@walkeros/cli 4.5.0 → 4.6.0-next-1788817472881

package/dist/index.js

@@ -139,9 +139,17 @@ function createCLILoggerConfig(options = {}) {
     // at DEBUG, ERROR always reaches the handler (and the ring) even without
     // --verbose.
     level: Level.DEBUG,
-    handler: (level, message, _context, scope) => {
+    handler: (level, message, context2, scope) => {
       const scopePath = scope.length > 0 ? `[${scope.join(":")}] ` : "";
-      const fullMessage = scrubSecrets(`${scopePath}${message}`);
+      let meta = "";
+      if (Object.keys(context2).length > 0) {
+        try {
+          meta = ` ${JSON.stringify(context2)}`;
+        } catch {
+          meta = " [unserializable context]";
+        }
+      }
+      const fullMessage = scrubSecrets(`${scopePath}${message}${meta}`);
       try {
         options.onLine?.(level, fullMessage);
       } catch {
@@ -260,7 +268,9 @@ import {
   writeFileSync,
   mkdirSync,
   unlinkSync,
-  existsSync
+  existsSync,
+  chmodSync,
+  renameSync
 } from "fs";
 import { join } from "path";
 import { homedir } from "os";
@@ -281,15 +291,33 @@ function readConfig() {
     return null;
   }
 }
-function writeConfig(config) {
+function replaceConfigFile(config) {
   const dir = getConfigDir();
-  mkdirSync(dir, { recursive: true });
+  mkdirSync(dir, { recursive: true, mode: 448 });
   const configPath = getConfigPath();
-  writeFileSync(configPath, JSON.stringify(config, null, 2), { mode: 384 });
+  const tempPath = `${configPath}.tmp`;
+  writeFileSync(tempPath, JSON.stringify(config, null, 2), { mode: 384 });
+  chmodSync(tempPath, 384);
+  renameSync(tempPath, configPath);
+}
+function writeConfig(config) {
+  replaceConfigFile({ ...readConfig() ?? {}, ...config });
+}
+function clearAuthFields() {
+  const config = readConfig();
+  if (!config) return;
+  const {
+    token: _token,
+    accessToken: _accessToken,
+    accessTokenExpiresAt: _accessTokenExpiresAt,
+    refreshToken: _refreshToken,
+    email: _email,
+    ...rest
+  } = config;
+  replaceConfigFile(rest);
 }
 function writeTelemetryOnlyConfig(partial) {
-  const existing = readConfig() ?? {};
-  writeConfig({ ...existing, ...partial });
+  writeConfig(partial);
 }
 function deleteConfig() {
   const configPath = getConfigPath();
@@ -323,7 +351,7 @@ function clearDefaultProject() {
   const config = readConfig();
   if (!config) return;
   const { defaultProjectId: _removed, ...rest } = config;
-  writeConfig(rest);
+  replaceConfigFile(rest);
 }
 function resolveToken() {
   const envToken = process.env.WALKEROS_TOKEN;
@@ -348,6 +376,336 @@ var init_config_file = __esm({
   }
 });
 
+// src/lib/config-lock.ts
+import { closeSync, mkdirSync as mkdirSync2, openSync, statSync, unlinkSync as unlinkSync2 } from "fs";
+function getConfigLockPath() {
+  return `${getConfigPath()}.lock`;
+}
+function hasCode(value) {
+  return typeof value === "object" && value !== null && "code" in value;
+}
+function isAlreadyLocked(error) {
+  return hasCode(error) && error.code === "EEXIST";
+}
+function delay(ms) {
+  return new Promise((resolve5) => setTimeout(resolve5, ms));
+}
+function breakIfStale(lockPath) {
+  try {
+    const age = Date.now() - statSync(lockPath).mtimeMs;
+    if (age < STALE_MS) return false;
+    unlinkSync2(lockPath);
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function withConfigLock(fn) {
+  const lockPath = getConfigLockPath();
+  mkdirSync2(getConfigDir(), { recursive: true, mode: 448 });
+  const deadline = Date.now() + TIMEOUT_MS;
+  for (; ; ) {
+    let handle;
+    try {
+      handle = openSync(lockPath, "wx", 384);
+    } catch (error) {
+      if (!isAlreadyLocked(error)) throw error;
+      if (breakIfStale(lockPath)) continue;
+      if (Date.now() >= deadline) {
+        throw new Error(
+          `Timed out waiting for the walkerOS config lock at ${lockPath}. Remove the file if no other walkeros process is running.`
+        );
+      }
+      await delay(RETRY_MS);
+      continue;
+    }
+    closeSync(handle);
+    try {
+      return await fn();
+    } finally {
+      try {
+        unlinkSync2(lockPath);
+      } catch {
+      }
+    }
+  }
+}
+var STALE_MS, RETRY_MS, TIMEOUT_MS;
+var init_config_lock = __esm({
+  "src/lib/config-lock.ts"() {
+    "use strict";
+    init_config_file();
+    STALE_MS = 15e3;
+    RETRY_MS = 100;
+    TIMEOUT_MS = 1e4;
+  }
+});
+
+// src/core/oauth-client.ts
+import { z } from "zod";
+async function readJson(response) {
+  try {
+    return await response.json();
+  } catch {
+    return null;
+  }
+}
+function errorCode(body) {
+  const parsed = ErrorSchema.safeParse(body);
+  return parsed.success ? parsed.data.error : null;
+}
+function describe(response, body) {
+  const parsed = ErrorSchema.safeParse(body);
+  if (parsed.success) {
+    return parsed.data.error_description ? `${parsed.data.error}: ${parsed.data.error_description}` : parsed.data.error;
+  }
+  return `HTTP ${response.status}`;
+}
+function post(fetchFn, url, form, signal) {
+  return fetchFn(url, {
+    method: "POST",
+    headers: { ...FORM_HEADERS },
+    body: new URLSearchParams(form).toString(),
+    ...signal ? { signal } : {}
+  });
+}
+function toTokenSet(body) {
+  const parsed = TokenSchema.safeParse(body);
+  if (!parsed.success) throw new Error("Malformed token response");
+  return {
+    accessToken: parsed.data.access_token,
+    accessTokenExpiresAt: new Date(
+      Date.now() + parsed.data.expires_in * 1e3
+    ).toISOString(),
+    refreshToken: parsed.data.refresh_token ?? null
+  };
+}
+async function startDeviceAuthorization(appUrl, fetchFn = globalThis.fetch) {
+  const response = await post(
+    fetchFn,
+    `${appUrl}/api/oauth/device_authorization`,
+    {
+      client_id: CLI_CLIENT_ID,
+      scope: CLI_SCOPE,
+      // RFC 8707. The token comes back bound to the API, so a leaked CLI token
+      // cannot be replayed against the MCP resource.
+      resource: `${appUrl}/api`
+    }
+  );
+  const body = await readJson(response);
+  if (!response.ok) throw new Error(describe(response, body));
+  const parsed = DeviceAuthorizationSchema.safeParse(body);
+  if (!parsed.success)
+    throw new Error("Malformed device authorization response");
+  return {
+    deviceCode: parsed.data.device_code,
+    userCode: parsed.data.user_code,
+    verificationUri: parsed.data.verification_uri,
+    verificationUriComplete: parsed.data.verification_uri_complete ?? parsed.data.verification_uri,
+    expiresIn: parsed.data.expires_in,
+    interval: parsed.data.interval
+  };
+}
+async function pollDeviceToken(appUrl, deviceCode, fetchFn = globalThis.fetch, signal) {
+  let response;
+  try {
+    response = await post(
+      fetchFn,
+      `${appUrl}/api/oauth/token`,
+      {
+        grant_type: DEVICE_CODE_GRANT,
+        device_code: deviceCode,
+        client_id: CLI_CLIENT_ID
+      },
+      signal
+    );
+  } catch (error) {
+    if (signal?.aborted) return { status: "pending" };
+    throw error;
+  }
+  const body = await readJson(response);
+  if (response.ok) {
+    try {
+      return { status: "ok", tokens: toTokenSet(body) };
+    } catch (error) {
+      return {
+        status: "error",
+        error: error instanceof Error ? error.message : String(error)
+      };
+    }
+  }
+  switch (errorCode(body)) {
+    case "authorization_pending":
+      return { status: "pending" };
+    case "slow_down":
+      return { status: "slow_down" };
+    case "access_denied":
+      return { status: "denied" };
+    case "expired_token":
+      return { status: "expired" };
+    default:
+      return { status: "error", error: describe(response, body) };
+  }
+}
+async function refreshTokens(appUrl, refreshToken, fetchFn = globalThis.fetch) {
+  const response = await post(
+    fetchFn,
+    `${appUrl}/api/oauth/token`,
+    {
+      grant_type: "refresh_token",
+      refresh_token: refreshToken,
+      client_id: CLI_CLIENT_ID
+    },
+    AbortSignal.timeout(REFRESH_TIMEOUT_MS)
+  );
+  const body = await readJson(response);
+  if (!response.ok) {
+    if (errorCode(body) === "invalid_grant") return null;
+    throw new Error(describe(response, body));
+  }
+  return toTokenSet(body);
+}
+async function revokeRefreshToken(appUrl, refreshToken, fetchFn = globalThis.fetch) {
+  try {
+    await post(
+      fetchFn,
+      `${appUrl}/api/oauth/revoke`,
+      {
+        token: refreshToken,
+        token_type_hint: "refresh_token",
+        client_id: CLI_CLIENT_ID
+      },
+      AbortSignal.timeout(REVOKE_TIMEOUT_MS)
+    );
+  } catch {
+  }
+}
+var CLI_CLIENT_ID, CLI_SCOPE, DEVICE_CODE_GRANT, REFRESH_TIMEOUT_MS, REVOKE_TIMEOUT_MS, FORM_HEADERS, DeviceAuthorizationSchema, TokenSchema, ErrorSchema;
+var init_oauth_client = __esm({
+  "src/core/oauth-client.ts"() {
+    "use strict";
+    CLI_CLIENT_ID = "walkeros-cli";
+    CLI_SCOPE = "read write offline_access";
+    DEVICE_CODE_GRANT = "urn:ietf:params:oauth:grant-type:device_code";
+    REFRESH_TIMEOUT_MS = 1e4;
+    REVOKE_TIMEOUT_MS = 5e3;
+    FORM_HEADERS = {
+      "Content-Type": "application/x-www-form-urlencoded",
+      Accept: "application/json"
+    };
+    DeviceAuthorizationSchema = z.object({
+      device_code: z.string().min(1),
+      user_code: z.string().min(1),
+      verification_uri: z.string().min(1),
+      verification_uri_complete: z.string().min(1).optional(),
+      expires_in: z.number().int().nonnegative(),
+      interval: z.number().int().nonnegative()
+    });
+    TokenSchema = z.object({
+      access_token: z.string().min(1),
+      expires_in: z.number().int().nonnegative(),
+      refresh_token: z.string().min(1).optional()
+    });
+    ErrorSchema = z.object({
+      error: z.string().min(1),
+      error_description: z.string().optional()
+    });
+  }
+});
+
+// src/core/auth.ts
+function noticeLegacyToken() {
+  if (legacyNoticeShown) return;
+  legacyNoticeShown = true;
+  process.stderr.write(
+    "walkerOS: using a static token from your config. Run `walkeros login` to switch to a session that refreshes automatically.\n"
+  );
+}
+function isFresh(config, nowMs) {
+  if (!config.accessToken || !config.accessTokenExpiresAt) return false;
+  const expiresAt = Date.parse(config.accessTokenExpiresAt);
+  if (Number.isNaN(expiresAt)) return false;
+  return expiresAt - nowMs > REFRESH_SKEW_MS;
+}
+async function resolveAccessToken(opts) {
+  const envToken = process.env.WALKEROS_TOKEN;
+  if (envToken) return envToken;
+  const now = opts?.now ?? Date.now;
+  const config = readConfig();
+  if (!config) return null;
+  if (config.token) {
+    noticeLegacyToken();
+    return config.token;
+  }
+  if (!config.refreshToken) {
+    return isFresh(config, now()) ? config.accessToken ?? null : null;
+  }
+  if (isFresh(config, now())) return config.accessToken ?? null;
+  return withConfigLock(async () => {
+    const current = readConfig();
+    if (!current?.refreshToken) return current?.accessToken ?? null;
+    if (isFresh(current, now())) return current.accessToken ?? null;
+    let rotated;
+    try {
+      rotated = await refreshTokens(
+        resolveAppUrl(),
+        current.refreshToken,
+        opts?.fetch
+      );
+    } catch (error) {
+      const reason = error instanceof Error ? error.message : String(error);
+      throw new Error(
+        `Could not reach ${resolveAppUrl()} to refresh your session: ${reason}. Your saved session was kept, so try again once the connection is back.`
+      );
+    }
+    if (rotated === null) {
+      clearAuthFields();
+      return null;
+    }
+    writeConfig({
+      accessToken: rotated.accessToken,
+      accessTokenExpiresAt: rotated.accessTokenExpiresAt,
+      // A server that rotates no new refresh token leaves the current one in
+      // force; overwriting it with null would end the session on the next call.
+      refreshToken: rotated.refreshToken ?? current.refreshToken
+    });
+    return rotated.accessToken;
+  });
+}
+async function getAuthHeaders() {
+  const token = await resolveAccessToken();
+  if (!token) return {};
+  return { Authorization: `Bearer ${token}` };
+}
+function credentialSource() {
+  if (process.env.WALKEROS_TOKEN) return "env";
+  const config = readConfig();
+  if (config?.token || config?.accessToken) return "config";
+  return null;
+}
+function resolveRunToken() {
+  return resolveDeployToken() ?? resolveToken()?.token ?? null;
+}
+function requireProjectId() {
+  const projectId = process.env.WALKEROS_PROJECT_ID || getDefaultProject();
+  if (!projectId)
+    throw new Error(
+      "No project selected. Set WALKEROS_PROJECT_ID or configure a default project."
+    );
+  return projectId;
+}
+var REFRESH_SKEW_MS, legacyNoticeShown;
+var init_auth = __esm({
+  "src/core/auth.ts"() {
+    "use strict";
+    init_config_file();
+    init_config_lock();
+    init_oauth_client();
+    REFRESH_SKEW_MS = 6e4;
+    legacyNoticeShown = false;
+  }
+});
+
 // src/core/client-context.ts
 function setClientContext(input) {
   const envType = process.env.WALKEROS_CLIENT_TYPE;
@@ -395,7 +753,7 @@ function buildHeaders(token, headers) {
 }
 async function apiFetch(path20, init) {
   const baseUrl = resolveAppUrl();
-  const token = resolveToken()?.token;
+  const token = await resolveAccessToken();
   return fetch(`${baseUrl}${path20}`, {
     ...init,
     headers: buildHeaders(token, init?.headers)
@@ -413,7 +771,7 @@ async function publicFetch(path20, init) {
 }
 async function deployFetch(path20, init) {
   const baseUrl = resolveAppUrl();
-  const token = resolveDeployToken() ?? resolveToken()?.token;
+  const token = resolveDeployToken() ?? await resolveAccessToken();
   if (!token)
     throw new Error(
       "No authentication token available. Set WALKEROS_DEPLOY_TOKEN or run walkeros auth login."
@@ -427,6 +785,7 @@ var init_http = __esm({
   "src/core/http.ts"() {
     "use strict";
     init_config_file();
+    init_auth();
     init_client_context();
   }
 });
@@ -442,8 +801,15 @@ function isUrl(str) {
     return false;
   }
 }
+function isAppOrigin(url) {
+  try {
+    return new URL(url).origin === new URL(resolveAppUrl()).origin;
+  } catch {
+    return false;
+  }
+}
 async function fetchContentString(url) {
-  const token = resolveToken()?.token;
+  const token = isAppOrigin(url) ? await resolveAccessToken() : null;
   const response = await fetch(url, {
     headers: mergeAuthHeaders(token)
   });
@@ -516,6 +882,7 @@ var init_utils = __esm({
   "src/config/utils.ts"() {
     "use strict";
     init_http();
+    init_auth();
     init_config_file();
   }
 });
@@ -720,34 +1087,6 @@ var init_stdin = __esm({
   }
 });
 
-// src/core/auth.ts
-function getToken() {
-  const result = resolveToken();
-  return result?.token;
-}
-function getAuthHeaders() {
-  const token = getToken();
-  if (!token) return {};
-  return { Authorization: `Bearer ${token}` };
-}
-function resolveRunToken() {
-  return resolveDeployToken() ?? resolveToken()?.token ?? null;
-}
-function requireProjectId() {
-  const projectId = process.env.WALKEROS_PROJECT_ID || getDefaultProject();
-  if (!projectId)
-    throw new Error(
-      "No project selected. Set WALKEROS_PROJECT_ID or configure a default project."
-    );
-  return projectId;
-}
-var init_auth = __esm({
-  "src/core/auth.ts"() {
-    "use strict";
-    init_config_file();
-  }
-});
-
 // src/core/sse.ts
 function parseSSEEvents(buffer) {
   const events = [];
@@ -1222,13 +1561,13 @@ function validateReference(type, name, ref) {
     return;
   }
   const hasPackage = !!ref.package;
-  const hasCode = hasCodeReference(ref.code);
-  if (hasPackage && hasCode) {
+  const hasCode2 = hasCodeReference(ref.code);
+  if (hasPackage && hasCode2) {
     throw new Error(
       `${type} "${name}": Cannot specify both package and code. Use one or the other.`
     );
   }
-  if (!hasPackage && !hasCode) {
+  if (!hasPackage && !hasCode2) {
     throw new Error(`${type} "${name}": Must specify either package or code.`);
   }
 }
@@ -1500,7 +1839,7 @@ function backoffForAttempt(index) {
   const spread = base * JITTER;
   return base + (Math.random() * 2 - 1) * spread;
 }
-function delay(ms) {
+function delay2(ms) {
   return new Promise((resolve5) => {
     setTimeout(resolve5, ms);
   });
@@ -1542,7 +1881,7 @@ async function withPacoteRetry(fn, label, options = {}) {
       maxTotalMs - (Date.now() - start)
     );
     if (sleepMs <= 0) break;
-    await delay(sleepMs);
+    await delay2(sleepMs);
   }
   throw new Error(
     `Failed ${label} after ${made} attempts: ${describeError(lastError)}`
@@ -3969,14 +4308,14 @@ __export(cache_exports, {
 });
 import {
   existsSync as existsSync3,
-  mkdirSync as mkdirSync4,
+  mkdirSync as mkdirSync5,
   copyFileSync,
   writeFileSync as writeFileSync4,
   readFileSync as readFileSync3
 } from "fs";
 import { join as join6 } from "path";
 function writeCache(cacheDir, bundlePath, configContent, version) {
-  mkdirSync4(cacheDir, { recursive: true });
+  mkdirSync5(cacheDir, { recursive: true });
   copyFileSync(bundlePath, join6(cacheDir, "flow.mjs"));
   writeFileSync4(join6(cacheDir, "config.json"), configContent, "utf-8");
   const meta = { version, timestamp: Date.now() };
@@ -4057,7 +4396,7 @@ var env_file_exports = {};
 __export(env_file_exports, {
   loadEnvFile: () => loadEnvFile
 });
-import { readFileSync as readFileSync5, statSync } from "fs";
+import { readFileSync as readFileSync5, statSync as statSync2 } from "fs";
 function parseLine(line) {
   const trimmed = line.trim();
   if (trimmed === "" || trimmed.startsWith("#")) return void 0;
@@ -4072,7 +4411,7 @@ function parseLine(line) {
   return { key, value };
 }
 function loadEnvFile(filePath) {
-  const stats = statSync(filePath);
+  const stats = statSync2(filePath);
   if (process.platform !== "win32") {
     const mode = stats.mode & 511;
     if (mode & 36) {
@@ -4316,13 +4655,13 @@ function installTimerInterception(options = {}) {
       setInterval: Reflect.get(target, "setInterval"),
       clearInterval: Reflect.get(target, "clearInterval")
     });
-    const trackedSetTimeout = (callback, delay3, ...args) => {
+    const trackedSetTimeout = (callback, delay5, ...args) => {
       if (typeof callback !== "function") return 0;
       const id = nextId++;
       pending.set(id, {
         id,
         callback,
-        delay: delay3 ?? 0,
+        delay: delay5 ?? 0,
         type: "timeout",
         args,
         cleared: false
@@ -4335,13 +4674,13 @@ function installTimerInterception(options = {}) {
       const entry = pending.get(numId);
       if (entry) entry.cleared = true;
     };
-    const trackedSetInterval = (callback, delay3, ...args) => {
+    const trackedSetInterval = (callback, delay5, ...args) => {
       if (typeof callback !== "function") return 0;
       const id = nextId++;
       pending.set(id, {
         id,
         callback,
-        delay: delay3 ?? 0,
+        delay: delay5 ?? 0,
         type: "interval",
         args,
         cleared: false
@@ -5688,14 +6027,14 @@ import { join as join8 } from "path";
 import { Level as Level2 } from "@walkeros/core";
 
 // src/commands/run/error-sink.ts
-import { mkdirSync as mkdirSync2, readFileSync as readFileSync2, writeFileSync as writeFileSync2 } from "fs";
+import { mkdirSync as mkdirSync3, readFileSync as readFileSync2, writeFileSync as writeFileSync2 } from "fs";
 import { join as join4 } from "path";
 function errorSinkPath(cacheDir) {
   return join4(cacheDir, "errors.jsonl");
 }
 function ensureSinkDir(cacheDir) {
   try {
-    mkdirSync2(cacheDir, { recursive: true });
+    mkdirSync3(cacheDir, { recursive: true });
   } catch {
   }
 }
@@ -5833,7 +6172,7 @@ init_stdin();
 import {
   createReadStream,
   existsSync as existsSync2,
-  mkdirSync as mkdirSync3,
+  mkdirSync as mkdirSync4,
   rmSync,
   writeFileSync as writeFileSync3
 } from "fs";
@@ -5903,7 +6242,7 @@ function backoffForAttempt2(index) {
   const spread = base * JITTER2;
   return base + (Math.random() * 2 - 1) * spread;
 }
-function delay2(ms) {
+function delay3(ms) {
   return new Promise((resolve5) => {
     setTimeout(resolve5, ms);
   });
@@ -5950,7 +6289,7 @@ async function fetchWithRetry(url, options = {}) {
       maxTotalMs - (Date.now() - start)
     );
     if (sleepMs <= 0) break;
-    await delay2(sleepMs);
+    await delay3(sleepMs);
   }
   const cause = lastReason ? describeReason(lastReason) : "no attempts made";
   throw new Error(`Fetch failed after ${made} attempts: ${cause}`);
@@ -5977,7 +6316,7 @@ function isArchive(value, contentType) {
 function writeBundleToDisk(writePath, content) {
   const dir = dirname4(writePath);
   if (!existsSync2(dir)) {
-    mkdirSync3(dir, { recursive: true });
+    mkdirSync4(dir, { recursive: true });
   }
   writeFileSync3(writePath, content, "utf-8");
 }
@@ -6000,7 +6339,7 @@ async function fetchTextToDisk(response, writePath) {
 }
 async function extractToDir(source, destDir) {
   if (!existsSync2(destDir)) {
-    mkdirSync3(destDir, { recursive: true });
+    mkdirSync4(destDir, { recursive: true });
   }
   const entryPath = join5(destDir, ARCHIVE_ENTRY);
   for (const member of [ARCHIVE_ENTRY, "node_modules", "package.json"]) {
@@ -6655,93 +6994,93 @@ init_asset_resolver();
 import { existsSync as existsSync4 } from "fs";
 
 // src/schemas/primitives.ts
-import { z } from "@walkeros/core/dev";
-var PortSchema = z.number().int("Port must be an integer").min(1, "Port must be at least 1").max(65535, "Port must be at most 65535").describe("HTTP server port number");
-var FilePathSchema = z.string().min(1, "File path cannot be empty").describe("Path to configuration file");
+import { z as z2 } from "@walkeros/core/dev";
+var PortSchema = z2.number().int("Port must be an integer").min(1, "Port must be at least 1").max(65535, "Port must be at most 65535").describe("HTTP server port number");
+var FilePathSchema = z2.string().min(1, "File path cannot be empty").describe("Path to configuration file");
 
 // src/schemas/run.ts
-import { z as z2 } from "@walkeros/core/dev";
-var RunOptionsSchema = z2.object({
+import { z as z3 } from "@walkeros/core/dev";
+var RunOptionsSchema = z3.object({
   flow: FilePathSchema,
   port: PortSchema.default(8080),
-  flowName: z2.string().optional().describe("Specific flow name to run")
+  flowName: z3.string().optional().describe("Specific flow name to run")
 });
 
 // src/schemas/validate.ts
-import { z as z3 } from "@walkeros/core/dev";
-var ValidationTypeSchema = z3.enum(["contract", "event", "flow", "mapping"]).describe('Validation type: "event", "flow", "mapping", or "contract"');
-var ValidateOptionsSchema = z3.object({
-  flow: z3.string().optional().describe("Flow name for multi-flow configs"),
-  path: z3.string().optional().describe(
+import { z as z4 } from "@walkeros/core/dev";
+var ValidationTypeSchema = z4.enum(["contract", "event", "flow", "mapping"]).describe('Validation type: "event", "flow", "mapping", or "contract"');
+var ValidateOptionsSchema = z4.object({
+  flow: z4.string().optional().describe("Flow name for multi-flow configs"),
+  path: z4.string().optional().describe(
     'Entry path for package schema validation (e.g., "destinations.snowplow", "sources.browser")'
   )
 });
 var ValidateInputShape = {
   type: ValidationTypeSchema,
-  input: z3.string().min(1).describe("JSON string, file path, or URL to validate"),
-  flow: z3.string().optional().describe("Flow name for multi-flow configs"),
-  path: z3.string().optional().describe(
+  input: z4.string().min(1).describe("JSON string, file path, or URL to validate"),
+  flow: z4.string().optional().describe("Flow name for multi-flow configs"),
+  path: z4.string().optional().describe(
     'Entry path for package schema validation (e.g., "destinations.snowplow"). When provided, validates the entry against its package JSON Schema instead of using --type.'
   )
 };
-var ValidateInputSchema = z3.object(ValidateInputShape);
+var ValidateInputSchema = z4.object(ValidateInputShape);
 
 // src/schemas/bundle.ts
-import { z as z4 } from "@walkeros/core/dev";
-var BundleOptionsSchema = z4.object({
-  silent: z4.boolean().optional().describe("Suppress all output"),
-  verbose: z4.boolean().optional().describe("Enable verbose logging"),
-  stats: z4.boolean().optional().default(true).describe("Return bundle statistics"),
-  cache: z4.boolean().optional().default(true).describe("Enable package caching"),
-  flowName: z4.string().optional().describe("Flow name for multi-flow configs")
+import { z as z5 } from "@walkeros/core/dev";
+var BundleOptionsSchema = z5.object({
+  silent: z5.boolean().optional().describe("Suppress all output"),
+  verbose: z5.boolean().optional().describe("Enable verbose logging"),
+  stats: z5.boolean().optional().default(true).describe("Return bundle statistics"),
+  cache: z5.boolean().optional().default(true).describe("Enable package caching"),
+  flowName: z5.string().optional().describe("Flow name for multi-flow configs")
 });
 var BundleInputShape = {
   configPath: FilePathSchema.describe(
     "Path to flow configuration file (JSON or JavaScript), URL, or inline JSON string"
   ),
-  flow: z4.string().optional().describe("Flow name for multi-flow configs"),
-  stats: z4.boolean().optional().default(true).describe("Return bundle statistics"),
-  output: z4.string().optional().describe("Output file path (defaults to config-defined)")
+  flow: z5.string().optional().describe("Flow name for multi-flow configs"),
+  stats: z5.boolean().optional().default(true).describe("Return bundle statistics"),
+  output: z5.string().optional().describe("Output file path (defaults to config-defined)")
 };
-var BundleInputSchema = z4.object(BundleInputShape);
+var BundleInputSchema = z5.object(BundleInputShape);
 
 // src/schemas/simulate.ts
-import { z as z5 } from "@walkeros/core/dev";
-var PlatformSchema = z5.enum(["web", "server"]).describe("Platform type for event processing");
-var SimulateOptionsSchema = z5.object({
-  silent: z5.boolean().optional().describe("Suppress all output"),
-  verbose: z5.boolean().optional().describe("Enable verbose logging"),
-  json: z5.boolean().optional().describe("Format output as JSON")
+import { z as z6 } from "@walkeros/core/dev";
+var PlatformSchema = z6.enum(["web", "server"]).describe("Platform type for event processing");
+var SimulateOptionsSchema = z6.object({
+  silent: z6.boolean().optional().describe("Suppress all output"),
+  verbose: z6.boolean().optional().describe("Enable verbose logging"),
+  json: z6.boolean().optional().describe("Format output as JSON")
 });
 var SimulateInputShape = {
   configPath: FilePathSchema.describe(
     "Path to flow configuration file, URL, or inline JSON string"
   ),
-  event: z5.string().min(1).optional().describe(
+  event: z6.string().min(1).optional().describe(
     "Event as JSON string, file path, or URL. For sources: { content, trigger?, env? }."
   ),
-  flow: z5.string().optional().describe("Flow name for multi-flow configs"),
+  flow: z6.string().optional().describe("Flow name for multi-flow configs"),
   platform: PlatformSchema.optional().describe("Override platform detection"),
-  step: z5.string().optional().describe(
+  step: z6.string().optional().describe(
     'Step target in type.name format (e.g. "source.browser", "destination.gtag")'
   )
 };
-var SimulateInputSchema = z5.object(SimulateInputShape);
+var SimulateInputSchema = z6.object(SimulateInputShape);
 
 // src/schemas/push.ts
-import { z as z6 } from "@walkeros/core/dev";
-var PushOptionsSchema = z6.object({
-  silent: z6.boolean().optional().describe("Suppress all output"),
-  verbose: z6.boolean().optional().describe("Enable verbose logging"),
-  json: z6.boolean().optional().describe("Format output as JSON")
+import { z as z7 } from "@walkeros/core/dev";
+var PushOptionsSchema = z7.object({
+  silent: z7.boolean().optional().describe("Suppress all output"),
+  verbose: z7.boolean().optional().describe("Enable verbose logging"),
+  json: z7.boolean().optional().describe("Format output as JSON")
 });
 var PushInputShape = {
   configPath: FilePathSchema.describe("Path to flow configuration file"),
-  event: z6.string().min(1).describe("Event as JSON string, file path, or URL"),
-  flow: z6.string().optional().describe("Flow name for multi-flow configs"),
+  event: z7.string().min(1).describe("Event as JSON string, file path, or URL"),
+  flow: z7.string().optional().describe("Flow name for multi-flow configs"),
   platform: PlatformSchema.optional().describe("Override platform detection")
 };
-var PushInputSchema = z6.object(PushInputShape);
+var PushInputSchema = z7.object(PushInputShape);
 
 // src/commands/run/validators.ts
 function validateFlowFile(filePath) {
@@ -8262,7 +8601,7 @@ function validateMapping(input) {
 // src/commands/validate/validators/entry.ts
 import Ajv from "ajv";
 import { fetchPackageSchema } from "@walkeros/core";
-var CLIENT_HEADER = "walkeros-cli/4.5.0";
+var CLIENT_HEADER = "walkeros-cli/4.6.0-next-1788817472881";
 var SECTIONS = ["destinations", "sources", "transformers"];
 function resolveEntry(path20, flowConfig) {
   const flows = flowConfig.flows;
@@ -8514,29 +8853,23 @@ async function validateCommand(options) {
 
 // src/commands/login/index.ts
 init_cli_logger();
+init_oauth_client();
 init_config_file();
-import { hostname } from "os";
-import { z as z7 } from "zod";
-var DeviceCodeResponseSchema = z7.object({
-  deviceCode: z7.string().min(1),
-  userCode: z7.string().min(1),
-  verificationUri: z7.string().min(1),
-  verificationUriComplete: z7.string().optional(),
-  // Server protocol allows 0 for both (e.g. fast retry / already expired).
-  expiresIn: z7.number().int().nonnegative(),
-  interval: z7.number().int().nonnegative()
-});
-var TokenResponseSchema = z7.object({
-  token: z7.string().min(1),
-  email: z7.string().min(1)
-});
+import { z as z8 } from "zod";
 var POLL_TIMEOUT_BUFFER_MS = 5e3;
-var DEFAULT_POLL_TIMEOUT_MS = 6e4;
 var DEFAULT_POLL_INTERVAL_MS = 5e3;
+var MIN_SERVER_POLL_INTERVAL_MS = 1e3;
+var DEFAULT_POLL_TIMEOUT_MS = 9e5;
+var SLOW_DOWN_STEP_MS = 5e3;
+var TIMED_OUT = "Authorization timed out. Please try again.";
+var WhoamiSchema = z8.object({ email: z8.string().min(1) });
 async function openInBrowser(url) {
   const { default: open } = await import("open");
   await open(url);
 }
+function delay4(ms) {
+  return new Promise((resolve5) => setTimeout(resolve5, ms));
+}
 async function loginCommand(options) {
   const logger = createCLILogger(options);
   try {
@@ -8544,8 +8877,11 @@ async function loginCommand(options) {
     if (options.json) {
       logger.json(result);
     } else if (result.success) {
-      logger.info(`Logged in as ${result.email}`);
-      logger.info(`Token stored in ${result.configPath}`);
+      if (result.email) logger.info(`Logged in as ${result.email}`);
+      else logger.info("Logged in.");
+      logger.info(`Session stored in ${result.configPath}`);
+    } else if (result.error) {
+      logger.error(result.error);
     }
     process.exit(result.success ? 0 : 1);
   } catch (error) {
@@ -8558,264 +8894,141 @@ async function loginCommand(options) {
     process.exit(1);
   }
 }
-async function requestDeviceCode(options = {}) {
-  const appUrl = options.url || resolveAppUrl();
-  const f = options.fetch ?? globalThis.fetch;
-  const response = await f(`${appUrl}/api/auth/device/code`, {
-    method: "POST",
-    headers: { "Content-Type": "application/json" },
-    body: JSON.stringify({})
-  });
-  if (!response.ok) {
-    throw new Error("Failed to request device code");
-  }
-  let raw;
+async function fetchEmail(appUrl, accessToken, fetchFn) {
   try {
-    raw = await response.json();
+    const response = await fetchFn(`${appUrl}/api/auth/whoami`, {
+      headers: { Authorization: `Bearer ${accessToken}` }
+    });
+    if (!response.ok) return void 0;
+    const parsed = WhoamiSchema.safeParse(await response.json());
+    return parsed.success ? parsed.data.email : void 0;
   } catch {
-    throw new Error("Malformed device code response");
-  }
-  const parsed = DeviceCodeResponseSchema.safeParse(raw);
-  if (!parsed.success) {
-    throw new Error("Malformed device code response");
+    return void 0;
   }
-  return {
-    deviceCode: parsed.data.deviceCode,
-    userCode: parsed.data.userCode,
-    verificationUri: parsed.data.verificationUri,
-    verificationUriComplete: parsed.data.verificationUriComplete,
-    expiresIn: parsed.data.expiresIn,
-    interval: parsed.data.interval
-  };
 }
-async function pollForToken(deviceCode, options = {}) {
+async function persistSession(appUrl, tokens, fetchFn) {
+  writeConfig({
+    accessToken: tokens.accessToken,
+    accessTokenExpiresAt: tokens.accessTokenExpiresAt,
+    refreshToken: tokens.refreshToken ?? void 0,
+    appUrl,
+    // Drop the static token this session replaces, so the deprecated path
+    // cannot outlive the login that retired it.
+    token: void 0
+  });
+  const email = await fetchEmail(appUrl, tokens.accessToken, fetchFn);
+  writeConfig({ email });
+}
+async function completeDeviceLogin(deviceCode, options = {}) {
+  const fetchFn = options.fetch ?? globalThis.fetch;
   const appUrl = options.url || resolveAppUrl();
-  const f = options.fetch ?? globalThis.fetch;
-  const timeoutMs = options.timeoutMs ?? DEFAULT_POLL_TIMEOUT_MS;
+  const deadline = Date.now() + (options.timeoutMs ?? DEFAULT_POLL_TIMEOUT_MS);
   let intervalMs = options.intervalMs ?? DEFAULT_POLL_INTERVAL_MS;
-  const deadline = Date.now() + timeoutMs;
-  while (Date.now() < deadline) {
-    await new Promise((r) => setTimeout(r, intervalMs));
-    if (Date.now() >= deadline) break;
-    const remaining = Math.max(1, deadline - Date.now());
-    const controller = new AbortController();
-    const timeoutHandle = setTimeout(() => controller.abort(), remaining);
-    let tokenResponse;
-    try {
-      tokenResponse = await f(`${appUrl}/api/auth/device/token`, {
-        method: "POST",
-        headers: { "Content-Type": "application/json" },
-        body: JSON.stringify({ deviceCode, hostname: hostname() }),
-        signal: controller.signal
-      });
-    } catch (err) {
-      clearTimeout(timeoutHandle);
-      if (err instanceof Error && err.name === "AbortError") {
-        break;
-      }
-      throw err;
-    } finally {
-      clearTimeout(timeoutHandle);
-    }
-    const data = await safeJsonParse(tokenResponse);
-    if (data === MALFORMED) {
-      return {
-        success: false,
-        status: "error",
-        error: "Server returned malformed response"
-      };
-    }
-    if (tokenResponse.ok) {
-      if (data.token === void 0) {
-        continue;
-      }
-      const tokenParsed = TokenResponseSchema.safeParse(data);
-      if (!tokenParsed.success) {
-        return {
-          success: false,
-          status: "error",
-          error: "Server returned malformed token response"
-        };
-      }
-      const { token, email } = tokenParsed.data;
-      writeConfig({ token, email, appUrl });
-      const configPath = getConfigPath();
-      return {
-        success: true,
-        status: "authenticated",
-        email,
-        configPath
-      };
-    }
-    if (data.error === "authorization_pending") continue;
-    if (data.error === "slow_down") {
-      intervalMs += 5e3;
+  let attempts = 0;
+  let waiting = "pending";
+  while (Date.now() + intervalMs <= deadline) {
+    if (options.maxPollAttempts !== void 0 && attempts >= options.maxPollAttempts)
+      break;
+    attempts += 1;
+    await delay4(intervalMs);
+    const poll = await pollDeviceToken(
+      appUrl,
+      deviceCode,
+      fetchFn,
+      AbortSignal.timeout(Math.max(1, deadline - Date.now()))
+    );
+    if (poll.status === "pending") {
+      waiting = "pending";
       continue;
     }
-    const errField = data.error;
-    let errorMsg;
-    if (typeof errField === "string") {
-      errorMsg = errField;
-    } else if (errField && typeof errField === "object" && "message" in errField && typeof errField.message === "string") {
-      errorMsg = errField.message;
-    } else {
-      errorMsg = "Authorization failed";
-    }
-    return { success: false, status: "error", error: errorMsg };
-  }
-  return { success: false, status: "pending" };
-}
-var MALFORMED = /* @__PURE__ */ Symbol("malformed-json");
-async function safeJsonParse(response) {
-  try {
-    const parsed = await response.json();
-    if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
-      return parsed;
+    if (poll.status === "slow_down") {
+      waiting = "slow_down";
+      intervalMs += SLOW_DOWN_STEP_MS;
+      continue;
     }
-    return MALFORMED;
-  } catch {
-    return MALFORMED;
+    if (poll.status !== "ok") return poll;
+    await persistSession(appUrl, poll.tokens, fetchFn);
+    return { status: "ok" };
   }
+  return { status: waiting };
 }
 async function login(options = {}) {
-  const fetchOption = options.fetch ?? globalThis.fetch;
-  const urlOption = options.url;
-  let codeResult;
+  const fetchFn = options.fetch ?? globalThis.fetch;
+  const appUrl = options.url || resolveAppUrl();
+  let authorization;
   try {
-    codeResult = await requestDeviceCode({
-      url: urlOption,
-      fetch: fetchOption
-    });
+    authorization = await startDeviceAuthorization(appUrl, fetchFn);
   } catch {
     return { success: false, error: "Failed to request device code" };
   }
-  const {
-    userCode,
-    verificationUri,
-    verificationUriComplete,
-    expiresIn,
-    interval,
-    deviceCode
-  } = codeResult;
-  const prompt = (msg) => process.stderr.write(msg + "\n");
+  const target = authorization.verificationUriComplete;
+  const prompt = (message) => process.stderr.write(message + "\n");
   prompt(`
-! Your one-time code: ${userCode}`);
-  prompt(`  Authorize here: ${verificationUriComplete || verificationUri}
+! Your one-time code: ${authorization.userCode}`);
+  prompt(`  Authorize here: ${target}
 `);
   const opener = options.openUrl ?? openInBrowser;
   try {
-    await opener(verificationUriComplete || verificationUri);
+    await opener(target);
     prompt("  Opening browser...");
   } catch {
     prompt("  Could not open browser. Visit the URL manually.");
   }
   prompt("  Waiting for authorization... (press Ctrl+C to cancel)\n");
-  const timeoutMs = expiresIn * 1e3 + POLL_TIMEOUT_BUFFER_MS;
-  const intervalMs = (interval ?? 5) * 1e3;
-  if (options.maxPollAttempts !== void 0) {
-    const appUrl = urlOption || resolveAppUrl();
-    const f = fetchOption;
-    let pollInterval = intervalMs;
-    let attempts = 0;
-    const deadline = Date.now() + timeoutMs;
-    while (Date.now() < deadline && attempts < options.maxPollAttempts) {
-      attempts++;
-      await new Promise((r) => setTimeout(r, pollInterval));
-      const remaining = Math.max(1, deadline - Date.now());
-      const controller = new AbortController();
-      const timeoutHandle = setTimeout(() => controller.abort(), remaining);
-      let tokenResponse;
-      try {
-        tokenResponse = await f(`${appUrl}/api/auth/device/token`, {
-          method: "POST",
-          headers: { "Content-Type": "application/json" },
-          body: JSON.stringify({ deviceCode, hostname: hostname() }),
-          signal: controller.signal
-        });
-      } catch (err) {
-        clearTimeout(timeoutHandle);
-        if (err instanceof Error && err.name === "AbortError") {
-          break;
-        }
-        throw err;
-      } finally {
-        clearTimeout(timeoutHandle);
-      }
-      const data = await safeJsonParse(tokenResponse);
-      if (data === MALFORMED) {
-        return {
-          success: false,
-          error: "Server returned malformed response"
-        };
-      }
-      if (tokenResponse.ok) {
-        if (data.token === void 0) {
-          continue;
-        }
-        const tokenParsed = TokenResponseSchema.safeParse(data);
-        if (!tokenParsed.success) {
-          return {
-            success: false,
-            error: "Server returned malformed token response"
-          };
-        }
-        const { token, email } = tokenParsed.data;
-        writeConfig({ token, email, appUrl });
-        const configPath = getConfigPath();
-        return { success: true, email, configPath };
-      }
-      if (data.error === "authorization_pending") continue;
-      if (data.error === "slow_down") {
-        pollInterval += 5e3;
-        continue;
-      }
-      const errField = data.error;
-      const errorMsg = typeof errField === "string" ? errField : "Authorization failed";
-      return { success: false, error: errorMsg };
-    }
-    return {
-      success: false,
-      error: "Authorization timed out. Please try again."
-    };
-  }
-  const pollResult = await pollForToken(deviceCode, {
-    url: urlOption,
-    fetch: fetchOption,
-    timeoutMs,
-    intervalMs
+  const outcome = await completeDeviceLogin(authorization.deviceCode, {
+    url: appUrl,
+    fetch: fetchFn,
+    timeoutMs: authorization.expiresIn * 1e3 + POLL_TIMEOUT_BUFFER_MS,
+    // Clamped here, at the one place a server's number enters the loop. The
+    // helper takes its caller's interval as stated, which is what keeps a
+    // stated 0 from becoming a poll flood without making the helper's own
+    // option untestably slow.
+    intervalMs: options.pollIntervalMs ?? Math.max(MIN_SERVER_POLL_INTERVAL_MS, authorization.interval * 1e3),
+    ...options.maxPollAttempts !== void 0 ? { maxPollAttempts: options.maxPollAttempts } : {}
   });
-  if (pollResult.success) {
-    return {
-      success: true,
-      email: pollResult.email,
-      configPath: pollResult.configPath
-    };
-  }
-  if (pollResult.status === "error") {
-    return { success: false, error: pollResult.error };
+  switch (outcome.status) {
+    case "ok": {
+      const email = readConfig()?.email;
+      return {
+        success: true,
+        ...email ? { email } : {},
+        configPath: getConfigPath()
+      };
+    }
+    case "denied":
+      return { success: false, error: "Authorization was denied." };
+    case "error":
+      return { success: false, error: outcome.error };
+    default:
+      return { success: false, error: TIMED_OUT };
   }
-  return {
-    success: false,
-    error: "Authorization timed out. Please try again."
-  };
 }
 
 // src/commands/logout/index.ts
 init_cli_logger();
+init_oauth_client();
 init_config_file();
 async function logoutCommand(options) {
   const logger = createCLILogger(options);
-  const deleted = deleteConfig();
+  const { deleted } = await logout();
   const configPath = getConfigPath();
   if (options.json) {
     logger.json({ success: true, deleted });
   } else if (deleted) {
-    logger.info(`Logged out. Token removed from ${configPath}`);
+    logger.info(`Logged out. Session removed from ${configPath}`);
   } else {
     logger.info("No stored credentials found.");
   }
   process.exit(0);
 }
+async function logout() {
+  const config = readConfig();
+  const appUrl = resolveAppUrl();
+  if (config?.refreshToken) {
+    await revokeRefreshToken(appUrl, config.refreshToken);
+  }
+  return { deleted: deleteConfig() };
+}
 
 // src/core/api-client.ts
 init_auth();
@@ -8827,8 +9040,8 @@ import createClient from "openapi-fetch";
 init_config_file();
 import { createHash } from "crypto";
 import semver4 from "semver";
-var bakedContractVersion = true ? "4.3.0" : PLACEHOLDER;
-var bakedContractHash = true ? "78d9f32be512ebb51e8c6c262aab05dd4eda28a84269fc53ff87b88e41940e6d" : "";
+var bakedContractVersion = true ? "4.5.1" : PLACEHOLDER;
+var bakedContractHash = true ? "335b9bd11acaf7c516e3fcd47c74b4ab212032375e00f2b58b8459f4cb30e3a6" : "";
 function isRecord3(value) {
   return value !== null && typeof value === "object" && !Array.isArray(value);
 }
@@ -8939,17 +9152,26 @@ function emitDriftWarning(responseHeaders) {
   );
 }
 function createApiClient() {
-  const token = getToken();
-  if (!token) throw new Error("WALKEROS_TOKEN not set.");
   const client = createClient({
     baseUrl: resolveAppUrl(),
     headers: {
-      Authorization: `Bearer ${token}`,
       "Content-Type": "application/json",
       ...clientContextHeaders()
     }
   });
   client.use({
+    // Authorization is attached per request, not at construction: the stdio
+    // MCP server builds one client and keeps it for hours, so a token captured
+    // here would go stale and never pick up a refresh.
+    async onRequest({ request }) {
+      const token = await resolveAccessToken();
+      if (!token)
+        throw new Error("Not authenticated. Run `walkeros login` first.");
+      request.headers.set("Authorization", `Bearer ${token}`);
+      return request;
+    },
+    // Surface contract drift once per process from any response's version
+    // headers. openapi-fetch ^0.17 supports `use({ onResponse })`.
     onResponse({ response }) {
       emitDriftWarning(response.headers);
       return void 0;
@@ -10212,6 +10434,7 @@ async function wrapSkeleton(options) {
 
 // src/index.ts
 init_auth();
+init_oauth_client();
 init_http();
 init_client_context();
 
@@ -10361,7 +10584,7 @@ async function listJourneys(options) {
 init_auth();
 init_http();
 init_output();
-init_config_file();
+init_auth();
 async function startObserveSession(options) {
   const pid = options.projectId ?? requireProjectId();
   const body = {
@@ -10413,6 +10636,149 @@ async function endObserveSession(options) {
   }
 }
 
+// src/commands/hub/index.ts
+init_auth();
+init_http();
+async function readJson2(response, fallback) {
+  if (!response.ok) {
+    const body = await response.json().catch(() => ({}));
+    throwApiResponseError(response, body, fallback);
+  }
+  return response.json();
+}
+async function listReleases(options) {
+  const pid = options.projectId ?? requireProjectId();
+  const params = new URLSearchParams({ rationale: "true" });
+  if (options.limit !== void 0) params.set("limit", String(options.limit));
+  if (options.offset !== void 0)
+    params.set("offset", String(options.offset));
+  const response = await apiFetch(
+    `/api/projects/${pid}/flows/${options.flowId}/releases?${params.toString()}`
+  );
+  return readJson2(response, "Failed to list releases");
+}
+async function getRelease(options) {
+  const pid = options.projectId ?? requireProjectId();
+  const segment = "versionId" in options.ref ? options.ref.versionId : String(options.ref.versionNumber);
+  const response = await apiFetch(
+    `/api/projects/${pid}/flows/${options.flowId}/releases/${encodeURIComponent(segment)}`
+  );
+  return readJson2(response, "Failed to read release");
+}
+async function listStepHistory(options) {
+  const pid = options.projectId ?? requireProjectId();
+  const params = new URLSearchParams({ step: options.step });
+  if (options.flow !== void 0) params.set("flow", options.flow);
+  if (options.limit !== void 0) params.set("limit", String(options.limit));
+  const response = await apiFetch(
+    `/api/projects/${pid}/flows/${options.flowId}/releases/step-history?${params.toString()}`
+  );
+  return readJson2(response, "Failed to read step history");
+}
+async function setReleaseRationale(options) {
+  const pid = options.projectId ?? requireProjectId();
+  const response = await apiFetch(
+    `/api/projects/${pid}/flows/${options.flowId}/releases/annotations`,
+    {
+      method: "PUT",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({
+        versionId: options.versionId,
+        humanText: options.text
+      })
+    }
+  );
+  return readJson2(response, "Failed to write release rationale");
+}
+async function listThreads(options) {
+  const pid = options.projectId ?? requireProjectId();
+  const params = new URLSearchParams();
+  if (options.anchorType !== void 0)
+    params.set("anchorType", options.anchorType);
+  if (options.anchorKey !== void 0)
+    params.set("anchorKey", options.anchorKey);
+  if (options.status !== void 0) params.set("status", options.status);
+  params.set("includeMessages", options.includeMessages ? "true" : "false");
+  if (options.limit !== void 0) params.set("limit", String(options.limit));
+  const response = await apiFetch(
+    `/api/projects/${pid}/flows/${options.flowId}/threads?${params.toString()}`
+  );
+  return readJson2(response, "Failed to list threads");
+}
+async function createThread(options) {
+  const pid = options.projectId ?? requireProjectId();
+  const response = await apiFetch(
+    `/api/projects/${pid}/flows/${options.flowId}/threads`,
+    {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({
+        anchorType: options.anchorType,
+        anchorKey: options.anchorKey,
+        ...options.anchorLabel !== void 0 ? { anchorLabel: options.anchorLabel } : {},
+        text: options.text
+      })
+    }
+  );
+  return readJson2(response, "Failed to open thread");
+}
+async function addThreadMessage(options) {
+  const pid = options.projectId ?? requireProjectId();
+  const response = await apiFetch(
+    `/api/projects/${pid}/flows/${options.flowId}/threads/${encodeURIComponent(options.threadId)}/messages`,
+    {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ text: options.text })
+    }
+  );
+  return readJson2(response, "Failed to add message");
+}
+async function listKnowledge(options) {
+  const pid = options.projectId ?? requireProjectId();
+  const params = new URLSearchParams();
+  if (options.pageKey !== void 0) params.set("pageKey", options.pageKey);
+  if (options.frameId !== void 0) params.set("frameId", options.frameId);
+  if (options.markId !== void 0) params.set("markId", options.markId);
+  params.set("includeMessages", options.includeMessages ? "true" : "false");
+  if (options.limit !== void 0) params.set("limit", String(options.limit));
+  const response = await apiFetch(
+    `/api/projects/${pid}/knowledge?${params.toString()}`
+  );
+  return readJson2(response, "Failed to read knowledge");
+}
+
+// src/commands/frames/index.ts
+init_auth();
+init_http();
+async function readJson3(response, fallback) {
+  if (!response.ok) {
+    const body = await response.json().catch(() => ({}));
+    throwApiResponseError(response, body, fallback);
+  }
+  return response.json();
+}
+async function listFrames(options = {}) {
+  const pid = options.projectId ?? requireProjectId();
+  const response = await apiFetch(`/api/projects/${pid}/frames`);
+  return readJson3(response, "Failed to list frames");
+}
+async function listPageFrames(options) {
+  const pid = options.projectId ?? requireProjectId();
+  const params = new URLSearchParams({ pageKey: options.pageKey });
+  const response = await apiFetch(
+    `/api/projects/${pid}/frames?${params.toString()}`
+  );
+  return readJson3(response, "Failed to list page frames");
+}
+async function getFrame(options) {
+  const pid = options.projectId ?? requireProjectId();
+  const response = await apiFetch(
+    `/api/projects/${pid}/frames/${encodeURIComponent(options.frameId)}`
+  );
+  return readJson3(response, "Failed to read frame");
+}
+
 // src/commands/secrets/index.ts
 init_auth();
 init_http();
@@ -10784,6 +11150,7 @@ export {
   ApiError,
   DeploymentAmbiguityError,
   VERSION,
+  addThreadMessage,
   annotateErrorWithDrift,
   apiFetch,
   bakedContractHash,
@@ -10793,9 +11160,11 @@ export {
   bundleCommand,
   canonicalContractHash,
   classifyStepProperties,
+  clearAuthFields,
   clientContextHeaders,
   compareContract,
   compareOutput,
+  completeDeviceLogin,
   containsCodeMarkers,
   createApiClient,
   createDeployCommand,
@@ -10807,6 +11176,8 @@ export {
   createProject,
   createProjectCommand,
   createSecret,
+  createThread,
+  credentialSource,
   deleteConfig,
   deleteDeployment,
   deleteDeploymentByFlowId,
@@ -10837,36 +11208,44 @@ export {
   getFeedbackPreference,
   getFlow,
   getFlowCommand,
+  getFrame,
   getObserveSession,
   getPreview,
   getProject,
   getProjectCommand,
-  getToken,
+  getRelease,
   listAllFlows,
   listDeployments,
   listDeploymentsCommand,
   listFlows,
   listFlowsCommand,
+  listFrames,
   listJourneys,
+  listKnowledge,
+  listPageFrames,
   listPreviews,
   listProjects,
   listProjectsCommand,
+  listReleases,
   listSecrets,
+  listStepHistory,
+  listThreads,
   loadConfig,
   loadJsonConfig,
+  login,
   loginCommand,
+  logout,
   logoutCommand,
   mergeAuthHeaders,
   parseSSEEvents,
-  pollForToken,
   publicFetch,
   push,
   pushCommand,
   readConfig,
   regrantPreview,
-  requestDeviceCode,
   requireProjectId,
   resetClientContext,
+  resolveAccessToken,
   resolveAppUrl,
   resolveToken,
   run,
@@ -10874,10 +11253,12 @@ export {
   setClientContext,
   setDefaultProject,
   setFeedbackPreference,
+  setReleaseRationale,
   simulateCollector,
   simulateDestination,
   simulateSource,
   simulateTransformer,
+  startDeviceAuthorization,
   startObserveSession,
   telemetry_exports as telemetry,
   telemetryDisableCommand,