@walkeros/cli 4.6.1 → 4.7.0-next-1790245733116

package/dist/index.d.ts

@@ -1,7 +1,8 @@
 import { Flow, PreviewKey, Elb, Ingest, WalkerOS, Simulation, ObserveWeb } from '@walkeros/core';
 export { Flow } from '@walkeros/core';
 import { BuildOptions as BuildOptions$1 } from 'esbuild';
-import { z } from '@walkeros/core/dev';
+import { z, ValidationType, ValidateResult } from '@walkeros/core/dev';
+export { ValidateResult, ValidationError, ValidationType, ValidationWarning, validateFlowStructure } from '@walkeros/core/dev';
 import * as openapi_fetch from 'openapi-fetch';
 
 /**
@@ -282,6 +283,7 @@ declare function bundleCommand(options: BundleCommandOptions): Promise<void>;
  * @param options.stats - Collect and return bundle statistics (default: false)
  * @param options.cache - Enable package caching (default: true)
  * @param options.flowName - Flow to use (required for multi-flow configs)
+ * @param options.buildEnv - Base env for web `$env` (default `process.env`)
  * @returns Bundle statistics if stats option is true, otherwise void
  *
  * @example
@@ -321,6 +323,13 @@ declare function bundle(configOrPath: unknown, options?: {
      */
     target?: BundleTarget;
     buildOverrides?: Partial<BuildOptions>;
+    /**
+     * Base environment web `$env` references resolve against, beneath the
+     * flow's declared `config.bundle.env`. Omitted, it is `process.env` (a
+     * local build). Pass `{}` for a hosted build, which then resolves against
+     * the declared values alone and never the building process's own env.
+     */
+    buildEnv?: Record<string, string | undefined>;
 }): Promise<BundleStats | void>;
 
 /**
@@ -551,16 +560,19 @@ interface SimulateTransformerOptions extends SimulateDataOptions {
  *
  * Takes a DeepPartialEvent, validates it with Zod, loads the flow config,
  * bundles it, starts the flow to get initialized transformers, then runs
- * the event through the target transformer (with optional before chain).
+ * the event from the target transformer on, exactly as the runtime does
+ * (`runTransformerSimulation`).
  *
- * Captured array: first entry = input event, subsequent entries = output event(s).
- * If the transformer drops the event (returns false), output event is null.
+ * Captured array: one entry per finished copy. When the event was dropped
+ * or stopped, a single `null` entry.
  */
 declare function simulateTransformer(configOrPath: string | Flow.Json, event: WalkerOS.DeepPartialEvent, options: SimulateTransformerOptions): Promise<Simulation.Result>;
 interface SimulateCollectorOptions extends SimulateDataOptions {
     collectorName: string;
     bundlePath?: string;
     flow?: string;
+    /** `collector.next.TRANSFORMER=VALUE` mocks for the collector's chain. */
+    mock?: string[];
     silent?: boolean;
     verbose?: boolean;
     snapshot?: string;
@@ -572,12 +584,14 @@ interface SimulateCollectorOptions extends SimulateDataOptions {
     };
 }
 /**
- * Self-contained collector enrichment simulation.
+ * Self-contained collector simulation.
  *
  * Takes a post-next `DeepPartialEvent` and an optional collector-state
- * snapshot, then returns the fully enriched event the runtime produces between
- * the pre-collector `next` chain and the post-collector `before` chain. Reuses
- * the runtime's own enrichment (`enrichEvent`); it does not reimplement it.
+ * snapshot, then returns what the runtime hands to the destination fan-out:
+ * the enriched event after the collector's own chain (`collector.next`), one
+ * entry per finished copy, or a single `null` entry when the chain dropped
+ * the event. Runs `runCollectorSimulation`; it does not reimplement the
+ * enrichment or the chain.
  */
 declare function simulateCollector(configOrPath: string | Flow.Json, event: WalkerOS.DeepPartialEvent, options: SimulateCollectorOptions): Promise<Simulation.Result>;
 interface SimulateDestinationOptions extends SimulateDataOptions {
@@ -600,87 +614,6 @@ interface SimulateDestinationOptions extends SimulateDataOptions {
  */
 declare function simulateDestination(configOrPath: string | Flow.Json, event: WalkerOS.DeepPartialEvent, options: SimulateDestinationOptions): Promise<Simulation.Result>;
 
-/**
- * Run Command Types
- *
- * Types for running walkerOS flows via CLI or Docker.
- */
-/**
- * CLI command options for `walkeros run`
- */
-interface RunCommandOptions {
-    /** Flow configuration file path (.json or pre-built .mjs) */
-    config?: string;
-    /** Server port (overrides flow config) */
-    port?: number;
-    /** Flow name for multi-flow configs */
-    flow?: string;
-    /** API flow ID (enables heartbeat, polling, secrets) */
-    flowId?: string;
-    /** Deployment ID (for heartbeat tracking) */
-    deploymentId?: string;
-    /** Project ID */
-    project?: string;
-    /** Opt-in dotenv file to load into process.env before config resolution */
-    envFile?: string;
-    /** Enable JSON output */
-    json?: boolean;
-    /** Verbose logging */
-    verbose?: boolean;
-    /** Suppress output */
-    silent?: boolean;
-}
-/**
- * Programmatic run options
- */
-interface RunOptions {
-    /** Flow configuration file path (.json or pre-built .mjs) */
-    config?: string;
-    /** Server port */
-    port?: number;
-    /** Flow name for multi-flow configs */
-    flow?: string;
-    /** API flow ID (enables heartbeat, polling, secrets) */
-    flowId?: string;
-    /** Project ID */
-    project?: string;
-    /** Verbose logging */
-    verbose?: boolean;
-    /** Suppress output */
-    silent?: boolean;
-}
-/**
- * Result from running a flow
- */
-interface RunResult {
-    /** Whether the flow ran successfully */
-    success: boolean;
-    /** Exit code */
-    exitCode: number;
-    /** Error message if failed */
-    error?: string;
-    /** Execution duration in milliseconds */
-    duration: number;
-}
-
-/**
- * Run Command
- *
- * Unified entry point for running walkerOS flows.
- * Used by both `walkeros run` (CLI) and Docker containers.
- */
-
-/**
- * CLI command function for `walkeros run`
- */
-declare function runCommand(options: RunCommandOptions): Promise<void>;
-/**
- * Programmatic run function
- */
-declare function run(options: RunOptions): Promise<RunResult>;
-
-type ValidationType = 'contract' | 'event' | 'flow' | 'mapping';
-type ValidateResultType = ValidationType | 'entry';
 interface ValidateCommandOptions {
     type: ValidationType;
     input?: string;
@@ -692,25 +625,6 @@ interface ValidateCommandOptions {
     strict?: boolean;
     silent?: boolean;
 }
-interface ValidationError {
-    path: string;
-    message: string;
-    value?: unknown;
-    code?: string;
-}
-interface ValidationWarning {
-    path: string;
-    message: string;
-    suggestion?: string;
-    code?: string;
-}
-interface ValidateResult {
-    valid: boolean;
-    type: ValidateResultType;
-    errors: ValidationError[];
-    warnings: ValidationWarning[];
-    details: Record<string, unknown>;
-}
 
 /**
  * Programmatic API for validation.
@@ -5005,15 +4919,15 @@ interface paths {
     put?: never;
     /**
      * Bundle flow
-     * @description Bundle a flow using CLI. Returns bundleId (content-hash). Use ?output=download to redirect to presigned S3 URL.
+     * @description Bundle a flow for deploy or download. Requires ?output=download: bearer callers get a 302 to a presigned S3 URL, session callers get the bundle bytes streamed. A POST without output=download returns 400.
      */
     post: {
       parameters: {
-        query?: {
+        query: {
           /** @description Named flow to bundle (required for multi-settings flows) */
           flow?: string;
-          /** @description Set to "download" to redirect to the bundle file */
-          output?: 'download';
+          /** @description Required. Must be "download" */
+          output: 'download';
         };
         header?: never;
         path: {
@@ -5024,33 +4938,22 @@ interface paths {
       };
       requestBody?: never;
       responses: {
-        /** @description Bundle result */
+        /** @description Bundle file streamed (session callers) */
         200: {
           headers: {
             [name: string]: unknown;
           };
-          content: {
-            'application/json': components['schemas']['BundleResponse'];
-          };
+          content?: never;
         };
-        /** @description Redirect to presigned bundle URL (when output=download) */
+        /** @description Redirect to presigned bundle URL (bearer callers) */
         302: {
           headers: {
             [name: string]: unknown;
           };
           content?: never;
         };
-        /** @description Unauthorized */
-        401: {
-          headers: {
-            [name: string]: unknown;
-          };
-          content: {
-            'application/json': components['schemas']['ErrorResponse'];
-          };
-        };
-        /** @description Not found */
-        404: {
+        /** @description Validation error */
+        400: {
           headers: {
             [name: string]: unknown;
           };
@@ -5058,52 +4961,6 @@ interface paths {
             'application/json': components['schemas']['ErrorResponse'];
           };
         };
-      };
-    };
-    delete?: never;
-    options?: never;
-    head?: never;
-    patch?: never;
-    trace?: never;
-  };
-  '/api/projects/{projectId}/flows/{flowId}/simulate': {
-    parameters: {
-      query?: never;
-      header?: never;
-      path?: never;
-      cookie?: never;
-    };
-    get?: never;
-    put?: never;
-    /**
-     * Simulate a flow step
-     * @description Execute a simulation against a pre-built bundle. Requires bundleId from the bundle endpoint.
-     */
-    post: {
-      parameters: {
-        query?: never;
-        header?: never;
-        path: {
-          projectId: string;
-          flowId: string;
-        };
-        cookie?: never;
-      };
-      requestBody?: {
-        content: {
-          'application/json': components['schemas']['SimulateRequest'];
-        };
-      };
-      responses: {
-        /** @description Simulation result */
-        200: {
-          headers: {
-            [name: string]: unknown;
-          };
-          content: {
-            'application/json': components['schemas']['SimulateResponse'];
-          };
-        };
         /** @description Unauthorized */
         401: {
           headers: {
@@ -5122,7 +4979,7 @@ interface paths {
             'application/json': components['schemas']['ErrorResponse'];
           };
         };
-        /** @description Simulation container error */
+        /** @description Bundle upstream unavailable */
         502: {
           headers: {
             [name: string]: unknown;
@@ -14268,37 +14125,6 @@ interface components {
       /** @example 90 */
       expiresInDays: 30 | 90 | 180 | 365;
     };
-    BundleResponse: {
-      bundleId: string;
-      cached: boolean;
-    };
-    SimulateResponse: {
-      success: boolean;
-      result?: {
-        /** @enum {string} */
-        step: 'source' | 'transformer' | 'destination';
-        name: string;
-        events: {
-          [key: string]: unknown;
-        }[];
-        calls: {
-          fn: string;
-          args: unknown[];
-          ts: number;
-        }[];
-        duration: number;
-      };
-    };
-    SimulateRequest: {
-      bundleId: string;
-      config: {
-        [key: string]: unknown;
-      };
-      event: {
-        [key: string]: unknown;
-      };
-      step: string;
-    };
     RegisterRuntimeRequest: {
       flowId: string;
       bundlePath: string;
@@ -15026,26 +14852,6 @@ declare function classifyStepProperties(step: Record<string, unknown>): {
     dataProps: Record<string, unknown>;
 };
 
-/**
- * Pure structural validation of a flow config — the exact checks the bundler
- * runs at codegen time, BEFORE any esbuild compile or package/archive fetch.
- *
- * Runs synchronously and never touches the network, the filesystem, or
- * esbuild. Aggregates every structural problem instead of throwing on the
- * first one, so a single call surfaces all issues in a config.
- *
- * Checks performed per flow:
- * - component names are valid JavaScript identifiers (they become generated
- *   property names),
- * - each source/destination/store reference specifies exactly one of
- *   package or code, and each transformer entry is a closed, valid shape,
- * - every `$store.` reference points at a defined store.
- *
- * Intended for fast deploy preflight: catch a bad flow config in well under a
- * second without spinning up a container or compiling anything.
- */
-declare function validateFlowStructure(flowConfig: Flow.Json): ValidateResult;
-
 /**
  * Publish-time wrap step.
  *
@@ -15117,6 +14923,366 @@ interface WrapSkeletonOptions {
 }
 declare function wrapSkeleton(options: WrapSkeletonOptions): Promise<void>;
 
+/**
+ * Build Manifest Schemas
+ *
+ * The contract of `walkeros bundle --manifest`: a build orchestrator writes a
+ * manifest, the CLI builds every requested artifact, PUTs each output to its
+ * own URL, then PUTs a structured result to `resultPutUrl`. Any orchestrator
+ * can drive it (a CI job, a hosted build job, a self-hoster's script); nothing
+ * in it is specific to one.
+ *
+ * Evolution rule: unknown TOP-LEVEL keys are tolerated and ignored, so an
+ * orchestrator can add a field for its own bookkeeping without a CLI release.
+ * A field the CLI must ACT on needs a CLI release, and `toolchain` makes the
+ * CLI refuse a manifest written for a different version rather than silently
+ * ignoring what it does not understand. Artifact entries and wrap options are
+ * strict for the same reason: an ignored option there would change the bytes.
+ *
+ * Build env: web `$env.NAME` resolves against `buildEnv` with the flow's
+ * `config.bundle.env` on top (declared wins), never against the CLI process's
+ * own environment. `config.bundle.env` values are taken as literals: a
+ * reference inside one (`"$env.X"`) is not resolved at build time and must
+ * not be relied on. A `$flow.<sibling>` reference resolves against the ENTRY
+ * flow's declared env, never the sibling's own `config.bundle.env`, so a
+ * value the sibling declares for itself is `MISSING_BUILD_ENV` here.
+ *
+ * Local paths: a manifest build refuses every config-chosen filesystem input
+ * (local step packages, `bundle.packages.<name>.path`, `bundle.traceInclude`,
+ * `include`) with `LOCAL_PATH_NOT_ALLOWED`, before anything is fetched.
+ */
+
+/** Current manifest format version. */
+declare const BUILD_MANIFEST_VERSION = 1;
+declare const BuildBundleArtifactSchema: z.ZodObject<{
+    outputName: z.ZodString;
+    putUrl: z.ZodURL;
+    contentType: z.ZodOptional<z.ZodString>;
+    headers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    target: z.ZodEnum<{
+        runner: "runner";
+        push: "push";
+        cdn: "cdn";
+        "cdn-skeleton": "cdn-skeleton";
+        simulate: "simulate";
+    }>;
+}, z.core.$strict>;
+declare const BuildWrapOptionsSchema: z.ZodObject<{
+    windowCollector: z.ZodOptional<z.ZodString>;
+    windowElb: z.ZodOptional<z.ZodString>;
+    preview: z.ZodOptional<z.ZodObject<{
+        enabled: z.ZodBoolean;
+        keyring: z.ZodArray<z.ZodObject<{
+            kid: z.ZodString;
+            spki: z.ZodString;
+        }, z.core.$strict>>;
+        iss: z.ZodString;
+        pb: z.ZodOptional<z.ZodString>;
+        acceptForeign: z.ZodOptional<z.ZodBoolean>;
+        demoAllowlist: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        previewOrigin: z.ZodString;
+    }, z.core.$strict>>;
+    previewGrantTargets: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    observe: z.ZodOptional<z.ZodObject<{
+        url: z.ZodString;
+        binding: z.ZodString;
+        flowId: z.ZodOptional<z.ZodString>;
+        level: z.ZodOptional<z.ZodEnum<{
+            standard: "standard";
+            trace: "trace";
+            off: "off";
+        }>>;
+        sample: z.ZodOptional<z.ZodNumber>;
+    }, z.core.$strict>>;
+    minify: z.ZodOptional<z.ZodBoolean>;
+    minifyOptions: z.ZodOptional<z.ZodObject<{
+        identifiers: z.ZodOptional<z.ZodBoolean>;
+        syntax: z.ZodOptional<z.ZodBoolean>;
+        whitespace: z.ZodOptional<z.ZodBoolean>;
+        keepNames: z.ZodOptional<z.ZodBoolean>;
+        legalComments: z.ZodOptional<z.ZodEnum<{
+            external: "external";
+            none: "none";
+            inline: "inline";
+            eof: "eof";
+            linked: "linked";
+        }>>;
+    }, z.core.$strict>>;
+    target: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>;
+declare const BuildWrapArtifactSchema: z.ZodObject<{
+    outputName: z.ZodString;
+    putUrl: z.ZodURL;
+    contentType: z.ZodOptional<z.ZodString>;
+    headers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    target: z.ZodLiteral<"wrap">;
+    platform: z.ZodEnum<{
+        browser: "browser";
+        node: "node";
+    }>;
+    skeleton: z.ZodUnion<readonly [z.ZodObject<{
+        url: z.ZodURL;
+    }, z.core.$strict>, z.ZodObject<{
+        artifact: z.ZodString;
+    }, z.core.$strict>]>;
+    options: z.ZodOptional<z.ZodObject<{
+        windowCollector: z.ZodOptional<z.ZodString>;
+        windowElb: z.ZodOptional<z.ZodString>;
+        preview: z.ZodOptional<z.ZodObject<{
+            enabled: z.ZodBoolean;
+            keyring: z.ZodArray<z.ZodObject<{
+                kid: z.ZodString;
+                spki: z.ZodString;
+            }, z.core.$strict>>;
+            iss: z.ZodString;
+            pb: z.ZodOptional<z.ZodString>;
+            acceptForeign: z.ZodOptional<z.ZodBoolean>;
+            demoAllowlist: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            previewOrigin: z.ZodString;
+        }, z.core.$strict>>;
+        previewGrantTargets: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        observe: z.ZodOptional<z.ZodObject<{
+            url: z.ZodString;
+            binding: z.ZodString;
+            flowId: z.ZodOptional<z.ZodString>;
+            level: z.ZodOptional<z.ZodEnum<{
+                standard: "standard";
+                trace: "trace";
+                off: "off";
+            }>>;
+            sample: z.ZodOptional<z.ZodNumber>;
+        }, z.core.$strict>>;
+        minify: z.ZodOptional<z.ZodBoolean>;
+        minifyOptions: z.ZodOptional<z.ZodObject<{
+            identifiers: z.ZodOptional<z.ZodBoolean>;
+            syntax: z.ZodOptional<z.ZodBoolean>;
+            whitespace: z.ZodOptional<z.ZodBoolean>;
+            keepNames: z.ZodOptional<z.ZodBoolean>;
+            legalComments: z.ZodOptional<z.ZodEnum<{
+                external: "external";
+                none: "none";
+                inline: "inline";
+                eof: "eof";
+                linked: "linked";
+            }>>;
+        }, z.core.$strict>>;
+        target: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+declare const BuildArtifactSchema: z.ZodUnion<readonly [z.ZodObject<{
+    outputName: z.ZodString;
+    putUrl: z.ZodURL;
+    contentType: z.ZodOptional<z.ZodString>;
+    headers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    target: z.ZodEnum<{
+        runner: "runner";
+        push: "push";
+        cdn: "cdn";
+        "cdn-skeleton": "cdn-skeleton";
+        simulate: "simulate";
+    }>;
+}, z.core.$strict>, z.ZodObject<{
+    outputName: z.ZodString;
+    putUrl: z.ZodURL;
+    contentType: z.ZodOptional<z.ZodString>;
+    headers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    target: z.ZodLiteral<"wrap">;
+    platform: z.ZodEnum<{
+        browser: "browser";
+        node: "node";
+    }>;
+    skeleton: z.ZodUnion<readonly [z.ZodObject<{
+        url: z.ZodURL;
+    }, z.core.$strict>, z.ZodObject<{
+        artifact: z.ZodString;
+    }, z.core.$strict>]>;
+    options: z.ZodOptional<z.ZodObject<{
+        windowCollector: z.ZodOptional<z.ZodString>;
+        windowElb: z.ZodOptional<z.ZodString>;
+        preview: z.ZodOptional<z.ZodObject<{
+            enabled: z.ZodBoolean;
+            keyring: z.ZodArray<z.ZodObject<{
+                kid: z.ZodString;
+                spki: z.ZodString;
+            }, z.core.$strict>>;
+            iss: z.ZodString;
+            pb: z.ZodOptional<z.ZodString>;
+            acceptForeign: z.ZodOptional<z.ZodBoolean>;
+            demoAllowlist: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            previewOrigin: z.ZodString;
+        }, z.core.$strict>>;
+        previewGrantTargets: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        observe: z.ZodOptional<z.ZodObject<{
+            url: z.ZodString;
+            binding: z.ZodString;
+            flowId: z.ZodOptional<z.ZodString>;
+            level: z.ZodOptional<z.ZodEnum<{
+                standard: "standard";
+                trace: "trace";
+                off: "off";
+            }>>;
+            sample: z.ZodOptional<z.ZodNumber>;
+        }, z.core.$strict>>;
+        minify: z.ZodOptional<z.ZodBoolean>;
+        minifyOptions: z.ZodOptional<z.ZodObject<{
+            identifiers: z.ZodOptional<z.ZodBoolean>;
+            syntax: z.ZodOptional<z.ZodBoolean>;
+            whitespace: z.ZodOptional<z.ZodBoolean>;
+            keepNames: z.ZodOptional<z.ZodBoolean>;
+            legalComments: z.ZodOptional<z.ZodEnum<{
+                external: "external";
+                none: "none";
+                inline: "inline";
+                eof: "eof";
+                linked: "linked";
+            }>>;
+        }, z.core.$strict>>;
+        target: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>>;
+}, z.core.$strict>]>;
+declare const BuildManifestSchema: z.ZodObject<{
+    version: z.ZodLiteral<1>;
+    toolchain: z.ZodString;
+    flowConfig: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    flowName: z.ZodOptional<z.ZodString>;
+    buildEnv: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    artifacts: z.ZodArray<z.ZodUnion<readonly [z.ZodObject<{
+        outputName: z.ZodString;
+        putUrl: z.ZodURL;
+        contentType: z.ZodOptional<z.ZodString>;
+        headers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+        target: z.ZodEnum<{
+            runner: "runner";
+            push: "push";
+            cdn: "cdn";
+            "cdn-skeleton": "cdn-skeleton";
+            simulate: "simulate";
+        }>;
+    }, z.core.$strict>, z.ZodObject<{
+        outputName: z.ZodString;
+        putUrl: z.ZodURL;
+        contentType: z.ZodOptional<z.ZodString>;
+        headers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+        target: z.ZodLiteral<"wrap">;
+        platform: z.ZodEnum<{
+            browser: "browser";
+            node: "node";
+        }>;
+        skeleton: z.ZodUnion<readonly [z.ZodObject<{
+            url: z.ZodURL;
+        }, z.core.$strict>, z.ZodObject<{
+            artifact: z.ZodString;
+        }, z.core.$strict>]>;
+        options: z.ZodOptional<z.ZodObject<{
+            windowCollector: z.ZodOptional<z.ZodString>;
+            windowElb: z.ZodOptional<z.ZodString>;
+            preview: z.ZodOptional<z.ZodObject<{
+                enabled: z.ZodBoolean;
+                keyring: z.ZodArray<z.ZodObject<{
+                    kid: z.ZodString;
+                    spki: z.ZodString;
+                }, z.core.$strict>>;
+                iss: z.ZodString;
+                pb: z.ZodOptional<z.ZodString>;
+                acceptForeign: z.ZodOptional<z.ZodBoolean>;
+                demoAllowlist: z.ZodOptional<z.ZodArray<z.ZodString>>;
+                previewOrigin: z.ZodString;
+            }, z.core.$strict>>;
+            previewGrantTargets: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            observe: z.ZodOptional<z.ZodObject<{
+                url: z.ZodString;
+                binding: z.ZodString;
+                flowId: z.ZodOptional<z.ZodString>;
+                level: z.ZodOptional<z.ZodEnum<{
+                    standard: "standard";
+                    trace: "trace";
+                    off: "off";
+                }>>;
+                sample: z.ZodOptional<z.ZodNumber>;
+            }, z.core.$strict>>;
+            minify: z.ZodOptional<z.ZodBoolean>;
+            minifyOptions: z.ZodOptional<z.ZodObject<{
+                identifiers: z.ZodOptional<z.ZodBoolean>;
+                syntax: z.ZodOptional<z.ZodBoolean>;
+                whitespace: z.ZodOptional<z.ZodBoolean>;
+                keepNames: z.ZodOptional<z.ZodBoolean>;
+                legalComments: z.ZodOptional<z.ZodEnum<{
+                    external: "external";
+                    none: "none";
+                    inline: "inline";
+                    eof: "eof";
+                    linked: "linked";
+                }>>;
+            }, z.core.$strict>>;
+            target: z.ZodOptional<z.ZodString>;
+        }, z.core.$strict>>;
+    }, z.core.$strict>]>>;
+    resultPutUrl: z.ZodURL;
+}, z.core.$loose>;
+type BuildManifest = z.infer<typeof BuildManifestSchema>;
+type BuildArtifact = z.infer<typeof BuildArtifactSchema>;
+type BuildWrapOptions = z.infer<typeof BuildWrapOptionsSchema>;
+/**
+ * Error codes a result can carry. User-config codes first, then build and
+ * infrastructure codes.
+ */
+declare const BUILD_ERROR_CODES: readonly ["INVALID_MANIFEST", "TOOLCHAIN_MISMATCH", "INVALID_CONFIG", "MISSING_BUILD_ENV", "WEB_SECRET_REF", "UNSUPPORTED_PACKAGE_SPEC", "LOCAL_PATH_NOT_ALLOWED", "BUILD_FAILED", "UPLOAD_FAILED"];
+type BuildErrorCode = (typeof BUILD_ERROR_CODES)[number];
+declare const BuildResultSchema: z.ZodObject<{
+    ok: z.ZodBoolean;
+    toolchain: z.ZodString;
+    artifacts: z.ZodArray<z.ZodObject<{
+        target: z.ZodString;
+        outputName: z.ZodString;
+        bytes: z.ZodNumber;
+        sha256: z.ZodString;
+    }, z.core.$strip>>;
+    error: z.ZodOptional<z.ZodObject<{
+        code: z.ZodEnum<{
+            INVALID_MANIFEST: "INVALID_MANIFEST";
+            TOOLCHAIN_MISMATCH: "TOOLCHAIN_MISMATCH";
+            INVALID_CONFIG: "INVALID_CONFIG";
+            MISSING_BUILD_ENV: "MISSING_BUILD_ENV";
+            WEB_SECRET_REF: "WEB_SECRET_REF";
+            UNSUPPORTED_PACKAGE_SPEC: "UNSUPPORTED_PACKAGE_SPEC";
+            LOCAL_PATH_NOT_ALLOWED: "LOCAL_PATH_NOT_ALLOWED";
+            BUILD_FAILED: "BUILD_FAILED";
+            UPLOAD_FAILED: "UPLOAD_FAILED";
+        }>;
+        message: z.ZodString;
+        outputName: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+type BuildResult = z.infer<typeof BuildResultSchema>;
+
+/**
+ * `walkeros bundle --manifest <source>`: build from a manifest.
+ *
+ * Fetches a manifest (see `schemas/build-manifest.ts`), refuses it unless its
+ * `toolchain` is this CLI's exact version, builds each artifact in order,
+ * PUTs every output to its own URL, and finally PUTs a structured result to
+ * `resultPutUrl`. Web `$env` resolves against `manifest.buildEnv` plus the
+ * flow's `config.bundle.env`, never against this process's environment.
+ *
+ * Messages are written for the orchestrator to show a user, so they never
+ * carry a URL query string (presigned credentials live there).
+ */
+
+/** Env var a bare `--manifest` reads its source from. */
+declare const BUILD_MANIFEST_ENV = "BUILD_MANIFEST_URL";
+interface RunBuildManifestResult {
+    result: BuildResult;
+    /** False when the result could not be PUT (or the manifest was unreadable). */
+    reported: boolean;
+}
+/**
+ * Run a manifest build end to end. Never throws: every failure becomes a
+ * result, and `reported` says whether that result reached `resultPutUrl`.
+ */
+declare function runBuildManifest(source: string): Promise<RunBuildManifestResult>;
+/** Resolve the `--manifest` value, falling back to the env for a bare flag. */
+declare function resolveManifestSource(manifest: string | true, env?: Record<string, string | undefined>): string;
+
 interface DeviceAuthorization {
     deviceCode: string;
     userCode: string;
@@ -15684,41 +15850,6 @@ declare function loadConfig<T = unknown>(input: string, options?: {
  */
 declare function loadJsonConfig<T>(configPath: string): Promise<T>;
 
-type StepType = 'source' | 'transformer' | 'destination';
-interface ExampleLookupResult {
-    stepType: StepType;
-    stepName: string;
-    exampleName: string;
-    example: {
-        in?: unknown;
-        mapping?: unknown;
-        out?: unknown;
-    };
-}
-/**
- * Find a named example in a flow config.
- *
- * Searches sources, transformers, and destinations for a matching example.
- * If --step is provided (e.g. "destination.gtag"), looks only in that step.
- * If not, searches all steps and errors if ambiguous.
- *
- * @param config - Raw (unresolved) flow config with examples intact
- * @param exampleName - Name of the example to find
- * @param stepTarget - Optional step target in "type.name" format
- * @returns The found example with its location
- */
-declare function findExample(config: Flow, exampleName: string, stepTarget?: string): ExampleLookupResult;
-
-/**
- * Compare simulation output against expected example output.
- */
-declare function compareOutput(expected: unknown, actual: unknown): {
-    expected: unknown;
-    actual: unknown;
-    match: boolean;
-    diff?: string;
-};
-
 interface EmitterOptions {
     /** Caller supplies the v4 source verbatim (type, platform, etc). */
     source: WalkerOS.Source;
@@ -15872,4 +16003,4 @@ declare module '@walkeros/core' {
     }
 }
 
-export { type AddThreadMessageOptions, ApiError, type ApiErrorDetail, type BuildOptions, type BundleStats, type CLIBuildOptions, type ClientContext, type ClientType, type CompareContractInput, type CompleteDeviceLoginOptions, type ContractComparison, type ContractVerdict, type CreatePreviewOptions, type CreateSecretOptions, type CreateThreadOptions, type DeletePreviewOptions, type DeleteSecretOptions, type DeployOptions, DeploymentAmbiguityError, type DeploymentSummaryForFlow, type DeviceAuthorization, type DeviceLoginResult, type EndObserveSessionOptions, type ExampleLookupResult, type FeedbackOptions, type GetFrameOptions, type GetObserveSessionOptions, type GetPreviewOptions, type GetReleaseOptions, type GlobalOptions, type HealthResult, type ListDeploymentsOptions, type ListFlowsOptions, type ListFramesOptions, type ListJourneysOptions, type ListKnowledgeOptions, type ListPageFramesOptions, type ListPreviewsOptions, type ListProjectsOptions, type ListReleasesOptions, type ListSecretsOptions, type ListStepHistoryOptions, type ListThreadsOptions, type LoginOptions, type LoginResult, type MinifyOptions, type PrepareInput, type PreparedFlow, type ProjectFlows, type PushResult, type RegrantPreviewOptions, type ReleaseDetailResponse, type ReleaseDiffResponse, type ReleaseIndexResponse, type ReleaseRationaleSummary, type ReleaseRef, type RunCommandOptions, type RunOptions, type RunResult, type SSEEvent, type SSEParseResult, type SetReleaseRationaleOptions, type SimulateCollectorOptions, type SimulateDataOptions, type SimulateDestinationOptions, type SimulateSourceOptions, type SimulateTransformerOptions, type StartObserveSessionOptions, type ThreadAnchorType, type ThreadStatus, type UpdateSecretOptions, VERSION, type ValidateResult, type ValidationError, type ValidationType, type ValidationWarning, type WalkerOSConfig, type WrapSkeletonOptions, addThreadMessage, annotateErrorWithDrift, apiFetch, bakedContractHash, bakedContractVersion, buildDataPayload, bundle, bundleCommand, canonicalContractHash, classifyStepProperties, clearAuthFields, clientContextHeaders, compareContract, compareOutput, completeDeviceLogin, containsCodeMarkers, createApiClient, createDeployCommand, createDeployment, createDeploymentCommand, createFlow, createFlowCommand, createPreview, createProject, createProjectCommand, createSecret, createThread, credentialSource, deleteConfig, deleteDeployment, deleteDeploymentByFlowId, deleteDeploymentCommand, deleteFlow, deleteFlowCommand, deletePreview, deleteProject, deleteProjectCommand, deleteSecret, deploy, deployCommand, deployFetch, duplicateFlow, duplicateFlowCommand, endObserveSession, feedback, feedbackCommand, fetchHealth, findExample, getAuthHeaders, getClientContext, getDefaultProject, getDeployment, getDeploymentBySlug, getDeploymentBySlugCommand, getDeploymentCommand, getFeedbackPreference, getFlow, getFlowCommand, getFrame, getObserveSession, getPreview, getProject, getProjectCommand, getRelease, listAllFlows, listDeployments, listDeploymentsCommand, listFlows, listFlowsCommand, listFrames, listJourneys, listKnowledge, listPageFrames, listPreviews, listProjects, listProjectsCommand, listReleases, listSecrets, listStepHistory, listThreads, loadConfig, loadJsonConfig, login, loginCommand, logout, logoutCommand, mergeAuthHeaders, parseSSEEvents, publicFetch, push, pushCommand, readConfig, regrantPreview, requireProjectId, resetClientContext, resolveAccessToken, resolveAppUrl, resolveToken, run, runCommand, setClientContext, setDefaultProject, setFeedbackPreference, setReleaseRationale, simulateCollector, simulateDestination, simulateSource, simulateTransformer, startDeviceAuthorization, startObserveSession, index as telemetry, telemetryDisableCommand, telemetryEnableCommand, telemetryStatusCommand, throwApiError, updateFlow, updateFlowCommand, updateProject, updateProjectCommand, updateSecret, validate, validateCommand, validateFlowStructure, whoami, whoamiCommand, wrapSkeleton, writeConfig };
+export { type AddThreadMessageOptions, ApiError, type ApiErrorDetail, BUILD_ERROR_CODES, BUILD_MANIFEST_ENV, BUILD_MANIFEST_VERSION, type BuildArtifact, BuildArtifactSchema, BuildBundleArtifactSchema, type BuildErrorCode, type BuildManifest, BuildManifestSchema, type BuildOptions, type BuildResult, BuildResultSchema, BuildWrapArtifactSchema, type BuildWrapOptions, BuildWrapOptionsSchema, type BundleStats, type CLIBuildOptions, type ClientContext, type ClientType, type CompareContractInput, type CompleteDeviceLoginOptions, type ContractComparison, type ContractVerdict, type CreatePreviewOptions, type CreateSecretOptions, type CreateThreadOptions, type DeletePreviewOptions, type DeleteSecretOptions, type DeployOptions, DeploymentAmbiguityError, type DeploymentSummaryForFlow, type DeviceAuthorization, type DeviceLoginResult, type EndObserveSessionOptions, type FeedbackOptions, type GetFrameOptions, type GetObserveSessionOptions, type GetPreviewOptions, type GetReleaseOptions, type GlobalOptions, type HealthResult, type ListDeploymentsOptions, type ListFlowsOptions, type ListFramesOptions, type ListJourneysOptions, type ListKnowledgeOptions, type ListPageFramesOptions, type ListPreviewsOptions, type ListProjectsOptions, type ListReleasesOptions, type ListSecretsOptions, type ListStepHistoryOptions, type ListThreadsOptions, type LoginOptions, type LoginResult, type MinifyOptions, type PrepareInput, type PreparedFlow, type ProjectFlows, type PushResult, type RegrantPreviewOptions, type ReleaseDetailResponse, type ReleaseDiffResponse, type ReleaseIndexResponse, type ReleaseRationaleSummary, type ReleaseRef, type RunBuildManifestResult, type SSEEvent, type SSEParseResult, type SetReleaseRationaleOptions, type SimulateCollectorOptions, type SimulateDataOptions, type SimulateDestinationOptions, type SimulateSourceOptions, type SimulateTransformerOptions, type StartObserveSessionOptions, type ThreadAnchorType, type ThreadStatus, type UpdateSecretOptions, VERSION, type WalkerOSConfig, type WrapSkeletonOptions, addThreadMessage, annotateErrorWithDrift, apiFetch, bakedContractHash, bakedContractVersion, buildDataPayload, bundle, bundleCommand, canonicalContractHash, classifyStepProperties, clearAuthFields, clientContextHeaders, compareContract, completeDeviceLogin, containsCodeMarkers, createApiClient, createDeployCommand, createDeployment, createDeploymentCommand, createFlow, createFlowCommand, createPreview, createProject, createProjectCommand, createSecret, createThread, credentialSource, deleteConfig, deleteDeployment, deleteDeploymentByFlowId, deleteDeploymentCommand, deleteFlow, deleteFlowCommand, deletePreview, deleteProject, deleteProjectCommand, deleteSecret, deploy, deployCommand, deployFetch, duplicateFlow, duplicateFlowCommand, endObserveSession, feedback, feedbackCommand, fetchHealth, getAuthHeaders, getClientContext, getDefaultProject, getDeployment, getDeploymentBySlug, getDeploymentBySlugCommand, getDeploymentCommand, getFeedbackPreference, getFlow, getFlowCommand, getFrame, getObserveSession, getPreview, getProject, getProjectCommand, getRelease, listAllFlows, listDeployments, listDeploymentsCommand, listFlows, listFlowsCommand, listFrames, listJourneys, listKnowledge, listPageFrames, listPreviews, listProjects, listProjectsCommand, listReleases, listSecrets, listStepHistory, listThreads, loadConfig, loadJsonConfig, login, loginCommand, logout, logoutCommand, mergeAuthHeaders, parseSSEEvents, publicFetch, push, pushCommand, readConfig, regrantPreview, requireProjectId, resetClientContext, resolveAccessToken, resolveAppUrl, resolveManifestSource, resolveToken, runBuildManifest, setClientContext, setDefaultProject, setFeedbackPreference, setReleaseRationale, simulateCollector, simulateDestination, simulateSource, simulateTransformer, startDeviceAuthorization, startObserveSession, index as telemetry, telemetryDisableCommand, telemetryEnableCommand, telemetryStatusCommand, throwApiError, updateFlow, updateFlowCommand, updateProject, updateProjectCommand, updateSecret, validate, validateCommand, whoami, whoamiCommand, wrapSkeleton, writeConfig };