@phnx-labs/agents-cli 1.22.54 → 1.22.56

package/dist/lib/scheduling/routines.d.ts

@@ -6,6 +6,7 @@
  * run metadata persistence, prompt variable expansion, and one-shot "at" time
  * scheduling.
  */
+import { Cron } from 'croner';
 import { type ResolvedExecutionContext, type ProjectResolution, type PlacementMode, type RoutineKind, type ContextFsProbe } from '../routine-context.js';
 import type { AgentId, RunStrategy } from '../types.js';
 import type { LoopConfig } from '../loop.js';
@@ -16,6 +17,53 @@ export declare function nextRunLabel(job: JobConfig, scheduler: JobScheduler, no
 export declare function localLatestRun(job: JobConfig): RunMeta | null;
 export declare function listJobsForDisplay(cwd?: string): JobConfig[];
 export declare function buildRoutineListJson(): Record<string, unknown>[];
+/** One routine's live scheduler-status row for `agents routines status --json`. */
+export interface RoutineStatusRow {
+    name: string;
+    /** The single device this routine is pinned to fire on, or null when unpinned. */
+    ownerDevice: string | null;
+    /** True when `devices:` names more than one device — no single owner (doctor flags it). */
+    ambiguousDevicePin: boolean;
+    /** Every device this routine is enabled on. */
+    enabledDevices: string[];
+    /** Whether THIS device is the one that fires the routine. */
+    runsHere: boolean;
+    enabled: boolean;
+    overdue: boolean;
+    nextRun: string | null;
+    /** Terminal status of the last local fire: completed/failed/timeout/missed/blocked/skipped/running, or null if it never ran here. */
+    lastStatus: RunMeta['status'] | null;
+    /** The last fire's failure reason, when it did not complete cleanly. Named to match `list --json`'s `failureReason`. */
+    failureReason: string | null;
+    lastRunStartedAt: string | null;
+    lastRunCompletedAt: string | null;
+    /** Present only while a run is genuinely in flight on THIS device (a live local child or a host-placed run) — never a provisional pre-spawn claim. */
+    inFlight: {
+        runId: string;
+        pid: number | null;
+        startedAt: string;
+        triggerKind: RunMeta['triggerKind'] | null;
+    } | null;
+}
+/**
+ * The per-routine rows behind `agents routines status --json`. Distinct from
+ * {@link buildRoutineListJson}: this is the scheduler-truth surface the daemon
+ * owns — per routine it names the single owner device, the last fire's outcome
+ * and error, and any in-flight spawn — the fields an operator (or the menu bar /
+ * ext) needs to answer "did this routine fire, and is one running right now?"
+ * that the definition-shaped `list --json` does not carry (PHNX-3215).
+ *
+ * `monitorRunningJobs()` runs first to reap runs whose process has exited, then
+ * `inFlight` is gated on {@link isRunGenuinelyInFlight} — NOT on `status ===
+ * 'running'` alone, because a provisional pre-spawn claim is `running` with a
+ * null pid that the reaper does not touch (RUSH-2640).
+ *
+ * The routine set is the schedulable one ({@link listJobs}, the same
+ * `getDaemonStatus`/`routines status` counts), not the display set
+ * {@link buildRoutineListJson} uses — a scheduler-status surface names what the
+ * daemon can actually fire, not discoverable-but-unmaterialised project routines.
+ */
+export declare function buildRoutineStatusRows(): RoutineStatusRow[];
 /** Tool/site/directory allow-list for sandboxed job execution. */
 export interface JobAllowConfig {
     tools?: string[];
@@ -790,6 +838,26 @@ export declare function getRunDir(jobName: string, runId: string): string;
  * for the same UTC slot are one record.
  */
 export declare function slotRunId(scheduledFor: Date | string): string;
+/**
+ * The aligned schedule boundary a fire belongs to: the most recent occurrence of
+ * `cron` at or before `at`.
+ *
+ * This is the occurrence IDENTITY that {@link slotRunId} (forward dispatch) and
+ * `missedRunId` (catchup.ts) must both key on. croner's `currentRun()` inside a
+ * fire callback is the JITTERED wall-clock trigger instant (it carries
+ * milliseconds — verified), not the aligned boundary, so keying `slotRunId`
+ * directly on it produced a distinct id per delivery: two callbacks for one
+ * occurrence each claimed a different run dir and both launched, and a live fire
+ * never collided with its catch-up twin (which keys on the aligned
+ * `previousExpectedFire`). Flooring both to this boundary is what makes the
+ * single-fire claim a structural claim on `(routine, scheduledFor)` (SING-15).
+ *
+ * croner's `previousRun()` takes no argument and returns null on a freshly
+ * constructed instance, so we walk `nextRun(cursor)` forward from a lookback
+ * window and keep the last fire still ≤ `at` — the same derivation catchup's
+ * overdue detection has always used.
+ */
+export declare function alignedSlotForFire(cron: Cron, at: Date): Date | null;
 /**
  * Atomically CLAIM a run directory. Returns true on a successful claim, false
  * when the directory already exists (another caller — even in a separate process

package/dist/lib/scheduling/routines.js

@@ -26,7 +26,7 @@ import { enabledRoutineNames, devicesWithRoutineEnabled, replaceEnabledRoutines,
 import { humanizeCron, humanizeNextRun } from '../routines-format.js';
 import { discoverProjectRoutines } from '../routines-project.js';
 import { listProjectDefs } from '../projects.js';
-import { monitorRunningJobs } from '../daemon/runner.js';
+import { monitorRunningJobs, isRunGenuinelyInFlight } from '../daemon/runner.js';
 import { JobScheduler } from '../scheduler.js';
 import { detectOverdueJobs } from '../overdue.js';
 export function fireConditionLabel(job) {
@@ -142,6 +142,75 @@ export function buildRoutineListJson() {
         scheduler.stopAll();
     }
 }
+/**
+ * The per-routine rows behind `agents routines status --json`. Distinct from
+ * {@link buildRoutineListJson}: this is the scheduler-truth surface the daemon
+ * owns — per routine it names the single owner device, the last fire's outcome
+ * and error, and any in-flight spawn — the fields an operator (or the menu bar /
+ * ext) needs to answer "did this routine fire, and is one running right now?"
+ * that the definition-shaped `list --json` does not carry (PHNX-3215).
+ *
+ * `monitorRunningJobs()` runs first to reap runs whose process has exited, then
+ * `inFlight` is gated on {@link isRunGenuinelyInFlight} — NOT on `status ===
+ * 'running'` alone, because a provisional pre-spawn claim is `running` with a
+ * null pid that the reaper does not touch (RUSH-2640).
+ *
+ * The routine set is the schedulable one ({@link listJobs}, the same
+ * `getDaemonStatus`/`routines status` counts), not the display set
+ * {@link buildRoutineListJson} uses — a scheduler-status surface names what the
+ * daemon can actually fire, not discoverable-but-unmaterialised project routines.
+ */
+export function buildRoutineStatusRows() {
+    try {
+        monitorRunningJobs();
+    }
+    catch { /* best-effort orphan reap */ }
+    const jobs = listJobs();
+    if (jobs.length === 0)
+        return [];
+    const scheduler = new JobScheduler(async () => { });
+    scheduler.loadAll();
+    try {
+        const overdueSet = new Set();
+        try {
+            for (const job of detectOverdueJobs())
+                overdueSet.add(job.name);
+        }
+        catch {
+            // Best-effort indicator; never block status on detection errors.
+        }
+        const now = new Date();
+        return jobs.map((job) => {
+            const latestRun = localLatestRun(job);
+            const inFlight = latestRun && isRunGenuinelyInFlight(latestRun)
+                ? {
+                    runId: latestRun.runId,
+                    pid: latestRun.pid,
+                    startedAt: latestRun.startedAt,
+                    triggerKind: latestRun.triggerKind ?? null,
+                }
+                : null;
+            return {
+                name: job.name,
+                ownerDevice: routineOwnerDevice(job),
+                ambiguousDevicePin: hasAmbiguousDevicePin(job),
+                enabledDevices: devicesWithRoutineEnabled(job.name),
+                runsHere: jobRunsOnThisDevice(job),
+                enabled: job.enabled,
+                overdue: overdueSet.has(job.name),
+                nextRun: nextRunForDisplay(job, scheduler)?.toISOString() ?? null,
+                lastStatus: latestRun?.status ?? null,
+                failureReason: latestRun?.errorMessage ?? null,
+                lastRunStartedAt: latestRun?.startedAt ?? null,
+                lastRunCompletedAt: latestRun?.completedAt ?? null,
+                inFlight,
+            };
+        });
+    }
+    finally {
+        scheduler.stopAll();
+    }
+}
 export const HOST_STRATEGIES = ['local', 'host', 'fleet', 'cloud'];
 /** Canonical set of accepted GitHub trigger events — single source for validation. */
 export const GITHUB_TRIGGER_EVENTS = [
@@ -1449,6 +1518,62 @@ export function slotRunId(scheduledFor) {
     const iso = typeof scheduledFor === 'string' ? scheduledFor : scheduledFor.toISOString();
     return iso.replace(/[:.]/g, '-');
 }
+/**
+ * Lookback windows for {@link alignedSlotForFire}, narrowest first. A wider
+ * window is tried ONLY when the narrower one found no fire, so:
+ *  - a dense schedule (every-minute) resolves in the 1-hour window — ~60 steps,
+ *    not ~10080 — which matters because the forward-timer path now runs this on
+ *    every fire (a live fire is milliseconds past its boundary, so the narrowest
+ *    window always contains it);
+ *  - a sparse schedule (`0 9 1,13,25 * *` has 12-day gaps; monthly/quarterly/
+ *    annual) still resolves, because a fixed short window silently blinded
+ *    overdue detection to any cron whose gap exceeded it.
+ * A narrower window can only ever find the true most-recent fire ≤ `at` or
+ * nothing (never a wrong boundary), so prepending the cheap windows is
+ * behavior-preserving for the sparse-schedule overdue path.
+ */
+const HOUR_MS = 60 * 60 * 1000;
+const DAY_MS = 24 * HOUR_MS;
+const SLOT_LOOKBACK_WINDOWS_MS = [HOUR_MS, DAY_MS, 7 * DAY_MS, 32 * DAY_MS, 93 * DAY_MS, 400 * DAY_MS];
+/**
+ * The aligned schedule boundary a fire belongs to: the most recent occurrence of
+ * `cron` at or before `at`.
+ *
+ * This is the occurrence IDENTITY that {@link slotRunId} (forward dispatch) and
+ * `missedRunId` (catchup.ts) must both key on. croner's `currentRun()` inside a
+ * fire callback is the JITTERED wall-clock trigger instant (it carries
+ * milliseconds — verified), not the aligned boundary, so keying `slotRunId`
+ * directly on it produced a distinct id per delivery: two callbacks for one
+ * occurrence each claimed a different run dir and both launched, and a live fire
+ * never collided with its catch-up twin (which keys on the aligned
+ * `previousExpectedFire`). Flooring both to this boundary is what makes the
+ * single-fire claim a structural claim on `(routine, scheduledFor)` (SING-15).
+ *
+ * croner's `previousRun()` takes no argument and returns null on a freshly
+ * constructed instance, so we walk `nextRun(cursor)` forward from a lookback
+ * window and keep the last fire still ≤ `at` — the same derivation catchup's
+ * overdue detection has always used.
+ */
+export function alignedSlotForFire(cron, at) {
+    for (const window of SLOT_LOOKBACK_WINDOWS_MS) {
+        let cursor = new Date(at.getTime() - window);
+        let last = null;
+        // Cap iterations: an every-minute schedule yields ≤ 10080 steps over a week;
+        // 20k is a paranoia bound against pathological patterns. Only a schedule that
+        // found nothing in the narrower window reaches a wider one, and such a
+        // schedule is sparse, so the cap is never the binding constraint.
+        for (let i = 0; i < 20000; i++) {
+            const next = cron.nextRun(cursor);
+            if (!next || next.getTime() > at.getTime())
+                break;
+            last = next;
+            cursor = next;
+        }
+        if (last)
+            return last;
+    }
+    return null;
+}
 /**
  * Atomically CLAIM a run directory. Returns true on a successful claim, false
  * when the directory already exists (another caller — even in a separate process

package/dist/lib/session/db.d.ts

@@ -33,7 +33,8 @@ export declare const CONTENT_INDEX_VERSION = 1;
  */
 /** Bump when facet extraction changes so cached rows recompute (shell-command-by-binary v7). */
 export declare const INSIGHTS_EXTRACTOR_VERSION = 7;
-export declare const SESSION_TOPIC_EXTRACTOR_VERSION = 1;
+/** Bump when classifyTopic's output changes so cached topics recompute (human task taxonomy v2). */
+export declare const SESSION_TOPIC_EXTRACTOR_VERSION = 2;
 /** File stat snapshot used to detect changes between scan runs. */
 export interface ScanStamp {
     fileMtimeMs: number;

package/dist/lib/session/db.js

@@ -435,7 +435,8 @@ CREATE INDEX IF NOT EXISTS idx_computer_sessions_started ON computer_sessions(st
  */
 /** Bump when facet extraction changes so cached rows recompute (shell-command-by-binary v7). */
 export const INSIGHTS_EXTRACTOR_VERSION = 7;
-export const SESSION_TOPIC_EXTRACTOR_VERSION = 1;
+/** Bump when classifyTopic's output changes so cached topics recompute (human task taxonomy v2). */
+export const SESSION_TOPIC_EXTRACTOR_VERSION = 2;
 const PREVIEW_EXTRACTOR_VERSION = 1;
 let dbInstance = null;
 /**

package/dist/lib/share/capture.js

@@ -36,8 +36,17 @@ export function candidateBrowsers() {
         if (p && fs.existsSync(p) && !out.includes(p))
             out.push(p);
     };
-    // 1) An explicit override always wins.
-    push(process.env.PUPPETEER_EXECUTABLE_PATH || process.env.AGENTS_SHARE_BROWSER);
+    // 1) Explicit overrides are contracts, not hints. A typo must fail at the
+    // boundary instead of silently falling through to an unrelated browser.
+    for (const name of ['PUPPETEER_EXECUTABLE_PATH', 'AGENTS_SHARE_BROWSER']) {
+        const value = process.env[name]?.trim();
+        if (!value)
+            continue;
+        if (!fs.existsSync(value)) {
+            throw new Error(`${name} points to a browser that does not exist: ${value}`);
+        }
+        push(value);
+    }
     // 2) Managed Chromium in the Playwright / Puppeteer caches — purpose-built for
     //    headless, so it's the most reliable capture host when present.
     for (const bin of scanCaches())

package/dist/lib/share/provision.d.ts

@@ -1,3 +1,4 @@
+import type { WorkerBundle } from './worker-template.js';
 export declare const SHARE_LIFECYCLE_RULE_ID = "agents-share-expire-objects";
 export declare const SHARE_LIFECYCLE_RETENTION_DAYS = 366;
 interface R2LifecycleRule {
@@ -50,7 +51,7 @@ export declare function mergeShareLifecycleRule(existing?: R2LifecycleRule[], ru
 /** Ensure the share bucket self-cleans old objects. Exact per-link expiry is enforced by the Worker. */
 export declare function configureBucketLifecycle(apiToken: string, accountId: string, bucketName: string, opts?: ProvisionOptions): Promise<void>;
 /** Upload the module Worker with an R2 binding (`BUCKET`). Secrets are set via the Workers Secrets API. */
-export declare function deployWorker(apiToken: string, accountId: string, workerName: string, script: string, bucketName: string, opts?: ProvisionOptions): Promise<void>;
+export declare function deployWorker(apiToken: string, accountId: string, workerName: string, worker: string | WorkerBundle, bucketName: string, opts?: ProvisionOptions): Promise<void>;
 /** sha256 of the rendered Worker script, so a deployed endpoint can be compared
  * against the current `worker-template.ts` without redeploying to find out. */
 export declare function hashWorkerScript(script: string): string;
@@ -100,7 +101,7 @@ export type UpdateWorkerOpts = ProvisionOptions & {
  * re-setting the secret to its own value after every deploy gets the same
  * outcome without depending on an unverified upload-time flag.
  */
-export declare function updateWorker(apiToken: string, accountId: string, workerName: string, bucketName: string, script: string, writeToken: string, previousHash: string | undefined, opts?: UpdateWorkerOpts): Promise<UpdateWorkerResult>;
+export declare function updateWorker(apiToken: string, accountId: string, workerName: string, bucketName: string, worker: string | WorkerBundle, writeToken: string, previousHash: string | undefined, opts?: UpdateWorkerOpts): Promise<UpdateWorkerResult>;
 /** Add/update a secret_text binding using Cloudflare's Workers Secrets API. */
 export declare function putWorkerSecret(apiToken: string, accountId: string, workerName: string, name: string, text: string, opts?: ProvisionOptions): Promise<void>;
 /** Add/update the WRITE_TOKEN binding using Cloudflare's Workers Secrets API. */

package/dist/lib/share/provision.js

@@ -77,7 +77,7 @@ export async function configureBucketLifecycle(apiToken, accountId, bucketName,
     });
 }
 /** Upload the module Worker with an R2 binding (`BUCKET`). Secrets are set via the Workers Secrets API. */
-export async function deployWorker(apiToken, accountId, workerName, script, bucketName, opts = {}) {
+export async function deployWorker(apiToken, accountId, workerName, worker, bucketName, opts = {}) {
     const request = opts.request ?? defaultCloudflareRequester;
     const metadata = {
         main_module: 'worker.js',
@@ -88,7 +88,11 @@ export async function deployWorker(apiToken, accountId, workerName, script, buck
     };
     const form = new FormData();
     form.set('metadata', new Blob([JSON.stringify(metadata)], { type: 'application/json' }));
-    form.set('worker.js', new Blob([script], { type: 'application/javascript+module' }), 'worker.js');
+    const bundle = typeof worker === 'string' ? { script: worker, modules: [] } : worker;
+    form.set('worker.js', new Blob([bundle.script], { type: 'application/javascript+module' }), 'worker.js');
+    for (const module of bundle.modules) {
+        form.set(module.name, new Blob([module.contents], { type: module.contentType }), module.name);
+    }
     await request({
         apiToken,
         method: 'PUT',
@@ -130,7 +134,8 @@ export const WORKER_PHOENIX_ID_BASE_SECRET = 'PHOENIX_ID_BASE';
  * re-setting the secret to its own value after every deploy gets the same
  * outcome without depending on an unverified upload-time flag.
  */
-export async function updateWorker(apiToken, accountId, workerName, bucketName, script, writeToken, previousHash, opts = {}) {
+export async function updateWorker(apiToken, accountId, workerName, bucketName, worker, writeToken, previousHash, opts = {}) {
+    const script = typeof worker === 'string' ? worker : worker.script;
     const templateHash = hashWorkerScript(script);
     if (!opts.force && previousHash === templateHash) {
         // Script is current so we skip the upload (which would wipe secrets). A
@@ -142,7 +147,7 @@ export async function updateWorker(apiToken, accountId, workerName, bucketName,
         }
         return { templateHash, skipped: true };
     }
-    await deployWorker(apiToken, accountId, workerName, script, bucketName, opts);
+    await deployWorker(apiToken, accountId, workerName, worker, bucketName, opts);
     // Script upload clears bindings/secrets (see JSDoc above). If re-applying
     // WRITE_TOKEN fails here, the live Worker has no write token — every
     // `agents artifacts share` publish/delete 401s until a re-run of `agents artifacts share update`

package/dist/lib/share/publish.d.ts

@@ -1,4 +1,5 @@
 import { type ShareConfig } from './config.js';
+import { type ShareBackendKind } from './backend.js';
 export type PutFn = (url: string, body: Buffer, headers: Record<string, string>) => Promise<{
     ok: boolean;
     status: number;
@@ -9,6 +10,8 @@ export interface PublishEndpoint {
     token: string;
 }
 export interface PublishOptions {
+    /** Internal resolved backend; publishFile sets this after authentication. */
+    backendKind?: ShareBackendKind;
     slug?: string;
     /**
      * Auto-expire window. Relative (`30d`, `12h`), absolute (`2026-08-01`), or
@@ -133,7 +136,7 @@ export interface ShareProvenance {
  * provenance the CLI sets automatically, plus `expires-at` / `visibility` /
  * `owner` which the Worker stamps itself.
  */
-export declare const RESERVED_META_KEYS: readonly ["expires-at", "published-at", "visibility", "owner", "org_domain", "agent", "session", "host", "repo", "date", "avatar", "label", "label-source"];
+export declare const RESERVED_META_KEYS: readonly ["expires-at", "published-at", "visibility", "owner", "org_domain", "agent", "session", "host", "repo", "date", "avatar", "label", "label-source", "og-title", "og-description", "og-generated", "og-source-etag"];
 /**
  * Auto-capture publish provenance from the exec env, git, and the local clock.
  * Every field is present only when the environment genuinely carries it — a

package/dist/lib/share/publish.js

@@ -52,6 +52,10 @@ export const RESERVED_META_KEYS = [
     'avatar',
     'label',
     'label-source',
+    'og-title',
+    'og-description',
+    'og-generated',
+    'og-source-etag',
 ];
 const META_KEY_RE = /^[a-z0-9-]{1,64}$/;
 /**
@@ -506,6 +510,7 @@ export async function publishFile(filePath, opts = {}) {
         ...opts,
         githubUser: username,
         analyticsToken,
+        backendKind: backend.kind,
     });
 }
 export async function publishToEndpoint(filePath, endpoint, opts = {}) {
@@ -536,6 +541,19 @@ export async function publishToEndpoint(filePath, endpoint, opts = {}) {
     // is only reached when --label is omitted.
     const label = explicitLabel ? sanitizeLabel(explicitLabel) : deriveLabel(filePath, body);
     const labelSource = explicitLabel ? 'explicit' : 'derived';
+    const ogMeta = isHtml ? deriveMeta(body.toString('utf8')) : undefined;
+    // The managed Worker owns deterministic OG generation. Point crawlers at the
+    // lazy sibling route without invoking a browser on the publishing machine.
+    if (isHtml && opts.cover !== false && opts.backendKind === 'managed' && ogMeta) {
+        coverUrl = `${pageUrl}.png`;
+        body = Buffer.from(injectOgMeta(body.toString('utf8'), {
+            ...ogMeta,
+            imageUrl: coverUrl,
+            pageUrl,
+            imageWidth: OG_WIDTH,
+            imageHeight: OG_HEIGHT,
+        }), 'utf8');
+    }
     // Pre-publish scan (RUSH-2443/RUSH-2683): refuse emails / credential-shaped
     // strings unless --force. Runs on the raw file body AND on every piece of
     // free-text metadata that lands in public customMetadata — --label (explicit
@@ -558,6 +576,10 @@ export async function publishToEndpoint(filePath, endpoint, opts = {}) {
     // Validate the FULL customMetadata payload before any network call — fail
     // fast, not mid-upload.
     const metadataPreview = { ...meta, label, 'label-source': labelSource };
+    if (ogMeta && opts.backendKind === 'managed') {
+        metadataPreview['og-title'] = ogMeta.title;
+        metadataPreview['og-description'] = ogMeta.description;
+    }
     if (provenance.agent)
         metadataPreview.agent = provenance.agent;
     if (provenance.session)
@@ -606,6 +628,10 @@ export async function publishToEndpoint(filePath, endpoint, opts = {}) {
             setText('x-share-avatar', avatarUrl);
         setText('x-share-label', label);
         h['x-share-label-source'] = labelSource;
+        if (ogMeta && opts.backendKind === 'managed') {
+            setText('x-share-og-title', ogMeta.title);
+            setText('x-share-og-description', ogMeta.description);
+        }
         // Per VALUE, before JSON.stringify — folding the serialized form would rewrite
         // a curly quote inside a value into a bare `"`, which is structural in JSON and
         // makes the Worker's JSON.parse throw. It swallows that error, so every --meta
@@ -633,7 +659,7 @@ export async function publishToEndpoint(filePath, endpoint, opts = {}) {
     // Cover: screenshot the page's hero → upload <slug>.png → inject og:image meta.
     // Unlisted pages still get a cover (the direct URL is the capability), but the
     // cover inherits visibility=unlisted so it is also omitted from the gallery.
-    if (isHtml && opts.cover !== false) {
+    if (isHtml && opts.cover !== false && opts.backendKind !== 'managed') {
         const res = await attachOgCover(filePath, body, {
             pngUrl: `${pageUrl}.png`,
             pageUrl,

package/dist/lib/share/worker-template.d.ts

@@ -10,4 +10,18 @@
  * until its owner re-runs `agents artifacts share update`. Cosmetic renames are not
  * worth that; change this text only alongside a real Worker behavior change.
  */
+export interface WorkerModule {
+    name: string;
+    contentType: 'application/wasm';
+    contents: Uint8Array<ArrayBuffer>;
+}
+export interface WorkerBundle {
+    script: string;
+    modules: WorkerModule[];
+}
+/** Bundle the Worker renderer into an ES module plus workerd-compiled WASM modules. */
+export declare function renderWorkerBundle(): WorkerBundle;
+/** Single-file representation for direct Node tests, which cannot import compiled WASM modules. */
 export declare function renderWorkerScript(): string;
+/** Unbundled Worker source. Kept separate so esbuild can resolve npm modules. */
+export declare function renderWorkerSource(): string;