@walkeros/cli 4.7.0-next-1790722899482 → 4.7.0

package/dist/index.js

@@ -5,8 +5,8 @@ var __export = (target, all) => {
 };
 
 // src/commands/bundle/index.ts
-import path14 from "path";
-import fs15 from "fs-extra";
+import path15 from "path";
+import fs16 from "fs-extra";
 
 // src/core/cli-logger.ts
 import chalk from "chalk";
@@ -220,7 +220,7 @@ function isAlreadyLocked(error) {
   return hasCode(error) && error.code === "EEXIST";
 }
 function delay(ms) {
-  return new Promise((resolve3) => setTimeout(resolve3, ms));
+  return new Promise((resolve5) => setTimeout(resolve5, ms));
 }
 function breakIfStale(lockPath) {
   try {
@@ -553,18 +553,18 @@ function buildHeaders(token, headers) {
     ...mergeAuthHeaders(token, headers)
   };
 }
-async function apiFetch(path20, init) {
+async function apiFetch(path23, init) {
   const baseUrl = resolveAppUrl();
   const token = await resolveAccessToken();
   if (token) requireSecureUrl(baseUrl);
-  return fetch(`${baseUrl}${path20}`, {
+  return fetch(`${baseUrl}${path23}`, {
     ...init,
     headers: buildHeaders(token, init?.headers)
   });
 }
-async function publicFetch(path20, init) {
+async function publicFetch(path23, init) {
   const baseUrl = resolveAppUrl();
-  return fetch(`${baseUrl}${path20}`, {
+  return fetch(`${baseUrl}${path23}`, {
     ...init,
     headers: {
       ...clientContextHeaders(),
@@ -572,7 +572,7 @@ async function publicFetch(path20, init) {
     }
   });
 }
-async function deployFetch(path20, init) {
+async function deployFetch(path23, init) {
   const baseUrl = resolveAppUrl();
   const token = resolveDeployToken() ?? await resolveAccessToken();
   if (!token)
@@ -580,7 +580,7 @@ async function deployFetch(path20, init) {
       "No authentication token available. Set WALKEROS_DEPLOY_TOKEN or run walkeros auth login."
     );
   requireSecureUrl(baseUrl);
-  return fetch(`${baseUrl}${path20}`, {
+  return fetch(`${baseUrl}${path23}`, {
     ...init,
     headers: buildHeaders(token, init?.headers)
   });
@@ -1015,8 +1015,8 @@ function validateFlowConfig(data) {
     throw new Error("Invalid configuration: failed Flow.Json type guard.");
   }
   const errors = result.error.issues.map((issue) => {
-    const path20 = issue.path.length > 0 ? issue.path.map(String).join(".") : "root";
-    return `  - ${path20}: ${issue.message}`;
+    const path23 = issue.path.length > 0 ? issue.path.map(String).join(".") : "root";
+    return `  - ${path23}: ${issue.message}`;
   }).join("\n");
   throw new Error(`Invalid configuration:
 ${errors}`);
@@ -1055,9 +1055,86 @@ function getDefaultOutput(platform) {
 }
 
 // src/config/loader.ts
+import path8 from "path";
+import fs8 from "fs-extra";
+import { getFlowSettings, getPlatform } from "@walkeros/core";
+
+// src/core/content-digest.ts
+import { createHash } from "crypto";
 import path7 from "path";
 import fs7 from "fs-extra";
-import { getFlowSettings, getPlatform } from "@walkeros/core";
+var DIGEST_LENGTH = 12;
+function isRecord(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function canonicalJson(value) {
+  return JSON.stringify(value, (_key, inner) => {
+    if (!isRecord(inner)) return inner;
+    const sorted = {};
+    for (const key of Object.keys(inner).sort()) sorted[key] = inner[key];
+    return sorted;
+  });
+}
+function configDigest(flowSettings, flowName) {
+  const collector = {
+    ...flowSettings.collector ?? {}
+  };
+  delete collector.release;
+  collector.name ??= flowName;
+  const config = flowSettings.config;
+  const declaredEnv = config?.bundle?.env;
+  const hashedConfig = config && declaredEnv ? {
+    ...config,
+    bundle: { ...config.bundle, env: Object.keys(declaredEnv).sort() }
+  } : config;
+  return createHash("sha256").update(canonicalJson({ ...flowSettings, config: hashedConfig, collector })).digest("hex");
+}
+async function hashInstalledDir(dir) {
+  const hash = createHash("sha256");
+  for (const rel of await listFiles(dir, "")) {
+    const abs = path7.join(dir, rel);
+    const stat2 = await fs7.lstat(abs);
+    hash.update(`${rel}\0`);
+    hash.update(
+      stat2.isSymbolicLink() ? await fs7.readlink(abs) : await fs7.readFile(abs)
+    );
+    hash.update("\0");
+  }
+  return hash.digest("hex").slice(0, DIGEST_LENGTH);
+}
+async function listFiles(root, rel) {
+  const entries = await fs7.readdir(path7.join(root, rel), {
+    withFileTypes: true
+  });
+  const files = [];
+  for (const entry of entries) {
+    const entryRel = rel ? `${rel}/${entry.name}` : entry.name;
+    if (entry.isDirectory()) files.push(...await listFiles(root, entryRel));
+    else files.push(entryRel);
+  }
+  return files.sort();
+}
+function releaseDigest(input) {
+  return createHash("sha256").update(
+    canonicalJson({
+      config: input.configDigest,
+      versions: input.versions,
+      toolchain: input.toolchain
+    })
+  ).digest("hex").slice(0, DIGEST_LENGTH);
+}
+
+// src/config/window-collector.ts
+import { checkWindowCollector } from "@walkeros/core";
+function assertWindowCollector(value, source = {}) {
+  const check = checkWindowCollector(value);
+  if (check.ok) return check.name;
+  const path23 = source.path ?? "config.settings.windowCollector";
+  const subject = source.written !== void 0 && source.written !== value ? `${JSON.stringify(source.written)} resolved to ${JSON.stringify(value)}, which` : JSON.stringify(value);
+  throw new Error(`${path23}: ${subject} ${check.reason}.`);
+}
+
+// src/config/loader.ts
 var DEFAULT_INCLUDE_FOLDER = "./shared";
 function loadBundleConfig(rawConfig, options) {
   const sanitized = stripLegacyBundleExternal(rawConfig, options.logger);
@@ -1067,6 +1144,7 @@ function loadBundleConfig(rawConfig, options) {
   assertLiteralBuildEnv(config, flowName);
   let flowSettings = getFlowSettings(config, flowName, { deferred: true });
   const platform = getPlatform(flowSettings);
+  const flowConfigDigest = configDigest(flowSettings, flowName);
   if (!platform) {
     throw new Error(
       `Invalid configuration: flow "${flowName}" must have config.platform set to "web" or "server".`
@@ -1083,16 +1161,20 @@ function loadBundleConfig(rawConfig, options) {
   const overrides = bundle2?.overrides ?? {};
   const traceInclude = bundle2?.traceInclude;
   const output = options.buildOverrides?.output || getDefaultOutput(platform);
-  const configDir = isUrl(options.configPath) ? process.cwd() : path7.dirname(options.configPath);
+  const configDir = isUrl(options.configPath) ? process.cwd() : path8.dirname(options.configPath);
   let includes = config.include;
   if (!includes) {
-    const defaultIncludePath = path7.resolve(configDir, DEFAULT_INCLUDE_FOLDER);
-    if (fs7.pathExistsSync(defaultIncludePath)) {
+    const defaultIncludePath = path8.resolve(configDir, DEFAULT_INCLUDE_FOLDER);
+    if (fs8.pathExistsSync(defaultIncludePath)) {
       includes = [DEFAULT_INCLUDE_FOLDER];
     }
   }
   const buildOptions = {
     ...buildDefaults,
+    ...settingsToBuildOptions(platform, flowSettings.config?.settings, {
+      path: `flows.${flowName}.config.settings.windowCollector`,
+      written: config.flows[flowName]?.config?.settings?.windowCollector
+    }),
     packages,
     overrides,
     traceInclude,
@@ -1112,7 +1194,14 @@ function loadBundleConfig(rawConfig, options) {
     buildOptions,
     flowName,
     isMultiFlow,
-    availableFlows
+    availableFlows,
+    configDigest: flowConfigDigest
+  };
+}
+function settingsToBuildOptions(platform, settings, source = {}) {
+  if (platform !== "web" || settings?.windowCollector === void 0) return {};
+  return {
+    windowCollector: assertWindowCollector(settings.windowCollector, source)
   };
 }
 var REFERENCE_PATTERN = /\$(?:env|var|secret|flow|contract)\.|\$code:|__WALKEROS_(?:ENV|SECRET):/;
@@ -1203,8 +1292,8 @@ function isPlainObject(value) {
 // src/commands/bundle/bundler.ts
 import esbuild2 from "esbuild";
 import { builtinModules } from "module";
-import path13 from "path";
-import fs13 from "fs-extra";
+import path14 from "path";
+import fs14 from "fs-extra";
 import {
   packageNameToVariable as packageNameToVariable2,
   getStepRuntimeProps,
@@ -1372,8 +1461,8 @@ function applyStepPackages(flowSettings, packages, logger) {
 
 // src/core/package-manager.ts
 import pacote from "pacote";
-import path9 from "path";
-import fs9 from "fs-extra";
+import path10 from "path";
+import fs10 from "fs-extra";
 import { readFile } from "fs/promises";
 import os from "os";
 import semver2 from "semver";
@@ -1400,8 +1489,7 @@ async function getPackageCacheKey(packageName, version, date) {
   return getHashServer(input, HASH_LENGTH);
 }
 function normalizeJson(content) {
-  const parsed = JSON.parse(content);
-  return JSON.stringify(parsed);
+  return canonicalJson(JSON.parse(content));
 }
 async function getFlowSettingsCacheKey(content, date) {
   const dateStr = date ?? getTodayDate();
@@ -1412,8 +1500,8 @@ async function getFlowSettingsCacheKey(content, date) {
 
 // src/core/atomic-cache.ts
 import crypto from "crypto";
-import path8 from "path";
-import fs8 from "fs-extra";
+import path9 from "path";
+import fs9 from "fs-extra";
 var CACHE_COMPLETE_MARKER = ".walkeros-complete";
 var TMP_INFIX = ".tmp-";
 var BASE36 = "0123456789abcdefghijklmnopqrstuvwxyz";
@@ -1440,26 +1528,26 @@ function isCacheTempName(name) {
   return TMP_NAME.test(name);
 }
 async function isCacheDirComplete(dir) {
-  return fs8.pathExists(path8.join(dir, CACHE_COMPLETE_MARKER));
+  return fs9.pathExists(path9.join(dir, CACHE_COMPLETE_MARKER));
 }
 async function readCacheDir(src, dest) {
-  const marker = path8.join(src, CACHE_COMPLETE_MARKER);
-  await fs8.copy(src, dest, { filter: (file) => file !== marker });
+  const marker = path9.join(src, CACHE_COMPLETE_MARKER);
+  await fs9.copy(src, dest, { filter: (file) => file !== marker });
 }
 async function sweepStaleCacheTemps(dir, maxAgeMs = 36e5) {
   let entries;
   try {
-    entries = await fs8.readdir(dir);
+    entries = await fs9.readdir(dir);
   } catch {
     return;
   }
   const cutoff = Date.now() - maxAgeMs;
   await Promise.all(
     entries.filter(isCacheTempName).map(async (entry) => {
-      const entryPath = path8.join(dir, entry);
+      const entryPath = path9.join(dir, entry);
       try {
-        const stats = await fs8.stat(entryPath);
-        if (stats.mtimeMs < cutoff) await fs8.remove(entryPath);
+        const stats = await fs9.stat(entryPath);
+        if (stats.mtimeMs < cutoff) await fs9.remove(entryPath);
       } catch {
       }
     })
@@ -1469,7 +1557,7 @@ async function replaceIncomplete(tmp, dest) {
   const aside = tempSibling(dest);
   let moved = false;
   try {
-    await fs8.rename(dest, aside);
+    await fs9.rename(dest, aside);
     moved = true;
   } catch (error) {
     if (errorCode2(error) !== "ENOENT") throw error;
@@ -1478,54 +1566,54 @@ async function replaceIncomplete(tmp, dest) {
   const winner = restore ? aside : tmp;
   const loser = restore ? tmp : aside;
   try {
-    await fs8.rename(winner, dest);
+    await fs9.rename(winner, dest);
   } catch (error) {
     if (!isOccupied(error) || !await isCacheDirComplete(dest)) {
-      if (!restore && moved) await fs8.remove(aside);
+      if (!restore && moved) await fs9.remove(aside);
       throw error;
     }
-    await fs8.remove(winner);
+    await fs9.remove(winner);
   }
-  await fs8.remove(loser);
+  await fs9.remove(loser);
 }
 async function writeCacheDir(src, dest, logger, options = {}) {
-  const copy = options.copy ?? ((from, to) => fs8.copy(from, to));
-  const dir = path8.dirname(dest);
+  const copy = options.copy ?? ((from, to) => fs9.copy(from, to));
+  const dir = path9.dirname(dest);
   const tmp = tempSibling(dest);
   try {
-    await fs8.ensureDir(dir);
+    await fs9.ensureDir(dir);
     await sweepStaleCacheTemps(dir);
     await copy(src, tmp);
-    await fs8.writeFile(path8.join(tmp, CACHE_COMPLETE_MARKER), "");
+    await fs9.writeFile(path9.join(tmp, CACHE_COMPLETE_MARKER), "");
     try {
-      await fs8.rename(tmp, dest);
+      await fs9.rename(tmp, dest);
     } catch (error) {
       if (!isOccupied(error)) throw error;
       if (await isCacheDirComplete(dest)) {
-        await fs8.remove(tmp);
+        await fs9.remove(tmp);
         return;
       }
       await replaceIncomplete(tmp, dest);
     }
   } catch (error) {
-    await fs8.remove(tmp).catch(() => {
+    await fs9.remove(tmp).catch(() => {
     });
-    const label = options.label ?? path8.basename(dest);
+    const label = options.label ?? path9.basename(dest);
     logger.warn(
       `Package cache write failed for ${label}: ${getErrorMessage(error)}. The build continues without caching it.`
     );
   }
 }
 async function writeCacheFile(dest, content) {
-  const dir = path8.dirname(dest);
+  const dir = path9.dirname(dest);
   const tmp = tempSibling(dest);
-  await fs8.ensureDir(dir);
+  await fs9.ensureDir(dir);
   await sweepStaleCacheTemps(dir);
   try {
-    await fs8.writeFile(tmp, content, "utf-8");
-    await fs8.rename(tmp, dest);
+    await fs9.writeFile(tmp, content, "utf-8");
+    await fs9.rename(tmp, dest);
   } catch (error) {
-    await fs8.remove(tmp).catch(() => {
+    await fs9.remove(tmp).catch(() => {
     });
     throw error;
   }
@@ -1584,8 +1672,8 @@ var PACOTE_OPTS = {
 async function loadNpmConfigForPacote(projectDir = process.cwd(), homeDir = os.homedir()) {
   const merged = {};
   const sources = [
-    path9.join(homeDir, ".npmrc"),
-    path9.join(projectDir, ".npmrc")
+    path10.join(homeDir, ".npmrc"),
+    path10.join(projectDir, ".npmrc")
   ];
   for (const file of sources) {
     let content;
@@ -1651,8 +1739,8 @@ function backoffForAttempt(index) {
   return base + (Math.random() * 2 - 1) * spread;
 }
 function delay2(ms) {
-  return new Promise((resolve3) => {
-    setTimeout(resolve3, ms);
+  return new Promise((resolve5) => {
+    setTimeout(resolve5, ms);
   });
 }
 function describeError(error) {
@@ -1713,10 +1801,10 @@ function manifestWithResilience(spec, opts, _logger, retryOptions) {
   );
 }
 function getPackageDirectory(baseDir, packageName) {
-  return path9.join(baseDir, "node_modules", packageName);
+  return path10.join(baseDir, "node_modules", packageName);
 }
 function getNestedPackageDirectory(baseDir, consumerName, nestedPackageName) {
-  return path9.join(
+  return path10.join(
     baseDir,
     "node_modules",
     consumerName,
@@ -1797,12 +1885,12 @@ async function collectAllSpecs(packages, logger, configDir, overrides = {}, npmC
     if (visited.has(visitKey)) continue;
     visited.add(visitKey);
     if (item.localPath) {
-      const resolvedPath = path9.isAbsolute(item.localPath) ? item.localPath : path9.resolve(configDir || process.cwd(), item.localPath);
-      const candidatePath = path9.join(resolvedPath, "package.json");
-      const hasPkgJson = await fs9.pathExists(candidatePath);
+      const resolvedPath = path10.isAbsolute(item.localPath) ? item.localPath : path10.resolve(configDir || process.cwd(), item.localPath);
+      const candidatePath = path10.join(resolvedPath, "package.json");
+      const hasPkgJson = await fs10.pathExists(candidatePath);
       if (hasPkgJson) {
         try {
-          const pkgJson = await fs9.readJson(candidatePath);
+          const pkgJson = await fs10.readJson(candidatePath);
           const deps2 = pkgJson.dependencies || {};
           for (const [depName, depSpec] of Object.entries(deps2)) {
             if (typeof depSpec === "string") {
@@ -2031,7 +2119,7 @@ async function downloadPackagesImpl(packages, targetDir, logger, useCache, confi
   );
   const resolution = await resolveVersionConflicts(allSpecs, logger, npmConfig);
   const { topLevel, nested } = resolution;
-  await fs9.ensureDir(targetDir);
+  await fs10.ensureDir(targetDir);
   const localPackageMap = /* @__PURE__ */ new Map();
   for (const pkg of packages) {
     if (pkg.path) localPackageMap.set(pkg.name, pkg.path);
@@ -2060,7 +2148,7 @@ async function downloadPackagesImpl(packages, targetDir, logger, useCache, confi
         logger.debug(`Downloading ${packageSpec} (cached)`);
       }
       try {
-        await fs9.ensureDir(path9.dirname(packageDir));
+        await fs10.ensureDir(path10.dirname(packageDir));
         await readCacheDir(cachedPath, packageDir);
         packagePaths.set(name, packageDir);
         continue;
@@ -2069,7 +2157,7 @@ async function downloadPackagesImpl(packages, targetDir, logger, useCache, confi
       }
     }
     try {
-      await fs9.ensureDir(path9.dirname(packageDir));
+      await fs10.ensureDir(path10.dirname(packageDir));
       const cacheDir = process.env.NPM_CACHE_DIR || getTmpPath(tmpDir, "cache", "npm");
       await extractWithResilience(
         packageSpec,
@@ -2113,7 +2201,7 @@ async function downloadPackagesImpl(packages, targetDir, logger, useCache, confi
         nestedPkg.name
       );
       try {
-        await fs9.ensureDir(path9.dirname(nestedDir));
+        await fs10.ensureDir(path10.dirname(nestedDir));
         const cacheDir = process.env.NPM_CACHE_DIR || getTmpPath(tmpDir, "cache", "npm");
         await extractWithResilience(
           resolvedSpec,
@@ -2134,7 +2222,7 @@ async function downloadPackagesImpl(packages, targetDir, logger, useCache, confi
 async function getCachedPackagePath(pkg, tmpDir) {
   const cacheDir = getTmpPath(tmpDir, "cache", "packages");
   const cacheKey = await getPackageCacheKey(pkg.name, pkg.version);
-  return path9.join(cacheDir, cacheKey);
+  return path10.join(cacheDir, cacheKey);
 }
 async function isPackageCached(pkg, tmpDir) {
   const cachedPath = await getCachedPackagePath(pkg, tmpDir);
@@ -2166,18 +2254,18 @@ Each package must use the same version across all declarations. Please update yo
 // src/commands/bundle/nft-trace.ts
 import esbuild from "esbuild";
 import { nodeFileTrace } from "@vercel/nft";
-import * as path10 from "path";
-import * as fs10 from "fs/promises";
+import * as path11 from "path";
+import * as fs11 from "fs/promises";
 import picomatch from "picomatch";
 async function traceAndCopy(opts) {
   try {
-    await fs10.stat(opts.entry);
+    await fs11.stat(opts.entry);
   } catch {
     throw new Error(
       `nft-trace: entry file not found at '${opts.entry}'. Check the path or run 'walkeros bundle' from the directory containing your flow.json.`
     );
   }
-  const realBase = await fs10.realpath(opts.base);
+  const realBase = await fs11.realpath(opts.base);
   const expandedExtras = await expandTraceIncludes(
     opts.extraIncludes ?? [],
     realBase
@@ -2186,22 +2274,22 @@ async function traceAndCopy(opts) {
   const { fileList, reasons } = await nodeFileTrace(entries, {
     base: realBase
   });
-  const outDirReal = path10.resolve(opts.outDir);
+  const outDirReal = path11.resolve(opts.outDir);
   let copied = 0;
   for (const file of fileList) {
     const reason = reasons.get(file);
     if (reason?.ignored) continue;
-    const dst = path10.resolve(outDirReal, file);
-    if (!dst.startsWith(outDirReal + path10.sep) && dst !== outDirReal) {
+    const dst = path11.resolve(outDirReal, file);
+    if (!dst.startsWith(outDirReal + path11.sep) && dst !== outDirReal) {
       throw new Error(
         `nft-trace: traced file '${file}' resolves outside outDir. This usually means base is too narrow for a hoisted monorepo. Move base up to the workspace root or set traceInclude explicitly.`
       );
     }
-    const src = path10.join(realBase, file);
-    await fs10.mkdir(path10.dirname(dst), { recursive: true });
-    await fs10.copyFile(src, dst);
-    const s = await fs10.stat(src);
-    if (s.mode & 73) await fs10.chmod(dst, s.mode);
+    const src = path11.join(realBase, file);
+    await fs11.mkdir(path11.dirname(dst), { recursive: true });
+    await fs11.copyFile(src, dst);
+    const s = await fs11.stat(src);
+    if (s.mode & 73) await fs11.chmod(dst, s.mode);
     copied++;
   }
   return { fileList: Array.from(fileList), copied, reasons };
@@ -2261,13 +2349,13 @@ async function expandTraceIncludes(patterns, base) {
     else literals.push(entry);
   }
   const resolvedLiterals = literals.map(
-    (p) => path10.isAbsolute(p) ? p : path10.resolve(base, p)
+    (p) => path11.isAbsolute(p) ? p : path11.resolve(base, p)
   );
   if (globs.length === 0) return resolvedLiterals;
   const matchers = globs.map((g) => picomatch(g));
   const matchedFiles = [];
   await walkFiles(base, base, async (absFile, relFile) => {
-    const relPosix = relFile.split(path10.sep).join("/");
+    const relPosix = relFile.split(path11.sep).join("/");
     if (matchers.some((m) => m(relPosix))) {
       matchedFiles.push(absFile);
     }
@@ -2277,27 +2365,27 @@ async function expandTraceIncludes(patterns, base) {
 async function walkFiles(root, dir, visit) {
   let entries;
   try {
-    entries = await fs10.readdir(dir, { withFileTypes: true });
+    entries = await fs11.readdir(dir, { withFileTypes: true });
   } catch {
     return;
   }
   for (const entry of entries) {
-    const abs = path10.join(dir, entry.name);
+    const abs = path11.join(dir, entry.name);
     if (entry.isDirectory()) {
       await walkFiles(root, abs, visit);
     } else if (entry.isFile()) {
-      await visit(abs, path10.relative(root, abs));
+      await visit(abs, path11.relative(root, abs));
     }
   }
 }
 
 // src/commands/bundle/assert-consumer-deps.ts
-import fs11 from "fs-extra";
-import * as path11 from "path";
+import fs12 from "fs-extra";
+import * as path12 from "path";
 import semver3 from "semver";
 async function assertConsumerDepsSatisfied(root, logger) {
   const consumers = await collectInstalledPackages(
-    path11.join(root, "node_modules")
+    path12.join(root, "node_modules")
   );
   const violations = [];
   for (const consumer of consumers) {
@@ -2344,17 +2432,17 @@ async function assertConsumerDepsSatisfied(root, logger) {
 }
 async function collectInstalledPackages(nodeModulesDir) {
   const result = [];
-  if (!await fs11.pathExists(nodeModulesDir)) return result;
+  if (!await fs12.pathExists(nodeModulesDir)) return result;
   async function walk(dir) {
-    const entries = await fs11.readdir(dir, { withFileTypes: true });
+    const entries = await fs12.readdir(dir, { withFileTypes: true });
     for (const entry of entries) {
       if (!entry.isDirectory()) continue;
-      const full = path11.join(dir, entry.name);
+      const full = path12.join(dir, entry.name);
       if (entry.name.startsWith("@")) {
-        const scopedEntries = await fs11.readdir(full, { withFileTypes: true });
+        const scopedEntries = await fs12.readdir(full, { withFileTypes: true });
         for (const scoped of scopedEntries) {
           if (!scoped.isDirectory()) continue;
-          await collectOne(path11.join(full, scoped.name));
+          await collectOne(path12.join(full, scoped.name));
         }
         continue;
       }
@@ -2362,12 +2450,12 @@ async function collectInstalledPackages(nodeModulesDir) {
     }
   }
   async function collectOne(pkgDir) {
-    const pkgJsonPath = path11.join(pkgDir, "package.json");
-    if (!await fs11.pathExists(pkgJsonPath)) return;
-    const pkg = await fs11.readJson(pkgJsonPath);
+    const pkgJsonPath = path12.join(pkgDir, "package.json");
+    if (!await fs12.pathExists(pkgJsonPath)) return;
+    const pkg = await fs12.readJson(pkgJsonPath);
     result.push({ dir: pkgDir, pkg });
-    const nestedNm = path11.join(pkgDir, "node_modules");
-    if (await fs11.pathExists(nestedNm)) await walk(nestedNm);
+    const nestedNm = path12.join(pkgDir, "node_modules");
+    if (await fs12.pathExists(nestedNm)) await walk(nestedNm);
   }
   await walk(nodeModulesDir);
   return result;
@@ -2375,13 +2463,13 @@ async function collectInstalledPackages(nodeModulesDir) {
 async function resolveSiblingOrAncestor(consumerDir, depName, root) {
   let current = consumerDir;
   while (true) {
-    const candidate = path11.join(current, "node_modules", depName);
-    const pkgJson = path11.join(candidate, "package.json");
-    if (await fs11.pathExists(pkgJson)) {
-      const pkg = await fs11.readJson(pkgJson);
+    const candidate = path12.join(current, "node_modules", depName);
+    const pkgJson = path12.join(candidate, "package.json");
+    if (await fs12.pathExists(pkgJson)) {
+      const pkg = await fs12.readJson(pkgJson);
       if (pkg.version) return { dir: candidate, version: pkg.version };
     }
-    const parent = path11.dirname(current);
+    const parent = path12.dirname(current);
     if (parent === current || !current.startsWith(root)) return null;
     current = parent;
   }
@@ -2391,8 +2479,8 @@ async function resolveSiblingOrAncestor(consumerDir, depName, root) {
 import { getHashServer as getHashServer3 } from "@walkeros/server-core";
 
 // src/core/build-cache.ts
-import fs12 from "fs-extra";
-import path12 from "path";
+import fs13 from "fs-extra";
+import path13 from "path";
 import { getHashServer as getHashServer2 } from "@walkeros/server-core";
 function serializeKeyInputs(inputs) {
   return JSON.stringify({
@@ -2405,7 +2493,8 @@ function serializeKeyInputs(inputs) {
     minifyOptions: inputs.minifyOptions ?? null,
     windowCollector: inputs.windowCollector ?? null,
     windowElb: inputs.windowElb ?? null,
-    versionsHash: inputs.versionsHash
+    versionsHash: inputs.versionsHash,
+    toolchain: inputs.toolchain
   });
 }
 async function computeCodeCacheKey(codeContent, inputs) {
@@ -2417,11 +2506,11 @@ ${serializeKeyInputs(inputs)}`;
 async function getBuildCachePath(configContent, tmpDir) {
   const cacheDir = getTmpPath(tmpDir, "cache", "builds");
   const cacheKey = await getFlowSettingsCacheKey(configContent);
-  return path12.join(cacheDir, `${cacheKey}.js`);
+  return path13.join(cacheDir, `${cacheKey}.js`);
 }
 async function isBuildCached(configContent, tmpDir) {
   const cachePath = await getBuildCachePath(configContent, tmpDir);
-  return fs12.pathExists(cachePath);
+  return fs13.pathExists(cachePath);
 }
 async function cacheBuild(configContent, buildOutput, tmpDir) {
   const cachePath = await getBuildCachePath(configContent, tmpDir);
@@ -2429,15 +2518,15 @@ async function cacheBuild(configContent, buildOutput, tmpDir) {
 }
 async function getCachedBuild(configContent, tmpDir) {
   const cachePath = await getBuildCachePath(configContent, tmpDir);
-  if (await fs12.pathExists(cachePath)) {
-    return await fs12.readFile(cachePath, "utf-8");
+  if (await fs13.pathExists(cachePath)) {
+    return await fs13.readFile(cachePath, "utf-8");
   }
   return null;
 }
 async function getCodeCachePath(codeContent, tmpDir, inputs) {
   const cacheDir = getTmpPath(tmpDir, "cache", "code");
   const cacheKey = await computeCodeCacheKey(codeContent, inputs);
-  return path12.join(cacheDir, `${cacheKey}.js`);
+  return path13.join(cacheDir, `${cacheKey}.js`);
 }
 async function cacheCode(codeContent, codeOutput, tmpDir, inputs) {
   const cachePath = await getCodeCachePath(codeContent, tmpDir, inputs);
@@ -2445,21 +2534,44 @@ async function cacheCode(codeContent, codeOutput, tmpDir, inputs) {
 }
 async function getCachedCode(codeContent, tmpDir, inputs) {
   const cachePath = await getCodeCachePath(codeContent, tmpDir, inputs);
-  if (await fs12.pathExists(cachePath)) {
-    return fs12.readFile(cachePath, "utf-8");
+  if (await fs13.pathExists(cachePath)) {
+    return fs13.readFile(cachePath, "utf-8");
   }
   return null;
 }
 async function ensureCodeOnDisk(codeContent, compiledCode, tmpDir, inputs) {
   const cacheDir = getTmpPath(tmpDir, "cache", "code");
   const cacheKey = await computeCodeCacheKey(codeContent, inputs);
-  const cachePath = path12.join(cacheDir, `${cacheKey}.mjs`);
-  if (!await fs12.pathExists(cachePath)) {
+  const cachePath = path13.join(cacheDir, `${cacheKey}.mjs`);
+  if (!await fs13.pathExists(cachePath)) {
     await writeCacheFile(cachePath, compiledCode);
   }
   return cachePath;
 }
 
+// src/version.ts
+import { readFileSync as readFileSync2 } from "fs";
+import { fileURLToPath } from "url";
+import { dirname as dirname3, join as join4 } from "path";
+var versionFilename = fileURLToPath(import.meta.url);
+var versionDirname = dirname3(versionFilename);
+function findPackageJson() {
+  const paths = [
+    join4(versionDirname, "../package.json"),
+    // dist/ or src/
+    join4(versionDirname, "../../package.json")
+    // src/core/ (not used, but safe)
+  ];
+  for (const p of paths) {
+    try {
+      return readFileSync2(p, "utf-8");
+    } catch {
+    }
+  }
+  return JSON.stringify({ version: "0.0.0" });
+}
+var VERSION = JSON.parse(findPackageJson()).version;
+
 // src/commands/bundle/bundler.ts
 function isInlineCode(code) {
   return code !== null && typeof code === "object" && !Array.isArray(code) && "push" in code;
@@ -2500,18 +2612,18 @@ function generateInlineCode(inline, runtimeProps, isDestination) {
 }
 async function copyIncludes(includes, sourceDir, outputDir, logger) {
   for (const include of includes) {
-    const sourcePath = path13.resolve(sourceDir, include);
-    const folderName = path13.basename(include);
-    const destPath = path13.join(outputDir, folderName);
-    const resolvedOutput = path13.resolve(outputDir);
-    const resolvedSource = path13.resolve(sourcePath);
-    if (resolvedSource === resolvedOutput || resolvedOutput.startsWith(resolvedSource + path13.sep) || resolvedSource.startsWith(resolvedOutput + path13.sep)) {
+    const sourcePath = path14.resolve(sourceDir, include);
+    const folderName = path14.basename(include);
+    const destPath = path14.join(outputDir, folderName);
+    const resolvedOutput = path14.resolve(outputDir);
+    const resolvedSource = path14.resolve(sourcePath);
+    if (resolvedSource === resolvedOutput || resolvedOutput.startsWith(resolvedSource + path14.sep) || resolvedSource.startsWith(resolvedOutput + path14.sep)) {
       throw new Error(
         `Circular include detected: "${include}" resolves to "${resolvedSource}" which overlaps with output directory "${resolvedOutput}"`
       );
     }
-    if (await fs13.pathExists(sourcePath)) {
-      await fs13.copy(sourcePath, destPath);
+    if (await fs14.pathExists(sourcePath)) {
+      await fs14.copy(sourcePath, destPath);
       logger.debug(`Copied ${include} to output`);
     } else {
       logger.warn(`Include folder not found: ${include}`);
@@ -2536,27 +2648,42 @@ function generateCacheKeyContent(flowSettings, buildOptions, versionsHash) {
     // not change this key. The durable cross-version cache bust is the
     // version/toolchain hash, not this field.
     emittedFormat: resolveEmittedFormat(buildOptions),
-    versionsHash
+    versionsHash,
+    // Generated code changes with the CLI, so a CLI upgrade never serves a
+    // build made by the previous version.
+    toolchain: VERSION
   };
   return JSON.stringify(configForCache);
 }
 function resolveEmittedFormat(buildOptions) {
   return buildOptions.platform === "browser" ? "iife" : "esm";
 }
-async function bundleCore(flowSettings, buildOptions, logger, showStats = false) {
+async function resolvedVersionLines(topLevel, packagePaths) {
+  const lines = [];
+  for (const [name, pkg] of [...topLevel.entries()].sort(
+    ([a], [b]) => a.localeCompare(b)
+  )) {
+    const installed = packagePaths.get(name);
+    lines.push(
+      pkg.version === "local" && installed ? `${name}@local:${await hashInstalledDir(installed)}` : `${name}@${pkg.version}`
+    );
+  }
+  return lines;
+}
+async function bundleCore(flowSettings, buildOptions, logger, showStats = false, provenance) {
   const bundleStartTime = Date.now();
   const CACHE_DIR = buildOptions.tempDir || getTmpPath();
   const npmConfig = await loadNpmConfigForPacote(
     buildOptions.configDir ?? process.cwd()
   );
-  const outputPath = path13.resolve(buildOptions.output);
-  const outputDirAbs = path13.dirname(outputPath);
-  await fs13.remove(path13.join(outputDirAbs, "node_modules"));
-  await fs13.remove(path13.join(outputDirAbs, "package.json"));
-  await fs13.remove(path13.join(outputDirAbs, "package-lock.json"));
+  const outputPath = path14.resolve(buildOptions.output);
+  const outputDirAbs = path14.dirname(outputPath);
+  await fs14.remove(path14.join(outputDirAbs, "node_modules"));
+  await fs14.remove(path14.join(outputDirAbs, "package.json"));
+  await fs14.remove(path14.join(outputDirAbs, "package-lock.json"));
   const TEMP_DIR = buildOptions.tempDir || await tmpRunDir("build");
   try {
-    await fs13.ensureDir(TEMP_DIR);
+    await fs14.ensureDir(TEMP_DIR);
     const hasSourcesOrDests = Object.keys(flowSettings.sources || {}).length > 0 || Object.keys(flowSettings.destinations || {}).length > 0;
     if (hasSourcesOrDests && !buildOptions.packages["@walkeros/collector"]) {
       buildOptions.packages["@walkeros/collector"] = {};
@@ -2584,10 +2711,10 @@ async function bundleCore(flowSettings, buildOptions, logger, showStats = false)
     );
     const warnedBundleFieldPackages = /* @__PURE__ */ new Set();
     for (const [pkgName, pkgPath] of packagePaths.entries()) {
-      const pkgJsonPath = path13.join(pkgPath, "package.json");
+      const pkgJsonPath = path14.join(pkgPath, "package.json");
       let pkgJson;
       try {
-        pkgJson = await fs13.readJSON(pkgJsonPath);
+        pkgJson = await fs14.readJSON(pkgJsonPath);
       } catch {
         continue;
       }
@@ -2612,15 +2739,30 @@ async function bundleCore(flowSettings, buildOptions, logger, showStats = false)
               require: pkgJson.main
             }
           };
-          await fs13.writeJSON(pkgJsonPath, pkgJson, { spaces: 2 });
+          await fs14.writeJSON(pkgJsonPath, pkgJson, { spaces: 2 });
         }
       }
     }
     if (process.env.BUNDLER_STRICT_RANGES !== "0") {
       await assertConsumerDepsSatisfied(TEMP_DIR, logger);
     }
-    const sortedVersions = [...resolutionResult.topLevel.entries()].sort(([a], [b]) => a.localeCompare(b)).map(([name, p]) => `${name}@${p.version}`);
+    const sortedVersions = await resolvedVersionLines(
+      resolutionResult.topLevel,
+      packagePaths
+    );
     const versionsHash = await getHashServer3(sortedVersions.join("\n"), 12);
+    if (provenance) {
+      applyCollectorProvenance(
+        flowSettings,
+        provenance.flowName,
+        provenance.release,
+        () => releaseDigest({
+          configDigest: provenance.configDigest,
+          versions: sortedVersions,
+          toolchain: VERSION
+        })
+      );
+    }
     const declaredPackages = Object.keys(buildOptions.packages).filter(
       (name) => !name.startsWith(".") && !name.startsWith("/")
     );
@@ -2635,8 +2777,8 @@ async function bundleCore(flowSettings, buildOptions, logger, showStats = false)
         const cachedBuild = await getCachedBuild(configContent, CACHE_DIR);
         if (cachedBuild) {
           logger.debug("Using cached build");
-          await fs13.ensureDir(path13.dirname(outputPath));
-          await fs13.writeFile(outputPath, cachedBuild);
+          await fs14.ensureDir(path14.dirname(outputPath));
+          await fs14.writeFile(outputPath, cachedBuild);
           await finishArtifact(
             outputPath,
             flowSettings,
@@ -2645,7 +2787,7 @@ async function bundleCore(flowSettings, buildOptions, logger, showStats = false)
             declaredPackages,
             logger
           );
-          const stats2 = await fs13.stat(outputPath);
+          const stats2 = await fs14.stat(outputPath);
           const sizeKB2 = (stats2.size / 1024).toFixed(1);
           logger.info(`Output: ${outputPath} (${sizeKB2} KB, cached)`);
           if (showStats) {
@@ -2668,14 +2810,14 @@ async function bundleCore(flowSettings, buildOptions, logger, showStats = false)
         }
       }
     }
-    const packageJsonPath = path13.join(TEMP_DIR, "package.json");
-    await fs13.writeFile(
+    const packageJsonPath = path14.join(TEMP_DIR, "package.json");
+    await fs14.writeFile(
       packageJsonPath,
       JSON.stringify({ type: "module" }, null, 2)
     );
     logger.debug("Creating entry point");
     const { codeEntry, dataPayload, hasFlow, devPackages } = await createEntryPoint(flowSettings, buildOptions, packagePaths, logger);
-    await fs13.ensureDir(path13.dirname(outputPath));
+    await fs14.ensureDir(path14.dirname(outputPath));
     const codeKeyInputs = {
       // Deploy browser skeletons (externalizeDev) externalize each `<pkg>/dev`
       // so the lazy registry is not inlined; in-process simulate/push inline it.
@@ -2695,7 +2837,8 @@ async function bundleCore(flowSettings, buildOptions, logger, showStats = false)
       // Retained but inert (deprecation surface): no codegen reads it anymore.
       // Keeping it here only over-keys the code cache, which is harmless.
       windowElb: buildOptions.windowElb,
-      versionsHash
+      versionsHash,
+      toolchain: VERSION
     };
     let compiledCode = null;
     if (buildOptions.cache !== false) {
@@ -2707,8 +2850,8 @@ async function bundleCore(flowSettings, buildOptions, logger, showStats = false)
       logger.debug(
         `Running esbuild (target: ${buildOptions.target || "es2018"}, format: ${buildOptions.format})`
       );
-      const entryPath = path13.join(TEMP_DIR, "entry.js");
-      await fs13.writeFile(entryPath, codeEntry);
+      const entryPath = path14.join(TEMP_DIR, "entry.js");
+      await fs14.writeFile(entryPath, codeEntry);
       const esbuildOptions = createEsbuildOptions(
         { ...buildOptions, minify: false },
         entryPath,
@@ -2729,7 +2872,7 @@ async function bundleCore(flowSettings, buildOptions, logger, showStats = false)
       } finally {
         await esbuild2.stop();
       }
-      compiledCode = await fs13.readFile(outputPath, "utf-8");
+      compiledCode = await fs14.readFile(outputPath, "utf-8");
       if (buildOptions.cache !== false) {
         await cacheCode(codeEntry, compiledCode, CACHE_DIR, codeKeyInputs);
       }
@@ -2747,7 +2890,7 @@ export { __configData };`;
 ` : "";
       const esmOutput = `${banner}${compiledCode}
 ${dataDeclaration}`;
-      await fs13.writeFile(outputPath, esmOutput);
+      await fs14.writeFile(outputPath, esmOutput);
     } else {
       const stage2Entry = (buildOptions.platform || "node") === "browser" ? generateWebEntry(stage1Path, dataPayload, {
         windowCollector: buildOptions.windowCollector,
@@ -2755,8 +2898,8 @@ ${dataDeclaration}`;
         platform: buildOptions.platform,
         observe: readObserveConnect(flowSettings, logger)
       }) : generateServerEntry(stage1Path, dataPayload);
-      const stage2EntryPath = path13.join(TEMP_DIR, "stage2.mjs");
-      await fs13.writeFile(stage2EntryPath, stage2Entry);
+      const stage2EntryPath = path14.join(TEMP_DIR, "stage2.mjs");
+      await fs14.writeFile(stage2EntryPath, stage2Entry);
       const stage2Options = {
         entryPoints: [stage2EntryPath],
         bundle: true,
@@ -2794,7 +2937,7 @@ ${dataDeclaration}`;
         await esbuild2.stop();
       }
     }
-    const outputStats = await fs13.stat(outputPath);
+    const outputStats = await fs14.stat(outputPath);
     const sizeKB = (outputStats.size / 1024).toFixed(1);
     const buildTime = ((Date.now() - bundleStartTime) / 1e3).toFixed(1);
     logger.info(`Output: ${outputPath} (${sizeKB} KB, ${buildTime}s)`);
@@ -2804,7 +2947,7 @@ ${dataDeclaration}`;
         buildOptions,
         versionsHash
       );
-      const buildOutput = await fs13.readFile(outputPath, "utf-8");
+      const buildOutput = await fs14.readFile(outputPath, "utf-8");
       await cacheBuild(configContent, buildOutput, CACHE_DIR);
       logger.debug("Build cached for future use");
     }
@@ -2830,7 +2973,7 @@ ${dataDeclaration}`;
     throw error;
   } finally {
     if (!buildOptions.tempDir) {
-      await fs13.remove(TEMP_DIR).catch(() => {
+      await fs14.remove(TEMP_DIR).catch(() => {
       });
     }
   }
@@ -2859,12 +3002,12 @@ async function finishArtifact(outputPath, flowSettings, buildOptions, tempDir, d
   await copyIncludes(
     buildOptions.include,
     buildOptions.configDir || process.cwd(),
-    path13.dirname(outputPath),
+    path14.dirname(outputPath),
     logger
   );
 }
 async function collectBundleStats(outputPath, packages, startTime, entryContent) {
-  const stats = await fs13.stat(outputPath);
+  const stats = await fs14.stat(outputPath);
   const totalSize = stats.size;
   const buildTime = Date.now() - startTime;
   const packageStats = Object.entries(packages).map(([name, pkg]) => ({
@@ -2943,13 +3086,13 @@ function getNodeExternals() {
   return externals;
 }
 async function runNftServerPath(outputPath, flowSettings, buildOptions, tempDir, declaredPackages, logger) {
-  const outDir = path13.dirname(outputPath);
+  const outDir = path14.dirname(outputPath);
   const flowExtraIncludes = [
     ...flowSettings.config?.bundle?.traceInclude ?? [],
     ...buildOptions.traceInclude ?? []
   ];
-  const stagedEntry = path13.join(tempDir, "__nft-flow.mjs");
-  await fs13.copyFile(outputPath, stagedEntry);
+  const stagedEntry = path14.join(tempDir, "__nft-flow.mjs");
+  await fs14.copyFile(outputPath, stagedEntry);
   let result;
   try {
     result = await traceAndCopy({
@@ -2959,12 +3102,12 @@ async function runNftServerPath(outputPath, flowSettings, buildOptions, tempDir,
       extraIncludes: flowExtraIncludes
     });
   } finally {
-    await fs13.remove(stagedEntry).catch(() => {
+    await fs14.remove(stagedEntry).catch(() => {
     });
   }
-  const stagedRel = path13.relative(await fs13.realpath(tempDir), stagedEntry);
+  const stagedRel = path14.relative(await fs14.realpath(tempDir), stagedEntry);
   const trimmedFileList = result.fileList.filter((f) => f !== stagedRel);
-  await fs13.remove(path13.join(outDir, stagedRel)).catch(() => {
+  await fs14.remove(path14.join(outDir, stagedRel)).catch(() => {
   });
   if (declaredPackages.length > 0) {
     const unused = assertDepsTraced({
@@ -2984,8 +3127,8 @@ async function runNftServerPath(outputPath, flowSettings, buildOptions, tempDir,
     if (name.startsWith(".") || name.startsWith("/")) continue;
     dependencies[name] = "*";
   }
-  const sidecarPath = path13.join(outDir, "package.json");
-  await fs13.writeJson(
+  const sidecarPath = path14.join(outDir, "package.json");
+  await fs14.writeJson(
     sidecarPath,
     {
       name: "walkeros-bundle",
@@ -3085,7 +3228,7 @@ async function computePackageExports(usedPackages, packagePaths) {
     const localPath = packagePaths.get(packageName);
     if (!localPath) continue;
     try {
-      const pkgJson = await fs13.readJSON(path13.join(localPath, "package.json"));
+      const pkgJson = await fs14.readJSON(path14.join(localPath, "package.json"));
       const exports = pkgJson?.walkerOS?.exports;
       if (exports && typeof exports === "object" && !Array.isArray(exports))
         result[packageName] = Object.keys(exports);
@@ -3100,8 +3243,8 @@ async function computeDevPackages(usedPackages, packagePaths) {
     const localPath = packagePaths.get(packageName);
     if (!localPath) continue;
     try {
-      const pkgJsonPath = path13.join(localPath, "package.json");
-      const pkgJson = await fs13.readJSON(pkgJsonPath);
+      const pkgJsonPath = path14.join(localPath, "package.json");
+      const pkgJson = await fs14.readJSON(pkgJsonPath);
       const exports = pkgJson.exports;
       if (exports && typeof exports === "object" && "./dev" in exports) {
         devPackages.push(packageName);
@@ -3255,10 +3398,10 @@ ${firstError.text}`
 function buildDataPayload(flowSettings) {
   return buildSplitConfigObject(flowSettings, detectNamedImports(flowSettings)).dataPayloadObj;
 }
-function applyCollectorProvenance(flowSettings, flowName, release2, now = () => (/* @__PURE__ */ new Date()).toISOString()) {
+function applyCollectorProvenance(flowSettings, flowName, release2, fallback) {
   const collector = flowSettings.collector ?? {};
   collector.name ??= flowName;
-  collector.release ??= release2 ?? now();
+  collector.release = release2 ?? collector.release ?? fallback();
   flowSettings.collector = collector;
 }
 function buildSplitConfigObject(flowSettings, namedImports) {
@@ -3457,7 +3600,7 @@ function generateWebEntry(stage1Path, dataPayload, options = {}) {
   const assignments = [];
   if (options.windowCollector) {
     assignments.push(
-      `  if (typeof window !== 'undefined') window['${options.windowCollector}'] = collector;`
+      `  if (typeof window !== 'undefined') window['${assertWindowCollector(options.windowCollector)}'] = collector;`
     );
   }
   const assignmentCode = assignments.length > 0 ? "\n" + assignments.join("\n") : "";
@@ -3487,7 +3630,7 @@ function generateWrapEntry(stage1Path, options = {}) {
   const assignments = [];
   if (options.windowCollector) {
     assignments.push(
-      `  if (typeof window !== 'undefined') window['${options.windowCollector}'] = collector;`
+      `  if (typeof window !== 'undefined') window['${assertWindowCollector(options.windowCollector)}'] = collector;`
     );
   }
   const assignmentCode = assignments.length > 0 ? "\n" + assignments.join("\n") : "";
@@ -3726,12 +3869,12 @@ function resolveTarget2(target) {
 }
 
 // src/commands/bundle/upload.ts
-import fs14 from "fs-extra";
+import fs15 from "fs-extra";
 function sanitizeUrl(url) {
   return url.split("?")[0];
 }
 async function uploadBundleToUrl(filePath, url, timeoutMs = 3e4) {
-  const bundleContent = await fs14.readFile(filePath);
+  const bundleContent = await fs15.readFile(filePath);
   const doUpload = async (attempt) => {
     const response = await fetch(url, {
       method: "PUT",
@@ -3776,14 +3919,14 @@ Packages:`);
 
 // src/commands/bundle/index.ts
 function resolveOutputPath(output, buildOptions, flowSubdir) {
-  const resolved = path14.resolve(output);
+  const resolved = path15.resolve(output);
   const filename = buildOptions.platform === "browser" ? "walker.js" : "flow.mjs";
   if (flowSubdir) {
-    return path14.join(resolved, flowSubdir, filename);
+    return path15.join(resolved, flowSubdir, filename);
   }
-  const ext = path14.extname(resolved);
-  if (output.endsWith("/") || output.endsWith(path14.sep) || !ext) {
-    return path14.join(resolved, filename);
+  const ext = path15.extname(resolved);
+  if (output.endsWith("/") || output.endsWith(path15.sep) || !ext) {
+    return path15.join(resolved, filename);
   }
   return resolved;
 }
@@ -3791,26 +3934,33 @@ function isArchiveOutput(output) {
   const lower = output.toLowerCase();
   return lower.endsWith(".tar.gz") || lower.endsWith(".tgz");
 }
-async function runBundleCoreWithArchive(flowSettings, buildOptions, logger, showStats = false) {
+async function runBundleCoreWithArchive(flowSettings, buildOptions, logger, showStats, provenance) {
   if (!isArchiveOutput(buildOptions.output)) {
-    return bundleCore(flowSettings, buildOptions, logger, showStats);
+    return bundleCore(
+      flowSettings,
+      buildOptions,
+      logger,
+      showStats,
+      provenance
+    );
   }
   if (buildOptions.platform !== "node") {
     throw new Error(
-      `Archive output (${path14.extname(buildOptions.output)}) is only supported for server (node) flows. Web bundles are a single-file IIFE with no node_modules to pack \u2014 use a .js output instead.`
+      `Archive output (${path15.extname(buildOptions.output)}) is only supported for server (node) flows. Web bundles are a single-file IIFE with no node_modules to pack \u2014 use a .js output instead.`
     );
   }
-  const archivePath = path14.resolve(buildOptions.output);
+  const archivePath = path15.resolve(buildOptions.output);
   const tempDir = await tmpRunDir("archive");
   try {
     const stats = await bundleCore(
       flowSettings,
-      { ...buildOptions, output: path14.join(tempDir, "flow.mjs") },
+      { ...buildOptions, output: path15.join(tempDir, "flow.mjs") },
       logger,
-      showStats
+      showStats,
+      provenance
     );
     for (const required of ["flow.mjs", "package.json"]) {
-      if (!await fs15.pathExists(path14.join(tempDir, required))) {
+      if (!await fs16.pathExists(path15.join(tempDir, required))) {
         throw new Error(
           `Bundle archive build is missing ${required}; cannot pack ${archivePath}.`
         );
@@ -3819,14 +3969,14 @@ async function runBundleCoreWithArchive(flowSettings, buildOptions, logger, show
     const candidates = ["flow.mjs", "node_modules", "package.json"];
     const entries = [];
     for (const entry of candidates) {
-      if (await fs15.pathExists(path14.join(tempDir, entry))) entries.push(entry);
+      if (await fs16.pathExists(path15.join(tempDir, entry))) entries.push(entry);
     }
-    await fs15.ensureDir(path14.dirname(archivePath));
+    await fs16.ensureDir(path15.dirname(archivePath));
     await packBundleDir(tempDir, archivePath, entries);
     logger.debug(`Packed bundle archive: ${archivePath}`);
     return stats;
   } finally {
-    await fs15.remove(tempDir).catch(() => {
+    await fs16.remove(tempDir).catch(() => {
     });
   }
 }
@@ -3861,7 +4011,7 @@ async function bundleCommand(options) {
       } catch {
         throw new Error("Invalid JSON received on stdin");
       }
-      configPath = path14.resolve(process.cwd(), "stdin.config.json");
+      configPath = path15.resolve(process.cwd(), "stdin.config.json");
     } else {
       const file = options.config || "bundle.config.json";
       configPath = resolveAsset(file, "config");
@@ -3879,18 +4029,18 @@ async function bundleCommand(options) {
       flowSettings,
       buildOptions,
       flowName,
-      isMultiFlow
+      isMultiFlow,
+      configDigest: configDigest2
     } of configsToBundle) {
       try {
         if (options.cache !== void 0) {
           buildOptions.cache = options.cache;
         }
-        applyCollectorProvenance(flowSettings, flowName, options.release);
         const outputIsUrl = options.output ? isUrl(options.output) : false;
         const uploadUrl = outputIsUrl ? options.output : void 0;
         if (outputIsUrl) {
           const ext = buildOptions.platform === "browser" ? ".js" : ".mjs";
-          buildOptions.output = path14.join(
+          buildOptions.output = path15.join(
             await tmpRunDir("bundle"),
             `bundle${ext}`
           );
@@ -3914,19 +4064,20 @@ async function bundleCommand(options) {
           flowSettings,
           buildOptions,
           logger,
-          shouldCollectStats
+          shouldCollectStats === true,
+          { flowName, release: options.release, configDigest: configDigest2 }
         );
         results.push({ flowName, success: true, stats });
         if (uploadUrl) {
           await uploadBundleToUrl(buildOptions.output, uploadUrl);
           logger.info(`Uploaded to: ${sanitizeUrl(uploadUrl)}`);
-          await fs15.remove(path14.dirname(buildOptions.output));
+          await fs16.remove(path15.dirname(buildOptions.output));
         }
         if (!options.json && !options.all && options.stats && stats) {
           displayStats(stats, logger);
         }
         if (writingToStdout && !options.json) {
-          const bundleContent = await fs15.readFile(buildOptions.output);
+          const bundleContent = await fs16.readFile(buildOptions.output);
           await writeResult(bundleContent, {});
           if (process.stdout.isTTY) {
             const defaultPath = buildOptions.platform === "browser" ? "./dist/walker.js" : "./dist/flow.mjs";
@@ -4009,7 +4160,7 @@ async function bundle(configOrPath, options = {}) {
     );
   }
   let rawConfig;
-  let configPath = path14.resolve(process.cwd(), "walkeros.config.json");
+  let configPath = path15.resolve(process.cwd(), "walkeros.config.json");
   if (typeof configOrPath === "string") {
     configPath = resolveAsset(configOrPath, "config");
     rawConfig = await loadJsonConfig(configPath);
@@ -4022,13 +4173,12 @@ async function bundle(configOrPath, options = {}) {
     withDev: preset.withDev,
     externalizeDev: preset.externalizeDev
   };
-  const { flowSettings, buildOptions, flowName } = loadBundleConfig(rawConfig, {
+  const { flowSettings, buildOptions, flowName, configDigest: configDigest2 } = loadBundleConfig(rawConfig, {
     configPath,
     flowName: options.flowName,
     buildOverrides: mergedOverrides,
     buildEnv: options.buildEnv
   });
-  applyCollectorProvenance(flowSettings, flowName, options.release);
   if (options.cache !== void 0) {
     buildOptions.cache = options.cache;
   }
@@ -4037,13 +4187,14 @@ async function bundle(configOrPath, options = {}) {
     flowSettings,
     buildOptions,
     logger,
-    options.stats ?? false
+    options.stats ?? false,
+    { flowName, release: options.release, configDigest: configDigest2 }
   );
 }
 
 // src/commands/push/index.ts
-import path17 from "path";
-import fs17 from "fs-extra";
+import path18 from "path";
+import fs18 from "fs-extra";
 import { createIngest, getPlatform as getPlatform3, stepId } from "@walkeros/core";
 import {
   enrichEvent,
@@ -4054,7 +4205,7 @@ import {
 } from "@walkeros/collector";
 
 // src/core/redact-line.ts
-import { scrubSecrets, redactLine } from "@walkeros/core/node";
+import { scrubJson, scrubSecrets, redactLine } from "@walkeros/core/node";
 
 // src/core/to-printable.ts
 import { toPrintable } from "@walkeros/core/node";
@@ -4251,7 +4402,7 @@ function applyOverrides(config, overrides) {
 }
 
 // src/commands/push/flow-context.ts
-import path15 from "path";
+import path16 from "path";
 import { pathToFileURL } from "url";
 import { JSDOM, VirtualConsole } from "jsdom";
 
@@ -4310,7 +4461,7 @@ function installTimerInterception(options = {}) {
   if (options.domWindow && options.domWindow !== globalThis) {
     patchTarget(options.domWindow);
   }
-  const drainMicrotasks = () => new Promise((resolve3) => realSetTimeout(resolve3, 0));
+  const drainMicrotasks = () => new Promise((resolve5) => realSetTimeout(resolve5, 0));
   async function flush(wallTimeout = 5e3) {
     const deadline = Date.now() + wallTimeout;
     const maxIterations = 100;
@@ -4405,7 +4556,12 @@ var DOM_GLOBALS = [
   "CustomEvent",
   "Event",
   "localStorage",
-  "sessionStorage"
+  "sessionStorage",
+  "Node",
+  "Element",
+  "HTMLElement",
+  "Document",
+  "ShadowRoot"
 ];
 function exposeDomGlobals(domWindow) {
   const saved = DOM_GLOBALS.map(
@@ -4495,7 +4651,7 @@ async function withFlowContext(options, fn, onError) {
         vm.runInThisContext(snapshotCode);
       }
     }
-    const fileUrl = pathToFileURL(path15.resolve(esmPath)).href;
+    const fileUrl = pathToFileURL(path16.resolve(esmPath)).href;
     const module = await import(`${fileUrl}?t=${Date.now()}`);
     const { wireConfig, startFlow: startFlow2 } = module;
     if (typeof wireConfig !== "function" || typeof startFlow2 !== "function") {
@@ -4618,14 +4774,44 @@ function buildSimulationResult(args) {
 }
 
 // src/commands/push/prepare.ts
-import path16 from "path";
-import fs16 from "fs-extra";
+import path17 from "path";
+import fs17 from "fs-extra";
 import { getPlatform as getPlatform2 } from "@walkeros/core";
+
+// src/core/known-secrets.ts
+import { REF_SECRET } from "@walkeros/core";
+function collectKnownSecrets(flow, env = process.env) {
+  const names = /* @__PURE__ */ new Set();
+  collectSecretNames(flow, names);
+  const values = /* @__PURE__ */ new Set();
+  for (const name of names) {
+    const value = env[name];
+    if (value) values.add(value);
+  }
+  return [...values];
+}
+function collectSecretNames(value, names) {
+  if (typeof value === "string") {
+    const match = value.match(REF_SECRET);
+    if (match) names.add(match[1]);
+    return;
+  }
+  if (Array.isArray(value)) {
+    for (const item of value) collectSecretNames(item, names);
+    return;
+  }
+  if (value && typeof value === "object") {
+    for (const item of Object.values(value)) collectSecretNames(item, names);
+  }
+}
+
+// src/commands/push/prepare.ts
 async function prepareFlow(input) {
   const logger = createCLILogger({
     silent: input.silent,
     verbose: input.verbose,
-    stderr: input.json
+    stderr: input.json,
+    knownSecrets: collectKnownSecrets(input.config)
   });
   logger.debug("Loading flow configuration");
   const { flowSettings, buildOptions } = loadBundleConfig(input.config, {
@@ -4649,7 +4835,7 @@ async function prepareFlow(input) {
   }
   logger.debug("Bundling flow configuration");
   const tempDir = await tmpRunDir("push");
-  const bundlePath = path16.join(tempDir, "flow.mjs");
+  const bundlePath = path17.join(tempDir, "flow.mjs");
   const pushBuildOptions = {
     ...buildOptions,
     output: bundlePath,
@@ -4666,7 +4852,7 @@ async function prepareFlow(input) {
     overrides,
     flowSettings,
     cleanup: async () => {
-      await fs16.remove(tempDir).catch(() => {
+      await fs17.remove(tempDir).catch(() => {
       });
     }
   };
@@ -4710,51 +4896,6 @@ function dispatchSimulate(flags) {
   return { kind: plan.kind, ids: plan.ids };
 }
 
-// src/core/known-secrets.ts
-import { REF_SECRET } from "@walkeros/core";
-function collectKnownSecrets(flow, env = process.env) {
-  const names = /* @__PURE__ */ new Set();
-  collectSecretNames(flow, names);
-  const values = /* @__PURE__ */ new Set();
-  for (const name of names) {
-    const value = env[name];
-    if (value) values.add(value);
-  }
-  return [...values];
-}
-function collectSecretNames(value, names) {
-  if (typeof value === "string") {
-    const match = value.match(REF_SECRET);
-    if (match) names.add(match[1]);
-    return;
-  }
-  if (Array.isArray(value)) {
-    for (const item of value) collectSecretNames(item, names);
-    return;
-  }
-  if (value && typeof value === "object") {
-    for (const item of Object.values(value)) collectSecretNames(item, names);
-  }
-}
-var MIN_KNOWN_LEN = 6;
-function maskKnownNumbers(value, known) {
-  const candidates = known.filter((secret) => secret.length >= MIN_KNOWN_LEN);
-  const mask = (item) => {
-    if (typeof item === "number") {
-      const printed = String(item);
-      return candidates.some((secret) => printed.includes(secret)) ? "***" : item;
-    }
-    if (Array.isArray(item)) return item.map(mask);
-    if (item && typeof item === "object") {
-      const copy = {};
-      for (const [key, entry] of Object.entries(item)) copy[key] = mask(entry);
-      return copy;
-    }
-    return item;
-  };
-  return mask(value);
-}
-
 // src/commands/push/run.ts
 import { isObject as isObject3 } from "@walkeros/core";
 function simulationToPushResult(result) {
@@ -4951,22 +5092,22 @@ async function runDestinationSimulationLoop(config, event, destinationIds, optio
 }
 
 // src/commands/push/dev-examples.ts
-function isRecord(value) {
+function isRecord2(value) {
   return value !== null && typeof value === "object";
 }
 function selectDevExamples(devModule, exportName) {
-  if (!isRecord(devModule)) return void 0;
+  if (!isRecord2(devModule)) return void 0;
   const map = devModule.exportExamples;
-  if (isRecord(map) && exportName !== void 0) {
+  if (isRecord2(map) && exportName !== void 0) {
     const selected = map[exportName];
-    return isRecord(selected) ? selected : void 0;
+    return isRecord2(selected) ? selected : void 0;
   }
   const examples = devModule.examples;
-  return isRecord(examples) ? examples : void 0;
+  return isRecord2(examples) ? examples : void 0;
 }
 function legacyExportRefusal(devModule, packageExports, packageName, exportName) {
   if (exportName === void 0) return void 0;
-  if (isRecord(devModule) && isRecord(devModule.exportExamples))
+  if (isRecord2(devModule) && isRecord2(devModule.exportExamples))
     return void 0;
   if (packageExports) {
     const declared = packageExports[packageName];
@@ -5014,11 +5155,11 @@ function resolveExportName(flow, kind, id) {
 }
 
 // src/commands/push/index.ts
-function isRecord2(value) {
+function isRecord3(value) {
   return value !== null && typeof value === "object";
 }
 function isFlowJson(value) {
-  return isRecord2(value) && isRecord2(value.flows);
+  return isRecord3(value) && isRecord3(value.flows);
 }
 function isString(value) {
   return typeof value === "string";
@@ -5036,9 +5177,9 @@ function getDevEnv(devModule, exportName) {
   const examples = selectDevExamples(devModule, exportName);
   if (!examples || !("env" in examples)) return void 0;
   const env = examples.env;
-  if (!isRecord2(env)) return void 0;
+  if (!isRecord3(env)) return void 0;
   const result = {};
-  if ("push" in env && isRecord2(env.push)) result.push = env.push;
+  if ("push" in env && isRecord3(env.push)) result.push = env.push;
   if ("simulation" in env && isStringArray(env.simulation))
     result.simulation = env.simulation;
   return result;
@@ -5046,14 +5187,14 @@ function getDevEnv(devModule, exportName) {
 async function applyStoreMockEnvs(flowConfig, flowSettings, devExports) {
   const unmocked = [];
   const stores = flowConfig.stores;
-  if (!isRecord2(stores)) return unmocked;
+  if (!isRecord3(stores)) return unmocked;
   for (const [storeId, storeDef] of Object.entries(stores)) {
     const packageName = flowSettings.stores?.[storeId]?.package;
     const loadDev = packageName ? devExports?.[packageName] : void 0;
     const devModule = typeof loadDev === "function" ? await loadDev() : void 0;
     const { exportName } = resolveExportName(flowSettings, "store", storeId);
     const push2 = getDevEnv(devModule, exportName)?.push;
-    if (!push2 || !isRecord2(storeDef)) {
+    if (!push2 || !isRecord3(storeDef)) {
       unmocked.push(storeId);
       continue;
     }
@@ -5065,10 +5206,12 @@ function isStringArray(value) {
   return Array.isArray(value) && value.every(isString);
 }
 async function pushCore(inputPath, event, options = {}) {
+  let known = options.knownSecrets ?? [];
   const logger = createCLILogger({
     silent: options.silent,
     verbose: options.verbose,
-    stderr: options.json
+    stderr: options.json,
+    knownSecrets: () => known
   });
   const startTime = Date.now();
   let tempDir;
@@ -5089,6 +5232,7 @@ async function pushCore(inputPath, event, options = {}) {
     if (detected.type === "config") {
       const raw = options.raw !== void 0 ? options.raw : "content" in detected ? JSON.parse(detected.content) : void 0;
       const knownSecrets = options.knownSecrets ?? (isFlowJson(raw) ? collectKnownSecrets(raw) : []);
+      known = knownSecrets;
       result = await executeConfigPush(
         {
           config: inputPath,
@@ -5129,7 +5273,7 @@ async function pushCore(inputPath, event, options = {}) {
     };
   } finally {
     if (tempDir) {
-      await fs17.remove(tempDir).catch(() => {
+      await fs18.remove(tempDir).catch(() => {
       });
     }
   }
@@ -5145,14 +5289,9 @@ async function pushCommand(options) {
 }
 function renderPushOutput(result, options = {}) {
   const knownSecrets = options.knownSecrets ?? [];
-  return scrubSecrets(
-    options.json ? JSON.stringify(
-      maskKnownNumbers(toPrintable(result), knownSecrets),
-      null,
-      2
-    ) : formatPushResult(result, { knownSecrets }),
-    { known: knownSecrets }
-  );
+  return options.json ? scrubJson(result, { known: knownSecrets, space: 2 }) : scrubSecrets(formatPushResult(result, { knownSecrets }), {
+    known: knownSecrets
+  });
 }
 var MAX_CALL_ARGS_LENGTH = 300;
 function compactJson(value) {
@@ -5206,7 +5345,7 @@ function formatPushResult(result, options = {}) {
   const lines = [];
   lines.push(`success: ${result.success}`);
   if (result.success) {
-    const elbResult = isRecord2(result.elbResult) ? result.elbResult : void 0;
+    const elbResult = isRecord3(result.elbResult) ? result.elbResult : void 0;
     if (elbResult) {
       if (typeof elbResult.id === "string")
         lines.push(`  Event ID: ${elbResult.id}`);
@@ -5260,7 +5399,7 @@ async function executeConfigPush(options, validatedEvent, logger, setTempDir, lo
   logger.debug("Bundling flow configuration");
   const tempDir = await tmpRunDir("push");
   setTempDir(tempDir);
-  const tempPath = path17.join(tempDir, "flow.mjs");
+  const tempPath = path18.join(tempDir, "flow.mjs");
   const pushBuildOptions = {
     ...buildOptions,
     output: tempPath,
@@ -5289,8 +5428,8 @@ async function executeConfigPush(options, validatedEvent, logger, setTempDir, lo
 async function executeBundlePush(bundleContent, platform, validatedEvent, logger, setTempDir, overrides = {}, snapshotCode, flowLogs = {}) {
   const tempDir = await tmpRunDir("push");
   setTempDir(tempDir);
-  const tempPath = path17.join(tempDir, "flow.mjs");
-  await fs17.writeFile(tempPath, bundleContent, "utf8");
+  const tempPath = path18.join(tempDir, "flow.mjs");
+  await fs18.writeFile(tempPath, bundleContent, "utf8");
   logger.debug(`Bundle written to: ${tempPath}`);
   logger.debug(
     `Executing in ${platform} environment (${platform === "web" ? "JSDOM" : "Node.js"})`
@@ -5399,9 +5538,9 @@ function resolvePageUrl(input, pageUrl) {
   return parsed.href;
 }
 function triggerUrl(input) {
-  if (!isRecord2(input) || !isRecord2(input.trigger)) return void 0;
+  if (!isRecord3(input) || !isRecord3(input.trigger)) return void 0;
   const { options } = input.trigger;
-  return isRecord2(options) && isString(options.url) ? options.url : void 0;
+  return isRecord3(options) && isString(options.url) ? options.url : void 0;
 }
 function isSourceInit(value) {
   return typeof value === "function";
@@ -5527,12 +5666,12 @@ async function simulateSource(configOrPath, input, options) {
             `Stores without a mock env run as configured: ${unmockedStores.join(", ")}`
           );
         const wiredSources = flowConfig.sources;
-        const wiredSource = isRecord2(wiredSources) ? wiredSources[options.sourceId] : void 0;
-        const source = isRecord2(
+        const wiredSource = isRecord3(wiredSources) ? wiredSources[options.sourceId] : void 0;
+        const source = isRecord3(
           wiredSource
         ) ? {
           ...wiredSource,
-          ...isRecord2(wiredSource.config) ? { config: { ...wiredSource.config } } : {}
+          ...isRecord3(wiredSource.config) ? { config: { ...wiredSource.config } } : {}
         } : void 0;
         flowConfig.sources = source ? { [options.sourceId]: source } : {};
         const commandCalls = [];
@@ -5546,7 +5685,7 @@ async function simulateSource(configOrPath, input, options) {
             simulation: devEnv.simulation
           });
           source.env = {
-            ...isRecord2(source.env) ? source.env : {},
+            ...isRecord3(source.env) ? source.env : {},
             ...wrappedEnv
           };
           trackedCalls = calls;
@@ -5897,10 +6036,10 @@ async function simulateCollector(configOrPath, event, options) {
   }
 }
 function isConsentRecord(value) {
-  return isRecord2(value) && Object.values(value).every((granted) => typeof granted === "boolean");
+  return isRecord3(value) && Object.values(value).every((granted) => typeof granted === "boolean");
 }
 function pendingRequire(definition) {
-  if (!isRecord2(definition) || !isRecord2(definition.config)) return [];
+  if (!isRecord3(definition) || !isRecord3(definition.config)) return [];
   const { require: require2 } = definition.config;
   return isStringArray(require2) ? require2 : [];
 }
@@ -5970,16 +6109,16 @@ async function simulateDestination(configOrPath, event, options) {
           options.data ?? module.__configData ?? void 0
         );
         const wiredDestinations = flowConfig.destinations;
-        const wiredTarget = isRecord2(wiredDestinations) ? wiredDestinations[options.destinationId] : void 0;
-        if (!isRecord2(wiredTarget)) {
-          const available = isRecord2(wiredDestinations) ? Object.keys(wiredDestinations).join(", ") : "";
+        const wiredTarget = isRecord3(wiredDestinations) ? wiredDestinations[options.destinationId] : void 0;
+        if (!isRecord3(wiredTarget)) {
+          const available = isRecord3(wiredDestinations) ? Object.keys(wiredDestinations).join(", ") : "";
           throw new Error(
             `Destination "${options.destinationId}" not found in collector. Available: ${available || "none"}`
           );
         }
         const target = {
           ...wiredTarget,
-          config: isRecord2(wiredTarget.config) ? { ...wiredTarget.config } : {}
+          config: isRecord3(wiredTarget.config) ? { ...wiredTarget.config } : {}
         };
         flowConfig.destinations = { [options.destinationId]: target };
         if (flowConfig.sources) flowConfig.sources = {};
@@ -6019,7 +6158,7 @@ async function simulateDestination(configOrPath, event, options) {
             );
           }
           const destConfig = target.config;
-          if (isRecord2(destConfig)) {
+          if (isRecord3(destConfig)) {
             destConfig.env = devEnv.push;
           }
           if (devEnv.simulation?.length) {
@@ -6028,7 +6167,7 @@ async function simulateDestination(configOrPath, event, options) {
               simulation: devEnv.simulation
             };
             const { wrappedEnv, calls } = wrapEnv(combined);
-            if (isRecord2(destConfig)) destConfig.env = wrappedEnv;
+            if (isRecord3(destConfig)) destConfig.env = wrappedEnv;
             trackedCalls = calls;
           }
         }
@@ -6115,7 +6254,10 @@ async function simulateDestination(configOrPath, event, options) {
 }
 
 // src/commands/validate/index.ts
+import * as fs20 from "fs";
+import * as path20 from "path";
 import chalk2 from "chalk";
+import { isObject as isObject9 } from "@walkeros/core";
 
 // src/commands/validate/validators/contract.ts
 import { isObject as isObject4 } from "@walkeros/core";
@@ -6242,21 +6384,28 @@ function validateContract(input) {
       }
     }
   }
+  const reportedCycles = /* @__PURE__ */ new Set();
   for (const name of contractNames) {
-    const visited = /* @__PURE__ */ new Set();
+    const chain = [];
     let current = name;
     while (current) {
-      if (visited.has(current)) {
-        errors.push({
-          path: `${name}.extend`,
-          message: `Circular extend chain: ${[...visited, current].join(" \u2192 ")}`,
-          code: "CIRCULAR_EXTENDS"
-        });
+      const start = chain.indexOf(current);
+      if (start !== -1) {
+        const cycle = chain.slice(start);
+        const key = [...cycle].sort().join("\0");
+        if (!reportedCycles.has(key)) {
+          reportedCycles.add(key);
+          errors.push({
+            path: `${cycle[0]}.extend`,
+            message: `Circular extend chain: ${[...cycle, current].join(" \u2192 ")}`,
+            code: "CIRCULAR_EXTENDS"
+          });
+        }
         break;
       }
-      visited.add(current);
+      chain.push(current);
       const entry = contracts[current];
-      current = entry?.extend || "";
+      current = isObject4(entry) && typeof entry.extend === "string" ? entry.extend : "";
     }
   }
   return {
@@ -6323,21 +6472,25 @@ function validateEvent2(input) {
 
 // src/commands/validate/validators/flow.ts
 import {
+  checkWindowCollector as checkWindowCollector2,
+  ENV_MARKER_PREFIX as ENV_MARKER_PREFIX3,
   getByPath,
-  getFlowSettings as getFlowSettings2,
   getRouteGraph,
-  isObject as isObject6,
+  isObject as isObject7,
   REF_CONTRACT,
   resolveContracts,
   validateStepEntry
 } from "@walkeros/core";
-import { schemas as schemas4 } from "@walkeros/core/dev";
+import { schemas as schemas4, validateFlowStructure } from "@walkeros/core/dev";
 import {
   validateEventAgainstContract
 } from "@walkeros/transformer-validate";
 
 // src/commands/validate/scope.ts
 import { isObject as isObject5 } from "@walkeros/core";
+function isFlowJson2(value) {
+  return isObject5(value) && "version" in value && isObject5(value.flows);
+}
 var ENTRY_SECTIONS = [
   "sources",
   "destinations",
@@ -6370,11 +6523,11 @@ function resolveScope(config, options = {}) {
     }
     flows = [options.flow];
   }
-  const path20 = options.path;
-  if (path20 === void 0) {
+  const path23 = options.path;
+  if (path23 === void 0) {
     return { allFlows, flows, entries: [], searchedFlows: [], errors: [] };
   }
-  const parts = path20.split(".");
+  const parts = path23.split(".");
   let sections = ENTRY_SECTIONS;
   let section;
   let key;
@@ -6387,7 +6540,7 @@ function resolveScope(config, options = {}) {
         searchedFlows: [],
         errors: [
           {
-            path: path20,
+            path: path23,
             message: `Section "${parts[0]}" cannot be addressed by --path. Use one of: ${ENTRY_SECTIONS.join(", ")}`,
             code: "UNSUPPORTED_SECTION"
           }
@@ -6407,8 +6560,8 @@ function resolveScope(config, options = {}) {
       searchedFlows: [],
       errors: [
         {
-          path: path20,
-          message: `Invalid path "${path20}". Use "section.key" or just "key"`,
+          path: path23,
+          message: `Invalid path "${path23}". Use "section.key" or just "key"`,
           code: "INVALID_PATH"
         }
       ]
@@ -6436,7 +6589,7 @@ function resolveScope(config, options = {}) {
       target: { key },
       errors: [
         {
-          path: path20,
+          path: path23,
           message: `Ambiguous key "${key}" found in multiple sections: ${matched.join(", ")}. Use dot-notation (e.g., ${matched[0]}.${key})`,
           code: "AMBIGUOUS_ENTRY"
         }
@@ -6453,7 +6606,7 @@ function resolveScope(config, options = {}) {
       target,
       errors: [
         {
-          path: path20,
+          path: path23,
           message: `Entry "${key}" not found in ${section ?? "any section"} of flow(s): ${flows.join(", ") || "none"}`,
           code: "ENTRY_NOT_FOUND"
         }
@@ -6469,9 +6622,9 @@ function resolveScope(config, options = {}) {
     errors: []
   };
 }
-function flowOfPath(path20, flowNames) {
+function flowOfPath(path23, flowNames) {
   return flowNames.find(
-    (name) => path20 === `flows.${name}` || path20.startsWith(`flows.${name}.`)
+    (name) => path23 === `flows.${name}` || path23.startsWith(`flows.${name}.`)
   );
 }
 function describeScope(resolved, checks) {
@@ -6488,93 +6641,554 @@ function describeScope(resolved, checks) {
   return scope;
 }
 
-// src/commands/validate/validators/flow.ts
-var { validateFlowConfig: validateFlowConfig2 } = schemas4;
-function isFlowJson2(value) {
-  if (!isObject6(value)) return false;
-  if (!("version" in value) || !("flows" in value)) return false;
-  return isObject6(value.flows);
-}
-function validateFlow(input, options = {}) {
-  const errors = [];
-  const warnings = [];
-  const skipped = [];
-  const checks = ["file:schema", "flow:schema"];
-  const details = {};
-  let json;
+// src/commands/validate/validators/resolve.ts
+import {
+  FlowCycleError,
+  FlowReferenceError,
+  getFlowSettings as getFlowSettings2,
+  getErrorMessage as getErrorMessage2
+} from "@walkeros/core";
+function resolveFlow2(file, name) {
   try {
-    json = JSON.stringify(input, null, 2);
-  } catch {
-    errors.push({
-      path: "root",
-      message: "Input cannot be serialized to JSON",
-      code: "SERIALIZATION_ERROR"
-    });
-    return { valid: false, type: "flow", errors, warnings, details };
-  }
-  const scope = resolveScope(input, { flow: options.flow });
-  errors.push(...scope.errors);
-  const config = isObject6(input) ? input : {};
-  const flowsValue = config.flows;
-  const flows = isObject6(flowsValue) ? flowsValue : void 0;
-  const allFlows = scope.allFlows;
-  const inScope = (path20) => {
-    const flow = flowOfPath(path20, allFlows);
-    return flow === void 0 || scope.flows.includes(flow);
-  };
-  const coreResult = validateFlowConfig2(json);
-  for (const issue of coreResult.errors) {
-    const path20 = issue.path || "root";
-    if (!inScope(path20)) continue;
-    errors.push({ path: path20, message: issue.message, code: "SCHEMA_VALIDATION" });
+    const flow = getFlowSettings2(file, name, { deferred: true });
+    return { ok: true, flow };
+  } catch (error) {
+    return {
+      ok: false,
+      error: {
+        path: `flows.${name}`,
+        message: getErrorMessage2(error),
+        code: resolutionCode(error)
+      }
+    };
   }
-  for (const issue of coreResult.warnings) {
-    const path20 = issue.path || "root";
-    if (!inScope(path20)) continue;
-    warnings.push({ path: path20, message: issue.message, code: "CONFIG_WARNING" });
+}
+function resolutionCode(error) {
+  if (error instanceof FlowReferenceError) return error.code;
+  if (error instanceof FlowCycleError) return error.code;
+  return "UNRESOLVED_REFERENCE";
+}
+
+// src/commands/validate/validators/settings.ts
+import * as fs19 from "fs";
+import * as path19 from "path";
+import Ajv from "ajv";
+import {
+  ENV_MARKER_PREFIX as ENV_MARKER_PREFIX2,
+  fetchPackage,
+  getErrorMessage as getErrorMessage3,
+  isObject as isObject6,
+  REF_CODE_PREFIX,
+  REF_STORE,
+  SECRET_MARKER_PREFIX as SECRET_MARKER_PREFIX3
+} from "@walkeros/core";
+var CLIENT_HEADER = "walkeros-cli/4.7.0";
+function createSettingsContext(configDir) {
+  return { configDir, cache: /* @__PURE__ */ new Map(), compiled: /* @__PURE__ */ new Map() };
+}
+function selectSettingsSchema(pkg, packageLabel, exportName) {
+  if (exportName === void 0) return { ok: true, settings: pkg.settings };
+  if (pkg.exportSchemas) {
+    const entry = Object.prototype.hasOwnProperty.call(
+      pkg.exportSchemas,
+      exportName
+    ) ? pkg.exportSchemas[exportName] : void 0;
+    if (!isObject6(entry))
+      return {
+        ok: false,
+        reason: `${packageLabel} has no export "${exportName}"`
+      };
+    return { ok: true, settings: entry.settings };
   }
-  if (flows && allFlows.length === 0) {
-    errors.push({
-      path: "flows",
-      message: "At least one flow is required",
-      code: "EMPTY_FLOWS"
-    });
+  if (pkg.exports && pkg.exports.length < 2)
+    return { ok: true, settings: pkg.settings };
+  return {
+    ok: false,
+    reason: `${packageLabel} predates per-export settings schemas; the step imports "${exportName}"`
+  };
+}
+var SECTION_KIND = {
+  sources: "source",
+  transformers: "transformer",
+  destinations: "destination",
+  stores: "store"
+};
+function pointerSegments(pointer) {
+  if (pointer === "") return [];
+  return pointer.split("/").slice(1).map((segment) => segment.replace(/~1/g, "/").replace(/~0/g, "~"));
+}
+function valueAt(root, segments) {
+  let current = root;
+  for (const segment of segments) {
+    if (Array.isArray(current)) current = current[Number(segment)];
+    else if (isObject6(current)) current = current[segment];
+    else return void 0;
   }
-  checks.push("flow:steps");
-  for (const flowName of scope.flows) {
-    const flowValue = flows?.[flowName];
-    if (!isObject6(flowValue)) continue;
-    const transformersValue = flowValue.transformers;
-    if (!isObject6(transformersValue)) continue;
-    for (const [name, transformerValue] of Object.entries(transformersValue)) {
-      if (!isObject6(transformerValue)) continue;
-      const result = validateStepEntry(transformerValue, "Transformer");
-      if (!result.ok) {
-        errors.push({
-          path: `flows.${flowName}.transformers.${name}`,
-          message: result.reason || "Invalid transformer entry.",
-          code: result.code
-        });
-      }
+  return current;
+}
+var MARKER = ENV_MARKER_PREFIX2.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+var ENV_MARKER = new RegExp(
+  `${MARKER}([a-zA-Z_][a-zA-Z0-9_]*)(?::((?:(?!${MARKER})[^\\s"'])*))?`,
+  "g"
+);
+function prepareSettings(settings) {
+  const deferred = [];
+  const walk = (value, segments) => {
+    if (Array.isArray(value))
+      return value.map((item, index) => walk(item, [...segments, `${index}`]));
+    if (isObject6(value))
+      return Object.fromEntries(
+        Object.entries(value).map(([key, item]) => [
+          key,
+          walk(item, [...segments, key])
+        ])
+      );
+    if (typeof value !== "string") return value;
+    if (value.startsWith(SECRET_MARKER_PREFIX3)) {
+      deferred.push({
+        segments,
+        reference: `$secret.${value.slice(SECRET_MARKER_PREFIX3.length)}`
+      });
+      return value;
+    }
+    if (value.includes(ENV_MARKER_PREFIX2)) {
+      let runtimeOnly = false;
+      const withDefaults = value.replace(
+        ENV_MARKER,
+        (_match, _name, fallback) => {
+          if (fallback === void 0) runtimeOnly = true;
+          return fallback ?? "";
+        }
+      );
+      if (!runtimeOnly) return withDefaults;
+      deferred.push({
+        segments,
+        reference: value.replace(
+          ENV_MARKER,
+          (_match, name, fallback) => fallback === void 0 ? `$env.${name}` : `$env.${name}:${fallback}`
+        )
+      });
+      return value;
+    }
+    if (REF_STORE.test(value) || value.startsWith(REF_CODE_PREFIX)) {
+      deferred.push({ segments, reference: value });
+    }
+    return value;
+  };
+  return { value: walk(settings, []), deferred };
+}
+function isUnder(segments, prefix) {
+  return prefix.every((segment, index) => segments[index] === segment);
+}
+function bundlePin(rawFlow, name) {
+  const config = isObject6(rawFlow) ? rawFlow.config : void 0;
+  const bundle2 = isObject6(config) ? config.bundle : void 0;
+  const packages = isObject6(bundle2) ? bundle2.packages : void 0;
+  const pin = isObject6(packages) ? packages[name] : void 0;
+  if (!isObject6(pin)) return {};
+  return {
+    ...typeof pin.version === "string" ? { version: pin.version } : {},
+    ...typeof pin.path === "string" ? { path: pin.path } : {}
+  };
+}
+function packageSource(spec, rawFlow) {
+  if (spec.startsWith(".") || spec.startsWith("/"))
+    return { name: spec, localPath: spec };
+  const { name, version } = parsePackageSpec(spec);
+  const pin = bundlePin(rawFlow, name);
+  if (pin.path) return { name, localPath: pin.path };
+  const pinned = pin.version ?? version;
+  return pinned ? { name, version: pinned } : { name };
+}
+function readJson2(file) {
+  return JSON.parse(fs19.readFileSync(file, "utf-8"));
+}
+function readLocalSchema(source, configDir) {
+  const localPath = source.localPath ?? "";
+  const root = path19.isAbsolute(localPath) ? localPath : path19.resolve(configDir, localPath);
+  const file = [
+    path19.join(root, "dist", "walkerOS.json"),
+    path19.join(root, "walkerOS.json")
+  ].find((candidate) => fs19.existsSync(candidate));
+  if (!file) throw new Error(`no walkerOS.json under ${root}`);
+  const meta = readJson2(file);
+  const pkgFile = path19.join(root, "package.json");
+  const pkg = fs19.existsSync(pkgFile) ? readJson2(pkgFile) : void 0;
+  const schemas6 = isObject6(meta) ? meta.schemas : void 0;
+  const exportSchemas = isObject6(meta) ? meta.exportSchemas : void 0;
+  const declared = isObject6(meta) && isObject6(meta.$meta) ? meta.$meta.exports : void 0;
+  const version = isObject6(pkg) && typeof pkg.version === "string" ? pkg.version : void 0;
+  return {
+    ...version ? { version } : {},
+    settings: isObject6(schemas6) ? schemas6.settings : void 0,
+    ...isObject6(exportSchemas) ? { exportSchemas } : {},
+    ...isObject6(declared) ? { exports: Object.keys(declared) } : {}
+  };
+}
+async function loadSchema(source, context2) {
+  if (source.localPath !== void 0) {
+    const configDir = context2.configDir;
+    if (configDir === void 0)
+      throw new Error(
+        "it is a local path package and the input is not a file, so there is no directory to read it from"
+      );
+    return readLocalSchema(source, configDir);
+  }
+  const info = await fetchPackage(source.name, {
+    ...source.version ? { version: source.version } : {},
+    client: CLIENT_HEADER
+  });
+  return {
+    version: info.version,
+    settings: info.schemas.settings,
+    ...info.exportSchemas ? { exportSchemas: info.exportSchemas } : {},
+    ...info.exports ? { exports: Object.keys(info.exports) } : {}
+  };
+}
+function compileSettings(settings) {
+  if (!isObject6(settings)) return void 0;
+  const ajv = new Ajv({ allErrors: true, validateFormats: false });
+  try {
+    return { ok: true, validate: ajv.compile(settings) };
+  } catch (error) {
+    return { ok: false, message: getErrorMessage3(error) };
+  }
+}
+function sourceKey(source) {
+  return source.localPath ? `path:${source.localPath}` : `${source.name}@${source.version ?? "latest"}`;
+}
+function cachedSchema(source, context2) {
+  const key = sourceKey(source);
+  let pending = context2.cache.get(key);
+  if (!pending) {
+    pending = loadSchema(source, context2);
+    context2.cache.set(key, pending);
+  }
+  return pending;
+}
+function cachedCompile(source, exportName, settings, context2) {
+  const key = `${sourceKey(source)}#${exportName ?? ""}`;
+  if (context2.compiled.has(key)) return context2.compiled.get(key);
+  const compiled = compileSettings(settings);
+  context2.compiled.set(key, compiled);
+  return compiled;
+}
+async function checkStepSettings(target, resolvedFlow, rawFlow, check, context2) {
+  const at = `flows.${target.flow}.${target.section}.${target.key}`;
+  const outcome = { findings: [], skipped: [], deferred: [] };
+  const spec = typeof target.entry.package === "string" ? target.entry.package : "";
+  if (!spec) {
+    outcome.skipped.push({
+      path: at,
+      check,
+      reason: "No package field, so there is no settings schema to fetch",
+      code: "NO_PACKAGE"
+    });
+    return outcome;
+  }
+  const source = packageSource(spec, rawFlow);
+  let schema;
+  try {
+    schema = await cachedSchema(source, context2);
+  } catch (error) {
+    outcome.skipped.push({
+      path: at,
+      check,
+      reason: `Schema for ${source.name}${source.version ? `@${source.version}` : ""} could not be loaded: ${getErrorMessage3(error)}`,
+      code: "SCHEMA_UNAVAILABLE"
+    });
+    return outcome;
+  }
+  outcome.checked = {
+    path: at,
+    package: source.name,
+    ...schema.version ? { version: schema.version } : {}
+  };
+  const { exportName } = resolveExportName(
+    resolvedFlow,
+    SECTION_KIND[target.section],
+    target.key
+  );
+  const version = schema.version ?? source.version;
+  const selection = selectSettingsSchema(
+    schema,
+    version ? `${source.name}@${version}` : source.name,
+    exportName
+  );
+  if (!selection.ok) {
+    outcome.skipped.push({
+      path: at,
+      check,
+      reason: selection.reason,
+      code: "NO_SETTINGS_SCHEMA"
+    });
+    return outcome;
+  }
+  const compiled = cachedCompile(
+    source,
+    exportName,
+    selection.settings,
+    context2
+  );
+  if (!compiled) {
+    outcome.skipped.push({
+      path: at,
+      check,
+      reason: `Package ${source.name} has no settings schema`,
+      code: "NO_SETTINGS_SCHEMA"
+    });
+    return outcome;
+  }
+  if (!compiled.ok) {
+    outcome.skipped.push({
+      path: at,
+      check,
+      reason: `The settings schema of ${source.name} cannot be compiled: ${compiled.message}`,
+      code: "SCHEMA_UNAVAILABLE"
+    });
+    return outcome;
+  }
+  const validate2 = compiled.validate;
+  const step = stepOf(resolvedFlow, target.section, target.key);
+  const config = isObject6(step?.config) ? step.config : {};
+  const prepared = prepareSettings(config.settings ?? {});
+  const base = `${at}.config.settings`;
+  for (const { segments, reference } of prepared.deferred) {
+    outcome.deferred.push({
+      path: [base, ...segments].join("."),
+      reference
+    });
+  }
+  if (validate2(prepared.value)) return outcome;
+  for (const e of validate2.errors || []) {
+    const segments = pointerSegments(e.instancePath);
+    if (prepared.deferred.some((d) => isUnder(segments, d.segments))) continue;
+    const finding = {
+      path: [base, ...segments].join("."),
+      message: describeAjvError(e),
+      code: "ENTRY_SCHEMA",
+      keyword: e.keyword
+    };
+    if (segments.length > 0) finding.value = valueAt(prepared.value, segments);
+    outcome.findings.push(finding);
+  }
+  return outcome;
+}
+function describeAjvError(error) {
+  const message = error.message || "Unknown error";
+  const extra = error.params.additionalProperty;
+  return error.keyword === "additionalProperties" && typeof extra === "string" ? `${message}: "${extra}"` : message;
+}
+function stepOf(flow, section, key) {
+  switch (section) {
+    case "sources":
+      return flow.sources?.[key];
+    case "destinations":
+      return flow.destinations?.[key];
+    case "transformers":
+      return flow.transformers?.[key];
+    case "stores":
+      return flow.stores?.[key];
+  }
+}
+
+// src/commands/validate/validators/flow.ts
+var { validateFlowConfig: validateFlowConfig2 } = schemas4;
+var DEPRECATED_PACKAGES = {
+  "@walkeros/store-memory": "has been removed. Use the built-in cache by omitting cache.store, or remove the store declaration if it was only used as a cache target."
+};
+var OPEN_STEP_KINDS = [
+  ["destinations", "Destination"],
+  ["stores", "Store"]
+];
+async function validateFlowWithPackages(input, options = {}) {
+  const run = runFlowChecks(input, options);
+  const { result, scope } = run;
+  if (options.offline) {
+    const described = describeScope(scope, run.checks);
+    described.offline = true;
+    result.details.scope = described;
+    return result;
+  }
+  run.checks.push("flow:package-settings");
+  const context2 = createSettingsContext(options.configDir);
+  const deferred = [];
+  const packages = [];
+  const pending = [];
+  for (const name of scope.flows) {
+    const flow = run.resolved.get(name);
+    const rawFlow = run.typed?.flows[name];
+    const reason = run.gate(name);
+    if (!flow || !rawFlow || reason) {
+      run.skipped.push({
+        path: `flows.${name}`,
+        check: "flow:package-settings",
+        reason: reason ?? `flows.${name} did not resolve`,
+        code: "GATED_BY_ERRORS"
+      });
+      continue;
+    }
+    for (const section of ENTRY_SECTIONS) {
+      const steps = isObject7(rawFlow[section]) ? rawFlow[section] : {};
+      for (const [key, entry] of Object.entries(steps)) {
+        if (!isObject7(entry) || entry.package === void 0) continue;
+        const target = { flow: name, section, key, entry };
+        pending.push(
+          checkStepSettings(
+            target,
+            flow,
+            rawFlow,
+            "flow:package-settings",
+            context2
+          )
+        );
+      }
+    }
+  }
+  for (const outcome of await Promise.all(pending)) {
+    result.warnings.push(...outcome.findings);
+    run.skipped.push(...outcome.skipped);
+    deferred.push(...outcome.deferred);
+    if (outcome.checked) packages.push(outcome.checked);
+  }
+  result.details.scope = describeScope(scope, run.checks);
+  result.details.deferred = [...result.details.deferred ?? [], ...deferred];
+  if (packages.length > 0) result.details.packages = packages;
+  return result;
+}
+function runFlowChecks(input, options) {
+  const errors = [];
+  const warnings = [];
+  const skipped = [];
+  const checks = ["file:schema", "flow:schema"];
+  const details = {};
+  const resolved = /* @__PURE__ */ new Map();
+  const result = {
+    valid: false,
+    type: "flow",
+    errors,
+    warnings,
+    details
+  };
+  let json;
+  const scope = resolveScope(input, { flow: options.flow });
+  try {
+    json = JSON.stringify(input, null, 2);
+  } catch {
+    errors.push({
+      path: "root",
+      message: "Input cannot be serialized to JSON",
+      code: "SERIALIZATION_ERROR"
+    });
+    return {
+      result,
+      scope,
+      resolved,
+      checks,
+      skipped,
+      gate: () => "the input cannot be serialized"
+    };
+  }
+  errors.push(...scope.errors);
+  const config = isObject7(input) ? input : {};
+  const flowsValue = config.flows;
+  const flows = isObject7(flowsValue) ? flowsValue : void 0;
+  const allFlows = scope.allFlows;
+  const inScope = (path23) => {
+    const flow = flowOfPath(path23, allFlows);
+    return flow === void 0 || scope.flows.includes(flow);
+  };
+  let contractErrors = 0;
+  if ("contract" in config) {
+    checks.push("file:contract");
+    const contract = validateContract(config.contract);
+    contractErrors = contract.errors.length;
+    for (const error of contract.errors)
+      errors.push({ ...error, path: `contract.${error.path}` });
+    for (const warning of contract.warnings)
+      warnings.push({ ...warning, path: `contract.${warning.path}` });
+  }
+  const coreResult = validateFlowConfig2(json);
+  for (const issue of coreResult.errors) {
+    const path23 = issue.path || "root";
+    if (!inScope(path23)) continue;
+    if (path23 === "contract" && contractErrors > 0) continue;
+    errors.push({ path: path23, message: issue.message, code: "SCHEMA_VALIDATION" });
+  }
+  for (const issue of coreResult.warnings) {
+    const path23 = issue.path || "root";
+    if (!inScope(path23)) continue;
+    warnings.push({ path: path23, message: issue.message, code: "CONFIG_WARNING" });
+  }
+  if (flows && allFlows.length === 0) {
+    errors.push({
+      path: "flows",
+      message: "At least one flow is required",
+      code: "EMPTY_FLOWS"
+    });
+  }
+  checks.push("flow:steps");
+  for (const flowName of scope.flows) {
+    const flowValue = flows?.[flowName];
+    if (!isObject7(flowValue)) continue;
+    const transformersValue = flowValue.transformers;
+    if (isObject7(transformersValue)) {
+      for (const [name, transformerValue] of Object.entries(
+        transformersValue
+      )) {
+        if (!isObject7(transformerValue)) continue;
+        const result2 = validateStepEntry(transformerValue, "Transformer");
+        if (!result2.ok) {
+          errors.push({
+            path: `flows.${flowName}.transformers.${name}`,
+            message: result2.reason || "Invalid transformer entry.",
+            code: result2.code
+          });
+        }
+      }
+    }
+    for (const [section, kind] of OPEN_STEP_KINDS) {
+      const steps = flowValue[section];
+      if (!isObject7(steps)) continue;
+      for (const [name, step] of Object.entries(steps)) {
+        if (!isObject7(step)) continue;
+        const at = `flows.${flowName}.${section}.${name}`;
+        for (const key of unknownStepKeys(step, kind)) {
+          warnings.push({
+            path: `${at}.${key}`,
+            message: `Unknown key "${key}" on ${kind} is ignored by the runtime`,
+            suggestion: "Remove the key, or move it to where it belongs.",
+            code: "UNKNOWN_KEY"
+          });
+        }
+        const pkg = step.package;
+        if (typeof pkg === "string" && pkg in DEPRECATED_PACKAGES) {
+          warnings.push({
+            path: at,
+            message: `${kind} "${name}" uses ${pkg}, which ${DEPRECATED_PACKAGES[pkg]}`,
+            code: "DEPRECATED_PACKAGE"
+          });
+        }
+      }
     }
   }
-  if (flows) {
-    details.flowNames = allFlows;
-    details.flowCount = allFlows.length;
-  }
+  if (flows) {
+    details.flowNames = allFlows;
+    details.flowCount = allFlows.length;
+  }
   checks.push("flow:package-versions");
   let totalPackageCount = 0;
   for (const flowName of scope.flows) {
     const flowValue = flows?.[flowName];
-    if (!isObject6(flowValue)) continue;
+    if (!isObject7(flowValue)) continue;
     const flowConfig = flowValue.config;
-    if (!isObject6(flowConfig)) continue;
+    if (!isObject7(flowConfig)) continue;
     const bundle2 = flowConfig.bundle;
-    if (!isObject6(bundle2)) continue;
+    if (!isObject7(bundle2)) continue;
     const packages = bundle2.packages;
-    if (!isObject6(packages)) continue;
+    if (!isObject7(packages)) continue;
     for (const [pkgName, pkgConfigValue] of Object.entries(packages)) {
-      if (!isObject6(pkgConfigValue)) continue;
+      if (!isObject7(pkgConfigValue)) continue;
       if (!pkgConfigValue.version && !pkgConfigValue.path) {
         warnings.push({
           path: `flows.${flowName}.config.bundle.packages.${pkgName}`,
@@ -6594,10 +7208,8 @@ function validateFlow(input, options = {}) {
   }
   const typed = isFlowJson2(input) ? input : void 0;
   const gate = (name) => {
-    if (!typed || errors.some(
-      (e) => e.code === "SCHEMA_VALIDATION" && flowOfPath(e.path, allFlows) === void 0
-    ))
-      return "file-level schema errors: the file shape is not valid";
+    if (!typed || errors.some((e) => flowOfPath(e.path, allFlows) === void 0))
+      return "file-level errors: the file shape or its contract is not valid";
     if (errors.some((e) => flowOfPath(e.path, allFlows) === name))
       return `earlier errors in flows.${name}`;
     return void 0;
@@ -6621,9 +7233,25 @@ function validateFlow(input, options = {}) {
       run(name, flow, typed);
     }
   };
+  perFlow(["flow:structure"], (name, flow, file) => {
+    const structure = validateFlowStructure({
+      ...file,
+      flows: { [name]: flow }
+    });
+    errors.push(...structure.errors);
+  });
   perFlow(["flow:routes"], (name, flow) => {
     lintFlowRoutes(name, flow, errors, warnings);
   });
+  const resolutions = /* @__PURE__ */ new Map();
+  const resolutionOf = (name, file) => {
+    let resolution = resolutions.get(name);
+    if (!resolution) {
+      resolution = resolveFlow2(file, name);
+      resolutions.set(name, resolution);
+    }
+    return resolution;
+  };
   let totalConnections;
   perFlow(
     ["flow:examples", "flow:contract-examples", "flow:mapping-keys"],
@@ -6633,23 +7261,27 @@ function validateFlow(input, options = {}) {
         checkCompatibility(name, conn, errors, warnings);
       }
       totalConnections = (totalConnections ?? 0) + connections.length;
+      const resolution = resolutionOf(name, file);
       for (const [stepName, transformer] of Object.entries(
         flow.transformers || {}
       )) {
         if (!isValidateStep(transformer)) continue;
+        const resolvedConfig = resolution.ok ? resolution.flow.transformers?.[stepName]?.config : void 0;
         checkValidateStepExamples(
           `flows.${name}.transformers.${stepName}`,
           transformer,
           file.contract,
           errors,
           warnings,
-          options.strict === true
+          options.strict === true,
+          skipped,
+          isObject7(resolvedConfig) && isObject7(resolvedConfig.settings) ? resolvedConfig.settings : void 0
         );
       }
       for (const [destName, dest] of Object.entries(flow.destinations || {})) {
-        if (!isObject6(dest.config)) continue;
+        if (!isObject7(dest.config)) continue;
         const mapping = dest.config.mapping;
-        if (!isObject6(mapping)) continue;
+        if (!isObject7(mapping)) continue;
         for (const key of Object.keys(mapping)) {
           if (key.includes(".") && !key.includes(" ")) {
             const parts = key.split(".");
@@ -6667,41 +7299,59 @@ function validateFlow(input, options = {}) {
   if (totalConnections !== void 0) {
     details.connectionsChecked = totalConnections;
   }
-  perFlow(["flow:flow-refs"], (name, _flow, file) => {
-    try {
-      getFlowSettings2(file, name, {
-        deferred: true,
-        // don't fail on missing $env when validating
-        strictFlowRefs: false,
-        onWarning: (message) => {
-          warnings.push({
-            path: `flows.${name}`,
-            message,
-            code: "FLOW_REF_WARNING"
-          });
-        }
-      });
-    } catch (err) {
-      const message = err instanceof Error ? err.message : String(err);
-      if (/Cyclic \$flow reference/.test(message)) {
-        errors.push({
-          path: `flows.${name}`,
-          message,
-          code: "FLOW_CYCLE"
-        });
-      }
+  const deferred = [];
+  perFlow(["flow:resolve"], (name, flow, file) => {
+    const resolution = resolutionOf(name, file);
+    if (!resolution.ok) {
+      errors.push(resolution.error);
+      return;
     }
+    resolved.set(name, resolution.flow);
+    checkResolvedWindowCollector(name, flow, resolution.flow, errors, deferred);
   });
   details.scope = describeScope(scope, checks);
   details.skipped = skipped;
+  details.deferred = deferred;
+  result.valid = errors.length === 0;
   return {
-    valid: errors.length === 0,
-    type: "flow",
-    errors,
-    warnings,
-    details
+    result,
+    scope,
+    typed,
+    resolved,
+    checks,
+    skipped,
+    gate
   };
 }
+function checkResolvedWindowCollector(name, raw, flow, errors, deferred) {
+  const written = raw.config?.settings?.windowCollector;
+  const value = flow.config?.settings?.windowCollector;
+  if (flow.config?.platform !== "web" || typeof written !== "string" || !/\$(?:var|env)\./.test(written))
+    return;
+  const path23 = `flows.${name}.config.settings.windowCollector`;
+  if (typeof value === "string" && value.includes(ENV_MARKER_PREFIX3)) {
+    deferred.push({ path: path23, reference: written });
+    return;
+  }
+  const check = checkWindowCollector2(value);
+  if (check.ok) return;
+  errors.push({
+    path: path23,
+    message: `${JSON.stringify(written)} resolved to ${JSON.stringify(value)}, which ${check.reason}`,
+    code: "SCHEMA_VALIDATION"
+  });
+}
+function unknownStepKeys(step, kind) {
+  const unknown = [];
+  const rest = { ...step };
+  for (; ; ) {
+    const verdict = validateStepEntry(rest, kind);
+    if (verdict.code !== "UNKNOWN_KEY" || verdict.key === void 0) break;
+    unknown.push(verdict.key);
+    Reflect.deleteProperty(rest, verdict.key);
+  }
+  return unknown;
+}
 function routeTargets(spec) {
   if (spec === void 0) return [];
   const targets = /* @__PURE__ */ new Set();
@@ -6772,10 +7422,10 @@ function buildConnectionGraph(config) {
 function checkCompatibility(flowName, conn, errors, warnings) {
   const fromOuts = Object.entries(conn.from.examples).filter(([, ex]) => hasComparableOut(ex.out)).map(([name, ex]) => ({ name, value: ex.out }));
   const toIns = Object.entries(conn.to.examples).filter(([, ex]) => ex.in !== void 0 && !ex.command).map(([name, ex]) => ({ name, value: ex.in }));
-  const path20 = `flows.${flowName}.${conn.from.type}s.${conn.from.name} \u2192 ${conn.to.type}s.${conn.to.name}`;
+  const path23 = `flows.${flowName}.${conn.from.type}s.${conn.from.name} \u2192 ${conn.to.type}s.${conn.to.name}`;
   if (fromOuts.length === 0 || toIns.length === 0) {
     warnings.push({
-      path: path20,
+      path: path23,
       message: "Cannot check compatibility: missing out or in examples",
       suggestion: "Add out examples to the source step or in examples to the target step",
       code: "EXAMPLES_INCOMPLETE"
@@ -6789,7 +7439,7 @@ function checkCompatibility(flowName, conn, errors, warnings) {
   );
   if (!hasMatch) {
     errors.push({
-      path: path20,
+      path: path23,
       message: "No compatible out/in pair found between connected steps",
       code: "INCOMPATIBLE_EXAMPLES"
     });
@@ -6799,21 +7449,21 @@ function isStepOut(value) {
   return Array.isArray(value) && value.every((entry) => Array.isArray(entry) && typeof entry[0] === "string");
 }
 function returnedEvents(value) {
-  if (isObject6(value)) return [isObject6(value.event) ? value.event : value];
+  if (isObject7(value)) return [isObject7(value.event) ? value.event : value];
   if (Array.isArray(value)) return value.flatMap(returnedEvents);
   return [];
 }
 function outEvents(out) {
   if (isStepOut(out)) {
     return out.flatMap(([head, first]) => {
-      if (head === "elb") return isObject6(first) ? [first] : [];
+      if (head === "elb") return isObject7(first) ? [first] : [];
       if (head === "return") return returnedEvents(first);
       return [];
     });
   }
   if (Array.isArray(out) || typeof out === "string")
     return out.length > 0 ? [out] : [];
-  return isObject6(out) && Object.keys(out).length > 0 ? [out] : [];
+  return isObject7(out) && Object.keys(out).length > 0 ? [out] : [];
 }
 function hasComparableOut(out) {
   return outEvents(out).length > 0;
@@ -6850,17 +7500,17 @@ function lintFlowRoutes(flowName, flow, errors, warnings) {
     check(dest.next, `${at}.destinations.${name}.next`);
   }
 }
-function routeAt(spec, path20) {
+function routeAt(spec, path23) {
   let current = spec;
-  for (const key of path20) {
+  for (const key of path23) {
     if (typeof key === "number")
       current = Array.isArray(current) ? current[key] : void 0;
-    else current = isObject6(current) ? current[key] : void 0;
+    else current = isObject7(current) ? current[key] : void 0;
   }
   return current;
 }
 function lintRoute(spec, position, known, errors, warnings) {
-  const where = (path20) => path20.length > 0 ? `${position}.${path20.join(".")}` : position;
+  const where = (path23) => path23.length > 0 ? `${position}.${path23.join(".")}` : position;
   const reported = /* @__PURE__ */ new Set();
   const once = (key) => {
     if (reported.has(key)) return false;
@@ -6880,7 +7530,7 @@ function lintRoute(spec, position, known, errors, warnings) {
     if (node.stop && !node.match && node.kind !== "many") {
       const self = routeAt(spec, node.path);
       const list = routeAt(spec, node.path.slice(0, -1));
-      if (isObject6(self) && self.stop === true && typeof last === "number" && Array.isArray(list) && last < list.length - 1 && once(`stop:${where(node.path)}`)) {
+      if (isObject7(self) && self.stop === true && typeof last === "number" && Array.isArray(list) && last < list.length - 1 && once(`stop:${where(node.path)}`)) {
         const at = where(node.path);
         warnings.push({
           path: at,
@@ -6937,38 +7587,73 @@ function resolveStepContracts(entries, contract) {
   if (contract) {
     try {
       resolved = resolveContracts(contract);
-    } catch {
-      return void 0;
+    } catch (error) {
+      return {
+        ok: false,
+        message: `the root contract does not resolve (${error instanceof Error ? error.message : String(error)})`
+      };
     }
   }
   const sources = [];
-  for (const entry of entries) {
-    if (isObject6(entry)) {
+  for (const [index, entry] of entries.entries()) {
+    if (isObject7(entry)) {
       sources.push(entry);
       continue;
     }
-    if (typeof entry !== "string") return void 0;
-    const match = entry.match(REF_CONTRACT);
-    if (!match || !(match[1] in resolved)) return void 0;
+    const match = typeof entry === "string" ? entry.match(REF_CONTRACT) : null;
+    if (!match)
+      return {
+        ok: false,
+        index,
+        message: "an entry must be a $contract reference or a JSON Schema"
+      };
+    if (!(match[1] in resolved))
+      return {
+        ok: false,
+        index,
+        message: `contract "${match[1]}" is not defined in the root contract (defined: ${Object.keys(resolved).join(", ") || "none"})`
+      };
     const rule = match[2] ? getByPath(resolved[match[1]], match[2]) : resolved[match[1]];
-    if (!isObject6(rule)) return void 0;
+    if (!isObject7(rule))
+      return {
+        ok: false,
+        index,
+        message: `${match[0]} does not point at a contract rule object`
+      };
     sources.push(rule);
   }
-  return sources;
-}
-function checkValidateStepExamples(stepPath, step, contract, errors, warnings, strict) {
-  if (!step.examples) return;
-  const settings = isObject6(step.config) && isObject6(step.config.settings) ? step.config.settings : {};
-  if (settings.contract !== void 0 && !Array.isArray(settings.contract))
+  return { ok: true, sources };
+}
+function checkValidateStepExamples(stepPath, step, contract, errors, warnings, strict, skipped, resolvedSettings) {
+  const settings = resolvedSettings ?? (isObject7(step.config) && isObject7(step.config.settings) ? step.config.settings : {});
+  const contractPath = `${stepPath}.config.settings.contract`;
+  if (settings.contract !== void 0 && !Array.isArray(settings.contract)) {
+    if (step.examples)
+      skipped?.push({
+        path: stepPath,
+        check: "flow:contract-examples",
+        reason: "config.settings.contract is not a list, so the step cannot be judged statically",
+        code: "CONTRACT_NOT_STATIC"
+      });
+    return;
+  }
+  const resolution = Array.isArray(settings.contract) ? resolveStepContracts(settings.contract, contract) : { ok: true, sources: [] };
+  if (!resolution.ok) {
+    errors.push({
+      path: resolution.index === void 0 ? contractPath : `${contractPath}.${resolution.index}`,
+      message: `The validate step's contract does not resolve: ${resolution.message}`,
+      code: "UNRESOLVED_CONTRACT"
+    });
     return;
-  const contracts = Array.isArray(settings.contract) ? resolveStepContracts(settings.contract, contract) : [];
-  if (!contracts) return;
+  }
+  if (!step.examples) return;
+  const contracts = resolution.sources;
   const mode = settings.mode === "strict" ? "strict" : "pass";
   const format = settings.format === true;
-  const output = isObject6(settings.output) ? settings.output : {};
+  const output = isObject7(settings.output) ? settings.output : {};
   const isValidPath = typeof output.isValid === "string" ? output.isValid : "source.valid";
   for (const [exName, example] of Object.entries(step.examples)) {
-    if (example.command || !isObject6(example.in)) continue;
+    if (example.command || !isObject7(example.in)) continue;
     if (example.out === void 0) continue;
     const event = example.in;
     const verdict = validateEventAgainstContract(event, void 0, {
@@ -6990,13 +7675,13 @@ function checkValidateStepExamples(stepPath, step, contract, errors, warnings, s
     if (agrees) continue;
     const reason = verdict.isValid ? "the event satisfies the contract" : `the event breaks the contract (${verdict.errors.map((e) => `${e.path || "/"}: ${e.message}`).join("; ")})`;
     const expected = mode === "strict" && !verdict.isValid ? 'drops it (["return", false])' : `passes it on${isValidPath ? ` with ${isValidPath} ${verdict.isValid}` : ""}`;
-    const path20 = `${stepPath}.examples.${exName}.out`;
+    const path23 = `${stepPath}.examples.${exName}.out`;
     const message = `Example out disagrees with the validate step: ${reason}, so with mode "${mode}" the step ${expected}.`;
     if (strict) {
-      errors.push({ path: path20, message, code: "CONTRACT_VIOLATION" });
+      errors.push({ path: path23, message, code: "CONTRACT_VIOLATION" });
     } else {
       warnings.push({
-        path: path20,
+        path: path23,
         message,
         suggestion: "Make the example out show what the validate step does with its settings.",
         code: "CONTRACT_VIOLATION"
@@ -7006,14 +7691,14 @@ function checkValidateStepExamples(stepPath, step, contract, errors, warnings, s
 }
 
 // src/commands/validate/validators/mapping.ts
-import { isObject as isObject7 } from "@walkeros/core";
+import { isObject as isObject8 } from "@walkeros/core";
 import { schemas as schemas5 } from "@walkeros/core/dev";
 var { RuleSchema } = schemas5.MappingSchemas;
 function isRule(value) {
-  return isObject7(value) && RuleSchema.safeParse(value).success;
+  return isObject8(value) && RuleSchema.safeParse(value).success;
 }
 function isNestedActions(key, value) {
-  if (key.includes(" ") || !isObject7(value)) return false;
+  if (key.includes(" ") || !isObject8(value)) return false;
   const rules = Object.values(value);
   return rules.length > 0 && rules.every(
     (rule) => Array.isArray(rule) ? rule.length > 0 && rule.every(isRule) : isRule(rule)
@@ -7023,7 +7708,7 @@ function validateMapping(input) {
   const errors = [];
   const warnings = [];
   const details = {};
-  if (!isObject7(input)) {
+  if (!isObject8(input)) {
     errors.push({
       path: "root",
       message: "Mapping must be an object with event patterns as keys",
@@ -7083,83 +7768,43 @@ function validateMapping(input) {
 }
 
 // src/commands/validate/validators/entry.ts
-import Ajv from "ajv";
-import { fetchPackageSchema, isObject as isObject8 } from "@walkeros/core";
-var CLIENT_HEADER = "walkeros-cli/4.7.0-next-1790722899482";
-function pointerSegments(pointer) {
-  if (pointer === "") return [];
-  return pointer.split("/").slice(1).map((segment) => segment.replace(/~1/g, "/").replace(/~0/g, "~"));
-}
-function valueAt(root, segments) {
-  let current = root;
-  for (const segment of segments) {
-    if (Array.isArray(current)) current = current[Number(segment)];
-    else if (isObject8(current)) current = current[segment];
-    else return void 0;
-  }
-  return current;
-}
-async function checkEntrySettings(target, errors, skipped, packages) {
-  const at = `flows.${target.flow}.${target.section}.${target.key}`;
-  const packageName = typeof target.entry.package === "string" ? target.entry.package : "";
-  if (!packageName) {
-    skipped.push({
-      path: at,
-      check: "entry:settings",
-      reason: "No package field, so there is no settings schema to fetch",
-      code: "NO_PACKAGE"
-    });
-    return;
-  }
-  packages.push({ path: at, package: packageName });
-  let settingsSchema;
-  try {
-    const info = await fetchPackageSchema(packageName, {
-      client: CLIENT_HEADER
-    });
-    settingsSchema = info.schemas?.settings;
-  } catch (error) {
-    skipped.push({
-      path: at,
-      check: "entry:settings",
-      reason: `Schema for ${packageName} could not be fetched: ${error instanceof Error ? error.message : "Unknown error"}`,
-      code: "SCHEMA_UNAVAILABLE"
-    });
-    return;
-  }
-  if (!isObject8(settingsSchema)) {
-    skipped.push({
-      path: at,
-      check: "entry:settings",
-      reason: `Package ${packageName} has no settings schema`,
-      code: "NO_SETTINGS_SCHEMA"
-    });
-    return;
-  }
-  const config = isObject8(target.entry.config) ? target.entry.config : {};
-  const settings = config.settings ?? {};
-  const ajv = new Ajv({ allErrors: true, validateFormats: false });
-  const validate2 = ajv.compile(settingsSchema);
-  if (validate2(settings)) return;
-  for (const e of validate2.errors || []) {
-    const segments = pointerSegments(e.instancePath);
-    const error = {
-      path: [`${at}.config.settings`, ...segments].join("."),
-      message: e.message || "Unknown error",
-      code: "ENTRY_SCHEMA",
-      keyword: e.keyword
-    };
-    if (segments.length > 0) error.value = valueAt(settings, segments);
-    errors.push(error);
-  }
-}
-async function validateEntry(path20, flowConfig, options = {}) {
-  const resolved = resolveScope(flowConfig, { flow: options.flow, path: path20 });
+async function validateEntry(path23, flowConfig, options = {}) {
+  const resolved = resolveScope(flowConfig, { flow: options.flow, path: path23 });
   const errors = [...resolved.errors];
   const skipped = [];
+  const deferred = [];
   const packages = [];
+  const context2 = createSettingsContext(options.configDir);
+  const file = isFlowJson2(flowConfig) ? flowConfig : void 0;
+  const resolutions = /* @__PURE__ */ new Map();
   for (const target of resolved.entries) {
-    await checkEntrySettings(target, errors, skipped, packages);
+    const at = `flows.${target.flow}.${target.section}.${target.key}`;
+    let resolution = resolutions.get(target.flow);
+    if (!resolution && file) {
+      resolution = resolveFlow2(file, target.flow);
+      resolutions.set(target.flow, resolution);
+      if (!resolution.ok) errors.push(resolution.error);
+    }
+    if (!resolution?.ok) {
+      skipped.push({
+        path: at,
+        check: "entry:settings",
+        reason: `flows.${target.flow} does not resolve, so its settings cannot be checked`,
+        code: "GATED_BY_ERRORS"
+      });
+      continue;
+    }
+    const outcome = await checkStepSettings(
+      target,
+      resolution.flow,
+      file?.flows[target.flow],
+      "entry:settings",
+      context2
+    );
+    errors.push(...outcome.findings);
+    skipped.push(...outcome.skipped);
+    deferred.push(...outcome.deferred);
+    if (outcome.checked) packages.push(outcome.checked);
   }
   return {
     valid: errors.length === 0,
@@ -7169,18 +7814,105 @@ async function validateEntry(path20, flowConfig, options = {}) {
     details: {
       scope: describeScope(resolved, ["entry:settings"]),
       skipped,
+      deferred,
       ...packages.length > 0 ? { packages } : {}
     }
   };
 }
 
 // src/commands/validate/types.ts
+var VALIDATE_CODES = [
+  // Input and options
+  "INPUT_ERROR",
+  "SERIALIZATION_ERROR",
+  "OPTION_NOT_APPLICABLE",
+  // Scope (--flow, --path)
+  "FLOW_NOT_FOUND",
+  "ENTRY_NOT_FOUND",
+  "AMBIGUOUS_ENTRY",
+  "UNSUPPORTED_SECTION",
+  "INVALID_PATH",
+  // Flow file
+  "SCHEMA_VALIDATION",
+  "CONFIG_WARNING",
+  "EMPTY_FLOWS",
+  "UNKNOWN_KEY",
+  "CONFLICT",
+  "MISSING_PACKAGE",
+  "OBSOLETE_CODE_STRING",
+  "INVALID_IMPORT",
+  "INVALID_CODE_SHAPE",
+  "PACKAGE_VERSION_MISSING",
+  "DEPRECATED_PACKAGE",
+  "UNKNOWN_ROUTE_TARGET",
+  "ROUTE_DEAD_CODE",
+  "ROUTE_EMPTY_MANY",
+  "ROUTE_SINGLE_MANY",
+  "ROUTE_FIRST_MATCH",
+  "INCOMPATIBLE_EXAMPLES",
+  "EXAMPLES_INCOMPLETE",
+  "CONTRACT_VIOLATION",
+  "MAPPING_DOT_KEY",
+  "FLOW_REF_WARNING",
+  "FLOW_CYCLE",
+  "VAR_CYCLE",
+  // Structure (the bundler's own preflight, validateFlowStructure)
+  "INVALID_COMPONENT_NAME",
+  "INVALID_REFERENCE",
+  "STORE_REFERENCE_NOT_FOUND",
+  // Resolution (getFlowSettings, as the bundler resolves the flow)
+  "UNRESOLVED_REFERENCE",
+  "MISSING_ENV",
+  "WEB_SECRET_REF",
+  "UNRESOLVED_CONTRACT",
+  // Entry settings against the package schema
+  "ENTRY_SCHEMA",
+  // Contract
+  "NO_CONTRACT_SECTION",
+  "INVALID_CONTRACT",
+  "FLAT_CONTRACT_SHAPE",
+  "INVALID_CONTRACT_ENTRY",
+  "UNKNOWN_CONTRACT_KEY",
+  "INVALID_TAGGING",
+  "INVALID_SCHEMA",
+  "INVALID_EXTENDS",
+  "INVALID_SECTION",
+  "INVALID_EVENTS",
+  "CIRCULAR_EXTENDS",
+  "INVALID_ENTITY_KEY",
+  "INVALID_ENTITY",
+  "INVALID_ACTION_KEY",
+  "INVALID_SCHEMA_ENTRY",
+  // Event
+  "NOT_AN_OBJECT",
+  "MISSING_EVENT_NAME",
+  "EMPTY_EVENT_NAME",
+  "INVALID_EVENT_NAME",
+  // Mapping
+  "INVALID_MAPPING_TYPE",
+  "INVALID_EVENT_PATTERN",
+  "INVALID_RULE_TYPE",
+  "CATCH_ALL_NOT_LAST",
+  // Skips (details.skipped[].code)
+  "GATED_BY_ERRORS",
+  "CONTRACT_NOT_STATIC",
+  "NO_PACKAGE",
+  "NO_SETTINGS_SCHEMA",
+  "SCHEMA_UNAVAILABLE"
+];
 var USAGE_CODES = ["OPTION_NOT_APPLICABLE"];
 
 // src/commands/validate/index.ts
 function inapplicableOptions(type, options) {
-  if (type === "flow") return [];
   const errors = [];
+  if (options.offline === true && (type !== "flow" || options.path)) {
+    errors.push({
+      path: "options.offline",
+      message: type === "flow" ? "--offline removes the package settings check, which is all --path checks; drop one of them" : `--offline applies to a whole flow file and does not apply to -t ${type}`,
+      code: "OPTION_NOT_APPLICABLE"
+    });
+  }
+  if (type === "flow") return errors;
   if (options.path !== void 0) {
     errors.push({
       path: "options.path",
@@ -7197,6 +7929,31 @@ function inapplicableOptions(type, options) {
   }
   return errors;
 }
+function validateContractInput(input) {
+  if (!isFlowJson2(input)) return validateContract(input);
+  const contract = isObject9(input) ? input.contract : void 0;
+  if (contract === void 0) {
+    return {
+      valid: false,
+      type: "contract",
+      errors: [
+        {
+          path: "contract",
+          message: "The flow file has no contract section to validate",
+          code: "NO_CONTRACT_SECTION"
+        }
+      ],
+      warnings: [],
+      details: {}
+    };
+  }
+  return validateContract(contract);
+}
+function configDirOf(input) {
+  if (typeof input !== "string") return void 0;
+  const candidate = path20.resolve(input);
+  return fs20.existsSync(candidate) && fs20.statSync(candidate).isFile() ? path20.dirname(candidate) : void 0;
+}
 function withDocumentScope(result, check) {
   return {
     ...result,
@@ -7223,18 +7980,32 @@ async function validate(type, input, options = {}) {
       details: { scope: { flows: [], checks: [] }, skipped: [] }
     };
   }
+  const result = await validateByType(type, input, resolved, options);
+  return options.strict === true ? escalateStrict(result) : result;
+}
+function escalateStrict(result) {
+  const skipped = result.details.skipped ?? [];
+  if (result.warnings.length === 0 && skipped.length === 0) return result;
+  return { ...result, valid: false };
+}
+async function validateByType(type, input, resolved, options) {
   switch (type) {
     case "contract":
-      return withDocumentScope(validateContract(resolved), "contract");
+      return withDocumentScope(validateContractInput(resolved), "contract");
     case "event":
       return withDocumentScope(validateEvent2(resolved), "event");
     case "flow":
       if (options.path !== void 0) {
-        return validateEntry(options.path, resolved, { flow: options.flow });
+        return validateEntry(options.path, resolved, {
+          flow: options.flow,
+          configDir: options.configDir ?? configDirOf(input)
+        });
       }
-      return validateFlow(resolved, {
+      return validateFlowWithPackages(resolved, {
         flow: options.flow,
-        strict: options.strict
+        strict: options.strict,
+        offline: options.offline,
+        configDir: options.configDir ?? configDirOf(input)
       });
     case "mapping":
       return withDocumentScope(validateMapping(resolved), "mapping");
@@ -7255,6 +8026,7 @@ function formatScope(result) {
     );
   }
   parts.push(`${scope.checks.length} check(s): ${scope.checks.join(", ")}`);
+  if (scope.offline) parts.push("offline: package settings not checked");
   return `Scope: ${parts.join("; ")}`;
 }
 function formatResult(result, options) {
@@ -7293,7 +8065,13 @@ function formatResult(result, options) {
       chalk2.gray(`  - skipped ${skip.check} at ${skip.path}: ${skip.reason}`)
     );
   }
-  if (result.valid && skipped.length === 0) {
+  if (options.exitCode === 2) {
+    lines.push(
+      chalk2.red(
+        `  \u2717 Failed under --strict: ${result.warnings.length} warning(s) and ${skipped.length} skipped check(s) count as failures`
+      )
+    );
+  } else if (result.valid && skipped.length === 0) {
     lines.push(chalk2.green(`  \u2713 All checks passed`));
   } else if (result.valid) {
     lines.push(
@@ -7326,16 +8104,18 @@ async function validateCommand(options) {
     const result = await validate(options.type, input, {
       flow: options.flow,
       path: options.path,
-      strict: options.strict
+      strict: options.strict,
+      offline: options.offline
     });
+    exitCode = exitCodeOf(result, options.strict === true);
     if (!options.silent || options.output) {
       const formatted = formatResult(result, {
         json: options.json,
-        verbose: options.verbose
+        verbose: options.verbose,
+        exitCode
       });
       await writeResult(formatted + "\n", { output: options.output });
     }
-    exitCode = exitCodeOf(result, options.strict === true);
   } catch (error) {
     const errorMessage = getErrorMessage(error);
     if (options.json) {
@@ -7347,7 +8127,7 @@ async function validateCommand(options) {
             { path: "input", message: errorMessage, code: "INPUT_ERROR" }
           ],
           warnings: [],
-          details: {}
+          details: { scope: { flows: [], checks: [] }, skipped: [] }
         },
         null,
         2
@@ -7365,10 +8145,10 @@ function exitCodeOf(result, strict) {
     (e) => USAGE_CODES.some((usageCode) => usageCode === e.code)
   ))
     return 3;
-  if (!result.valid) return 1;
+  if (result.errors.length > 0) return 1;
   const skipped = result.details.skipped ?? [];
   if (strict && (result.warnings.length > 0 || skipped.length > 0)) return 2;
-  return 0;
+  return result.valid ? 0 : 1;
 }
 
 // src/commands/login/index.ts
@@ -7386,7 +8166,7 @@ async function openInBrowser(url) {
   await open(url);
 }
 function delay3(ms) {
-  return new Promise((resolve3) => setTimeout(resolve3, ms));
+  return new Promise((resolve5) => setTimeout(resolve5, ms));
 }
 async function loginCommand(options) {
   const logger = createCLILogger(options);
@@ -7450,14 +8230,11 @@ async function completeDeviceLogin(deviceCode, options = {}) {
       break;
     attempts += 1;
     await delay3(intervalMs);
-    const poll = await pollDeviceToken(
-      appUrl,
-      deviceCode,
-      fetchFn,
-      AbortSignal.timeout(Math.max(1, deadline - Date.now()))
-    );
+    const signal = AbortSignal.timeout(Math.max(1, deadline - Date.now()));
+    const poll = await pollDeviceToken(appUrl, deviceCode, fetchFn, signal);
     if (poll.status === "pending") {
       waiting = "pending";
+      if (signal.aborted) break;
       continue;
     }
     if (poll.status === "slow_down") {
@@ -7559,18 +8336,18 @@ async function logout() {
 import createClient from "openapi-fetch";
 
 // src/core/contract.ts
-import { createHash } from "crypto";
+import { createHash as createHash2 } from "crypto";
 import semver4 from "semver";
 var bakedContractVersion = true ? "4.7.0" : PLACEHOLDER;
 var bakedContractHash = true ? "1758bf6b37ad72eb37dd8176f240ae64b16c5b1f9da376cab6357027c835a833" : "";
-function isRecord3(value) {
+function isRecord4(value) {
   return value !== null && typeof value === "object" && !Array.isArray(value);
 }
 function canonicalize(value) {
   if (Array.isArray(value)) {
     return value.map(canonicalize);
   }
-  if (isRecord3(value)) {
+  if (isRecord4(value)) {
     const result = {};
     for (const key of Object.keys(value).sort()) {
       result[key] = canonicalize(value[key]);
@@ -7580,7 +8357,7 @@ function canonicalize(value) {
   return value;
 }
 function stripInfoVersion(doc) {
-  if (!isRecord3(doc) || !isRecord3(doc.info)) {
+  if (!isRecord4(doc) || !isRecord4(doc.info)) {
     return doc;
   }
   const restInfo = {};
@@ -7591,7 +8368,7 @@ function stripInfoVersion(doc) {
 }
 function canonicalContractHash(doc) {
   const canonical = canonicalize(stripInfoVersion(doc));
-  return createHash("sha256").update(JSON.stringify(canonical)).digest("hex");
+  return createHash2("sha256").update(JSON.stringify(canonical)).digest("hex");
 }
 var HEALTH_TIMEOUT_MS = 5e3;
 async function fetchHealth(baseUrl) {
@@ -7601,7 +8378,7 @@ async function fetchHealth(baseUrl) {
     });
     const body = await res.json().catch(() => void 0);
     const result = { reachable: true };
-    if (isRecord3(body)) {
+    if (isRecord4(body)) {
       const record = body;
       if (typeof record.status === "string") result.status = record.status;
       if (typeof record.appVersion === "string")
@@ -8051,19 +8828,17 @@ async function getFlowCommand(flowId, options) {
   );
 }
 async function createFlowCommand(name, options) {
-  const content = options.content ? JSON.parse(options.content) : JSON.parse(await readFlowStdin());
-  await handleResult2(
-    () => createFlow({ name, content, projectId: options.project }),
-    options
-  );
+  await handleResult2(async () => {
+    const content = options.content ? await loadFlowContent(options.content) : JSON.parse(await readFlowStdin());
+    return createFlow({ name, content, projectId: options.project });
+  }, options);
 }
 async function updateFlowCommand(flowId, options) {
-  const content = options.content ? JSON.parse(options.content) : void 0;
   await handleResult2(
-    () => updateFlow({
+    async () => updateFlow({
       flowId,
       name: options.name,
-      content,
+      content: options.content ? await loadFlowContent(options.content) : void 0,
       projectId: options.project
     }),
     options
@@ -8081,6 +8856,9 @@ async function duplicateFlowCommand(flowId, options) {
     options
   );
 }
+function loadFlowContent(input) {
+  return loadJsonConfig(input);
+}
 async function readFlowStdin() {
   if (!isStdinPiped()) {
     throw new Error("Content required: use --content or pipe via stdin");
@@ -8231,7 +9009,7 @@ async function deploySettings(options) {
       if (e instanceof ApiError && e.retryable) {
         const waitSeconds = Math.min(e.retryAfterSeconds ?? 5, 60);
         options.onStatus?.("rate_limited", `retrying in ${waitSeconds}s`);
-        await new Promise((resolve3) => setTimeout(resolve3, waitSeconds * 1e3));
+        await new Promise((resolve5) => setTimeout(resolve5, waitSeconds * 1e3));
         response = await triggerDeploy();
       } else {
         throw e;
@@ -8355,32 +9133,7 @@ async function getDeploymentCommand(flowId, options) {
 }
 
 // src/commands/deployments/index.ts
-import { getPlatform as getPlatform4, isObject as isObject9 } from "@walkeros/core";
-
-// src/version.ts
-import { readFileSync as readFileSync2 } from "fs";
-import { fileURLToPath } from "url";
-import { dirname as dirname3, join as join4 } from "path";
-var versionFilename = fileURLToPath(import.meta.url);
-var versionDirname = dirname3(versionFilename);
-function findPackageJson() {
-  const paths = [
-    join4(versionDirname, "../package.json"),
-    // dist/ or src/
-    join4(versionDirname, "../../package.json")
-    // src/core/ (not used, but safe)
-  ];
-  for (const p of paths) {
-    try {
-      return readFileSync2(p, "utf-8");
-    } catch {
-    }
-  }
-  return JSON.stringify({ version: "0.0.0" });
-}
-var VERSION = JSON.parse(findPackageJson()).version;
-
-// src/commands/deployments/index.ts
+import { getPlatform as getPlatform4, isObject as isObject10 } from "@walkeros/core";
 async function listDeployments(options = {}) {
   const id = options.projectId ?? requireProjectId();
   const params = new URLSearchParams();
@@ -8541,8 +9294,8 @@ async function createDeployCommand(config, options) {
       const flowName = options.flow ?? Object.keys(flows)[0];
       if (!flowName) throw new Error("No flows found in config");
       const flowSettings = flows[flowName];
-      if (!isObject9(flowSettings)) throw new Error("Invalid flow config");
-      const platform = isObject9(flowSettings.config) ? flowSettings.config.platform : void 0;
+      if (!isObject10(flowSettings)) throw new Error("Invalid flow config");
+      const platform = isObject10(flowSettings.config) ? flowSettings.config.platform : void 0;
       if (platform !== "web" && platform !== "server")
         throw new Error(
           `Flow "${flowName}" must have config.platform set to "web" or "server"`
@@ -8664,14 +9417,14 @@ async function feedbackCommand(text) {
   }
 }
 function promptUser(question) {
-  return new Promise((resolve3) => {
+  return new Promise((resolve5) => {
     const rl = createInterface({
       input: process.stdin,
       output: process.stderr
     });
     rl.question(question, (answer) => {
       rl.close();
-      resolve3(answer);
+      resolve5(answer);
     });
   });
 }
@@ -8744,12 +9497,12 @@ function telemetryDisableCommand() {
 }
 
 // src/index.ts
-import { validateFlowStructure } from "@walkeros/core/dev";
+import { validateFlowStructure as validateFlowStructure2 } from "@walkeros/core/dev";
 
 // src/commands/bundle/wrap.ts
-import * as path18 from "path";
+import * as path21 from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
-import fs18 from "fs-extra";
+import fs21 from "fs-extra";
 import * as esbuild3 from "esbuild";
 function extractDevExternals(skeletonText) {
   const pattern = /import\(\s*['"]([^'"]+\/dev)['"]\s*\)/g;
@@ -8761,13 +9514,13 @@ function extractDevExternals(skeletonText) {
   return Array.from(found);
 }
 function getNodeResolutionPaths() {
-  const here = path18.dirname(fileURLToPath2(import.meta.url));
+  const here = path21.dirname(fileURLToPath2(import.meta.url));
   const candidates = [];
   let dir = here;
   for (let i = 0; i < 8; i++) {
-    const candidate = path18.join(dir, "node_modules");
+    const candidate = path21.join(dir, "node_modules");
     candidates.push(candidate);
-    const parent = path18.dirname(dir);
+    const parent = path21.dirname(dir);
     if (parent === dir) break;
     dir = parent;
   }
@@ -8794,11 +9547,11 @@ async function wrapSkeleton(options) {
       `Invalid previewOrigin "${options.preview.previewOrigin}". Must be a bare hostname matching /^[a-z0-9.-]+$/.`
     );
   }
-  if (!await fs18.pathExists(skeletonPath)) {
+  if (!await fs21.pathExists(skeletonPath)) {
     throw new Error(`wrapSkeleton: skeleton not found at ${skeletonPath}`);
   }
-  const absoluteSkeletonPath = path18.resolve(skeletonPath);
-  const skeletonText = await fs18.readFile(absoluteSkeletonPath, "utf-8");
+  const absoluteSkeletonPath = path21.resolve(skeletonPath);
+  const skeletonText = await fs21.readFile(absoluteSkeletonPath, "utf-8");
   const devExternals = extractDevExternals(skeletonText);
   const entryText = platform === "browser" ? generateWrapEntry(absoluteSkeletonPath, {
     ...windowCollector ? { windowCollector } : {},
@@ -8809,10 +9562,10 @@ async function wrapSkeleton(options) {
     ...options.observe ? { observe: options.observe } : {}
   }) : generateWrapEntryServer(absoluteSkeletonPath);
   const entryDir = await tmpRunDir("wrap");
-  const entryPath = path18.join(entryDir, "flow.mjs");
+  const entryPath = path21.join(entryDir, "flow.mjs");
   try {
-    await fs18.writeFile(entryPath, entryText);
-    await fs18.ensureDir(path18.dirname(outputPath));
+    await fs21.writeFile(entryPath, entryText);
+    await fs21.ensureDir(path21.dirname(outputPath));
     const esbuildOptions = {
       entryPoints: [entryPath],
       bundle: true,
@@ -8853,16 +9606,16 @@ async function wrapSkeleton(options) {
     }
     await esbuild3.build(esbuildOptions);
   } finally {
-    await fs18.remove(entryDir).catch(() => {
+    await fs21.remove(entryDir).catch(() => {
     });
   }
 }
 
 // src/commands/bundle/manifest.ts
 import crypto2 from "crypto";
-import path19 from "path";
-import fs19 from "fs-extra";
-import { FlowReferenceError } from "@walkeros/core";
+import path22 from "path";
+import fs22 from "fs-extra";
+import { FlowReferenceError as FlowReferenceError2 } from "@walkeros/core";
 
 // src/schemas/build-manifest.ts
 import { z as z3 } from "@walkeros/core/dev";
@@ -9015,6 +9768,66 @@ var BuildResultSchema = z3.object({
   }).optional()
 }).meta({ id: "BuildResult", title: "walkeros bundle --manifest result" });
 
+// src/commands/bundle/fetch-retry.ts
+var BACKOFF_MS = [1e3, 3e3];
+function defaultSleep(ms) {
+  return new Promise((resolve5) => setTimeout(resolve5, ms));
+}
+function isTransientStatus(status) {
+  return status >= 500 || status === 429;
+}
+function causeDetail(error) {
+  if (!("cause" in error)) return void 0;
+  const cause = error.cause;
+  if (typeof cause !== "object" || cause === null) return void 0;
+  if ("code" in cause && typeof cause.code === "string") return cause.code;
+  if ("name" in cause && typeof cause.name === "string" && cause.name !== "Error") {
+    return cause.name;
+  }
+  return void 0;
+}
+function describeFetchError(failure, timeoutMs) {
+  if (failure instanceof Response) return `HTTP ${failure.status}`;
+  if (typeof failure !== "object" || failure === null) return "fetch failed";
+  if ("name" in failure && failure.name === "TimeoutError") {
+    return timeoutMs === void 0 ? "timed out" : `timed out after ${timeoutMs / 1e3}s`;
+  }
+  const detail = causeDetail(failure);
+  if (detail) return `fetch failed (${detail})`;
+  return "fetch failed";
+}
+async function fetchWithRetry(url, init, options) {
+  const { label, timeoutMs, warn, sleep = defaultSleep } = options;
+  const maxAttempts = BACKOFF_MS.length + 1;
+  for (let attempt = 1; ; attempt++) {
+    let failure;
+    try {
+      const response = await fetch(url, {
+        ...init,
+        signal: AbortSignal.timeout(timeoutMs)
+      });
+      if (response.ok) return response;
+      failure = response;
+    } catch (error) {
+      failure = error;
+    }
+    const reason = describeFetchError(failure, timeoutMs);
+    if (failure instanceof Response && !isTransientStatus(failure.status)) {
+      throw new Error(`${label} failed: ${reason}`);
+    }
+    const delay4 = BACKOFF_MS[attempt - 1];
+    if (delay4 === void 0) {
+      throw new Error(
+        `${label} failed after ${maxAttempts} attempts: ${reason}`
+      );
+    }
+    warn?.(
+      `${label} attempt ${attempt}/${maxAttempts} failed: ${reason}, retrying in ${delay4 / 1e3}s`
+    );
+    await sleep(delay4);
+  }
+}
+
 // src/commands/bundle/manifest.ts
 var BUILD_MANIFEST_ENV = "BUILD_MANIFEST_URL";
 var BuildError = class extends Error {
@@ -9063,7 +9876,7 @@ function assertNoLocalPaths(loaded) {
 }
 function classify(error, phase) {
   if (error instanceof BuildError) return error.code;
-  if (error instanceof FlowReferenceError) {
+  if (error instanceof FlowReferenceError2) {
     return error.code === "MISSING_ENV" ? "MISSING_BUILD_ENV" : "WEB_SECRET_REF";
   }
   if (error instanceof UnsupportedPackageSpecError) {
@@ -9074,20 +9887,17 @@ function classify(error, phase) {
 function isHttpUrl(source) {
   return source.startsWith("http://") || source.startsWith("https://");
 }
-async function readManifestSource(source) {
+async function readManifestSource(source, retry) {
   let text;
   if (isHttpUrl(source)) {
-    const response = await fetch(source, {
-      signal: AbortSignal.timeout(3e4)
-    });
-    if (!response.ok) {
-      throw new Error(
-        `Manifest fetch failed: ${response.status} ${sanitizeUrl(source)}`
-      );
-    }
+    const response = await fetchWithRetry(
+      source,
+      {},
+      { ...retry, label: "Manifest download", timeoutMs: 3e4 }
+    );
     text = await response.text();
   } else {
-    text = await fs19.readFile(source, "utf-8");
+    text = await fs22.readFile(source, "utf-8");
   }
   return JSON.parse(text);
 }
@@ -9098,46 +9908,42 @@ function contentTypeFor(outputName) {
   }
   return "application/javascript";
 }
-async function put(url, body, contentType, headers = {}) {
-  const attempt = async () => {
-    try {
-      return await fetch(url, {
+async function put(url, body, contentType, headers, retry) {
+  try {
+    await fetchWithRetry(
+      url,
+      {
         method: "PUT",
         body,
-        headers: { ...headers, "Content-Type": contentType },
-        signal: AbortSignal.timeout(6e4)
-      });
-    } catch {
-      return void 0;
-    }
-  };
-  let response = await attempt();
-  if (!response || response.status >= 500) response = await attempt();
-  if (!response || !response.ok) {
-    throw new BuildError(
-      "UPLOAD_FAILED",
-      `Upload failed: ${response ? response.status : "network error"} ${sanitizeUrl(url)}`
+        headers: { ...headers, "Content-Type": contentType }
+      },
+      { ...retry, label: "Upload", timeoutMs: 6e4 }
     );
+  } catch (error) {
+    throw new BuildError("UPLOAD_FAILED", getErrorMessage(error));
   }
 }
-async function download(url, dest) {
-  const response = await fetch(url, { signal: AbortSignal.timeout(6e4) });
-  if (!response.ok) {
-    throw new BuildError(
-      "BUILD_FAILED",
-      `Skeleton fetch failed: ${response.status} ${sanitizeUrl(url)}`
+async function download(url, dest, retry) {
+  let response;
+  try {
+    response = await fetchWithRetry(
+      url,
+      {},
+      { ...retry, label: "Skeleton download", timeoutMs: 6e4 }
     );
+  } catch (error) {
+    throw new BuildError("BUILD_FAILED", getErrorMessage(error));
   }
-  await fs19.writeFile(dest, Buffer.from(await response.arrayBuffer()));
+  await fs22.writeFile(dest, Buffer.from(await response.arrayBuffer()));
 }
-async function buildArtifact(manifest, configPath, artifact, workDir, index, outputs) {
-  const output = path19.join(workDir, "out", artifact.outputName);
-  await fs19.ensureDir(path19.dirname(output));
+async function buildArtifact(manifest, configPath, artifact, workDir, index, outputs, retry) {
+  const output = path22.join(workDir, "out", artifact.outputName);
+  await fs22.ensureDir(path22.dirname(output));
   if (artifact.target === "wrap") {
     let skeletonPath;
     if ("url" in artifact.skeleton) {
-      skeletonPath = path19.join(workDir, `skeleton-${index}.mjs`);
-      await download(artifact.skeleton.url, skeletonPath);
+      skeletonPath = path22.join(workDir, `skeleton-${index}.mjs`);
+      await download(artifact.skeleton.url, skeletonPath, retry);
     } else {
       const built = outputs.get(artifact.skeleton.artifact);
       if (!built) {
@@ -9156,8 +9962,8 @@ async function buildArtifact(manifest, configPath, artifact, workDir, index, out
     });
     return output;
   }
-  const scratch = path19.join(workDir, `cli-${index}`);
-  await fs19.ensureDir(scratch);
+  const scratch = path22.join(workDir, `cli-${index}`);
+  await fs22.ensureDir(scratch);
   await bundle(configPath, {
     ...manifest.flowName ? { flowName: manifest.flowName } : {},
     target: artifact.target,
@@ -9170,14 +9976,15 @@ async function buildArtifact(manifest, configPath, artifact, workDir, index, out
   });
   return output;
 }
-async function runBuildManifest(source) {
+async function runBuildManifest(source, retry = {}) {
+  const report = (url, result2) => reportResult(url, result2, retry);
   const result = { ok: false, toolchain: VERSION, artifacts: [] };
   const fail = (code, message, outputName) => {
     result.error = outputName ? { code, message, outputName } : { code, message };
   };
   let raw;
   try {
-    raw = await readManifestSource(source);
+    raw = await readManifestSource(source, retry);
   } catch (error) {
     fail("INVALID_MANIFEST", getErrorMessage(error));
     return { result, reported: false };
@@ -9204,10 +10011,10 @@ async function runBuildManifest(source) {
   }
   const workDir = await tmpRunDir("build");
   try {
-    const configPath = path19.join(workDir, "flow.json");
+    const configPath = path22.join(workDir, "flow.json");
     if (manifest.flowConfig) {
       try {
-        await fs19.writeJson(configPath, manifest.flowConfig);
+        await fs22.writeJson(configPath, manifest.flowConfig);
         const loaded = loadBundleConfig(manifest.flowConfig, {
           configPath,
           flowName: manifest.flowName,
@@ -9231,15 +10038,17 @@ async function runBuildManifest(source) {
           artifact,
           workDir,
           index,
-          outputs
+          outputs,
+          retry
         );
         outputs.set(artifact.outputName, output);
-        const content = await fs19.readFile(output);
+        const content = await fs22.readFile(output);
         await put(
           artifact.putUrl,
           content,
           artifact.contentType ?? contentTypeFor(artifact.outputName),
-          artifact.headers
+          artifact.headers ?? {},
+          retry
         );
         result.artifacts.push({
           target: artifact.target,
@@ -9262,13 +10071,13 @@ async function runBuildManifest(source) {
     result.ok = true;
     return { result, reported: await report(manifest.resultPutUrl, result) };
   } finally {
-    await fs19.remove(workDir).catch(() => {
+    await fs22.remove(workDir).catch(() => {
     });
   }
 }
-async function report(url, result) {
+async function reportResult(url, result, retry) {
   try {
-    await put(url, JSON.stringify(result), "application/json");
+    await put(url, JSON.stringify(result), "application/json", {}, retry);
     return true;
   } catch {
     return false;
@@ -9476,7 +10285,7 @@ async function endObserveSession(options) {
 }
 
 // src/commands/hub/index.ts
-async function readJson2(response, fallback) {
+async function readJson3(response, fallback) {
   if (!response.ok) {
     const body = await response.json().catch(() => ({}));
     throwApiResponseError(response, body, fallback);
@@ -9492,7 +10301,7 @@ async function listReleases(options) {
   const response = await apiFetch(
     `/api/projects/${pid}/flows/${options.flowId}/releases?${params.toString()}`
   );
-  return readJson2(response, "Failed to list releases");
+  return readJson3(response, "Failed to list releases");
 }
 async function getRelease(options) {
   const pid = options.projectId ?? requireProjectId();
@@ -9500,7 +10309,7 @@ async function getRelease(options) {
   const response = await apiFetch(
     `/api/projects/${pid}/flows/${options.flowId}/releases/${encodeURIComponent(segment)}`
   );
-  return readJson2(response, "Failed to read release");
+  return readJson3(response, "Failed to read release");
 }
 async function listStepHistory(options) {
   const pid = options.projectId ?? requireProjectId();
@@ -9510,7 +10319,7 @@ async function listStepHistory(options) {
   const response = await apiFetch(
     `/api/projects/${pid}/flows/${options.flowId}/releases/step-history?${params.toString()}`
   );
-  return readJson2(response, "Failed to read step history");
+  return readJson3(response, "Failed to read step history");
 }
 async function setReleaseRationale(options) {
   const pid = options.projectId ?? requireProjectId();
@@ -9525,7 +10334,7 @@ async function setReleaseRationale(options) {
       })
     }
   );
-  return readJson2(response, "Failed to write release rationale");
+  return readJson3(response, "Failed to write release rationale");
 }
 async function listThreads(options) {
   const pid = options.projectId ?? requireProjectId();
@@ -9540,7 +10349,7 @@ async function listThreads(options) {
   const response = await apiFetch(
     `/api/projects/${pid}/flows/${options.flowId}/threads?${params.toString()}`
   );
-  return readJson2(response, "Failed to list threads");
+  return readJson3(response, "Failed to list threads");
 }
 async function createThread(options) {
   const pid = options.projectId ?? requireProjectId();
@@ -9557,7 +10366,7 @@ async function createThread(options) {
       })
     }
   );
-  return readJson2(response, "Failed to open thread");
+  return readJson3(response, "Failed to open thread");
 }
 async function addThreadMessage(options) {
   const pid = options.projectId ?? requireProjectId();
@@ -9569,7 +10378,7 @@ async function addThreadMessage(options) {
       body: JSON.stringify({ text: options.text })
     }
   );
-  return readJson2(response, "Failed to add message");
+  return readJson3(response, "Failed to add message");
 }
 async function listKnowledge(options) {
   const pid = options.projectId ?? requireProjectId();
@@ -9582,11 +10391,11 @@ async function listKnowledge(options) {
   const response = await apiFetch(
     `/api/projects/${pid}/knowledge?${params.toString()}`
   );
-  return readJson2(response, "Failed to read knowledge");
+  return readJson3(response, "Failed to read knowledge");
 }
 
 // src/commands/frames/index.ts
-async function readJson3(response, fallback) {
+async function readJson4(response, fallback) {
   if (!response.ok) {
     const body = await response.json().catch(() => ({}));
     throwApiResponseError(response, body, fallback);
@@ -9596,7 +10405,7 @@ async function readJson3(response, fallback) {
 async function listFrames(options = {}) {
   const pid = options.projectId ?? requireProjectId();
   const response = await apiFetch(`/api/projects/${pid}/frames`);
-  return readJson3(response, "Failed to list frames");
+  return readJson4(response, "Failed to list frames");
 }
 async function listPageFrames(options) {
   const pid = options.projectId ?? requireProjectId();
@@ -9604,14 +10413,14 @@ async function listPageFrames(options) {
   const response = await apiFetch(
     `/api/projects/${pid}/frames?${params.toString()}`
   );
-  return readJson3(response, "Failed to list page frames");
+  return readJson4(response, "Failed to list page frames");
 }
 async function getFrame(options) {
   const pid = options.projectId ?? requireProjectId();
   const response = await apiFetch(
     `/api/projects/${pid}/frames/${encodeURIComponent(options.frameId)}`
   );
-  return readJson3(response, "Failed to read frame");
+  return readJson4(response, "Failed to read frame");
 }
 
 // src/commands/secrets/index.ts
@@ -9881,6 +10690,7 @@ export {
   BuildWrapArtifactSchema,
   BuildWrapOptionsSchema,
   DeploymentAmbiguityError,
+  VALIDATE_CODES,
   VERSION,
   addThreadMessage,
   annotateErrorWithDrift,
@@ -9968,7 +10778,6 @@ export {
   loginCommand,
   logout,
   logoutCommand,
-  maskKnownNumbers,
   mergeAuthHeaders,
   parseSSEEvents,
   publicFetch,
@@ -10007,7 +10816,7 @@ export {
   updateSecret,
   validate,
   validateCommand,
-  validateFlowStructure,
+  validateFlowStructure2 as validateFlowStructure,
   whoami,
   whoamiCommand,
   wrapSkeleton,