The lockfile is a POST you send when you're satisfied

Tuesday, a new integration. require('stripe'), require('csv-stringify'), no install step: exec pulls the latest of each on first use, and the endpoint works by Thursday.

Before it ships to the customer, two POSTs. /api/v1/exec/package/install with the package names runs bun install on the box and writes them into package.json. Then /api/v1/exec/package/pin rewrites every declared range to the exact version sitting in node_modules: the one you tested against, not the one the registry resolves next month. Call pin again later and it reports that nothing changed.

There is no laptop in this workflow. The install ran on the machine that serves the endpoint; the pin froze what that machine actually loaded. Auto-install got you to working. The pin keeps it there. The lockfile is a POST you send when you're satisfied.