[APPS-2958] Add: list each action call's static inputs in the debugBundle response - #610

P1 / post-GA follow-up: the upfront consent prompt isn't needed for GA.

Motivation

• APPS-2958: the consent prompt needs to say what each backend call will do, such as which URL and verb an http.request uses, not only which actions and connections it touches.
• Values the build can't resolve are left out, so the prompt can show them as set when the call runs.
• Stacked on [APPS-2958 Add: list each backend function's action calls in the debugBundle response]([APPS-2958] Add: list each backend function's action calls in the debugBundle response #607).

Architecture

flowchart LR
    C["Action-catalog calls in the bundle"] --> L["listActionCalls: connectionId + static string inputs per call"]
    L --> R["debugBundle JSON: actions[].calls"]
    R --> G["Frame guard: copy own fields, check types"]
    G --> P["run-query bundle to the parent"]

interface DebugBundleActionCall {
    connectionId?: string;           // absent when the call sets none
    inputs: Record<string, string>;  // inline `inputs` keys that resolve to a string
}

interface DebugBundleAction {
    fqn: string;
    connectionIds: string[];         // unchanged
    calls: DebugBundleActionCall[];  // new: one entry per call site
}

• Additive: fqn and connectionIds are unchanged; a listed input is a string literal, an expression-free template or a top-level string const (never an object member, which an alias or call can mutate unseen), so it is already in the response's code.

Changes

QA Instructions

• Tests pass, including the real dev-server test and fail-before, but they were recorded before head 7649b0dc and aren't re-verified on it. Setup: Local QA without npm link.
• Real dev server: the integration test bundles the twoActions.backend.ts fixture through Vite and reads /__dd/debugBundle as JSON.

yarn build:all
# Expected: exit 0
yarn test:unit packages/plugins/apps/src/backend/ast-parsing/list-action-calls.test.ts
# Expected: Tests: 33 passed, 33 total
yarn test:unit packages/plugins/apps/src/vite/dev-server.integration.test.ts -t "Should list the actions a real backend file calls"
# Expected: passes, with http.request's calls: [{ connectionId: 'conn-http', inputs: { url: 'https://example.com', verb: 'GET' } }]
TMPDIR=<a dir under /private/tmp> yarn test:unit packages/plugins/apps/src --testPathIgnorePatterns network-guard
# Expected: Test Suites: 44 passed; Tests: 1016 passed (macOS needs a TMPDIR outside /var; CI on Linux doesn't)
yarn test:unit packages/plugins/apps/src/vite/network-guard.test.ts
# Expected: Tests: 129 passed, 129 total (run without TMPDIR set)
yarn lint && yarn typecheck:all && yarn cli integrity
# Expected: all exit 0, integrity leaves no extra changes

Blast Radius

• No feature flag. Risk: Low. Only the dev server's JSON debugBundle response and the framed bundle copy change.
• The frame's guard drops a malformed action list as a whole; the bundle is still posted.

Documentation

• The response shape is documented on DebugBundleResponse in packages/plugins/apps/src/backend/protocol.ts.
• Related: [APPS-2958 Add: let the parent page keep a Live Preview backend call waiting]([APPS-2958] Add: let the parent page keep a Live Preview backend call waiting #609)

🤖 Generated with Claude Code