@walkeros/cli 4.6.0-next-1788817472881 → 4.6.0

package/dist/index.d.ts

@@ -336,7 +336,7 @@ type Platform = 'web' | 'server';
  *
  * Priority: `WALKEROS_TOKEN`, then a legacy static token, then the OAuth
  * session. Returns null when nothing can be resolved, which callers render as
- * "run `walkeros login`".
+ * "run `walkeros auth login`".
  *
  * Throws when a refresh was needed but could not be carried out, which is a
  * different problem from having no session and must not be reported as one.
@@ -352,7 +352,7 @@ declare function resolveAccessToken(opts?: {
 declare function getAuthHeaders(): Promise<Record<string, string>>;
 /**
  * Where a credential would come from, without resolving or refreshing it.
- * For commands that want to send someone to `walkeros login` before spending
+ * For commands that want to send someone to `walkeros auth login` before spending
  * a network round trip.
  */
 declare function credentialSource(): 'env' | 'config' | null;
@@ -366,6 +366,11 @@ declare function mergeAuthHeaders(token: string | null | undefined, headers?: He
 /**
  * Authenticated fetch — resolves base URL + adds auth token.
  * Use for all API calls that require WALKEROS_TOKEN.
+ *
+ * The transport is checked only once a credential is actually going out.
+ * `resolveAppUrl` keeps answering with whatever is configured, which is what
+ * the paths that merely REPORT the target (diagnostics, health, telemetry)
+ * need from it.
  */
 declare function apiFetch(path: string, init?: RequestInit): Promise<Response>;
 /**
@@ -819,6 +824,11 @@ interface LogoutCommandOptions extends GlobalOptions {
     json?: boolean;
 }
 declare function logoutCommand(options: LogoutCommandOptions): Promise<void>;
+interface LogoutResult {
+    deleted: boolean;
+    /** A different session reached the config while the revocation was in flight. */
+    superseded: boolean;
+}
 /**
  * Revoke the stored refresh token, then drop the local config.
  *
@@ -826,9 +836,7 @@ declare function logoutCommand(options: LogoutCommandOptions): Promise<void>;
  * alive on the server that nothing can ever reach to retire. It is best
  * effort: a logout on a plane still has to clear the machine.
  */
-declare function logout(): Promise<{
-    deleted: boolean;
-}>;
+declare function logout(): Promise<LogoutResult>;
 
 declare function whoami(): Promise<{
     userId: string;
@@ -1353,158 +1361,6 @@ interface paths {
     patch?: never;
     trace?: never;
   };
-  '/api/auth/device/code': {
-    parameters: {
-      query?: never;
-      header?: never;
-      path?: never;
-      cookie?: never;
-    };
-    get?: never;
-    put?: never;
-    /**
-     * Request device code
-     * @description Generate a device code and user code for the device authorization flow.
-     */
-    post: {
-      parameters: {
-        query?: never;
-        header?: never;
-        path?: never;
-        cookie?: never;
-      };
-      requestBody?: never;
-      responses: {
-        /** @description Device code generated */
-        200: {
-          headers: {
-            [name: string]: unknown;
-          };
-          content: {
-            'application/json': components['schemas']['DeviceCodeResponse'];
-          };
-        };
-      };
-    };
-    delete?: never;
-    options?: never;
-    head?: never;
-    patch?: never;
-    trace?: never;
-  };
-  '/api/auth/device/approve': {
-    parameters: {
-      query?: never;
-      header?: never;
-      path?: never;
-      cookie?: never;
-    };
-    get?: never;
-    put?: never;
-    /**
-     * Approve device code
-     * @description Approve a device authorization request using the user code. Requires authentication.
-     */
-    post: {
-      parameters: {
-        query?: never;
-        header?: never;
-        path?: never;
-        cookie?: never;
-      };
-      requestBody?: {
-        content: {
-          'application/json': components['schemas']['ApproveDeviceRequest'];
-        };
-      };
-      responses: {
-        /** @description Device approved */
-        200: {
-          headers: {
-            [name: string]: unknown;
-          };
-          content: {
-            'application/json': components['schemas']['ApproveDeviceResponse'];
-          };
-        };
-        /** @description Unauthorized */
-        401: {
-          headers: {
-            [name: string]: unknown;
-          };
-          content: {
-            'application/json': components['schemas']['ErrorResponse'];
-          };
-        };
-        /** @description Not found */
-        404: {
-          headers: {
-            [name: string]: unknown;
-          };
-          content: {
-            'application/json': components['schemas']['ErrorResponse'];
-          };
-        };
-      };
-    };
-    delete?: never;
-    options?: never;
-    head?: never;
-    patch?: never;
-    trace?: never;
-  };
-  '/api/auth/device/token': {
-    parameters: {
-      query?: never;
-      header?: never;
-      path?: never;
-      cookie?: never;
-    };
-    get?: never;
-    put?: never;
-    /**
-     * Poll device token
-     * @description Poll for authorization status using the device code. Returns a token when approved.
-     */
-    post: {
-      parameters: {
-        query?: never;
-        header?: never;
-        path?: never;
-        cookie?: never;
-      };
-      requestBody?: {
-        content: {
-          'application/json': components['schemas']['DeviceTokenRequest'];
-        };
-      };
-      responses: {
-        /** @description Authorization approved */
-        200: {
-          headers: {
-            [name: string]: unknown;
-          };
-          content: {
-            'application/json': components['schemas']['DeviceTokenResponse'];
-          };
-        };
-        /** @description Pending, slow down, or expired */
-        400: {
-          headers: {
-            [name: string]: unknown;
-          };
-          content: {
-            'application/json': components['schemas']['ErrorResponse'];
-          };
-        };
-      };
-    };
-    delete?: never;
-    options?: never;
-    head?: never;
-    patch?: never;
-    trace?: never;
-  };
   '/api/projects': {
     parameters: {
       query?: never;
@@ -4950,8 +4806,8 @@ interface paths {
       cookie?: never;
     };
     /**
-     * List my tokens
-     * @description List all API tokens for the authenticated user. Returns summaries (no raw token values).
+     * List my automation tokens
+     * @description The caller's live automation tokens, with the scope and audience each carries. No raw token value is ever returned; `tokenPrefix` is the only fragment of one that survives issuance. A connected app's access token lives in the same store and is deliberately absent: it is taken back by disconnecting the app.
      */
     get: {
       parameters: {
@@ -4962,13 +4818,13 @@ interface paths {
       };
       requestBody?: never;
       responses: {
-        /** @description List of tokens */
+        /** @description List of automation tokens */
         200: {
           headers: {
             [name: string]: unknown;
           };
           content: {
-            'application/json': components['schemas']['ListApiTokensResponse'];
+            'application/json': components['schemas']['ListAutomationTokensResponse'];
           };
         };
         /** @description Unauthorized */
@@ -4984,8 +4840,8 @@ interface paths {
     };
     put?: never;
     /**
-     * Create token
-     * @description Create a new API token. The raw token is returned once and cannot be retrieved again.
+     * Create automation token
+     * @description Mint an automation token for the authenticated user. The audience is `api` and `mcp`, so one token works against REST and against `/api/mcp`, and the chosen scope decides how far it gets at either: `read` is refused every non-safe REST method with 403 `INSUFFICIENT_SCOPE`. The raw token is returned once and cannot be retrieved again, so the answer carries `Cache-Control: no-store`.
      */
     post: {
       parameters: {
@@ -4996,7 +4852,7 @@ interface paths {
       };
       requestBody?: {
         content: {
-          'application/json': components['schemas']['CreateApiTokenRequest'];
+          'application/json': components['schemas']['CreateAutomationTokenRequest'];
         };
       };
       responses: {
@@ -5006,7 +4862,7 @@ interface paths {
             [name: string]: unknown;
           };
           content: {
-            'application/json': components['schemas']['CreateApiTokenResponse'];
+            'application/json': components['schemas']['CreateAutomationTokenResponse'];
           };
         };
         /** @description Validation error */
@@ -5044,6 +4900,52 @@ interface paths {
     patch?: never;
     trace?: never;
   };
+  '/api/tokens/revoke-all': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    get?: never;
+    put?: never;
+    /**
+     * Revoke all access
+     * @description Revoke every grant this person holds, the tokens hanging from them, and every automation token they hold. Runner tokens survive: those are the credentials deployed flow containers run with, so revoking them would stop every container the person is running. Session only: a bearer credential is refused with 401 `SESSION_REQUIRED`, so a machine token cannot disconnect everything its owner has connected.
+     */
+    post: {
+      parameters: {
+        query?: never;
+        header?: never;
+        path?: never;
+        cookie?: never;
+      };
+      requestBody?: never;
+      responses: {
+        /** @description Access revoked */
+        204: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content?: never;
+        };
+        /** @description Unauthorized */
+        401: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            'application/json': components['schemas']['ErrorResponse'];
+          };
+        };
+      };
+    };
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
   '/api/tokens/{tokenId}': {
     parameters: {
       query?: never;
@@ -5055,8 +4957,8 @@ interface paths {
     put?: never;
     post?: never;
     /**
-     * Revoke token
-     * @description Revoke an API token (soft delete via revokedAt timestamp).
+     * Revoke automation token
+     * @description Revoke one of the caller's tokens. Idempotent and scoped to the caller: an unknown id, another person's token and an already revoked one all answer 204, since a distinguishable answer would tell the caller which ids exist.
      */
     delete: {
       parameters: {
@@ -8680,12 +8582,13 @@ interface paths {
     };
     /**
      * List the frames of a page, or of the whole project
-     * @description A frame is a named rectangle with marks inside it, the spatial unit of a measurement plan. Naming a `pageKey` returns that page’s frames at any depth, marks and all, newest updated first: the walk starts at the page’s top-level frames and descends containment, so a child is reachable through its parent rather than by carrying a page of its own. Naming no page returns every live frame of the project WITHOUT its marks, which is what makes that read cheap enough to answer "what does this project have": the marks are the bulk of a frame and a listing never renders them. That lean read asks nothing about containment, so a frame whose parent cannot be resolved still appears. Requires member role.
+     * @description A frame is a named rectangle with marks inside it, the spatial unit of a measurement plan. Naming a `pageKey` returns that page’s frames at any depth, marks and all, newest updated first: the walk starts at the page’s top-level frames and descends containment, so a child is reachable through its parent rather than by carrying a page of its own. Naming no page returns every live frame of the project WITHOUT its marks, which is what makes that read cheap enough to answer "what does this project have": the marks are the bulk of a frame and a listing never renders them. That lean read asks nothing about containment, so a frame whose parent cannot be resolved still appears. `include=marks` asks that project-wide read for the marks anyway, for a surface that spans pages and cannot fetch a page at a time; it is a second, heavier read of the same rows, taken after the lean list has already painted, and omitting it returns exactly the lean rows. It says nothing to the page read, which carries marks either way. Requires member role.
      */
     get: {
       parameters: {
         query?: {
           pageKey?: string;
+          include?: 'marks';
         };
         header?: never;
         path: {
@@ -9211,7 +9114,7 @@ interface paths {
     patch?: never;
     trace?: never;
   };
-  '/api/projects/{projectId}/flows/{flowId}/releases/step-history': {
+  '/api/projects/{projectId}/canvases': {
     parameters: {
       query?: never;
       header?: never;
@@ -9219,41 +9122,27 @@ interface paths {
       cookie?: never;
     };
     /**
-     * List the releases that touched one step
-     * @description The releases of this flow that added, changed, or removed one step, newest first, each carrying the rationale stored for it. `step` is a `type.name` key over source, transformer, destination, store, and contract. `flow` narrows the scan to one named flow inside the config and is ignored for a contract key. `limit` bounds the releases scanned, not the entries returned. When nothing matched, `knownSteps` lists the addressable keys of the newest scanned release. Requires member role.
+     * List the canvases of the project
+     * @description A canvas is a named, freely arranged board over a project’s frames, the surface on which a plan is laid out across pages rather than within one. This returns every live canvas by name WITHOUT its document: the document is the bulk of a canvas and a listing renders none of it, so opening a board is the single-canvas read. Requires member role.
      */
     get: {
       parameters: {
-        query: {
-          step: string;
-          flow?: string;
-          limit?: number | null;
-        };
+        query?: never;
         header?: never;
         path: {
           projectId: string;
-          flowId: string;
         };
         cookie?: never;
       };
       requestBody?: never;
       responses: {
-        /** @description The releases that touched the step */
+        /** @description The project’s canvases, without their documents */
         200: {
           headers: {
             [name: string]: unknown;
           };
           content: {
-            'application/json': components['schemas']['StepHistoryResponse'];
-          };
-        };
-        /** @description Invalid step key or query */
-        400: {
-          headers: {
-            [name: string]: unknown;
-          };
-          content: {
-            'application/json': components['schemas']['ErrorResponse'];
+            'application/json': components['schemas']['CanvasListResponse'];
           };
         };
         /** @description Unauthorized */
@@ -9295,25 +9184,9 @@ interface paths {
       };
     };
     put?: never;
-    post?: never;
-    delete?: never;
-    options?: never;
-    head?: never;
-    patch?: never;
-    trace?: never;
-  };
-  '/api/projects/{projectId}/flows/{flowId}/releases/summarize': {
-    parameters: {
-      query?: never;
-      header?: never;
-      path?: never;
-      cookie?: never;
-    };
-    get?: never;
-    put?: never;
     /**
-     * Summarize or check a release
-     * @description Describe what one release of this flow changed against an earlier release, or check a written note against that same change. In `draft` mode the generated text is stored as the release's generated summary; in `check` mode nothing is stored and the response says whether the note matches. The diff is always recomputed from the two stored snapshots, with secret literals masked, and is never taken from the request. Both versions must be numbered releases of this flow, and `prevVersionId` must be the earlier of the two. Requires member role and the `hub` feature.
+     * Create one canvas
+     * @description Create one empty canvas at version 1. The id is the client’s, so a board drawn before the first save keeps its identity when it arrives. A canvas comes into existence here and nowhere else: a document write to an id the project does not hold is a 404 rather than a create, which is what keeps a stray write from minting a board. A name another live canvas already holds is 409 `CANVAS_NAME_EXISTS`; the partial unique index is over live rows, so a name a deleted canvas still carries is free. An id that is not a canvas id is refused by the body schema as 400 `VALIDATION_ERROR`. An id that is not available, because a canvas, in this project or another, already holds it, is 400 `INVALID_CANVAS`, whose message says nothing about the project that holds it. Requires member role.
      */
     post: {
       parameters: {
@@ -9321,34 +9194,29 @@ interface paths {
         header?: never;
         path: {
           projectId: string;
-          flowId: string;
         };
         cookie?: never;
       };
       requestBody?: {
         content: {
           'application/json': {
-            /** @example ver_a1b2c3d4 */
-            versionId: string;
-            /** @example ver_a1b2c3d4 */
-            prevVersionId: string;
-            /** @enum {string} */
-            mode: 'draft' | 'check';
-            currentText?: string;
+            /** @example cnv_V1StGXR8Z5jdHi6BmyT7K */
+            id: string;
+            name: string;
           };
         };
       };
       responses: {
-        /** @description The generated summary or the check verdict */
-        200: {
+        /** @description The created canvas, with its empty document */
+        201: {
           headers: {
             [name: string]: unknown;
           };
           content: {
-            'application/json': components['schemas']['SummarizeReleaseResponse'];
+            'application/json': components['schemas']['Canvas'];
           };
         };
-        /** @description Invalid body, a target is not a release, the pair is out of order, or no LLM provider is configured */
+        /** @description Invalid body, or an id that is not available */
         400: {
           headers: {
             [name: string]: unknown;
@@ -9384,8 +9252,8 @@ interface paths {
             'application/json': components['schemas']['ErrorResponse'];
           };
         };
-        /** @description Rate limited */
-        429: {
+        /** @description A name another live canvas already holds */
+        409: {
           headers: {
             [name: string]: unknown;
           };
@@ -9393,8 +9261,8 @@ interface paths {
             'application/json': components['schemas']['ErrorResponse'];
           };
         };
-        /** @description The model call failed or returned no usable text */
-        502: {
+        /** @description Rate limited */
+        429: {
           headers: {
             [name: string]: unknown;
           };
@@ -9410,7 +9278,7 @@ interface paths {
     patch?: never;
     trace?: never;
   };
-  '/api/projects/{projectId}/deployments/{deploymentId}/versions/current/content': {
+  '/api/projects/{projectId}/canvases/{canvasId}': {
     parameters: {
       query?: never;
       header?: never;
@@ -9418,8 +9286,8 @@ interface paths {
       cookie?: never;
     };
     /**
-     * Get current deployed content
-     * @description Get the active deployed per-setting content for a deployment, used to diff changes since deploy. Content is masked and display-only; every field is null when there is no deployed baseline. Requires member role.
+     * Read one canvas
+     * @description One canvas with its whole document: the nodes with their positions, the edges, and the node keys the board suppresses. A canvas of another project reads back as nothing and answers 404, never 403, so this route cannot become an oracle for what exists elsewhere. A deleted canvas is gone to every read. Requires member role.
      */
     get: {
       parameters: {
@@ -9427,23 +9295,24 @@ interface paths {
         header?: never;
         path: {
           projectId: string;
-          deploymentId: string;
+          /** @description Canvas ID (cnv_...) */
+          canvasId: string;
         };
         cookie?: never;
       };
       requestBody?: never;
       responses: {
-        /** @description Deployed content (or a null baseline) */
+        /** @description The canvas */
         200: {
           headers: {
             [name: string]: unknown;
           };
           content: {
-            'application/json': components['schemas']['DeployedContentResponse'];
+            'application/json': components['schemas']['Canvas'];
           };
         };
-        /** @description Unauthorized */
-        401: {
+        /** @description The path segment does not address a canvas */
+        400: {
           headers: {
             [name: string]: unknown;
           };
@@ -9451,8 +9320,383 @@ interface paths {
             'application/json': components['schemas']['ErrorResponse'];
           };
         };
-        /** @description Forbidden */
-        403: {
+        /** @description Unauthorized */
+        401: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            'application/json': components['schemas']['ErrorResponse'];
+          };
+        };
+        /** @description Forbidden */
+        403: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            'application/json': components['schemas']['ErrorResponse'];
+          };
+        };
+        /** @description Not found */
+        404: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            'application/json': components['schemas']['ErrorResponse'];
+          };
+        };
+        /** @description Rate limited */
+        429: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            'application/json': components['schemas']['ErrorResponse'];
+          };
+        };
+      };
+    };
+    /**
+     * Replace the document of one canvas
+     * @description The whole board every time: a canvas is read and written as a unit, so there is no partial write to reconcile. `clientWriteId` is minted at compose time and is what makes a replayed drain exact: a write whose id already produced the stored version landed once and is answered with that version, writing nothing, so an offline queue drains repeatedly without turning one edit into two versions. A write against a version someone else has moved past answers 409 `CANVAS_VERSION_CONFLICT` carrying the head, which is what lets a client raise keep-mine against load-theirs on the board that conflicted instead of dropping what a person drew. A canvas this project does not hold, or one that was removed, is 404 `CANVAS_NOT_FOUND`: this door replaces a document and never creates one. Requires member role.
+     */
+    put: {
+      parameters: {
+        query?: never;
+        header?: never;
+        path: {
+          projectId: string;
+          /** @description Canvas ID (cnv_...) */
+          canvasId: string;
+        };
+        cookie?: never;
+      };
+      requestBody?: {
+        content: {
+          'application/json': {
+            document: components['schemas']['CanvasDocument'];
+            baseVersion: number;
+            clientWriteId: string;
+          };
+        };
+      };
+      responses: {
+        /** @description The stored version */
+        200: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            'application/json': components['schemas']['PutCanvasResponse'];
+          };
+        };
+        /** @description Invalid body, or a path segment that addresses no canvas */
+        400: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            'application/json': components['schemas']['ErrorResponse'];
+          };
+        };
+        /** @description Unauthorized */
+        401: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            'application/json': components['schemas']['ErrorResponse'];
+          };
+        };
+        /** @description Forbidden */
+        403: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            'application/json': components['schemas']['ErrorResponse'];
+          };
+        };
+        /** @description This project does not hold the named canvas */
+        404: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            'application/json': components['schemas']['ErrorResponse'];
+          };
+        };
+        /** @description A stale base version, carrying the head */
+        409: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            'application/json': components['schemas']['CanvasConflictResponse'];
+          };
+        };
+        /** @description Rate limited */
+        429: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            'application/json': components['schemas']['ErrorResponse'];
+          };
+        };
+      };
+    };
+    post?: never;
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  '/api/projects/{projectId}/flows/{flowId}/releases/step-history': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    /**
+     * List the releases that touched one step
+     * @description The releases of this flow that added, changed, or removed one step, newest first, each carrying the rationale stored for it. `step` is a `type.name` key over source, transformer, destination, store, and contract. `flow` narrows the scan to one named flow inside the config and is ignored for a contract key. `limit` bounds the releases scanned, not the entries returned. When nothing matched, `knownSteps` lists the addressable keys of the newest scanned release. Requires member role.
+     */
+    get: {
+      parameters: {
+        query: {
+          step: string;
+          flow?: string;
+          limit?: number | null;
+        };
+        header?: never;
+        path: {
+          projectId: string;
+          flowId: string;
+        };
+        cookie?: never;
+      };
+      requestBody?: never;
+      responses: {
+        /** @description The releases that touched the step */
+        200: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            'application/json': components['schemas']['StepHistoryResponse'];
+          };
+        };
+        /** @description Invalid step key or query */
+        400: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            'application/json': components['schemas']['ErrorResponse'];
+          };
+        };
+        /** @description Unauthorized */
+        401: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            'application/json': components['schemas']['ErrorResponse'];
+          };
+        };
+        /** @description Forbidden */
+        403: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            'application/json': components['schemas']['ErrorResponse'];
+          };
+        };
+        /** @description Not found */
+        404: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            'application/json': components['schemas']['ErrorResponse'];
+          };
+        };
+        /** @description Rate limited */
+        429: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            'application/json': components['schemas']['ErrorResponse'];
+          };
+        };
+      };
+    };
+    put?: never;
+    post?: never;
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  '/api/projects/{projectId}/flows/{flowId}/releases/summarize': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    get?: never;
+    put?: never;
+    /**
+     * Summarize or check a release
+     * @description Describe what one release of this flow changed against an earlier release, or check a written note against that same change. In `draft` mode the generated text is stored as the release's generated summary; in `check` mode nothing is stored and the response says whether the note matches. The diff is always recomputed from the two stored snapshots, with secret literals masked, and is never taken from the request. Both versions must be numbered releases of this flow, and `prevVersionId` must be the earlier of the two. Requires member role and the `hub` feature.
+     */
+    post: {
+      parameters: {
+        query?: never;
+        header?: never;
+        path: {
+          projectId: string;
+          flowId: string;
+        };
+        cookie?: never;
+      };
+      requestBody?: {
+        content: {
+          'application/json': {
+            /** @example ver_a1b2c3d4 */
+            versionId: string;
+            /** @example ver_a1b2c3d4 */
+            prevVersionId: string;
+            /** @enum {string} */
+            mode: 'draft' | 'check';
+            currentText?: string;
+          };
+        };
+      };
+      responses: {
+        /** @description The generated summary or the check verdict */
+        200: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            'application/json': components['schemas']['SummarizeReleaseResponse'];
+          };
+        };
+        /** @description Invalid body, a target is not a release, the pair is out of order, or no LLM provider is configured */
+        400: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            'application/json': components['schemas']['ErrorResponse'];
+          };
+        };
+        /** @description Unauthorized */
+        401: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            'application/json': components['schemas']['ErrorResponse'];
+          };
+        };
+        /** @description Forbidden */
+        403: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            'application/json': components['schemas']['ErrorResponse'];
+          };
+        };
+        /** @description Not found */
+        404: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            'application/json': components['schemas']['ErrorResponse'];
+          };
+        };
+        /** @description Rate limited */
+        429: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            'application/json': components['schemas']['ErrorResponse'];
+          };
+        };
+        /** @description The model call failed or returned no usable text */
+        502: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            'application/json': components['schemas']['ErrorResponse'];
+          };
+        };
+      };
+    };
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
+  '/api/projects/{projectId}/deployments/{deploymentId}/versions/current/content': {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    /**
+     * Get current deployed content
+     * @description Get the active deployed per-setting content for a deployment, used to diff changes since deploy. Content is masked and display-only; every field is null when there is no deployed baseline. Requires member role.
+     */
+    get: {
+      parameters: {
+        query?: never;
+        header?: never;
+        path: {
+          projectId: string;
+          deploymentId: string;
+        };
+        cookie?: never;
+      };
+      requestBody?: never;
+      responses: {
+        /** @description Deployed content (or a null baseline) */
+        200: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            'application/json': components['schemas']['DeployedContentResponse'];
+          };
+        };
+        /** @description Unauthorized */
+        401: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            'application/json': components['schemas']['ErrorResponse'];
+          };
+        };
+        /** @description Forbidden */
+        403: {
           headers: {
             [name: string]: unknown;
           };
@@ -10259,76 +10503,7 @@ interface paths {
           };
         };
         /** @description Unauthorized */
-        401: {
-          headers: {
-            [name: string]: unknown;
-          };
-          content: {
-            'application/json': components['schemas']['ErrorResponse'];
-          };
-        };
-        /** @description Forbidden */
-        403: {
-          headers: {
-            [name: string]: unknown;
-          };
-          content: {
-            'application/json': components['schemas']['ErrorResponse'];
-          };
-        };
-      };
-    };
-    put?: never;
-    post?: never;
-    delete?: never;
-    options?: never;
-    head?: never;
-    patch?: never;
-    trace?: never;
-  };
-  '/api/projects/{projectId}/chat/sessions/{sessionId}': {
-    parameters: {
-      query?: never;
-      header?: never;
-      path?: never;
-      cookie?: never;
-    };
-    /**
-     * Get chat session
-     * @description Return a chat session and its full message history when the caller owns it. Foreign or unknown sessions return 404 (never 403) so existence is not leaked. Requires member role and the chat feature.
-     */
-    get: {
-      parameters: {
-        query?: never;
-        header?: never;
-        path: {
-          projectId: string;
-          sessionId: string;
-        };
-        cookie?: never;
-      };
-      requestBody?: never;
-      responses: {
-        /** @description Chat session with messages */
-        200: {
-          headers: {
-            [name: string]: unknown;
-          };
-          content: {
-            'application/json': components['schemas']['ChatSessionDetailResponse'];
-          };
-        };
-        /** @description Unauthorized */
-        401: {
-          headers: {
-            [name: string]: unknown;
-          };
-          content: {
-            'application/json': components['schemas']['ErrorResponse'];
-          };
-        };
-        /** @description Forbidden */
-        403: {
+        401: {
           headers: {
             [name: string]: unknown;
           };
@@ -10336,8 +10511,8 @@ interface paths {
             'application/json': components['schemas']['ErrorResponse'];
           };
         };
-        /** @description Not found */
-        404: {
+        /** @description Forbidden */
+        403: {
           headers: {
             [name: string]: unknown;
           };
@@ -10355,50 +10530,36 @@ interface paths {
     patch?: never;
     trace?: never;
   };
-  '/api/projects/{projectId}/chat/elicit': {
+  '/api/projects/{projectId}/chat/sessions/{sessionId}': {
     parameters: {
       query?: never;
       header?: never;
       path?: never;
       cookie?: never;
     };
-    get?: never;
-    put?: never;
     /**
-     * Answer elicitation prompt
-     * @description Answer a pending MCP elicitation prompt (accept, decline, or cancel), unblocking the waiting tool invocation. Requires member role and the chat feature.
+     * Get chat session
+     * @description Return a chat session and its full message history when the caller owns it. Foreign or unknown sessions return 404 (never 403) so existence is not leaked. Requires member role and the chat feature.
      */
-    post: {
+    get: {
       parameters: {
         query?: never;
         header?: never;
         path: {
           projectId: string;
+          sessionId: string;
         };
         cookie?: never;
       };
-      requestBody?: {
-        content: {
-          'application/json': components['schemas']['ElicitRequest'];
-        };
-      };
+      requestBody?: never;
       responses: {
-        /** @description Elicitation resolved */
+        /** @description Chat session with messages */
         200: {
           headers: {
             [name: string]: unknown;
           };
           content: {
-            'application/json': components['schemas']['ElicitResponse'];
-          };
-        };
-        /** @description Validation error */
-        400: {
-          headers: {
-            [name: string]: unknown;
-          };
-          content: {
-            'application/json': components['schemas']['ErrorResponse'];
+            'application/json': components['schemas']['ChatSessionDetailResponse'];
           };
         };
         /** @description Unauthorized */
@@ -10430,77 +10591,49 @@ interface paths {
         };
       };
     };
+    put?: never;
+    post?: never;
     delete?: never;
     options?: never;
     head?: never;
     patch?: never;
     trace?: never;
   };
-  '/api/mcp/tokens': {
+  '/api/projects/{projectId}/chat/elicit': {
     parameters: {
       query?: never;
       header?: never;
       path?: never;
       cookie?: never;
     };
-    /**
-     * List MCP tokens
-     * @description List the authenticated user's personal MCP tokens. No secret material is returned.
-     */
-    get: {
-      parameters: {
-        query?: never;
-        header?: never;
-        path?: never;
-        cookie?: never;
-      };
-      requestBody?: never;
-      responses: {
-        /** @description MCP token list */
-        200: {
-          headers: {
-            [name: string]: unknown;
-          };
-          content: {
-            'application/json': components['schemas']['ListMcpTokensResponse'];
-          };
-        };
-        /** @description Unauthorized */
-        401: {
-          headers: {
-            [name: string]: unknown;
-          };
-          content: {
-            'application/json': components['schemas']['ErrorResponse'];
-          };
-        };
-      };
-    };
+    get?: never;
     put?: never;
     /**
-     * Issue MCP token
-     * @description Issue a personal MCP token. The raw token is returned exactly once and is never retrievable afterwards.
+     * Answer elicitation prompt
+     * @description Answer a pending MCP elicitation prompt (accept, decline, or cancel), unblocking the waiting tool invocation. Requires member role and the chat feature.
      */
     post: {
       parameters: {
         query?: never;
         header?: never;
-        path?: never;
+        path: {
+          projectId: string;
+        };
         cookie?: never;
       };
       requestBody?: {
         content: {
-          'application/json': components['schemas']['CreateMcpTokenRequest'];
+          'application/json': components['schemas']['ElicitRequest'];
         };
       };
       responses: {
-        /** @description MCP token issued */
-        201: {
+        /** @description Elicitation resolved */
+        200: {
           headers: {
             [name: string]: unknown;
           };
           content: {
-            'application/json': components['schemas']['CreateMcpTokenResponse'];
+            'application/json': components['schemas']['ElicitResponse'];
           };
         };
         /** @description Validation error */
@@ -10521,48 +10654,17 @@ interface paths {
             'application/json': components['schemas']['ErrorResponse'];
           };
         };
-      };
-    };
-    delete?: never;
-    options?: never;
-    head?: never;
-    patch?: never;
-    trace?: never;
-  };
-  '/api/mcp/tokens/{tokenId}': {
-    parameters: {
-      query?: never;
-      header?: never;
-      path?: never;
-      cookie?: never;
-    };
-    get?: never;
-    put?: never;
-    post?: never;
-    /**
-     * Revoke MCP token
-     * @description Revoke a personal MCP token by id.
-     */
-    delete: {
-      parameters: {
-        query?: never;
-        header?: never;
-        path: {
-          tokenId: string;
-        };
-        cookie?: never;
-      };
-      requestBody?: never;
-      responses: {
-        /** @description MCP token revoked */
-        204: {
+        /** @description Forbidden */
+        403: {
           headers: {
             [name: string]: unknown;
           };
-          content?: never;
+          content: {
+            'application/json': components['schemas']['ErrorResponse'];
+          };
         };
-        /** @description Unauthorized */
-        401: {
+        /** @description Not found */
+        404: {
           headers: {
             [name: string]: unknown;
           };
@@ -10572,6 +10674,7 @@ interface paths {
         };
       };
     };
+    delete?: never;
     options?: never;
     head?: never;
     patch?: never;
@@ -11834,14 +11937,19 @@ interface components {
         role: string;
         joinedAt: string;
       }[];
-      apiTokens: {
+      tokens: {
         id: string;
         name: string;
+        /** @example automation */
+        kind: string;
+        /** @example read write */
+        scope: string;
+        /** @example api mcp */
+        audience: string;
         projectId: string | null;
-        origin: string;
         createdAt: string;
         lastUsedAt: string | null;
-        expiresAt: string | null;
+        expiresAt: string;
         revokedAt: string | null;
       }[];
       sessions: {
@@ -11850,14 +11958,6 @@ interface components {
         expiresAt: string;
         lastTouchedAt: string;
       }[];
-      mcpTokens: {
-        id: string;
-        name: string;
-        createdAt: string;
-        lastUsedAt: string | null;
-        expiresAt: string;
-        revokedAt: string | null;
-      }[];
       mcpSessions: {
         id: string;
         projectId: string | null;
@@ -11891,19 +11991,27 @@ interface components {
         cancelledAt: string | null;
       }[];
     };
-    ApiTokenSummary: {
+    AutomationTokenSummary: {
       /** @example tok_a1b2c3d4 */
       id: string;
       /** @example CI Pipeline */
       name: string;
-      /** @example sk-walkeros-abcd */
-      prefix: string;
-      /** @example manual */
-      origin: string;
-      /** @example null */
-      projectId: string | null;
-      /** @example null */
-      scopes: string[] | null;
+      /** @example wos_pat_a1b2 */
+      tokenPrefix: string;
+      /**
+       * @example [
+       *       "read",
+       *       "write"
+       *     ]
+       */
+      scope: string[];
+      /**
+       * @example [
+       *       "api",
+       *       "mcp"
+       *     ]
+       */
+      audience: string[];
       /**
        * Format: date-time
        * @example 2026-01-26T14:30:00.000Z
@@ -11918,7 +12026,7 @@ interface components {
        * Format: date-time
        * @example 2026-01-26T14:30:00.000Z
        */
-      expiresAt: string | null;
+      expiresAt: string;
       /**
        * Format: date-time
        * @example 2026-01-26T14:30:00.000Z
@@ -12944,6 +13052,89 @@ interface components {
       };
       head: components['schemas']['Frame'];
     };
+    CanvasDocument: {
+      /** @enum {number} */
+      v: 1;
+      nodes: components['schemas']['CanvasNodeEntry'][];
+      edges: components['schemas']['CanvasEdgeEntry'][];
+      hidden: string[];
+    };
+    CanvasNodeEntry: {
+      kind: string;
+      ref: string;
+      position: components['schemas']['CanvasPoint'];
+      parent?: string;
+      size?: {
+        width: number;
+        height: number;
+      };
+      label?: string;
+    };
+    CanvasPoint: {
+      x: number;
+      y: number;
+    };
+    CanvasEdgeEntry: {
+      id: string;
+      /** @enum {string} */
+      kind: 'navigation';
+      from: string;
+      to: string;
+      label?: string;
+    };
+    Canvas: {
+      /** @example cnv_V1StGXR8Z5jdHi6BmyT7K */
+      id: string;
+      projectId: string;
+      name: string;
+      document: components['schemas']['CanvasDocument'];
+      version: number;
+      /**
+       * Format: date-time
+       * @example 2026-01-26T14:30:00.000Z
+       */
+      createdAt: string;
+      /**
+       * Format: date-time
+       * @example 2026-01-26T14:30:00.000Z
+       */
+      updatedAt: string;
+      createdBy: string;
+      updatedBy: string;
+    };
+    CanvasLean: {
+      /** @example cnv_V1StGXR8Z5jdHi6BmyT7K */
+      id: string;
+      projectId: string;
+      name: string;
+      version: number;
+      /**
+       * Format: date-time
+       * @example 2026-01-26T14:30:00.000Z
+       */
+      createdAt: string;
+      /**
+       * Format: date-time
+       * @example 2026-01-26T14:30:00.000Z
+       */
+      updatedAt: string;
+      createdBy: string;
+      updatedBy: string;
+    };
+    CanvasListResponse: {
+      canvases: components['schemas']['CanvasLean'][];
+    };
+    PutCanvasResponse: {
+      version: number;
+    };
+    CanvasConflictResponse: {
+      error: {
+        /** @enum {string} */
+        code: 'CANVAS_VERSION_CONFLICT';
+        message: string;
+      };
+      head: components['schemas']['Canvas'];
+    };
     SummarizeReleaseResponse: {
       /** @enum {string} */
       mode: 'draft' | 'check';
@@ -13773,33 +13964,6 @@ interface components {
       /** @enum {boolean} */
       ok: true;
     };
-    CreateMcpTokenRequest: {
-      name: string;
-      ttlSeconds?: number;
-    };
-    CreateMcpTokenResponse: {
-      id: string;
-      name: string;
-      token: string;
-      /** Format: date-time */
-      createdAt: string;
-      /** Format: date-time */
-      expiresAt: string;
-    };
-    ListMcpTokensResponse: {
-      tokens: components['schemas']['McpTokenSummary'][];
-    };
-    McpTokenSummary: {
-      id: string;
-      name: string;
-      audience: string;
-      /** Format: date-time */
-      createdAt: string;
-      /** Format: date-time */
-      lastUsedAt: string | null;
-      /** Format: date-time */
-      expiresAt: string;
-    };
     PackageCatalogResponse: {
       catalog: components['schemas']['PackageCatalogEntry'][];
       count: number;
@@ -13904,27 +14068,6 @@ interface components {
         isCurrent: boolean;
       }[];
     };
-    DeviceCodeResponse: {
-      deviceCode: string;
-      userCode: string;
-      expiresIn: number;
-      interval: number;
-    };
-    ApproveDeviceResponse: {
-      success: boolean;
-    };
-    ApproveDeviceRequest: {
-      userCode: string;
-    };
-    DeviceTokenResponse: {
-      token: string;
-      email: string;
-      userId: string;
-    };
-    DeviceTokenRequest: {
-      deviceCode: string;
-      hostname?: string;
-    };
     ListProjectsResponse: {
       projects: components['schemas']['Project'][];
       total: number;
@@ -14077,18 +14220,32 @@ interface components {
       /** @enum {string} */
       createdBy: 'user' | 'auto_save' | 'restore' | 'deploy' | 'preview';
     };
-    ListApiTokensResponse: {
-      tokens: components['schemas']['ApiTokenSummary'][];
+    ListAutomationTokensResponse: {
+      tokens: components['schemas']['AutomationTokenSummary'][];
     };
-    CreateApiTokenResponse: {
+    CreateAutomationTokenResponse: {
       /** @example tok_a1b2c3d4 */
       id: string;
       /** @example CI Pipeline */
       name: string;
-      /** @example sk-walkeros-abcd1234... */
+      /** @example wos_pat_a1b2c3d4... */
       token: string;
-      /** @example sk-walkeros-abcd */
-      prefix: string;
+      /** @example wos_pat_a1b2 */
+      tokenPrefix: string;
+      /**
+       * @example [
+       *       "read",
+       *       "write"
+       *     ]
+       */
+      scope: string[];
+      /**
+       * @example [
+       *       "api",
+       *       "mcp"
+       *     ]
+       */
+      audience: string[];
       /**
        * Format: date-time
        * @example 2026-01-26T14:30:00.000Z
@@ -14098,15 +14255,18 @@ interface components {
        * Format: date-time
        * @example 2026-01-26T14:30:00.000Z
        */
-      expiresAt: string | null;
-      /** @example null */
-      projectId: string | null;
+      expiresAt: string;
     };
-    CreateApiTokenRequest: {
+    CreateAutomationTokenRequest: {
       /** @example CI Pipeline */
       name: string;
+      /**
+       * @example read write
+       * @enum {string}
+       */
+      scope: 'read' | 'read write';
       /** @example 90 */
-      expiresInDays?: number | null;
+      expiresInDays: 30 | 90 | 180 | 365;
     };
     BundleResponse: {
       bundleId: string;
@@ -15006,8 +15166,16 @@ interface HealthResult {
  * rejects without a credential) and defensively parses the JSON body. Resolves `{ reachable: false }`
  * only on a real network/timeout failure; a non-2xx status still counts as
  * reachable.
+ *
+ * `baseUrl` names the app to probe, without a trailing slash. Omitted, it
+ * falls back to `resolveAppUrl()`, the local machine's chain
+ * (`WALKEROS_APP_URL`, then the CLI config file, then the built-in default),
+ * which is what every `walkeros` binary invocation wants. A caller that is
+ * NOT the local CLI has to pass its own: an in-process host has no CLI config
+ * to read, so the fallback would silently probe a different backend than the
+ * one that caller talks to.
  */
-declare function fetchHealth(): Promise<HealthResult>;
+declare function fetchHealth(baseUrl?: string): Promise<HealthResult>;
 type ContractVerdict = 'in-sync' | 'client-older' | 'client-newer' | 'unknown';
 interface ContractComparison {
     verdict: ContractVerdict;
@@ -15018,9 +15186,15 @@ interface ContractComparison {
 interface CompareContractInput {
     bakedVersion?: string;
     bakedHash?: string;
+    /**
+     * The app to probe, without a trailing slash. Omitted, the probe resolves
+     * the local machine's app URL; see {@link fetchHealth}.
+     */
+    baseUrl?: string;
 }
 /**
  * Compare the client's baked contract against the live app's `/api/health`.
+ * The app is `input.baseUrl` when given, otherwise the locally resolved one.
  *
  * - unreachable / missing `contractVersion`+`contractHash` → `unknown`
  * - baked hash == live hash → `in-sync`
@@ -15260,7 +15434,13 @@ interface SetReleaseRationaleOptions {
     projectId?: string;
     flowId: string;
     versionId: string;
-    text: string;
+    /**
+     * The rationale to store. `null` CLEARS the one already there: `humanText`
+     * is the only field a client may write, and null is how the route says
+     * "remove it". Without it there would be no way back from a rationale
+     * written by mistake.
+     */
+    text: string | null;
 }
 declare function setReleaseRationale(options: SetReleaseRationaleOptions): Promise<VersionAnnotation>;
 type ThreadAnchorType = 'step' | 'entity_action' | 'release' | 'contract' | 'tag';
@@ -15353,7 +15533,7 @@ interface WalkerOSConfig {
     /**
      * Static bearer written by the pre-OAuth CLI. Honored until it expires, and
      * the first use in a process prints a one-line notice naming
-     * `walkeros login`, which replaces it with a refreshable session.
+     * `walkeros auth login`, which replaces it with a refreshable session.
      */
     token?: string;
     /** Short-lived bearer from the device authorization grant. */
@@ -15399,7 +15579,7 @@ declare function writeConfig(config: WalkerOSConfig): void;
  * Remove every credential field, keeping the rest of the config.
  *
  * Used when the stored session is known to be dead, so the next command can
- * say "run `walkeros login`" instead of failing against the API.
+ * say "run `walkeros auth login`" instead of failing against the API.
  */
 declare function clearAuthFields(): void;
 /**