[Actions] sdk: @wave-av/sdk/compose as a finished rendering — save, run, types on the live shape, release, live e2e

[yakimoto]

Sub-epic: the TypeScript SDK rendering of WAVE Composer — @wave-av/sdk/compose as a finished product surface, not just a merged module.

POST https://api.wave.online/v1/compose takes a plain-language intent and returns a grounded proposal: which WAVE products to chain, in what order, at what live price. The SDK is one of four renderings of that one engine (API, CLI, SDK, MCP); all four must serve the same proposal without re-implementing it.

Today (receipt)

• feat(compose): add @wave-av/sdk/compose (compose, saveFlow) #124 feat(compose): add @wave-av/sdk/compose (compose, saveFlow) MERGED 2026-09-06T19:30:02Z (feat/compose). Both entry points exist in source.
• The engine it calls is live. Probed unauthenticated this session: POST https://api.wave.online/v1/compose with no credentials returns 402 with an x402 payment challenge naming "resource": "/v1/compose". With a key holding composer:write it returns 200, carrying these keys: callShape, engine, executes, flowId, groundedAt, grounding, id, intent, manifestHash, next, priceRows, productIds, scopes, stages, tools.
• GET https://api.wave.online/.well-known/wave-skills/composer.json returns 200 and declares auth.scope: "composer:write" and pricing.meter: "wave_compose_builds".
• What is not done: no published release carries compose yet, the types are not proven against the live response, saveFlow has no live receipt, there is no run/progress/artifact surface, and no e2e in this repo's CI calls the live gateway.

Done means (live proof)

• (a) Compose live against the engine — compose() returns a proposal fetched from POST https://api.wave.online/v1/compose. Receipt: the merged PR (feat(compose): add @wave-av/sdk/compose (compose, saveFlow) #124) plus a captured live response.
• (b) Save flow — saveFlow() persists a composed proposal through the authenticated bearer path and it reads back by id. Receipt: the save response and the subsequent read.
• (c) Run + progress + artifacts — the SDK can hand a proposal to a run, expose stage progress as it streams, and list the resulting artifacts.
• (d) Types and examples grounded on the LIVE response shape — the exported types name the keys the API actually returns (stages, priceRows, scopes, engine, executes, flowId, candidates). A test fails if a declared key is absent from a live response, or if the live response carries a key the types drop silently.
• (e) Release cut — a version bump plus a release-workflow run id as the receipt, and the published package's compose import resolves from a clean install.
• (f) e2e vs the live gateway in this repo's CI — a test asserting 402 without a key and the 200 response shape with a key, green, with the run id recorded.

Owner

Lane builds it. Jake crossing: the merge to this public repo's default branch, and any release publish.

Depends on

The runner surface behind (c) is tracked on the API side; (a), (b), (d), (e), (f) are independent and buildable now.

Layer

Actions — the SDK face of WAVE's Knowledge / Actions / Awareness triple.