@workflow-manager/runner 0.1.0 → 0.3.0

package/dist/runtimePreflight.js

@@ -0,0 +1,189 @@
+import fs from "node:fs";
+import path from "node:path";
+import { resolveTaskAdapter } from "./adapters.js";
+import { shouldUseRealClaudeCode } from "./claudeCodeExecutor.js";
+import { shouldUseRealOpencode } from "./opencodeExecutor.js";
+import { DEFAULT_PI_COMMAND } from "./piAgentExecutor.js";
+function asRecord(value) {
+    return value && typeof value === "object" && !Array.isArray(value) ? value : {};
+}
+function isExecutable(filePath) {
+    try {
+        const stat = fs.statSync(filePath);
+        if (!stat.isFile()) {
+            return false;
+        }
+        fs.accessSync(filePath, fs.constants.X_OK);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+function commandExists(command, env) {
+    if (command.includes("/") || command.includes("\\")) {
+        return isExecutable(path.resolve(command));
+    }
+    const pathValue = env.PATH ?? "";
+    const extensions = process.platform === "win32" ? (env.PATHEXT ?? ".EXE;.CMD;.BAT;.COM").split(";").filter(Boolean) : [""];
+    for (const directory of pathValue.split(path.delimiter)) {
+        if (!directory) {
+            continue;
+        }
+        for (const extension of extensions) {
+            if (isExecutable(path.join(directory, `${command}${extension}`))) {
+                return true;
+            }
+        }
+    }
+    return false;
+}
+function piAgentCommand(step, env) {
+    const payload = asRecord(step.taskSpec?.payload);
+    if (typeof payload.command === "string" && payload.command.trim()) {
+        return payload.command;
+    }
+    if (env.WFM_PI_AGENT_COMMAND?.trim()) {
+        return env.WFM_PI_AGENT_COMMAND;
+    }
+    return DEFAULT_PI_COMMAND;
+}
+function requiredEnvFromModel(model) {
+    if (typeof model !== "string" || !model.trim()) {
+        return null;
+    }
+    const normalized = model.trim().toLowerCase();
+    if (normalized.startsWith("openrouter/")) {
+        return "OPENROUTER_API_KEY";
+    }
+    if (normalized.startsWith("openai/") || normalized.startsWith("gpt-") || normalized.includes("/gpt-")) {
+        return "OPENAI_API_KEY";
+    }
+    if (normalized.startsWith("anthropic/") || normalized.startsWith("claude-") || normalized.includes("/claude")) {
+        return "ANTHROPIC_API_KEY";
+    }
+    return null;
+}
+function explicitRequiredEnv(step) {
+    const payload = asRecord(step.taskSpec?.payload);
+    const required = new Set();
+    if (Array.isArray(payload.requiredEnv)) {
+        for (const value of payload.requiredEnv) {
+            if (typeof value === "string" && value.trim()) {
+                required.add(value.trim());
+            }
+        }
+    }
+    return [...required].sort();
+}
+function requiredEnvVars(step) {
+    const payload = asRecord(step.taskSpec?.payload);
+    const required = new Set(explicitRequiredEnv(step));
+    const fromInitModel = requiredEnvFromModel(step.taskSpec?.init?.model);
+    const fromPayloadModel = requiredEnvFromModel(payload.model);
+    if (fromInitModel)
+        required.add(fromInitModel);
+    if (fromPayloadModel)
+        required.add(fromPayloadModel);
+    return [...required].sort();
+}
+function runtimeRequirement(step, env) {
+    if (step.kind !== "task") {
+        return null;
+    }
+    const adapter = resolveTaskAdapter(step.taskSpec?.adapterKey);
+    const envVars = requiredEnvVars(step);
+    if (adapter === "pi-agent") {
+        // pi manages provider credentials in its own auth store, so only
+        // explicitly declared env vars are enforced for pi steps.
+        return { stepKey: step.key, adapter, command: piAgentCommand(step, env), envVars: explicitRequiredEnv(step) };
+    }
+    if (adapter === "opencode" && shouldUseRealOpencode(step)) {
+        return { stepKey: step.key, adapter, command: "opencode", envVars };
+    }
+    if (adapter === "claude-code" && shouldUseRealClaudeCode(step)) {
+        return { stepKey: step.key, adapter, command: "claude", envVars };
+    }
+    if (envVars.length > 0 && adapter !== "mock") {
+        return { stepKey: step.key, adapter, envVars };
+    }
+    return null;
+}
+export function validateRuntimeRequirements(definition, env = process.env) {
+    const errors = [];
+    for (const step of definition.steps) {
+        const requirement = runtimeRequirement(step, env);
+        if (!requirement) {
+            continue;
+        }
+        if (requirement.command && !commandExists(requirement.command, env)) {
+            errors.push(`Step ${requirement.stepKey} requires ${requirement.adapter} command "${requirement.command}", but it is not installed or not executable on this host`);
+        }
+        for (const envVar of requirement.envVars) {
+            if (!env[envVar]?.trim()) {
+                errors.push(`Step ${requirement.stepKey} requires ${envVar} for ${requirement.adapter} LLM access`);
+            }
+        }
+    }
+    return errors;
+}
+function commandCheck(key, label, command, required, env) {
+    const ok = commandExists(command, env);
+    return {
+        key,
+        label,
+        status: ok ? "ok" : "missing",
+        required,
+        detail: ok ? `${command} is executable` : `${command} is not installed or not executable on this host`,
+    };
+}
+function envCheck(key, label, envVar, env) {
+    const ok = !!env[envVar]?.trim();
+    return {
+        key,
+        label,
+        status: ok ? "ok" : "missing",
+        required: false,
+        detail: ok ? `${envVar} is set` : `${envVar} is not set`,
+    };
+}
+export function runtimeDoctorChecks(env = process.env) {
+    const piAgentStep = { key: "pi-agent", kind: "task", taskSpec: {} };
+    return [
+        commandCheck("pi-agent", "Pi command", piAgentCommand(piAgentStep, env), true, env),
+        commandCheck("opencode", "OpenCode command", "opencode", false, env),
+        commandCheck("claude", "Claude Code command", "claude", false, env),
+        envCheck("openrouter-key", "OpenRouter API key", "OPENROUTER_API_KEY", env),
+        envCheck("openai-key", "OpenAI API key", "OPENAI_API_KEY", env),
+        envCheck("anthropic-key", "Anthropic API key", "ANTHROPIC_API_KEY", env),
+    ];
+}
+export function adapterImplementationStatuses() {
+    return [
+        {
+            adapter: "pi-agent",
+            status: "real",
+            detail: "default host-backed adapter driving the pi coding agent CLI",
+        },
+        {
+            adapter: "mock",
+            status: "mock",
+            detail: "deterministic in-process simulator for tests and local authoring",
+        },
+        {
+            adapter: "opencode",
+            status: "partial",
+            detail: "mock-routed by default; real host smoke path only when useRealAdapter and opencodeSmokeTest are true",
+        },
+        {
+            adapter: "codex",
+            status: "mock",
+            detail: "currently mock-routed; real Codex executor is not implemented yet",
+        },
+        {
+            adapter: "claude-code",
+            status: "partial",
+            detail: "mock-routed by default; real host CLI path only when useRealAdapter is true",
+        },
+    ];
+}

package/dist/skillResolver.d.ts

@@ -0,0 +1,6 @@
+import type { WorkflowDefinition } from "./types.js";
+export interface ResolvedSkill {
+    content: string;
+    origin: string;
+}
+export declare function resolveSkill(name: string, workflow: WorkflowDefinition, workflowFilePath: string): ResolvedSkill | null;

package/dist/skillResolver.js

@@ -0,0 +1,75 @@
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+function readFileSafe(filePath) {
+    try {
+        if (!fs.existsSync(filePath))
+            return null;
+        return fs.readFileSync(filePath, "utf-8");
+    }
+    catch {
+        return null;
+    }
+}
+function isSafeSkillName(name) {
+    if (!name || name.includes("..") || name.includes("/") || name.includes("\\"))
+        return false;
+    return /^[a-zA-Z0-9_.-]+$/.test(name);
+}
+function isAllowedLocalSkillSourcePath(source) {
+    if (!source || path.isAbsolute(source) || source.includes("\\") || source.includes(".."))
+        return false;
+    const normalized = path.posix.normalize(source);
+    const withoutDot = normalized.startsWith("./") ? normalized.slice(2) : normalized;
+    if (!withoutDot.startsWith("skills/"))
+        return false;
+    return withoutDot.endsWith("/SKILL.md");
+}
+function resolveAllowedLocalSkillSourcePath(workflowDir, source) {
+    if (!isAllowedLocalSkillSourcePath(source))
+        return null;
+    const sourcePath = path.resolve(workflowDir, source);
+    const allowedRoot = path.resolve(workflowDir, "skills");
+    if (!sourcePath.startsWith(`${allowedRoot}${path.sep}`))
+        return null;
+    if (path.basename(sourcePath) !== "SKILL.md")
+        return null;
+    return sourcePath;
+}
+function tryRead(...candidates) {
+    for (const candidate of candidates) {
+        const content = readFileSafe(candidate);
+        if (content && content.trim())
+            return content;
+    }
+    return null;
+}
+export function resolveSkill(name, workflow, workflowFilePath) {
+    const entry = workflow.skills?.[name];
+    if (entry?.content && entry.content.trim()) {
+        return { content: entry.content, origin: "embedded" };
+    }
+    if (entry?.source) {
+        const workflowDir = path.dirname(path.resolve(workflowFilePath));
+        const sourcePath = resolveAllowedLocalSkillSourcePath(workflowDir, entry.source);
+        if (!sourcePath)
+            return null;
+        const content = readFileSafe(sourcePath);
+        if (content && content.trim())
+            return { content, origin: "source" };
+        return null;
+    }
+    if (!isSafeSkillName(name))
+        return null;
+    const workflowDir = path.dirname(path.resolve(workflowFilePath));
+    const projectLocal = tryRead(path.join(workflowDir, "skills", name, "SKILL.md"));
+    if (projectLocal)
+        return { content: projectLocal, origin: "project-local" };
+    const userGlobal = tryRead(path.join(os.homedir(), ".workflow-manager", "skills", name, "SKILL.md"));
+    if (userGlobal)
+        return { content: userGlobal, origin: "user-global" };
+    const packaged = tryRead(path.join(workflowDir, "node_modules", "workflow-manager", "skills", name, "SKILL.md"), path.join(workflowDir, "..", "node_modules", "workflow-manager", "skills", name, "SKILL.md"));
+    if (packaged)
+        return { content: packaged, origin: "npm" };
+    return null;
+}

package/dist/types.d.ts

@@ -5,7 +5,7 @@ export type NodeType = "AGENT" | "HUMAN" | "SYSTEM";
 export type ExecutionStatus = "SUCCESS" | "QA_REJECTED" | "YIELD_EXTERNAL" | "FAILED";
 export type QaAction = "PROCEED" | "RETRY_CURRENT" | "ROLLBACK_PREVIOUS" | "RESTART_ALL";
 export type ValidationMode = "none" | "human" | "external";
-export type AdapterKey = "mock" | "opencode" | "codex" | "claude-code";
+export type AdapterKey = "pi-agent" | "mock" | "opencode" | "codex" | "claude-code";
 export interface RetryPolicy {
     maxAttempts?: number;
 }
@@ -43,6 +43,17 @@ export interface StepDefinition {
         validation?: ValidationSpec;
     };
 }
+export interface SkillUpstream {
+    repo?: string;
+    ref?: string;
+    path?: string;
+}
+export interface SkillEntry {
+    source?: string;
+    content?: string;
+    upstream?: SkillUpstream;
+    contentSha256?: string;
+}
 export interface WorkflowDefinition {
     key: string;
     title: string;
@@ -51,6 +62,7 @@ export interface WorkflowDefinition {
     inputSchema?: Record<string, unknown>;
     outputSchema?: Record<string, unknown>;
     defaultRetryPolicy?: RetryPolicy;
+    skills?: Record<string, SkillEntry>;
     steps: StepDefinition[];
 }
 export interface InputEnvelope {
@@ -96,6 +108,117 @@ export interface StepRun {
     confirmed: boolean;
     output?: Record<string, unknown>;
 }
+export interface ApprovalReviewItem {
+    stepKey: string | null;
+    title: string;
+    summary: string;
+    source: "current_step" | "dependency" | "approval_gate";
+    status?: StepRunStatus;
+}
+export interface ApprovalPreview {
+    stepLabel: string;
+    objective: string | null;
+    summary: string;
+    items: ApprovalReviewItem[];
+}
+export interface WaitingForApprovalState {
+    stepKey: string;
+    reason: string;
+    validation?: ValidationMode;
+    preview?: ApprovalPreview | null;
+}
+export interface StepLastExecution {
+    executionStatus: ExecutionStatus | null;
+    qaAction: QaAction | null;
+    feedbackReason: string | null;
+}
+export interface ContextSummary {
+    type: "none" | "string" | "object";
+    length?: number;
+    keys?: string[];
+}
+export interface StepConfigSummary {
+    model: string | null;
+    skills: string[];
+    mcps: string[];
+    systemPrompts: string[];
+    contextSummary: ContextSummary;
+}
+export interface StepSnapshot {
+    stepKey: string;
+    status: StepRunStatus;
+    attempt: number;
+    confirmed: boolean;
+    adapter: AdapterKey | "approval";
+    startedAt: string | null;
+    updatedAt: string | null;
+    finishedAt: string | null;
+}
+export interface StepDetailSnapshot extends StepSnapshot {
+    kind: StepKind;
+    objective: string | null;
+    dependsOn: string[];
+    config: StepConfigSummary;
+    lastExecution: StepLastExecution;
+}
+export interface RunSnapshot {
+    runId: string;
+    workflowKey: string;
+    workflowTitle: string;
+    status: WorkflowRunStatus;
+    currentStepKey: string | null;
+    startedAt: string | null;
+    updatedAt: string | null;
+    endedAt: string | null;
+    objective: string;
+    objectives: string[];
+    waitingForApproval: WaitingForApprovalState | null;
+    steps: StepSnapshot[];
+}
+export interface RunnerLogChunk {
+    id: string;
+    runId: string;
+    stepKey?: string;
+    stream: "stdout" | "stderr";
+    text: string;
+    occurredAt: string;
+}
+export interface RunnerSessionInfo {
+    sessionId: string;
+    pid: number;
+    host: string;
+    port: number;
+    baseUrl: string;
+    attachToken: string;
+    startedAt: string;
+    run: {
+        runId: string;
+        workflowKey: string;
+        workflowTitle: string;
+        status: WorkflowRunStatus;
+    };
+}
+export type ApprovalDecision = "approved" | "cancelled";
+export interface ApprovalRequest {
+    stepKey: string;
+    reason: string;
+    validation?: ValidationMode;
+}
+export interface ApprovalDecisionPayload {
+    decision: ApprovalDecision;
+    actor?: string;
+    note?: string;
+    source?: string;
+}
+export interface RunnerEventEnvelope {
+    id: string;
+    sequence: number;
+    type: RunEvent["type"];
+    runId: string;
+    stepKey?: string;
+    occurredAt: string;
+    data: Record<string, unknown>;
+}
 export interface RunResult {
     runId: string;
     status: WorkflowRunStatus;
@@ -104,17 +227,40 @@ export interface RunResult {
     events: RunEvent[];
 }
 export interface RunOptions {
+    runId?: string;
     objective?: string;
     input?: Record<string, unknown>;
     actor?: string;
     confirmations?: string[];
     autoConfirmAll?: boolean;
+    interactive?: boolean;
+    workflowFilePath?: string;
+    approvalPrompt?: (request: ApprovalRequest & {
+        preview?: ApprovalPreview | null;
+        signal?: AbortSignal;
+    }) => Promise<ApprovalDecisionPayload | null>;
+    observer?: RunObserver;
+    controller?: RunController;
+}
+export interface StepExecutionHooks {
+    onStarted?: (payload?: Record<string, unknown>) => void;
+    onStdout?: (chunk: string) => void;
+    onStderr?: (chunk: string) => void;
+    onFinished?: (payload?: Record<string, unknown>) => void;
+}
+export interface RunController {
+    waitForDecision(request: ApprovalRequest): Promise<ApprovalDecisionPayload>;
+}
+export interface RunObserver {
+    onEvent(event: RunEvent): void;
+    onSnapshot(snapshot: RunSnapshot, stepDetails: StepDetailSnapshot[]): void;
+    onLog(log: RunnerLogChunk): void;
 }
 export interface RunEvent {
     id: string;
     runId: string;
     stepRunId?: string;
-    type: "run.created" | "run.started" | "run.waiting_for_approval" | "step.runnable" | "step.claimed" | "step.execution_started" | "step.execution_finished" | "step.waiting_for_approval" | "approval.resolved" | "step.retried" | "step.confirmed" | "run.completed" | "run.failed" | "run.cancelled";
+    type: "run.created" | "run.started" | "run.waiting_for_approval" | "step.runnable" | "step.claimed" | "step.execution_started" | "step.execution_finished" | "step.waiting_for_approval" | "approval.resolved" | "step.retried" | "step.confirmed" | "agent.started" | "agent.stdout" | "agent.stderr" | "agent.finished" | "run.completed" | "run.failed" | "run.cancelled";
     sequenceNumber: number;
     occurredAt: string;
     actor: string;

package/man/wfm.1

@@ -12,8 +12,11 @@ it with deterministic in-memory orchestration.
 Workflow files can be Markdown with YAML frontmatter or JSON.
 .SH COMMANDS
 .TP
-.B questions
-Print discovery questions used to design a workflow.
+.B doctor [workflow.md|workflow.json] [--json]
+Inspect host adapter setup, LLM access keys, and current adapter implementation status. When a workflow path is provided, also validate schema and runtime requirements without executing steps.
+.TP
+.B agent [path] [--force]
+Create WFM-focused agent rules. The default path is ./AGENTS.md. Existing files are not overwritten unless --force is passed.
 .TP
 .B scaffold [path] [--format markdown|json]
 Create a starter workflow file. Format defaults to markdown unless the output
@@ -22,8 +25,17 @@ path ends in .json.
 .B validate <workflow.md|workflow.json>
 Validate workflow structure and report schema errors.
 .TP
-.B run <workflow.md|workflow.json> [--input input.json] [--objective text] [--confirm list] [--auto-confirm-all]
-Run the workflow and print a JSON result with events and per-step outputs.
+.B run <workflow.md|workflow.json> [--input input.json] [--objective text] [--confirm list] [--auto-confirm-all] [--port number] [--verbose] [--json]
+Run the workflow with live CLI progress and optional JSON output.
+.TP
+.B approve [--url value] [--token value] [--run-id value] [--step value] [--actor value] [--note text]
+Approve the current waiting runner step through the local attach API.
+.TP
+.B resume [--url value] [--token value] [--run-id value] [--step value] [--actor value] [--note text]
+Alias for approve, intended for external resume flows.
+.TP
+.B cancel [--url value] [--token value] [--run-id value] [--step value] [--actor value] [--note text]
+Cancel the current waiting runner step through the local attach API.
 .TP
 .B auth <login|whoami|logout> [--token value]
 Manage remote registry authentication for CLI publish and pull flows.
@@ -55,6 +67,35 @@ Provide explicit confirmations for steps that require validation.
 .TP
 .B --auto-confirm-all
 Bypass confirmation gating for all steps.
+.TP
+.B --port <number>
+Bind the local attach API to a specific port. If omitted, the OS assigns a free port on 127.0.0.1.
+.TP
+.B --verbose
+Stream per-step agent output and execution updates to stderr while the workflow runs.
+.TP
+.B --json
+Print the final run result as JSON on stdout while keeping live progress on stderr.
+.TP
+Human approval steps in an interactive terminal show an inline review prompt so they can be approved or cancelled without a separate HTTP client.
+.TP
+.B --url <value>
+Runner attach API base URL for approve, resume, or cancel commands.
+.TP
+.B --token <value>
+Runner attach API bearer token for approve, resume, or cancel commands.
+.TP
+.B --run-id <value>
+Runner id to control. If omitted, the CLI reads it from /session.
+.TP
+.B --step <value>
+Optional step key when controlling a specific waiting step.
+.TP
+.B --actor <value>
+Actor name recorded in approval audit events.
+.TP
+.B --note <text>
+Optional approval or cancellation note recorded in the event payload.
 .SH EXAMPLES
 .TP
 Validate markdown workflow:
@@ -80,6 +121,15 @@ Search the remote registry:
 .TP
 Run with explicit confirmations:
 .B wfm run ./example-workflow.json --confirm discover:human,qa_gate:human
+.TP
+Inspect host setup:
+.B wfm doctor
+.TP
+Check a workflow before running it:
+.B wfm doctor ./example-workflow.json
+.TP
+Create agent rules:
+.B wfm agent ./AGENTS.md
 .SH FILES
 .TP
 .B man/wfm.1

package/package.json

@@ -1,11 +1,16 @@
 {
   "name": "@workflow-manager/runner",
-  "version": "0.1.0",
+  "version": "0.3.0",
   "description": "CLI runner for in-memory and markdown workflow orchestration using ATEP-like envelopes",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/navio/workflow-manager.git"
+  },
   "type": "module",
   "main": "dist/index.js",
   "bin": {
-    "wfm": "dist/index.js"
+    "wfm": "dist/index.js",
+    "workflow-manager": "dist/index.js"
   },
   "publishConfig": {
     "access": "public"
@@ -23,21 +28,34 @@
     "build:bin:linux": "bun build ./src/index.ts --compile --target bun-linux-x64 --outfile ./dist/wfm-linux-x64",
     "build:bin:windows": "bun build ./src/index.ts --compile --target bun-windows-x64 --outfile ./dist/wfm-windows-x64.exe",
     "build:bin:all": "bun run build:bin:macos && bun run build:bin:linux && bun run build:bin:windows",
+    "lint": "biome lint --error-on-warnings",
+    "lint:ci": "biome lint --changed --since=origin/main --error-on-warnings --no-errors-on-unmatched",
+    "lint:fix": "biome lint --write --error-on-warnings",
+    "lint:staged": "lint-staged --relative --concurrent false",
     "man": "man ./man/wfm.1",
-    "test:unit": "bun test tests/parser.test.ts tests/engine.test.ts tests/mockExecutor.test.ts tests/opencodeExecutor.test.ts tests/remote.test.ts tests/run-telemetry.test.ts tests/supabase-functions.test.ts tests/supabase-ops.test.ts tests/remote-registry-app.test.ts",
+    "test:unit": "bun test tests/parser.test.ts tests/engine.test.ts tests/runtimePreflight.test.ts tests/mockExecutor.test.ts tests/opencodeExecutor.test.ts tests/claudeCodeExecutor.test.ts tests/piAgentExecutor.test.ts tests/skillResolver.test.ts tests/publish-bundle.test.ts tests/remote.test.ts tests/installer.test.ts tests/run-telemetry.test.ts tests/runnerApi.test.ts tests/runnerCli.test.ts tests/supabase-functions.test.ts tests/supabase-ops.test.ts tests/remote-registry-app.test.ts",
+    "test:release": "bun test tests/parser.test.ts tests/engine.test.ts tests/runtimePreflight.test.ts tests/mockExecutor.test.ts tests/opencodeExecutor.test.ts tests/claudeCodeExecutor.test.ts tests/piAgentExecutor.test.ts tests/skillResolver.test.ts tests/publish-bundle.test.ts tests/remote.test.ts tests/run-telemetry.test.ts tests/runnerApi.test.ts tests/runnerCli.test.ts tests/supabase-functions.test.ts tests/supabase-ops.test.ts tests/remote-registry-app.test.ts tests/story-workflow.e2e.test.ts tests/opencode-real.e2e.test.ts",
     "test:e2e": "bun test tests/story-workflow.e2e.test.ts tests/opencode-real.e2e.test.ts",
     "test:e2e:real": "WORKFLOW_MANAGER_REAL_OPENCODE=1 bun test tests/opencode-real.e2e.test.ts",
     "test": "bun test",
     "dev": "bun run ./src/index.ts",
+    "netlify:build": "node ./scripts/netlify-build.mjs",
     "package:check": "npm pack --dry-run",
+    "prepare": "node ./scripts/install-git-hooks.mjs",
     "prepack": "bun run build",
     "supabase:start": "supabase start",
     "supabase:stop": "supabase stop",
     "supabase:status": "supabase status",
     "supabase:db:reset": "supabase db reset",
-    "supabase:functions:deploy": "supabase functions deploy create-cli-token --project-ref whairnylpdvxxgbygbzu --use-api --no-verify-jwt && supabase functions deploy auth-whoami --project-ref whairnylpdvxxgbygbzu --use-api --no-verify-jwt && supabase functions deploy list-cli-tokens --project-ref whairnylpdvxxgbygbzu --use-api --no-verify-jwt && supabase functions deploy manage-workflow --project-ref whairnylpdvxxgbygbzu --use-api --no-verify-jwt && supabase functions deploy refresh-workflow-stats --project-ref whairnylpdvxxgbygbzu --use-api --no-verify-jwt && supabase functions deploy revoke-cli-token --project-ref whairnylpdvxxgbygbzu --use-api --no-verify-jwt && supabase functions deploy publish-workflow --project-ref whairnylpdvxxgbygbzu --use-api --no-verify-jwt && supabase functions deploy pull-workflow --project-ref whairnylpdvxxgbygbzu --use-api --no-verify-jwt && supabase functions deploy search-workflows --project-ref whairnylpdvxxgbygbzu --use-api --no-verify-jwt && supabase functions deploy workflow-analytics --project-ref whairnylpdvxxgbygbzu --use-api --no-verify-jwt && supabase functions deploy track-run-telemetry --project-ref whairnylpdvxxgbygbzu --use-api --no-verify-jwt && supabase functions deploy workflow-run-insights --project-ref whairnylpdvxxgbygbzu --use-api --no-verify-jwt",
+    "supabase:db:lint": "supabase db lint --local --fail-on error",
+    "supabase:test": "bun test tests/supabase-functions.test.ts tests/supabase-ops.test.ts",
+    "supabase:functions:deploy": "supabase functions deploy --project-ref whairnylpdvxxgbygbzu --use-api",
     "remote-registry:dev": "bun --cwd apps/remote-registry dev",
     "remote-registry:build": "bun --cwd apps/remote-registry build",
+    "remote-registry:test": "bun --cwd apps/remote-registry test:app",
+    "remote-registry:test:auth:local": "bun --cwd apps/remote-registry test:auth:local",
+    "remote-registry:test:publish:local": "bun --cwd apps/remote-registry test:publish:local",
+    "remote-registry:test:smoke:local": "bun --cwd apps/remote-registry test:smoke:local",
     "docs:dev": "vitepress dev doc",
     "docs:build": "vitepress build doc",
     "docs:preview": "vitepress preview doc"
@@ -57,9 +75,15 @@
     "gray-matter": "^4.0.3"
   },
   "devDependencies": {
+    "@biomejs/biome": "^2.4.14",
+    "@netlify/edge-functions": "^2.13.0",
     "@types/node": "^24.6.0",
     "bun-types": "^1.3.0",
+    "lint-staged": "^16.4.0",
     "typescript": "^5.9.2",
     "vitepress": "^1.5.0"
+  },
+  "lint-staged": {
+    "*.{js,cjs,mjs,jsx,ts,tsx,mts,cts,json,jsonc,css}": "biome lint --write --no-errors-on-unmatched"
   }
 }