array(z8.string()),
-  snippetAccess: z8.array(z8.string()),
-  llmAccess: z8.boolean(),
-  llmModels: z8.array(z8.string()),
-  llmMonthlyTokenLimit: z8.number().int().nonnegative().nullable(),
+  method: httpMethodSchema,
+  url: z8.string(),
+  headers: z8.array(keyValueSchema),
+  params: z8.array(keyValueSchema),
+  auth: authConfigSchema,
+  body: z8.string(),
+  bodyType: bodyTypeSchema,
+  preRequestScript: z8.string(),
+  postRequestScript: z8.string(),
+  comment: z8.string(),
+  folderId: z8.string().nullable(),
+  sortOrder: z8.number().int(),
   createdAt: timestampSchema,
-  updatedAt: timestampSchema
+  updatedAt: timestampSchema,
+  createdByUserId: z8.string().nullable(),
+  updatedByUserId: z8.string().nullable()
 });
-var adminUserListEntrySchema = hubUserRecordSchema.extend({
-  warnings: z8.array(z8.string())
+var createCollectionBodySchema = z8.object({
+  name: z8.string().trim().min(1)
 });
-var listAdminUsersResponseSchema = z8.object({
-  users: z8.array(adminUserListEntrySchema)
+var updateCollectionBodySchema = z8.object({
+  name: z8.string().trim().min(1),
+  variables: z8.array(variableSchema),
+  headers: z8.array(keyValueSchema),
+  preRequestScript: z8.string(),
+  postRequestScript: z8.string(),
+  auth: authConfigSchema
 });
-var updateAdminUserBodySchema = z8.object({
-  name: z8.string().trim().min(1).optional(),
-  role: userRoleSchema.optional(),
-  collectionAccess: z8.array(z8.string()).optional(),
-  environmentAccess: z8.array(z8.string()).optional(),
-  snippetAccess: z8.array(z8.string()).optional(),
-  llmAccess: z8.boolean().optional(),
-  llmModels: z8.array(z8.string()).optional(),
-  llmMonthlyTokenLimit: z8.number().int().nonnegative().nullable().optional()
+var createEnvironmentBodySchema = z8.object({
+  name: z8.string().trim().min(1)
 });
-var createAdminUserBodySchema = z8.object({
+var updateEnvironmentBodySchema = z8.object({
   name: z8.string().trim().min(1),
-  role: userRoleSchema,
-  collectionAccess: z8.array(z8.string()).optional(),
-  environmentAccess: z8.array(z8.string()).optional(),
-  snippetAccess: z8.array(z8.string()).optional(),
-  llmAccess: z8.boolean().optional(),
-  llmModels: z8.array(z8.string()).optional(),
-  llmMonthlyTokenLimit: z8.number().int().nonnegative().nullable().optional()
+  variables: z8.array(variableSchema)
 });
-var hubApiTokenRecordSchema = z8.object({
-  id: z8.string(),
-  userId: z8.string(),
-  name: z8.string(),
-  tokenPrefix: z8.string(),
-  createdAt: timestampSchema,
-  lastUsedAt: timestampSchema.nullable(),
-  revokedAt: timestampSchema.nullable()
+var createSnippetBodySchema = z8.object({
+  name: z8.string().trim().min(1),
+  code: z8.string().default(""),
+  scope: snippetScopeSchema.default("any")
 });
-var createAdminUserResponseSchema = z8.object({
-  user: hubUserRecordSchema,
-  token: hubApiTokenRecordSchema,
-  secret: z8.string()
+var updateSnippetBodySchema = z8.object({
+  name: z8.string().trim().min(1),
+  code: z8.string(),
+  scope: snippetScopeSchema
 });
-var createAdminTokenBodySchema = z8.object({
+var createFolderBodySchema = z8.object({
   name: z8.string().trim().min(1)
 });
-var createdApiTokenResponseSchema = z8.object({
-  token: hubApiTokenRecordSchema,
-  secret: z8.string()
+var renameFolderBodySchema = z8.object({
+  name: z8.string().trim().min(1)
+});
+var reorderFoldersBodySchema = z8.object({
+  orderedFolderIds: z8.array(z8.string().trim().min(1))
+});
+var saveRequestBodySchema = z8.object({
+  name: z8.string().trim().min(1),
+  method: httpMethodSchema,
+  url: z8.string(),
+  headers: z8.array(keyValueSchema),
+  params: z8.array(keyValueSchema),
+  auth: authConfigSchema,
+  body: z8.string(),
+  bodyType: bodyTypeSchema,
+  preRequestScript: z8.string(),
+  postRequestScript: z8.string(),
+  comment: z8.string(),
+  folderId: z8.string().nullable().optional()
+});
+var updateSaveRequestBodySchema = saveRequestBodySchema.extend({
+  collectionId: z8.string().trim().min(1)
 });
-var listAdminTokensResponseSchema = z8.object({
-  tokens: z8.array(hubApiTokenRecordSchema)
+var reorderRequestsBodySchema = z8.object({
+  folderId: z8.string().nullable(),
+  orderedRequestIds: z8.array(z8.string().trim().min(1))
 });
-var reloadConfigSectionResultSchema = z8.object({
-  section: z8.enum(["db", "redis", "llm", "plugins", "server"]),
-  status: z8.enum(["reloaded", "unchanged", "failed", "restart-required"]),
-  error: z8.string().optional()
+var moveRequestBodySchema = z8.object({
+  folderId: z8.string().nullable(),
+  index: z8.number().int().min(0)
 });
-var reloadConfigResponseSchema = z8.object({
-  sections: z8.array(reloadConfigSectionResultSchema),
-  fatalError: z8.string().optional()
+var listCollectionsResponseSchema = z8.object({
+  collections: z8.array(collectionRecordSchema)
 });
-function serializeHubUser(user) {
+var listEnvironmentsResponseSchema = z8.object({
+  environments: z8.array(environmentRecordSchema)
+});
+var listSnippetsResponseSchema = z8.object({
+  snippets: z8.array(snippetRecordSchema)
+});
+var listFoldersResponseSchema = z8.object({
+  folders: z8.array(folderRecordSchema)
+});
+var listRequestsResponseSchema = z8.object({
+  requests: z8.array(savedRequestRecordSchema)
+});
+var emptyResponseSchema = z8.null();
+function serializeCollection(record) {
   return {
-    id: user.id,
-    name: user.name,
-    role: user.role,
-    collectionAccess: user.collectionAccess,
-    environmentAccess: user.environmentAccess,
-    snippetAccess: user.snippetAccess,
-    llmAccess: user.llmAccess,
-    llmModels: user.llmModels,
-    llmMonthlyTokenLimit: user.llmMonthlyTokenLimit,
-    createdAt: user.createdAt.toISOString(),
-    updatedAt: user.updatedAt.toISOString()
+    ...record,
+    createdAt: record.createdAt.toISOString(),
+    updatedAt: record.updatedAt.toISOString()
   };
 }
-function serializeApiToken(token) {
+function serializeEnvironment(record) {
   return {
-    id: token.id,
-    userId: token.userId,
-    name: token.name,
-    tokenPrefix: token.tokenPrefix,
-    createdAt: token.createdAt.toISOString(),
-    lastUsedAt: token.lastUsedAt ? token.lastUsedAt.toISOString() : null,
-    revokedAt: token.revokedAt ? token.revokedAt.toISOString() : null
+    ...record,
+    createdAt: record.createdAt.toISOString(),
+    updatedAt: record.updatedAt.toISOString()
   };
 }
-
-// src/server/routes/schemas/entities.ts
-import { z as z9 } from "zod/v4";
-var collectionRecordSchema = z9.object({
-  id: z9.string(),
-  name: z9.string(),
-  variables: z9.array(variableSchema),
-  headers: z9.array(keyValueSchema),
-  auth: authConfigSchema,
-  preRequestScript: z9.string(),
-  postRequestScript: z9.string(),
-  createdAt: timestampSchema,
-  updatedAt: timestampSchema,
-  createdByUserId: z9.string().nullable(),
-  updatedByUserId: z9.string().nullable(),
-  deletionLocked: z9.boolean()
-});
-var environmentRecordSchema = z9.object({
-  id: z9.string(),
-  name: z9.string(),
-  variables: z9.array(variableSchema),
-  createdAt: timestampSchema,
-  updatedAt: timestampSchema,
-  createdByUserId: z9.string().nullable(),
-  updatedByUserId: z9.string().nullable(),
-  deletionLocked: z9.boolean()
+function serializeSnippet(record) {
+  return {
+    ...record,
+    createdAt: record.createdAt.toISOString(),
+    updatedAt: record.updatedAt.toISOString()
+  };
+}
+function serializeFolder(record) {
+  return {
+    ...record,
+    createdAt: record.createdAt.toISOString(),
+    updatedAt: record.updatedAt.toISOString()
+  };
+}
+function serializeSavedRequest(record) {
+  return {
+    ...record,
+    createdAt: record.createdAt.toISOString(),
+    updatedAt: record.updatedAt.toISOString()
+  };
+}
+var runResultRecordSchema = z8.object({
+  id: z8.string(),
+  kind: z8.enum(["collection-run-results", "request-run-results"]),
+  label: z8.string(),
+  collectionName: z8.string().nullable(),
+  requestName: z8.string().nullable(),
+  summary: z8.object({
+    passed: z8.number().int().nonnegative(),
+    failed: z8.number().int().nonnegative(),
+    skipped: z8.number().int().nonnegative()
+  }),
+  createdAt: timestampSchema,
+  createdByUserId: z8.string().nullable()
+});
+var runResultDetailSchema = runResultRecordSchema.extend({
+  payload: z8.record(z8.string(), z8.unknown())
+});
+var createRunResultBodySchema = z8.object({
+  label: z8.string().trim().min(1).optional(),
+  payload: z8.record(z8.string(), z8.unknown())
 });
-var snippetScopeSchema = z9.enum(["pre-request", "post-request", "any"]);
-var snippetRecordSchema = z9.object({
+var listRunResultsResponseSchema = z8.object({
+  runResults: z8.array(runResultRecordSchema)
+});
+function serializeRunResult(record) {
+  return {
+    id: record.id,
+    kind: record.kind,
+    label: record.label,
+    collectionName: record.collectionName,
+    requestName: record.requestName,
+    summary: record.summary,
+    createdAt: record.createdAt.toISOString(),
+    createdByUserId: record.createdByUserId
+  };
+}
+function serializeRunResultDetail(record) {
+  return {
+    ...serializeRunResult(record),
+    payload: record.payload
+  };
+}
+
+// src/server/routes/schemas/admin.ts
+var adminResourceOptionSchema = z9.object({
   id: z9.string(),
   name: z9.string(),
-  code: z9.string(),
-  scope: snippetScopeSchema,
-  sortOrder: z9.number().int(),
-  createdAt: timestampSchema,
-  updatedAt: timestampSchema,
-  createdByUserId: z9.string().nullable(),
-  updatedByUserId: z9.string().nullable(),
   deletionLocked: z9.boolean()
 });
-var folderRecordSchema = z9.object({
+var adminEntityConfigSchema = z9.object({
   id: z9.string(),
-  collectionId: z9.string(),
   name: z9.string(),
-  sortOrder: z9.number().int(),
-  createdAt: timestampSchema,
-  updatedAt: timestampSchema,
-  createdByUserId: z9.string().nullable(),
-  updatedByUserId: z9.string().nullable()
+  deletionLocked: z9.boolean()
 });
-var savedRequestRecordSchema = z9.object({
-  id: z9.string(),
-  collectionId: z9.string(),
-  name: z9.string(),
-  method: httpMethodSchema,
-  url: z9.string(),
-  headers: z9.array(keyValueSchema),
-  params: z9.array(keyValueSchema),
-  auth: authConfigSchema,
-  body: z9.string(),
-  bodyType: bodyTypeSchema,
-  preRequestScript: z9.string(),
-  postRequestScript: z9.string(),
-  comment: z9.string(),
-  folderId: z9.string().nullable(),
-  sortOrder: z9.number().int(),
-  createdAt: timestampSchema,
-  updatedAt: timestampSchema,
-  createdByUserId: z9.string().nullable(),
-  updatedByUserId: z9.string().nullable()
+var updateAdminCollectionBodySchema = z9.object({
+  deletionLocked: z9.boolean()
 });
-var createCollectionBodySchema = z9.object({
-  name: z9.string().trim().min(1)
+var updateAdminEnvironmentBodySchema = z9.object({
+  deletionLocked: z9.boolean()
 });
-var updateCollectionBodySchema = z9.object({
-  name: z9.string().trim().min(1),
-  variables: z9.array(variableSchema),
-  headers: z9.array(keyValueSchema),
-  preRequestScript: z9.string(),
-  postRequestScript: z9.string(),
-  auth: authConfigSchema
+var updateAdminSnippetBodySchema = z9.object({
+  name: z9.string().trim().min(1).optional(),
+  code: z9.string().optional(),
+  scope: snippetScopeSchema.optional(),
+  deletionLocked: z9.boolean().optional()
+}).superRefine((body, ctx) => {
+  const hasContentFields = body.name !== void 0 || body.code !== void 0 || body.scope !== void 0;
+  const hasFullContent = body.name !== void 0 && body.code !== void 0 && body.scope !== void 0;
+  if (hasContentFields && !hasFullContent) {
+    ctx.addIssue({
+      code: "custom",
+      message: "name, code, and scope must be provided together"
+    });
+  }
+  if (!hasContentFields && body.deletionLocked === void 0) {
+    ctx.addIssue({
+      code: "custom",
+      message: "Provide snippet content (name, code, scope) and/or deletionLocked"
+    });
+  }
 });
-var createEnvironmentBodySchema = z9.object({
-  name: z9.string().trim().min(1)
+var createAdminSnippetBodySchema = createSnippetBodySchema;
+var listAdminCollectionsResponseSchema = z9.object({
+  collections: z9.array(adminResourceOptionSchema)
 });
-var updateEnvironmentBodySchema = z9.object({
-  name: z9.string().trim().min(1),
-  variables: z9.array(variableSchema)
+var listAdminEnvironmentsResponseSchema = z9.object({
+  environments: z9.array(adminResourceOptionSchema)
 });
-var createSnippetBodySchema = z9.object({
-  name: z9.string().trim().min(1),
-  code: z9.string().default(""),
-  scope: snippetScopeSchema.default("any")
+var listAdminSnippetsResponseSchema = z9.object({
+  snippets: z9.array(snippetRecordSchema)
 });
-var updateSnippetBodySchema = z9.object({
-  name: z9.string().trim().min(1),
-  code: z9.string(),
-  scope: snippetScopeSchema
+var listAdminRunResultsResponseSchema = z9.object({
+  runResults: z9.array(runResultRecordSchema)
 });
-var createFolderBodySchema = z9.object({
-  name: z9.string().trim().min(1)
+var adminSnippetRecordSchema = snippetRecordSchema;
+var listAdminLlmModelsResponseSchema = listLlmModelsResponseSchema;
+var hubUserRecordSchema = z9.object({
+  id: z9.string(),
+  name: z9.string(),
+  role: userRoleSchema,
+  collectionAccess: z9.array(z9.string()),
+  environmentAccess: z9.array(z9.string()),
+  snippetAccess: z9.array(z9.string()),
+  llmAccess: z9.boolean(),
+  llmModels: z9.array(z9.string()),
+  llmMonthlyTokenLimit: z9.number().int().nonnegative().nullable(),
+  createdAt: timestampSchema,
+  updatedAt: timestampSchema
 });
-var renameFolderBodySchema = z9.object({
-  name: z9.string().trim().min(1)
+var adminUserListEntrySchema = hubUserRecordSchema.extend({
+  warnings: z9.array(z9.string())
 });
-var reorderFoldersBodySchema = z9.object({
-  orderedFolderIds: z9.array(z9.string().trim().min(1))
+var listAdminUsersResponseSchema = z9.object({
+  users: z9.array(adminUserListEntrySchema)
 });
-var saveRequestBodySchema = z9.object({
-  name: z9.string().trim().min(1),
-  method: httpMethodSchema,
-  url: z9.string(),
-  headers: z9.array(keyValueSchema),
-  params: z9.array(keyValueSchema),
-  auth: authConfigSchema,
-  body: z9.string(),
-  bodyType: bodyTypeSchema,
-  preRequestScript: z9.string(),
-  postRequestScript: z9.string(),
-  comment: z9.string(),
-  folderId: z9.string().nullable().optional()
+var updateAdminUserBodySchema = z9.object({
+  name: z9.string().trim().min(1).optional(),
+  role: userRoleSchema.optional(),
+  collectionAccess: z9.array(z9.string()).optional(),
+  environmentAccess: z9.array(z9.string()).optional(),
+  snippetAccess: z9.array(z9.string()).optional(),
+  llmAccess: z9.boolean().optional(),
+  llmModels: z9.array(z9.string()).optional(),
+  llmMonthlyTokenLimit: z9.number().int().nonnegative().nullable().optional()
 });
-var updateSaveRequestBodySchema = saveRequestBodySchema.extend({
-  collectionId: z9.string().trim().min(1)
+var createAdminUserBodySchema = z9.object({
+  name: z9.string().trim().min(1),
+  role: userRoleSchema,
+  collectionAccess: z9.array(z9.string()).optional(),
+  environmentAccess: z9.array(z9.string()).optional(),
+  snippetAccess: z9.array(z9.string()).optional(),
+  llmAccess: z9.boolean().optional(),
+  llmModels: z9.array(z9.string()).optional(),
+  llmMonthlyTokenLimit: z9.number().int().nonnegative().nullable().optional()
 });
-var reorderRequestsBodySchema = z9.object({
-  folderId: z9.string().nullable(),
-  orderedRequestIds: z9.array(z9.string().trim().min(1))
+var hubApiTokenRecordSchema = z9.object({
+  id: z9.string(),
+  userId: z9.string(),
+  name: z9.string(),
+  tokenPrefix: z9.string(),
+  createdAt: timestampSchema,
+  lastUsedAt: timestampSchema.nullable(),
+  revokedAt: timestampSchema.nullable()
 });
-var moveRequestBodySchema = z9.object({
-  folderId: z9.string().nullable(),
-  index: z9.number().int().min(0)
+var createAdminUserResponseSchema = z9.object({
+  user: hubUserRecordSchema,
+  token: hubApiTokenRecordSchema,
+  secret: z9.string()
 });
-var listCollectionsResponseSchema = z9.object({
-  collections: z9.array(collectionRecordSchema)
+var createAdminTokenBodySchema = z9.object({
+  name: z9.string().trim().min(1)
 });
-var listEnvironmentsResponseSchema = z9.object({
-  environments: z9.array(environmentRecordSchema)
+var createdApiTokenResponseSchema = z9.object({
+  token: hubApiTokenRecordSchema,
+  secret: z9.string()
 });
-var listSnippetsResponseSchema = z9.object({
-  snippets: z9.array(snippetRecordSchema)
+var listAdminTokensResponseSchema = z9.object({
+  tokens: z9.array(hubApiTokenRecordSchema)
 });
-var listFoldersResponseSchema = z9.object({
-  folders: z9.array(folderRecordSchema)
+var reloadConfigSectionResultSchema = z9.object({
+  section: z9.enum(["db", "redis", "llm", "plugins", "server"]),
+  status: z9.enum(["reloaded", "unchanged", "failed", "restart-required"]),
+  error: z9.string().optional()
 });
-var listRequestsResponseSchema = z9.object({
-  requests: z9.array(savedRequestRecordSchema)
+var reloadConfigResponseSchema = z9.object({
+  sections: z9.array(reloadConfigSectionResultSchema),
+  fatalError: z9.string().optional()
 });
-var emptyResponseSchema = z9.null();
-function serializeCollection(record) {
-  return {
-    ...record,
-    createdAt: record.createdAt.toISOString(),
-    updatedAt: record.updatedAt.toISOString()
-  };
-}
-function serializeEnvironment(record) {
-  return {
-    ...record,
-    createdAt: record.createdAt.toISOString(),
-    updatedAt: record.updatedAt.toISOString()
-  };
-}
-function serializeSnippet(record) {
-  return {
-    ...record,
-    createdAt: record.createdAt.toISOString(),
-    updatedAt: record.updatedAt.toISOString()
-  };
-}
-function serializeFolder(record) {
+function serializeHubUser(user) {
   return {
-    ...record,
-    createdAt: record.createdAt.toISOString(),
-    updatedAt: record.updatedAt.toISOString()
+    id: user.id,
+    name: user.name,
+    role: user.role,
+    collectionAccess: user.collectionAccess,
+    environmentAccess: user.environmentAccess,
+    snippetAccess: user.snippetAccess,
+    llmAccess: user.llmAccess,
+    llmModels: user.llmModels,
+    llmMonthlyTokenLimit: user.llmMonthlyTokenLimit,
+    createdAt: user.createdAt.toISOString(),
+    updatedAt: user.updatedAt.toISOString()
   };
 }
-function serializeSavedRequest(record) {
+function serializeApiToken(token) {
   return {
-    ...record,
-    createdAt: record.createdAt.toISOString(),
-    updatedAt: record.updatedAt.toISOString()
+    id: token.id,
+    userId: token.userId,
+    name: token.name,
+    tokenPrefix: token.tokenPrefix,
+    createdAt: token.createdAt.toISOString(),
+    lastUsedAt: token.lastUsedAt ? token.lastUsedAt.toISOString() : null,
+    revokedAt: token.revokedAt ? token.revokedAt.toISOString() : null
   };
 }
 
@@ -7553,11 +7980,7 @@ async function registerAdminRoutes(app, options) {
         }
         const snippets = await db.listSnippets();
         return reply.send({
-          snippets: snippets.map((snippet) => ({
-            id: snippet.id,
-            name: snippet.name,
-            deletionLocked: snippet.deletionLocked
-          }))
+          snippets: snippets.map((snippet) => serializeSnippet(snippet))
         });
       } catch (error) {
         if (handleDbError(reply, error)) {
@@ -7567,6 +7990,40 @@ async function registerAdminRoutes(app, options) {
       }
     }
   });
+  routes.route({
+    method: "POST",
+    url: "/admin/snippets",
+    schema: {
+      body: createAdminSnippetBodySchema,
+      response: {
+        201: adminSnippetRecordSchema,
+        403: errorResponseSchema
+      }
+    },
+    /**
+     * Creates a snippet through the management API.
+     */
+    handler: async (request, reply) => {
+      try {
+        const user = requireAuthenticatedUser(request);
+        if (denyUnlessAllowed(reply, canUseManagementApi(user))) {
+          return;
+        }
+        const snippet = await db.createSnippet(
+          request.body.name,
+          request.body.code,
+          request.body.scope,
+          user.id
+        );
+        return reply.code(201).send(serializeSnippet(snippet));
+      } catch (error) {
+        if (handleDbError(reply, error)) {
+          return;
+        }
+        throw error;
+      }
+    }
+  });
   routes.route({
     method: "DELETE",
     url: "/admin/collections/:id",
@@ -7672,6 +8129,71 @@ async function registerAdminRoutes(app, options) {
       }
     }
   });
+  routes.route({
+    method: "GET",
+    url: "/admin/run-results",
+    schema: {
+      response: {
+        200: listAdminRunResultsResponseSchema,
+        403: errorResponseSchema
+      }
+    },
+    /**
+     * Lists all run results for operator management.
+     */
+    handler: async (request, reply) => {
+      try {
+        const user = requireAuthenticatedUser(request);
+        if (denyUnlessAllowed(reply, canUseManagementApi(user))) {
+          return;
+        }
+        const runResults = await db.listAllRunResults();
+        return reply.send({
+          runResults: runResults.map((record) => serializeRunResult(record))
+        });
+      } catch (error) {
+        if (handleDbError(reply, error)) {
+          return;
+        }
+        throw error;
+      }
+    }
+  });
+  routes.route({
+    method: "DELETE",
+    url: "/admin/run-results/:id",
+    schema: {
+      params: idParamSchema,
+      response: {
+        204: emptyResponseSchema,
+        403: errorResponseSchema,
+        404: errorResponseSchema
+      }
+    },
+    /**
+     * Deletes a run result regardless of creator ownership.
+     */
+    handler: async (request, reply) => {
+      try {
+        const user = requireAuthenticatedUser(request);
+        if (denyUnlessAllowed(reply, canUseManagementApi(user))) {
+          return;
+        }
+        const record = await db.findRunResultById(request.params.id);
+        if (!record) {
+          void reply.code(404).send({ error: "Run result not found" });
+          return;
+        }
+        await db.deleteRunResult(request.params.id, user.id);
+        return reply.code(204).send(null);
+      } catch (error) {
+        if (handleDbError(reply, error)) {
+          return;
+        }
+        throw error;
+      }
+    }
+  });
   routes.route({
     method: "PUT",
     url: "/admin/snippets/:id",
@@ -7679,13 +8201,13 @@ async function registerAdminRoutes(app, options) {
       params: idParamSchema,
       body: updateAdminSnippetBodySchema,
       response: {
-        200: adminEntityConfigSchema,
+        200: adminSnippetRecordSchema,
         403: errorResponseSchema,
         404: errorResponseSchema
       }
     },
     /**
-     * Updates admin configuration for a snippet.
+     * Updates snippet content and/or admin configuration.
      */
     handler: async (request, reply) => {
       try {
@@ -7693,16 +8215,20 @@ async function registerAdminRoutes(app, options) {
         if (denyUnlessAllowed(reply, canUseManagementApi(user))) {
           return;
         }
-        const snippet = await db.setSnippetDeletionLocked(
-          request.params.id,
-          request.body.deletionLocked,
-          user.id
-        );
-        return reply.send({
-          id: snippet.id,
-          name: snippet.name,
-          deletionLocked: snippet.deletionLocked
-        });
+        const existing = await db.findSnippetById(request.params.id);
+        if (!existing) {
+          void reply.code(404).send({ error: "Snippet not found" });
+          return;
+        }
+        let snippet = existing;
+        const { name, code, scope, deletionLocked } = request.body;
+        if (name !== void 0 && code !== void 0 && scope !== void 0) {
+          snippet = await db.updateSnippet(request.params.id, name, code, scope, user.id);
+        }
+        if (deletionLocked !== void 0) {
+          snippet = await db.setSnippetDeletionLocked(request.params.id, deletionLocked, user.id);
+        }
+        return reply.send(serializeSnippet(snippet));
       } catch (error) {
         if (handleDbError(reply, error)) {
           return;
@@ -9050,6 +9576,140 @@ async function registerRequestRoutes(app, db) {
   });
 }
 
+// src/server/routes/runResults.ts
+async function registerRunResultRoutes(app, db) {
+  const routes = app.withTypeProvider();
+  routes.route({
+    method: "GET",
+    url: "/run-results",
+    schema: {
+      response: {
+        200: listRunResultsResponseSchema
+      }
+    },
+    /**
+     * Lists run results saved by the authenticated user token.
+     */
+    handler: async (request, reply) => {
+      try {
+        const user = requireAuthenticatedUser(request);
+        if (denyUnlessAllowed(reply, canListRunResults(user))) {
+          return;
+        }
+        const runResults = await db.listRunResultsForUser(user.id);
+        return reply.send({
+          runResults: runResults.map((record) => serializeRunResult(record))
+        });
+      } catch (error) {
+        if (handleDbError(reply, error)) {
+          return;
+        }
+        throw error;
+      }
+    }
+  });
+  routes.route({
+    method: "POST",
+    url: "/run-results",
+    schema: {
+      body: createRunResultBodySchema,
+      response: {
+        200: runResultDetailSchema,
+        400: errorResponseSchema
+      }
+    },
+    /**
+     * Saves a standalone run result snapshot.
+     */
+    handler: async (request, reply) => {
+      try {
+        const user = requireAuthenticatedUser(request);
+        if (denyUnlessAllowed(reply, canUseDataApi(user))) {
+          return;
+        }
+        const record = await db.createRunResult(request.body, user.id);
+        return reply.send(serializeRunResultDetail(record));
+      } catch (error) {
+        if (handleDbError(reply, error)) {
+          return;
+        }
+        throw error;
+      }
+    }
+  });
+  routes.route({
+    method: "GET",
+    url: "/run-results/:id",
+    schema: {
+      params: idParamSchema,
+      response: {
+        200: runResultDetailSchema,
+        404: errorResponseSchema
+      }
+    },
+    /**
+     * Loads a run result snapshot by id for shared deep links.
+     */
+    handler: async (request, reply) => {
+      try {
+        const user = requireAuthenticatedUser(request);
+        if (denyUnlessAllowed(reply, canUseDataApi(user))) {
+          return;
+        }
+        const record = await db.findRunResultById(request.params.id);
+        if (!record) {
+          void reply.code(404).send({ error: "Run result not found" });
+          return;
+        }
+        return reply.send(serializeRunResultDetail(record));
+      } catch (error) {
+        if (handleDbError(reply, error)) {
+          return;
+        }
+        throw error;
+      }
+    }
+  });
+  routes.route({
+    method: "DELETE",
+    url: "/run-results/:id",
+    schema: {
+      params: idParamSchema,
+      response: {
+        204: emptyResponseSchema,
+        403: errorResponseSchema,
+        404: errorResponseSchema
+      }
+    },
+    /**
+     * Deletes a run result saved by the authenticated user when permitted.
+     */
+    handler: async (request, reply) => {
+      try {
+        const user = requireAuthenticatedUser(request);
+        if (denyUnlessAllowed(reply, canUseDataApi(user))) {
+          return;
+        }
+        const record = await db.findRunResultById(request.params.id);
+        if (!record) {
+          void reply.code(404).send({ error: "Run result not found" });
+          return;
+        }
+        if (denyUnlessAllowed(reply, canDeleteRunResult(user, record))) {
+          return;
+        }
+        await db.deleteRunResult(request.params.id, user.id);
+        return reply.code(204).send(null);
+      } catch (error) {
+        if (handleDbError(reply, error)) {
+          return;
+        }
+        throw error;
+      }
+    }
+  });
+}
+
 // src/server/llm/client.ts
 var OPENAI_BASE_URL = "https://api.openai.com/v1";
 var CLAUDE_BASE_URL = "https://api.anthropic.com/v1";
@@ -9692,6 +10352,7 @@ async function registerProtectedRoutes(app, options) {
   await registerSnippetRoutes(app, options.db);
   await registerFolderRoutes(app, options.db);
   await registerRequestRoutes(app, options.db);
+  await registerRunResultRoutes(app, options.db);
   await registerLlmRoutes(app, { db: options.db, getLlm: options.getLlm });
   await registerPluginsRoutes(app, { getPlugins: options.getPlugins });
 }