@sapiom/harness 0.1.5 → 0.1.6

package/dist/core/run-local-bootstrap.js

@@ -0,0 +1,155 @@
+/**
+ * run-local bootstrap — the child-process entrypoint behind
+ * `POST /api/runs/local`.
+ *
+ * It runs an agent entirely in-process against stub capabilities
+ * (`runLocalFromDir` from @sapiom/agent-core) and writes the result as an
+ * NDJSON stream to stdout: one line per {@link LocalStepTrace}, then a single
+ * terminal summary line `{ outcome, output, error, unusedStubs, stubWarnings }`.
+ * Fully offline and zero-cost — run-local resolves every `ctx.sapiom.*` call
+ * from stubs and never touches the network.
+ *
+ * Why a separate child process (not an in-process import):
+ *  1. `runLocalFromDir` esbuild-bundles and dynamically `import()`s a workflow
+ *     project the harness doesn't control, so a stray top-level side effect,
+ *     infinite loop, or crash in someone else's step body is bounded to this
+ *     one child instead of taking the long-lived harness server down.
+ *  2. It sidesteps a Vite/Vitest limitation: the dynamic `import(\`file://…\`)`
+ *     inside the loader gets intercepted by the SSR dynamic-import-vars
+ *     transform when pulled into a Vitest module graph, and mishandles the
+ *     tmpdir `file://` URL on darwin. A plain child `node` process never goes
+ *     through that transform. (Mirrors the reasoning in canvas-manifest-check.)
+ *
+ * Contract with the route ({@link createActionsRouter}):
+ *  - Request arrives as one JSON object on **stdin**: `{ sourceDir, input?,
+ *    stubs?, maxAttemptsPerStep? }`.
+ *  - Output is line-oriented JSON on **stdout** — the route forwards each line
+ *    through unchanged, so the shapes here ARE the wire shapes the SPA parses.
+ *  - Diagnostics go to **stderr**; the route keeps a bounded tail for failures.
+ *  - Exit 0 once the terminal line is written (even for a failed run — a failed
+ *    *run* is a successful *invocation*); exit 1 only when no run happened
+ *    (bad request, load error) after writing a terminal `error` line.
+ */
+import { runLocalFromDir, } from "@sapiom/agent-core";
+/** Read the entire request payload from a readable stream as one UTF-8 string. */
+async function readAll(stream) {
+    const chunks = [];
+    for await (const chunk of stream) {
+        chunks.push(typeof chunk === "string" ? Buffer.from(chunk) : chunk);
+    }
+    return Buffer.concat(chunks).toString("utf8");
+}
+/**
+ * Parse the stdin payload into a {@link RunLocalRequest}. Throws a plain Error
+ * with a caller-safe message (no key material, no provider names) on anything
+ * that isn't a JSON object carrying a non-empty string `sourceDir`.
+ */
+export function parseRunLocalRequest(raw) {
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch {
+        throw new Error("run-local request is not valid JSON");
+    }
+    if (typeof parsed !== "object" || parsed === null) {
+        throw new Error("run-local request must be a JSON object");
+    }
+    const body = parsed;
+    const sourceDir = body.sourceDir;
+    if (typeof sourceDir !== "string" || sourceDir.trim() === "") {
+        throw new Error("run-local request requires a non-empty sourceDir");
+    }
+    return {
+        sourceDir,
+        input: body.input,
+        stubs: body.stubs,
+        maxAttemptsPerStep: typeof body.maxAttemptsPerStep === "number"
+            ? body.maxAttemptsPerStep
+            : undefined,
+    };
+}
+/** Serialize one step trace as a single NDJSON line (newline-terminated). */
+function traceLine(step) {
+    return JSON.stringify(step) + "\n";
+}
+/** Serialize the terminal summary as a single NDJSON line. */
+function summaryLine(line) {
+    return JSON.stringify(line) + "\n";
+}
+/**
+ * Run the request and emit its NDJSON stream to `out`. Returns the process exit
+ * code: 0 when a run executed (any outcome), 1 when the run could not be
+ * invoked (a terminal `error` line is emitted first). Never throws — every
+ * failure becomes an in-band terminal line, because a half-written stream with
+ * a thrown stack on stderr is far harder for the route to reason about than a
+ * clean terminal line plus an exit code.
+ */
+export async function runBootstrap(request, out) {
+    try {
+        const result = await runLocalFromDir({
+            sourceDir: request.sourceDir,
+            input: request.input,
+            stubs: request.stubs,
+            maxAttemptsPerStep: request.maxAttemptsPerStep,
+        });
+        // One line per step-attempt, in execution order — the consumer parses them
+        // incrementally rather than buffering the whole trace as a single blob.
+        for (const step of result.steps) {
+            out.write(traceLine(step));
+        }
+        const summary = {
+            kind: "summary",
+            outcome: result.outcome,
+            output: result.output,
+            error: result.error,
+            unusedStubs: result.unusedStubs,
+            stubWarnings: result.stubWarnings,
+        };
+        out.write(summaryLine(summary));
+        return 0;
+    }
+    catch (err) {
+        const errorLine = {
+            kind: "error",
+            outcome: "failed",
+            error: err instanceof Error ? err.message : String(err),
+        };
+        out.write(JSON.stringify(errorLine) + "\n");
+        return 1;
+    }
+}
+/**
+ * Entrypoint: read the request from stdin, run it, exit with the run's code.
+ * A stdin/read failure (or a request that can't be parsed) also degrades to a
+ * terminal `error` line + exit 1 — the route always sees a well-formed final
+ * line regardless of how the child failed.
+ */
+async function main() {
+    let request;
+    try {
+        request = parseRunLocalRequest(await readAll(process.stdin));
+    }
+    catch (err) {
+        const errorLine = {
+            kind: "error",
+            outcome: "failed",
+            error: err instanceof Error ? err.message : String(err),
+        };
+        process.stdout.write(JSON.stringify(errorLine) + "\n");
+        process.exitCode = 1;
+        return;
+    }
+    process.exitCode = await runBootstrap(request, process.stdout);
+}
+// Only self-invoke when run as the child entrypoint, never when imported by a
+// unit test (which drives runBootstrap / parseRunLocalRequest directly). The
+// built entry is dist/core/run-local-bootstrap.js; import.meta.url ends with
+// this module's own file, and process.argv[1] is the script node was told to
+// run — they share a basename only for the real child launch.
+const invokedAsScript = typeof process.argv[1] === "string" &&
+    import.meta.url === new URL(`file://${process.argv[1]}`).href;
+if (invokedAsScript) {
+    void main();
+}
+//# sourceMappingURL=run-local-bootstrap.js.map

package/dist/core/run-local-bootstrap.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"run-local-bootstrap.js","sourceRoot":"","sources":["../../src/core/run-local-bootstrap.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,OAAO,EACL,eAAe,GAIhB,MAAM,oBAAoB,CAAC;AA8C5B,kFAAkF;AAClF,KAAK,UAAU,OAAO,CAAC,MAA6B;IAClD,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QACjC,MAAM,CAAC,IAAI,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IACtE,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AAChD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAAC,GAAW;IAC9C,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IACzD,CAAC;IACD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QAClD,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IAC7D,CAAC;IACD,MAAM,IAAI,GAAG,MAAiC,CAAC;IAC/C,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;IACjC,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QAC7D,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACtE,CAAC;IACD,OAAO;QACL,SAAS;QACT,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,KAAK,EAAE,IAAI,CAAC,KAA6B;QACzC,kBAAkB,EAChB,OAAO,IAAI,CAAC,kBAAkB,KAAK,QAAQ;YACzC,CAAC,CAAC,IAAI,CAAC,kBAAkB;YACzB,CAAC,CAAC,SAAS;KAChB,CAAC;AACJ,CAAC;AAED,6EAA6E;AAC7E,SAAS,SAAS,CAAC,IAAoB;IACrC,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;AACrC,CAAC;AAED,8DAA8D;AAC9D,SAAS,WAAW,CAAC,IAAyB;IAC5C,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;AACrC,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,OAAwB,EACxB,GAA0B;IAE1B,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC;YACnC,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,kBAAkB,EAAE,OAAO,CAAC,kBAAkB;SAC/C,CAAC,CAAC;QAEH,2EAA2E;QAC3E,wEAAwE;QACxE,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;YAChC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;QAC7B,CAAC;QAED,MAAM,OAAO,GAAwB;YACnC,IAAI,EAAE,SAAS;YACf,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,YAAY,EAAE,MAAM,CAAC,YAAY;SAClC,CAAC;QACF,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC;QAChC,OAAO,CAAC,CAAC;IACX,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,SAAS,GAAsB;YACnC,IAAI,EAAE,OAAO;YACb,OAAO,EAAE,QAAQ;YACjB,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;SACxD,CAAC;QACF,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,CAAC;QAC5C,OAAO,CAAC,CAAC;IACX,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,IAAI;IACjB,IAAI,OAAwB,CAAC;IAC7B,IAAI,CAAC;QACH,OAAO,GAAG,oBAAoB,CAAC,MAAM,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;IAC/D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,SAAS,GAAsB;YACnC,IAAI,EAAE,OAAO;YACb,OAAO,EAAE,QAAQ;YACjB,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;SACxD,CAAC;QACF,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,CAAC;QACvD,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACrB,OAAO;IACT,CAAC;IACD,OAAO,CAAC,QAAQ,GAAG,MAAM,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;AACjE,CAAC;AAED,8EAA8E;AAC9E,6EAA6E;AAC7E,6EAA6E;AAC7E,6EAA6E;AAC7E,8DAA8D;AAC9D,MAAM,eAAe,GACnB,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,QAAQ;IACnC,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,IAAI,GAAG,CAAC,UAAU,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC;AAChE,IAAI,eAAe,EAAE,CAAC;IACpB,KAAK,IAAI,EAAE,CAAC;AACd,CAAC"}

package/dist/core/run-state.d.ts

@@ -16,6 +16,7 @@
  * elsewhere in the harness; consolidate into one shared helper when convenient.
  */
 import type { RunView } from "../shared/types.js";
+import { type ApiKeyProvider } from "./api-key-provider.js";
 /** Resolve the agents surface base URL from the environment. */
 export declare function resolveAgentsBaseUrl(): string;
 export type RunStateResult = {
@@ -27,7 +28,12 @@ export type RunStateResult = {
     error: string;
 };
 export interface RunStateFetcherOpts {
-    apiKey: string | null;
+    /**
+     * Sapiom API key. Accepts either a plain `string | null` (the boot-time key)
+     * or an {@link ApiKeyProvider} — pass a provider to get the refresh-on-401
+     * recovery path. A bare string never refreshes.
+     */
+    apiKey: string | null | ApiKeyProvider;
     baseUrl?: string;
     /** Injectable fetch implementation — defaults to global fetch. Test seam. */
     fetchImpl?: typeof fetch;
@@ -35,11 +41,20 @@ export interface RunStateFetcherOpts {
 export interface RunStateFetcher {
     fetch(executionId: string): Promise<RunStateResult>;
 }
+/** Upstream statuses that mean "the API key was rejected" — worth one refresh
+ *  + retry before we give up. 401 is the common case; 403 covers a key that
+ *  authenticated but lost authorization (e.g. rotated to a new org). */
+export declare function isAuthRejection(status: number): boolean;
 /**
  * Create a fetcher that resolves an execution's current render state from the
  * agents surface. The fetcher is intentionally non-throwing: all error paths
  * return a typed {@link RunStateResult} with `ok: false` so the router can
  * forward the appropriate HTTP status without a try/catch at the call site.
+ *
+ * When constructed with an {@link ApiKeyProvider}, a 401/403 from the upstream
+ * call triggers exactly one credential refresh + retry: if the shared store has
+ * a newer key (e.g. the user re-logged-in), the retry uses it and the Studio
+ * recovers in place instead of surfacing a dead-end auth error.
  */
 export declare function createRunStateFetcher(opts: RunStateFetcherOpts): RunStateFetcher;
 //# sourceMappingURL=run-state.d.ts.map

package/dist/core/run-state.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"run-state.d.ts","sourceRoot":"","sources":["../../src/core/run-state.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAIH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAGlD,gEAAgE;AAChE,wBAAgB,oBAAoB,IAAI,MAAM,CAM7C;AAED,MAAM,MAAM,cAAc,GACtB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,GAC9B;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAEjD,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,6EAA6E;IAC7E,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;CAC1B;AAED,MAAM,WAAW,eAAe;IAC9B,KAAK,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;CACrD;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,mBAAmB,GACxB,eAAe,CA6CjB"}
+{"version":3,"file":"run-state.d.ts","sourceRoot":"","sources":["../../src/core/run-state.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAIH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAElD,OAAO,EACL,KAAK,cAAc,EAEpB,MAAM,uBAAuB,CAAC;AAgB/B,gEAAgE;AAChE,wBAAgB,oBAAoB,IAAI,MAAM,CAM7C;AAED,MAAM,MAAM,cAAc,GACtB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,GAC9B;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAEjD,MAAM,WAAW,mBAAmB;IAClC;;;;OAIG;IACH,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,cAAc,CAAC;IACvC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,6EAA6E;IAC7E,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;CAC1B;AAED,MAAM,WAAW,eAAe;IAC9B,KAAK,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;CACrD;AAED;;wEAEwE;AACxE,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAEvD;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,mBAAmB,GACxB,eAAe,CA4EjB"}

package/dist/core/run-state.js

@@ -17,23 +17,80 @@
  */
 import { decodeExecutionProjection } from "@sapiom/agent-core";
 import { renderRunState } from "./render-run-state.js";
+import { staticApiKeyProvider, } from "./api-key-provider.js";
+/**
+ * Normalize the polymorphic `apiKey` option to an {@link ApiKeyProvider}. A
+ * plain string (or null) becomes a no-refresh provider so existing static-key
+ * callers keep working unchanged; a provider is used as-is.
+ */
+function toApiKeyProvider(apiKey) {
+    if (apiKey === null || typeof apiKey === "string") {
+        return staticApiKeyProvider(apiKey);
+    }
+    return apiKey;
+}
 /** Resolve the agents surface base URL from the environment. */
 export function resolveAgentsBaseUrl() {
     return (process.env.SAPIOM_AGENTS_URL ??
         process.env.SAPIOM_TOOLS_BASE ??
         "https://tools.sapiom.ai");
 }
+/** Upstream statuses that mean "the API key was rejected" — worth one refresh
+ *  + retry before we give up. 401 is the common case; 403 covers a key that
+ *  authenticated but lost authorization (e.g. rotated to a new org). */
+export function isAuthRejection(status) {
+    return status === 401 || status === 403;
+}
 /**
  * Create a fetcher that resolves an execution's current render state from the
  * agents surface. The fetcher is intentionally non-throwing: all error paths
  * return a typed {@link RunStateResult} with `ok: false` so the router can
  * forward the appropriate HTTP status without a try/catch at the call site.
+ *
+ * When constructed with an {@link ApiKeyProvider}, a 401/403 from the upstream
+ * call triggers exactly one credential refresh + retry: if the shared store has
+ * a newer key (e.g. the user re-logged-in), the retry uses it and the Studio
+ * recovers in place instead of surfacing a dead-end auth error.
  */
 export function createRunStateFetcher(opts) {
-    const { apiKey, baseUrl = resolveAgentsBaseUrl(), fetchImpl = fetch } = opts;
+    const { baseUrl = resolveAgentsBaseUrl(), fetchImpl = fetch } = opts;
+    const provider = toApiKeyProvider(opts.apiKey);
+    const requestOnce = async (executionId, apiKey) => {
+        try {
+            const res = await fetchImpl(`${baseUrl}/agents/v1/executions/${encodeURIComponent(executionId)}`, { headers: { "x-sapiom-api-key": apiKey } });
+            return { kind: "ok", res };
+        }
+        catch {
+            return {
+                kind: "err",
+                result: { ok: false, status: 502, error: "gateway unreachable" },
+            };
+        }
+    };
+    const decode = async (res) => {
+        if (res.status === 404) {
+            return { ok: false, status: 404, error: "execution not found" };
+        }
+        if (!res.ok) {
+            return {
+                ok: false,
+                status: 502,
+                error: `gateway responded ${res.status}`,
+            };
+        }
+        try {
+            const raw = (await res.json());
+            const runView = renderRunState(decodeExecutionProjection(raw));
+            return { ok: true, runView };
+        }
+        catch {
+            return { ok: false, status: 502, error: "could not decode execution" };
+        }
+    };
     return {
         async fetch(executionId) {
             // No API key — do not touch the network; the harness is not signed in.
+            let apiKey = provider.getKey();
             if (!apiKey) {
                 return {
                     ok: false,
@@ -41,31 +98,24 @@ export function createRunStateFetcher(opts) {
                     error: "harness is not signed in to Sapiom",
                 };
             }
-            let res;
-            try {
-                res = await fetchImpl(`${baseUrl}/agents/v1/executions/${encodeURIComponent(executionId)}`, { headers: { "x-sapiom-api-key": apiKey } });
-            }
-            catch {
-                return { ok: false, status: 502, error: "gateway unreachable" };
-            }
-            if (res.status === 404) {
-                return { ok: false, status: 404, error: "execution not found" };
-            }
-            if (!res.ok) {
-                return {
-                    ok: false,
-                    status: 502,
-                    error: `gateway responded ${res.status}`,
-                };
-            }
-            try {
-                const raw = (await res.json());
-                const runView = renderRunState(decodeExecutionProjection(raw));
-                return { ok: true, runView };
-            }
-            catch {
-                return { ok: false, status: 502, error: "could not decode execution" };
+            const first = await requestOnce(executionId, apiKey);
+            if (first.kind === "err")
+                return first.result;
+            // Refresh-on-401: re-read the shared credential store once and retry with
+            // the newer key when the rejection was an auth failure and refresh
+            // actually produced a different key. Any other status (or an unchanged
+            // key) falls through to normal decoding/error mapping — no wasted retry.
+            if (isAuthRejection(first.res.status)) {
+                const refreshed = await provider.refresh();
+                if (refreshed && refreshed !== apiKey) {
+                    apiKey = refreshed;
+                    const second = await requestOnce(executionId, apiKey);
+                    if (second.kind === "err")
+                        return second.result;
+                    return decode(second.res);
+                }
             }
+            return decode(first.res);
         },
     };
 }

package/dist/core/run-state.js.map

@@ -1 +1 @@
-{"version":3,"file":"run-state.js","sourceRoot":"","sources":["../../src/core/run-state.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,yBAAyB,EAAE,MAAM,oBAAoB,CAAC;AAG/D,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAEvD,gEAAgE;AAChE,MAAM,UAAU,oBAAoB;IAClC,OAAO,CACL,OAAO,CAAC,GAAG,CAAC,iBAAiB;QAC7B,OAAO,CAAC,GAAG,CAAC,iBAAiB;QAC7B,yBAAyB,CAC1B,CAAC;AACJ,CAAC;AAiBD;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CACnC,IAAyB;IAEzB,MAAM,EAAE,MAAM,EAAE,OAAO,GAAG,oBAAoB,EAAE,EAAE,SAAS,GAAG,KAAK,EAAE,GAAG,IAAI,CAAC;IAE7E,OAAO;QACL,KAAK,CAAC,KAAK,CAAC,WAAmB;YAC7B,uEAAuE;YACvE,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,OAAO;oBACL,EAAE,EAAE,KAAK;oBACT,MAAM,EAAE,GAAG;oBACX,KAAK,EAAE,oCAAoC;iBAC5C,CAAC;YACJ,CAAC;YAED,IAAI,GAAa,CAAC;YAClB,IAAI,CAAC;gBACH,GAAG,GAAG,MAAM,SAAS,CACnB,GAAG,OAAO,yBAAyB,kBAAkB,CAAC,WAAW,CAAC,EAAE,EACpE,EAAE,OAAO,EAAE,EAAE,kBAAkB,EAAE,MAAM,EAAE,EAAE,CAC5C,CAAC;YACJ,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,qBAAqB,EAAE,CAAC;YAClE,CAAC;YAED,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBACvB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,qBAAqB,EAAE,CAAC;YAClE,CAAC;YAED,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;gBACZ,OAAO;oBACL,EAAE,EAAE,KAAK;oBACT,MAAM,EAAE,GAAG;oBACX,KAAK,EAAE,qBAAqB,GAAG,CAAC,MAAM,EAAE;iBACzC,CAAC;YACJ,CAAC;YAED,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA4B,CAAC;gBAC1D,MAAM,OAAO,GAAG,cAAc,CAAC,yBAAyB,CAAC,GAAG,CAAC,CAAC,CAAC;gBAC/D,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;YAC/B,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,4BAA4B,EAAE,CAAC;YACzE,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"run-state.js","sourceRoot":"","sources":["../../src/core/run-state.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,yBAAyB,EAAE,MAAM,oBAAoB,CAAC;AAG/D,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAEL,oBAAoB,GACrB,MAAM,uBAAuB,CAAC;AAE/B;;;;GAIG;AACH,SAAS,gBAAgB,CACvB,MAAsC;IAEtC,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QAClD,OAAO,oBAAoB,CAAC,MAAM,CAAC,CAAC;IACtC,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,gEAAgE;AAChE,MAAM,UAAU,oBAAoB;IAClC,OAAO,CACL,OAAO,CAAC,GAAG,CAAC,iBAAiB;QAC7B,OAAO,CAAC,GAAG,CAAC,iBAAiB;QAC7B,yBAAyB,CAC1B,CAAC;AACJ,CAAC;AAsBD;;wEAEwE;AACxE,MAAM,UAAU,eAAe,CAAC,MAAc;IAC5C,OAAO,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,CAAC;AAC1C,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,qBAAqB,CACnC,IAAyB;IAEzB,MAAM,EAAE,OAAO,GAAG,oBAAoB,EAAE,EAAE,SAAS,GAAG,KAAK,EAAE,GAAG,IAAI,CAAC;IACrE,MAAM,QAAQ,GAAG,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAE/C,MAAM,WAAW,GAAG,KAAK,EACvB,WAAmB,EACnB,MAAc,EAGd,EAAE;QACF,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,SAAS,CACzB,GAAG,OAAO,yBAAyB,kBAAkB,CAAC,WAAW,CAAC,EAAE,EACpE,EAAE,OAAO,EAAE,EAAE,kBAAkB,EAAE,MAAM,EAAE,EAAE,CAC5C,CAAC;YACF,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;QAC7B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO;gBACL,IAAI,EAAE,KAAK;gBACX,MAAM,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,qBAAqB,EAAE;aACjE,CAAC;QACJ,CAAC;IACH,CAAC,CAAC;IAEF,MAAM,MAAM,GAAG,KAAK,EAAE,GAAa,EAA2B,EAAE;QAC9D,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACvB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,qBAAqB,EAAE,CAAC;QAClE,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,GAAG;gBACX,KAAK,EAAE,qBAAqB,GAAG,CAAC,MAAM,EAAE;aACzC,CAAC;QACJ,CAAC;QACD,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA4B,CAAC;YAC1D,MAAM,OAAO,GAAG,cAAc,CAAC,yBAAyB,CAAC,GAAG,CAAC,CAAC,CAAC;YAC/D,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;QAC/B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,4BAA4B,EAAE,CAAC;QACzE,CAAC;IACH,CAAC,CAAC;IAEF,OAAO;QACL,KAAK,CAAC,KAAK,CAAC,WAAmB;YAC7B,uEAAuE;YACvE,IAAI,MAAM,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC;YAC/B,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,OAAO;oBACL,EAAE,EAAE,KAAK;oBACT,MAAM,EAAE,GAAG;oBACX,KAAK,EAAE,oCAAoC;iBAC5C,CAAC;YACJ,CAAC;YAED,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;YACrD,IAAI,KAAK,CAAC,IAAI,KAAK,KAAK;gBAAE,OAAO,KAAK,CAAC,MAAM,CAAC;YAE9C,0EAA0E;YAC1E,mEAAmE;YACnE,uEAAuE;YACvE,yEAAyE;YACzE,IAAI,eAAe,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;gBACtC,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,OAAO,EAAE,CAAC;gBAC3C,IAAI,SAAS,IAAI,SAAS,KAAK,MAAM,EAAE,CAAC;oBACtC,MAAM,GAAG,SAAS,CAAC;oBACnB,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;oBACtD,IAAI,MAAM,CAAC,IAAI,KAAK,KAAK;wBAAE,OAAO,MAAM,CAAC,MAAM,CAAC;oBAChD,OAAO,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBAC5B,CAAC;YACH,CAAC;YAED,OAAO,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC3B,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/core/stub-feedback.d.ts

@@ -0,0 +1,52 @@
+/**
+ * stub-feedback — the pure, read-only derivations behind the run-inspector's
+ * stub affordances (WB15-2). Given a {@link RunView} (which already carries the
+ * run-level stub facts set by {@link renderLocalRun}), decide:
+ *  - whether a given step should show the "stubbed" chip, and
+ *  - what the read-only stub-hygiene notice should say (or nothing).
+ *
+ * Pure and deterministic: no LLM, no I/O, no clock — every result is a function
+ * of the RunView alone, so both are Stryker targets with mutation-first tests.
+ *
+ * Read-only by design: this surfaces what a stub run DID (served a call, or a
+ * supplied stub matched nothing / had the wrong shape). Editing stubs is a
+ * deferred fast-follow and lives nowhere here.
+ *
+ * Honesty is the whole point: the chip appears only for a step that actually ran
+ * in a stub-served run (never for a prod run, never for a step the run never
+ * reached), and the notice is `null` unless there is a real problem to report —
+ * so a clean run shows no chrome at all.
+ */
+import type { RunView } from "../shared/types.js";
+/**
+ * Should the "stubbed" chip render for the step named `stepName`?
+ *
+ * True only when BOTH hold:
+ *  1. the run was stub-served (`run.stubbed` — set by renderLocalRun for an
+ *     offline local run; never by renderRunState for a prod run), and
+ *  2. that step actually ran this run (it appears in `run.steps`).
+ *
+ * A local run resolves every `ctx.sapiom.*` call from a stub, so a step that ran
+ * was stub-served — that is the honest granularity (agent-core records no
+ * per-CALL stub attribution). A step the run never reached, or any step of a
+ * real run, gets no chip. A null run (nothing observed yet) is never stubbed.
+ */
+export declare function stepIsStubbed(run: RunView | null, stepName: string): boolean;
+/**
+ * The read-only stub-hygiene notice for a run, or `null` when there is nothing
+ * honest to show. Present only the signals that carry real content:
+ *  - `unusedStubs`: supplied stub keys that matched no capability call (a no-op
+ *    mock — almost always a typo or the wrong path form), and
+ *  - `stubWarnings`: stub values that matched a key but had the wrong shape.
+ *
+ * Returns `null` unless at least one non-empty signal exists, so the caller can
+ * render nothing for a clean run (honesty — no empty "0 issues" panel). The
+ * returned arrays are always non-empty when present (empty ones are dropped),
+ * so the component never has to re-check length.
+ */
+export interface StubNotice {
+    unusedStubs?: NonNullable<RunView["unusedStubs"]>;
+    stubWarnings?: NonNullable<RunView["stubWarnings"]>;
+}
+export declare function stubNotice(run: RunView | null): StubNotice | null;
+//# sourceMappingURL=stub-feedback.d.ts.map

package/dist/core/stub-feedback.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"stub-feedback.d.ts","sourceRoot":"","sources":["../../src/core/stub-feedback.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAElD;;;;;;;;;;;;GAYG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,OAAO,GAAG,IAAI,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAG5E;AAED;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,UAAU;IACzB,WAAW,CAAC,EAAE,WAAW,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC;IAClD,YAAY,CAAC,EAAE,WAAW,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC;CACrD;AAED,wBAAgB,UAAU,CAAC,GAAG,EAAE,OAAO,GAAG,IAAI,GAAG,UAAU,GAAG,IAAI,CAYjE"}

package/dist/core/stub-feedback.js

@@ -0,0 +1,33 @@
+/**
+ * Should the "stubbed" chip render for the step named `stepName`?
+ *
+ * True only when BOTH hold:
+ *  1. the run was stub-served (`run.stubbed` — set by renderLocalRun for an
+ *     offline local run; never by renderRunState for a prod run), and
+ *  2. that step actually ran this run (it appears in `run.steps`).
+ *
+ * A local run resolves every `ctx.sapiom.*` call from a stub, so a step that ran
+ * was stub-served — that is the honest granularity (agent-core records no
+ * per-CALL stub attribution). A step the run never reached, or any step of a
+ * real run, gets no chip. A null run (nothing observed yet) is never stubbed.
+ */
+export function stepIsStubbed(run, stepName) {
+    if (!run || run.stubbed !== true)
+        return false;
+    return run.steps.some((s) => s.name === stepName);
+}
+export function stubNotice(run) {
+    if (!run)
+        return null;
+    const notice = {};
+    if (run.unusedStubs && run.unusedStubs.length > 0) {
+        notice.unusedStubs = run.unusedStubs;
+    }
+    if (run.stubWarnings && run.stubWarnings.length > 0) {
+        notice.stubWarnings = run.stubWarnings;
+    }
+    // Empty object == no real signal; report honest absence as null so the
+    // inspector renders no notice block at all.
+    return notice.unusedStubs || notice.stubWarnings ? notice : null;
+}
+//# sourceMappingURL=stub-feedback.js.map

package/dist/core/stub-feedback.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"stub-feedback.js","sourceRoot":"","sources":["../../src/core/stub-feedback.ts"],"names":[],"mappings":"AAqBA;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,aAAa,CAAC,GAAmB,EAAE,QAAgB;IACjE,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAC/C,OAAO,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC;AACpD,CAAC;AAmBD,MAAM,UAAU,UAAU,CAAC,GAAmB;IAC5C,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,MAAM,MAAM,GAAe,EAAE,CAAC;IAC9B,IAAI,GAAG,CAAC,WAAW,IAAI,GAAG,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAClD,MAAM,CAAC,WAAW,GAAG,GAAG,CAAC,WAAW,CAAC;IACvC,CAAC;IACD,IAAI,GAAG,CAAC,YAAY,IAAI,GAAG,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpD,MAAM,CAAC,YAAY,GAAG,GAAG,CAAC,YAAY,CAAC;IACzC,CAAC;IACD,uEAAuE;IACvE,4CAA4C;IAC5C,OAAO,MAAM,CAAC,WAAW,IAAI,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;AACnE,CAAC"}

package/dist/server/actions.d.ts

@@ -0,0 +1,139 @@
+/**
+ * Actions router — backs the direct, in-app agent action macros:
+ *   POST /api/workflows/:id/deploy  → deploy the linked agent (build + poll).
+ *   POST /api/runs                  → start a prod execution → { executionId }.
+ *
+ * These are the "direct" replacements for the old CLI/agent-driven macros: the
+ * harness server calls the Sapiom backend itself (via {@link deploy} / {@link run}
+ * from @sapiom/agent-core), so an action never spawns a subprocess agent and never
+ * consumes the user's LLM credits. The Sapiom API key is held server-side and
+ * never forwarded to the browser — exactly like {@link createRunsRouter}: the
+ * SPA hits these local `/api/*` routes (no key in the request) and the router
+ * presents the key to the backend on its behalf.
+ *
+ * Deploy streams its build lifecycle as NDJSON (one JSON object per line, the
+ * same line-oriented convention the local-run stream uses) so the canvas can
+ * show "building…" the moment the build kicks off and a terminal line when it
+ * settles. Prod-run is a single request/response returning `{ executionId }`,
+ * which the existing live-canvas path then polls via the runs router.
+ *
+ * Run-local (`POST /api/runs/local`) is the offline sibling: it spawns the
+ * run-local bootstrap child, which runs the workflow in-process against stub
+ * capabilities and streams NDJSON back — one {@link LocalStepTrace} per line,
+ * then a terminal summary carrying `unusedStubs`/`stubWarnings`. It needs no
+ * API key and makes no network call, so it works signed-out and at zero cost.
+ */
+import { Router } from "express";
+import { createClient, deploy as coreDeploy, run as coreRun, readConfig as coreReadConfig } from "@sapiom/agent-core";
+import { type ApiKeyProvider } from "../core/api-key-provider.js";
+/**
+ * A registered workflow the actions router can act on — the subset of
+ * {@link WorkflowInfo} deploy needs. Resolved by the injected
+ * {@link ActionsRouterOpts.resolveWorkflow} so the router stays decoupled from
+ * the registry (mirrors the rest router's `findWorkflow` seam).
+ */
+export interface ActionWorkflow {
+    /** Absolute path to the agent project directory (deploy's `projectDir`). */
+    path: string;
+}
+/**
+ * One line of the deploy NDJSON stream. `building` is emitted once the build is
+ * triggered; exactly one terminal line (`ready` | `error`) closes the stream.
+ * `capability`-agnostic and credential-free by construction.
+ */
+export type DeployStreamEvent = {
+    phase: "building";
+    definitionId: string;
+} | {
+    phase: "ready";
+    definitionId: string;
+    buildRunId: string;
+    status: string;
+} | {
+    phase: "error";
+    code: string;
+    message: string;
+    hint?: string;
+};
+/**
+ * Injectable core operations. Real implementations are the @sapiom/agent-core
+ * exports; tests substitute fakes so no route ever touches git or the network.
+ * Undocumented for prod — a test seam only, mirroring `fetchImpl` in runs.ts.
+ */
+export interface ActionsCoreDeps {
+    createClient: typeof createClient;
+    deploy: typeof coreDeploy;
+    run: typeof coreRun;
+    readConfig: typeof coreReadConfig;
+}
+/**
+ * The slice of node's ChildProcess the run-local route uses — injectable so
+ * tests drive a fake child (a scripted stdout stream) without spawning a real
+ * `node` process. Mirrors {@link TaskProcess} in task-manager.ts.
+ */
+export interface RunLocalChildProcess {
+    /** Where the request JSON is written; closed immediately after. */
+    stdin: NodeJS.WritableStream | null;
+    /** Line-oriented NDJSON the route forwards to the HTTP response. */
+    stdout: NodeJS.ReadableStream | null;
+    /** Diagnostics; a bounded tail is kept for failure reporting. */
+    stderr: NodeJS.ReadableStream | null;
+    on(event: "exit", listener: (code: number | null) => void): unknown;
+    on(event: "error", listener: (err: Error) => void): unknown;
+}
+/** Spawn the run-local bootstrap child. Test seam — defaults to `node`ing the
+ *  compiled bootstrap. */
+export type RunLocalSpawnFn = () => RunLocalChildProcess;
+/**
+ * Resolve the compiled run-local bootstrap entry. This module lives at
+ * `dist/server/actions.js` (built) or `src/server/actions.ts` (tsx dev /
+ * vitest) — the bootstrap is its sibling one directory over in `core/`, with
+ * the same `.js`/`.ts` extension as this file. Reading the extension off
+ * `import.meta.url` (rather than hard-coding `.js`) keeps a real dev-server
+ * spawn resolvable too. Exported for unit coverage of the path math.
+ */
+export declare function resolveRunLocalBootstrapPath(moduleUrl: string): string;
+export interface ActionsRouterOpts {
+    /**
+     * Sapiom credential the deploy/prod-run actions authenticate with. Accepts
+     * either a plain `string | null` (the boot-time key) or an
+     * {@link ApiKeyProvider}; pass a provider — exactly like
+     * {@link createRunsRouter} — so a rejected key can refresh + retry and so each
+     * request reads the current key rather than a boot-time snapshot. This is the
+     * API key (`sk_…`), NOT the local boot token. `null` (or a provider whose
+     * `getKey()` is null) means the harness is not signed in.
+     */
+    apiKey: string | null | ApiKeyProvider;
+    /**
+     * Backend host for @sapiom/agent-core's GatewayClient (the CORE surface —
+     * `/v1/workflows` is appended by the client). Resolved from env by default.
+     * Test seam.
+     */
+    coreBaseUrl?: string;
+    /**
+     * Resolve a workflow `:id` (as it appears in the route path) to the registered
+     * workflow, or null when unknown. The caller supplies this from the live
+     * registry — the router does not read the registry directly.
+     */
+    resolveWorkflow: (id: string) => ActionWorkflow | null;
+    /** Injectable core operations. Test seam; defaults to the real exports. */
+    coreDeps?: Partial<ActionsCoreDeps>;
+    /**
+     * Spawn the run-local bootstrap child. Undocumented for prod — a test seam
+     * only (defaults to `node`ing the compiled bootstrap), so a test can stream a
+     * scripted trace without spawning a real process, mirroring `fetchImpl` in
+     * runs.ts and the `spawnProcess` seam in task-manager.ts.
+     */
+    runLocalSpawn?: RunLocalSpawnFn;
+}
+/**
+ * Create the actions router. Mounts:
+ *   - `POST /api/workflows/:id/deploy` — NDJSON build-status stream.
+ *   - `POST /api/runs` — `{ executionId }` for a started prod execution.
+ *   - `POST /api/runs/local` — NDJSON offline stub-run trace + summary.
+ *
+ * Deploy and prod-run run server-side with the held API key; run-local is fully
+ * offline and needs no key. None of them ever involve an AI coding agent.
+ */
+export declare function createActionsRouter(opts: ActionsRouterOpts): Router;
+//# sourceMappingURL=actions.d.ts.map

package/dist/server/actions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"actions.d.ts","sourceRoot":"","sources":["../../src/server/actions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAOH,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAEL,YAAY,EACZ,MAAM,IAAI,UAAU,EACpB,GAAG,IAAI,OAAO,EACd,UAAU,IAAI,cAAc,EAI7B,MAAM,oBAAoB,CAAC;AAI5B,OAAO,EACL,KAAK,cAAc,EAEpB,MAAM,6BAA6B,CAAC;AAErC;;;;;GAKG;AACH,MAAM,WAAW,cAAc;IAC7B,4EAA4E;IAC5E,IAAI,EAAE,MAAM,CAAC;CACd;AAED;;;;GAIG;AACH,MAAM,MAAM,iBAAiB,GACzB;IAAE,KAAK,EAAE,UAAU,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,GAC3C;IAAE,KAAK,EAAE,OAAO,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAC5E;IAAE,KAAK,EAAE,OAAO,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAErE;;;;GAIG;AACH,MAAM,WAAW,eAAe;IAC9B,YAAY,EAAE,OAAO,YAAY,CAAC;IAClC,MAAM,EAAE,OAAO,UAAU,CAAC;IAC1B,GAAG,EAAE,OAAO,OAAO,CAAC;IACpB,UAAU,EAAE,OAAO,cAAc,CAAC;CACnC;AASD;;;;GAIG;AACH,MAAM,WAAW,oBAAoB;IACnC,mEAAmE;IACnE,KAAK,EAAE,MAAM,CAAC,cAAc,GAAG,IAAI,CAAC;IACpC,oEAAoE;IACpE,MAAM,EAAE,MAAM,CAAC,cAAc,GAAG,IAAI,CAAC;IACrC,iEAAiE;IACjE,MAAM,EAAE,MAAM,CAAC,cAAc,GAAG,IAAI,CAAC;IACrC,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,KAAK,IAAI,GAAG,OAAO,CAAC;IACpE,EAAE,CAAC,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,GAAG,EAAE,KAAK,KAAK,IAAI,GAAG,OAAO,CAAC;CAC7D;AAED;0BAC0B;AAC1B,MAAM,MAAM,eAAe,GAAG,MAAM,oBAAoB,CAAC;AAEzD;;;;;;;GAOG;AACH,wBAAgB,4BAA4B,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAItE;AA0CD,MAAM,WAAW,iBAAiB;IAChC;;;;;;;;OAQG;IACH,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,cAAc,CAAC;IACvC;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;OAIG;IACH,eAAe,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,cAAc,GAAG,IAAI,CAAC;IACvD,2EAA2E;IAC3E,QAAQ,CAAC,EAAE,OAAO,CAAC,eAAe,CAAC,CAAC;IACpC;;;;;OAKG;IACH,aAAa,CAAC,EAAE,eAAe,CAAC;CACjC;AA4FD;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,iBAAiB,GAAG,MAAM,CAuRnE"}