@walkeros/cli 4.7.0 → 4.7.1-next-1791015692826

package/dist/index.js

@@ -4,6 +4,9 @@ var __export = (target, all) => {
     __defProp(target, name, { get: all[name], enumerable: true });
 };
 
+// <define:__CLIENT_OPERATION_DIGESTS__>
+var define_CLIENT_OPERATION_DIGESTS_default = [{ op: "GET /api/auth/whoami", usedBy: ["mcp auth", "walkeros auth login", "walkeros auth whoami"], digest: "f8287550f3ac65aa5b290875220f06dd3f48d607ed489b9f0a8f704d3f8f5cfd" }, { op: "POST /api/feedback", usedBy: ["mcp feedback", "walkeros feedback"], digest: "7417108c6ea8d60904b715dfedc1d8b9b597834f7d427df6b9226b36e5eef963" }, { op: "GET /api/health", usedBy: ["mcp diagnostics", "walkeros diagnostics"], digest: "2b3c0883edf4048aca77f4222247929b9045db33d06729502cb5021929d04156" }, { op: "POST /api/oauth/device_authorization", usedBy: ["mcp auth", "walkeros auth login"], digest: "a3e744775b93e7f50ea4021f8a027e656bb90e6f2358c65a35e4c45e16ac3fdd" }, { op: "POST /api/oauth/revoke", usedBy: ["mcp auth", "walkeros auth logout"], digest: "dbc453faaaa748d1129473ccda7b26a4e3267d67c25a8a9fc1da0068837fe154" }, { op: "POST /api/oauth/token", usedBy: ["@walkeros/cli resolveAccessToken", "mcp auth", "walkeros auth login"], digest: "16f5a3146c0a3fff703122a5ff25446bad07a6c37069a9e9a6db6925daa036a0" }, { op: "GET /api/openapi.json", usedBy: ["mcp diagnostics", "mcp resource walkeros://reference/openapi", "walkeros diagnostics"], digest: "dbf34e575af8f757d9a0f967c4565968d1a2d64b57a717fc65c8f81692099f0a" }, { op: "GET /api/packages", usedBy: ["mcp package_search", "mcp resource walkeros://reference/packages", "mcp resource walkeros://schema/{packageName}"], digest: "d9c713eea791e8bae3c606bcd1f0209db2c7050a39b18e96f7d913b7d0752e19" }, { op: "GET /api/projects", usedBy: ["mcp flow_manage", "mcp project_manage", "walkeros projects list"], digest: "1e65fca4cb31ccfc10b9835595ac4ee1f69bd6da14127bcc31d62616dfba7281" }, { op: "POST /api/projects", usedBy: ["mcp project_manage", "walkeros projects create"], digest: "3ab6d76c78d4433f0e0ab85a0a23753c7065bc232bfb30b7cee616a3aef8bec5" }, { op: "DELETE /api/projects/{projectId}", usedBy: ["mcp project_manage", "walkeros projects delete"], digest: "9f725b18812327c57cfbf8d8ed0139353c60ed2eb34024618e1760c2765889ca" }, { op: "GET /api/projects/{projectId}", usedBy: ["mcp project_manage", "walkeros projects get"], digest: "535d11026c7b7ff3b59512c0f68ddeb4e73104d4adab143351c7f9fa1ece6e78" }, { op: "PATCH /api/projects/{projectId}", usedBy: ["mcp project_manage", "walkeros projects update"], digest: "d15d7756dae06372328b43891a89dc839e6eb8587896d19999ff49ec8aa1d19b" }, { op: "GET /api/projects/{projectId}/deployments", usedBy: ["mcp deploy_manage", "walkeros deploy list"], digest: "2b3cc07e4cf1f739f7321b5bf157b91ac300205286a48c4f29dd11269d00f2c0" }, { op: "POST /api/projects/{projectId}/deployments", usedBy: ["walkeros deploy create"], digest: "fa0bcad018a21213f473bd058ef90975b50fd3f978340e36c61acf1d609bab95" }, { op: "DELETE /api/projects/{projectId}/deployments/{deploymentId}", usedBy: ["mcp deploy_manage", "walkeros deploy delete"], digest: "ce119e1743ecfdda590f7fae6bfc5a094c387efcbdaac6eaf9b2b7b0fffac58e" }, { op: "GET /api/projects/{projectId}/deployments/{deploymentId}", usedBy: ["mcp deploy_manage", "walkeros deploy status"], digest: "089bd54697005003c9fb256f853dad2e4431d62cbaa2805d311c6837e498ba2b" }, { op: "GET /api/projects/{projectId}/deployments/{deploymentId}/stream", usedBy: ["mcp deploy_manage", "walkeros deploy start"], digest: "cf27b0c148cfeb3b772f150a9de0359540643b3eeaff8dc373cb865557e24a82" }, { op: "GET /api/projects/{projectId}/flows", usedBy: ["mcp flow_manage", "walkeros flows list"], digest: "ecb58ddbde3808a161bee04d333d4e976e86f46505bacc6d571050a45c6c9ee8" }, { op: "POST /api/projects/{projectId}/flows", usedBy: ["mcp flow_manage", "walkeros flows create"], digest: "bcae723b986165cab63933eda1814a9da984cdfada8fe1a0c9cc01d4554d8372" }, { op: "DELETE /api/projects/{projectId}/flows/{flowId}", usedBy: ["mcp flow_manage", "walkeros flows delete"], digest: "1f164466f6b6058b79e787b0234b42d61274431dd6e29cb8acc23c2706218278" }, { op: "GET /api/projects/{projectId}/flows/{flowId}", usedBy: ["mcp deploy_manage", "mcp flow_bundle", "mcp flow_load", "mcp flow_manage", "mcp flow_simulate", "mcp observe_session", "walkeros deploy create", "walkeros deploy start", "walkeros flows get", "walkeros observe start", "walkeros previews create"], digest: "a8fc246e9b179a7becce56221be27aae649f471aebb639eda34b215c926f21dd" }, { op: "PATCH /api/projects/{projectId}/flows/{flowId}", usedBy: ["mcp flow_manage", "walkeros flows update"], digest: "f9e59060ab31184a3b5906c3346479616101f7793c7a00c35649f08d2f5d6a32" }, { op: "GET /api/projects/{projectId}/flows/{flowId}/deploy", usedBy: ["@walkeros/cli getDeployment"], digest: "8d9229fc0d884a75b1faf06877494e4dd5fa8c77affc7a7bb58d559fbd0c8646" }, { op: "POST /api/projects/{projectId}/flows/{flowId}/deploy", usedBy: ["mcp deploy_manage", "walkeros deploy start"], digest: "ea6922423f14dde427cf37f13f07e3f5f783358ff23fd7464925da068838068e" }, { op: "POST /api/projects/{projectId}/flows/{flowId}/duplicate", usedBy: ["mcp flow_manage", "walkeros flows duplicate"], digest: "b9111138d427419eea46ed590a301373a4c641b19d90ab1566891f5aaaadc231" }, { op: "GET /api/projects/{projectId}/flows/{flowId}/journeys", usedBy: ["mcp flow_manage", "mcp observe_journeys", "mcp observe_session"], digest: "78377e4a5b4b1e4dce9f94813bd3484e78b9520e57c712f963ef98c42516b01c" }, { op: "POST /api/projects/{projectId}/flows/{flowId}/observe-sessions", usedBy: ["mcp observe_session", "walkeros observe start"], digest: "5620b4826736b3aff1c80412d9861d5286304957df59d241e9adff6d101bb032" }, { op: "DELETE /api/projects/{projectId}/flows/{flowId}/observe-sessions/{sessionId}", usedBy: ["mcp observe_session"], digest: "9bdc90811f98a22030ee33bb24e2f270b64733b81e3e4dd3d16cd00620dafb44" }, { op: "GET /api/projects/{projectId}/flows/{flowId}/observe-sessions/{sessionId}", usedBy: ["mcp observe_session", "walkeros observe start"], digest: "ab5e8a2b908391c701c9e0b73813f1eb3bfa5b2a82e82b7009b2559467352491" }, { op: "POST /api/projects/{projectId}/flows/{flowId}/observe-sessions/{sessionId}/heartbeat", usedBy: ["walkeros observe start"], digest: "2b0b74a466c643aac87226c8154a530ce55deb5409a4fb65a4ef9b8aa182cbc7" }, { op: "GET /api/projects/{projectId}/flows/{flowId}/previews", usedBy: ["mcp flow_manage", "walkeros previews list"], digest: "ef72ef8b90676c59c626763f120d6a81910b29e4384f0ac8174f7e12420007c2" }, { op: "POST /api/projects/{projectId}/flows/{flowId}/previews", usedBy: ["mcp flow_manage", "walkeros previews create"], digest: "7239dc554d11983386108825087aa45eb4d0bd38eae87dbac376e68e724c6a8f" }, { op: "DELETE /api/projects/{projectId}/flows/{flowId}/previews/{previewId}", usedBy: ["mcp flow_manage", "walkeros previews delete"], digest: "de9be2358920517321c4e2c59c9ce59f174be0382596037ce36f987233689e51" }, { op: "GET /api/projects/{projectId}/flows/{flowId}/previews/{previewId}", usedBy: ["mcp flow_manage", "walkeros previews get"], digest: "4dbaa7000600aa12d45388511192dabdcd910fad9acedd802fdc68efea4e7bc7" }, { op: "POST /api/projects/{projectId}/flows/{flowId}/previews/{previewId}/grant", usedBy: ["mcp flow_manage", "walkeros previews create"], digest: "4cf5c7ea9363935bd978f858e4bb058c6dd64bb2763cefac9ce07da248605e7f" }, { op: "GET /api/projects/{projectId}/flows/{flowId}/releases", usedBy: ["mcp hub_manage"], digest: "c6ac90c93e07429b53c506292ceda03bfb8873686db76e422f5eed4638f4bee7" }, { op: "PUT /api/projects/{projectId}/flows/{flowId}/releases/annotations", usedBy: ["mcp hub_manage"], digest: "084f638f024a578ab2f401839f10f9554e6d2100ba7d67f1ab2be560616bd044" }, { op: "GET /api/projects/{projectId}/flows/{flowId}/releases/step-history", usedBy: ["mcp hub_manage"], digest: "a0d051814f7e8cc39e00592c16bc92a1afae0b58cd71b9b98ab6c85da4dd04e4" }, { op: "GET /api/projects/{projectId}/flows/{flowId}/releases/{versionId}", usedBy: ["mcp hub_manage"], digest: "d429b1564ca64148c5844e799c5dafc5d864fcf94df62f51174c3825db6a3463" }, { op: "GET /api/projects/{projectId}/flows/{flowId}/secrets", usedBy: ["mcp secret_manage"], digest: "19629983472c4e46b6c97fc8700b35549f38725fd4d7a5f59ddacd6a7bcfc8f2" }, { op: "POST /api/projects/{projectId}/flows/{flowId}/secrets", usedBy: ["mcp secret_manage"], digest: "b9407ce8584d147f84acf2562f1eb7c63c35e7ed93bd275d8c3c2ba3c4a1a8e3" }, { op: "GET /api/projects/{projectId}/flows/{flowId}/secrets/values", usedBy: ["runner"], digest: "0c02c86b0576047e8d986c2829212fef4e7eea5791250188619244bfbcdfb4aa" }, { op: "DELETE /api/projects/{projectId}/flows/{flowId}/secrets/{secretId}", usedBy: ["mcp secret_manage"], digest: "b744bcdb73b204d9aa4e4d3f846552a4154601df27c4fe18045bdb8a09624b84" }, { op: "PUT /api/projects/{projectId}/flows/{flowId}/secrets/{secretId}", usedBy: ["mcp secret_manage"], digest: "5b94004e066746ee7a83b90477db9d2a343361705c2e158df85d74e47085a46a" }, { op: "GET /api/projects/{projectId}/flows/{flowId}/settings/{settingsId}/deploy", usedBy: ["@walkeros/cli getDeployment"], digest: "0ad85a2494f22e9863362a7137d721d970b87ff60fdb41727a76cb4f590c83bc" }, { op: "POST /api/projects/{projectId}/flows/{flowId}/settings/{settingsId}/deploy", usedBy: ["mcp deploy_manage", "walkeros deploy start"], digest: "b6506c543c7e755592b5a6671016c4bae3b3e41cd76c28852297413e1a412e46" }, { op: "GET /api/projects/{projectId}/flows/{flowId}/threads", usedBy: ["mcp hub_manage"], digest: "ae0b8185fa74ba12d99eedacedb53e5801d7485cdf7b1c382334371454f8c323" }, { op: "POST /api/projects/{projectId}/flows/{flowId}/threads", usedBy: ["mcp hub_manage"], digest: "0ee52914274f52641a08b4c2d9da774c971d214929b43abee85d5e657b209144" }, { op: "POST /api/projects/{projectId}/flows/{flowId}/threads/{threadId}/messages", usedBy: ["mcp hub_manage"], digest: "28d8e964962b03c016c909111be0ce570df9bf43f89f0ab1c74b6dd65503eec1" }, { op: "GET /api/projects/{projectId}/frames", usedBy: ["mcp frame_manage"], digest: "c1cecd6354a7071418e709ecbf925a6ae14bb0099459bac786f35877108e29fd" }, { op: "GET /api/projects/{projectId}/frames/{frameId}", usedBy: ["mcp frame_manage"], digest: "98e3373cb23c9851280c505239ff960088d89bea9d922787da812bd7a59d104e" }, { op: "GET /api/projects/{projectId}/knowledge", usedBy: ["mcp hub_manage"], digest: "ca52e4593757c4fede25c41c3bb95e9a3b7476106549752b756860fc35abd1f1" }, { op: "POST /api/projects/{projectId}/runners/heartbeat", usedBy: ["runner"], digest: "96546fffffb32b66db7c5238daa2ba8f549d976f5ffcab2befa639e2eb1df0e1" }, { op: "POST /api/telemetry", usedBy: ["@walkeros/cli telemetry"], digest: "d119e16315ff9df09160d8b36ebc78dec089cb2a726f4a8fd77ff5b693999667" }];
+
 // src/commands/bundle/index.ts
 import path15 from "path";
 import fs16 from "fs-extra";
@@ -265,16 +268,425 @@ async function withConfigLock(fn) {
 
 // src/core/oauth-client.ts
 import { z } from "zod";
+
+// src/core/client-context.ts
+var context;
+function setClientContext(input) {
+  const envType = process.env.WALKEROS_CLIENT_TYPE;
+  const type = envType ?? input.type ?? "cli";
+  context = { type, version: input.version };
+}
+function getClientContext() {
+  return context;
+}
+function resetClientContext() {
+  context = void 0;
+}
+function clientContextHeaders() {
+  if (!context) return {};
+  return {
+    "User-Agent": `walkeros-${context.type}/${context.version}`,
+    "X-WalkerOS-Client": context.type,
+    "X-WalkerOS-Client-Version": context.version
+  };
+}
+
+// src/core/openapi-subset.ts
+import { createHash } from "crypto";
+var HTTP_METHODS = /* @__PURE__ */ new Set([
+  "get",
+  "put",
+  "post",
+  "delete",
+  "options",
+  "head",
+  "patch",
+  "trace"
+]);
+var DOC_KEYWORDS = /* @__PURE__ */ new Set([
+  "description",
+  "summary",
+  "title",
+  "example",
+  "examples",
+  "externalDocs",
+  "tags"
+]);
+var VERBATIM_KEYWORDS = /* @__PURE__ */ new Set([
+  "enum",
+  "const",
+  "default",
+  "required",
+  "security",
+  "mapping",
+  "scopes"
+]);
+var NAME_MAPS = /* @__PURE__ */ new Set([
+  "properties",
+  "patternProperties",
+  "dependentSchemas",
+  "$defs",
+  "definitions",
+  "paths",
+  "webhooks",
+  "schemas",
+  "responses",
+  "parameters",
+  "requestBodies",
+  "headers",
+  "securitySchemes",
+  "links",
+  "callbacks",
+  "pathItems",
+  "content",
+  "encoding",
+  "variables"
+]);
+var DROPPED_TOP_LEVEL = /* @__PURE__ */ new Set([
+  "tags",
+  "webhooks",
+  "externalDocs"
+]);
+var NOTHING_KEPT = /* @__PURE__ */ new Set();
+function isRecord(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function isVerbatim(key) {
+  return VERBATIM_KEYWORDS.has(key) || key.startsWith("x-");
+}
+function canonicalize(value) {
+  if (Array.isArray(value)) return value.map(canonicalize);
+  if (isRecord(value)) {
+    const result = {};
+    for (const key of Object.keys(value).sort()) {
+      result[key] = canonicalize(value[key]);
+    }
+    return result;
+  }
+  return value;
+}
+function parseOperation(op) {
+  const space = op.indexOf(" ");
+  const method = space > 0 ? op.slice(0, space).toLowerCase() : "";
+  const path23 = op.slice(space + 1);
+  if (!HTTP_METHODS.has(method) || !path23.startsWith("/")) {
+    throw new Error(`invalid operation: ${op}`);
+  }
+  return { method, path: path23 };
+}
+function hasOperation(doc, op) {
+  const { method, path: path23 } = parseOperation(op);
+  if (!isRecord(doc) || !isRecord(doc.paths)) return false;
+  const item = doc.paths[path23];
+  return isRecord(item) && isRecord(item[method]);
+}
+function stripNode(node) {
+  if (Array.isArray(node)) return node.map(stripNode);
+  if (!isRecord(node)) return node;
+  return stripObject(node, NOTHING_KEPT);
+}
+function stripObject(node, kept) {
+  const out = {};
+  for (const [key, value] of Object.entries(node)) {
+    if (kept.has(key) || isVerbatim(key)) out[key] = value;
+    else if (DOC_KEYWORDS.has(key)) continue;
+    else if (NAME_MAPS.has(key) && isRecord(value)) {
+      out[key] = stripNameMap(value, key === "responses");
+    } else out[key] = stripNode(value);
+  }
+  return out;
+}
+function stripNameMap(map, responses) {
+  const out = {};
+  for (const [name, node] of Object.entries(map)) {
+    out[name] = responses ? stripResponse(node) : stripNode(node);
+  }
+  return out;
+}
+function stripResponse(node) {
+  if (!isRecord(node) || typeof node.$ref === "string") return stripNode(node);
+  return { description: "", ...stripObject(node, NOTHING_KEPT) };
+}
+function stripDocument(doc) {
+  const out = {};
+  for (const [key, value] of Object.entries(doc)) {
+    if (DROPPED_TOP_LEVEL.has(key)) continue;
+    if (key === "info" && isRecord(value)) {
+      out.info = stripObject(value, /* @__PURE__ */ new Set(["title", "version"]));
+    } else if (isVerbatim(key)) out[key] = value;
+    else if (NAME_MAPS.has(key) && isRecord(value)) {
+      out[key] = stripNameMap(value, false);
+    } else out[key] = stripNode(value);
+  }
+  return out;
+}
+function collectRefs(node, refs) {
+  if (Array.isArray(node)) {
+    for (const item of node) collectRefs(item, refs);
+    return;
+  }
+  if (!isRecord(node)) return;
+  for (const [key, value] of Object.entries(node)) {
+    if (key === "$ref" && typeof value === "string") refs.add(value);
+    else if (NAME_MAPS.has(key) && isRecord(value)) {
+      for (const named of Object.values(value)) collectRefs(named, refs);
+    } else if (key === "discriminator" && isRecord(value)) {
+      const mapping = isRecord(value.mapping) ? value.mapping : {};
+      for (const target of Object.values(mapping)) {
+        if (typeof target === "string") refs.add(target);
+      }
+    } else if (!isVerbatim(key)) collectRefs(value, refs);
+  }
+}
+function componentOf(ref) {
+  const parts = ref.startsWith("#/") ? ref.slice(2).split("/").map((part) => part.replace(/~1/g, "/").replace(/~0/g, "~")) : [];
+  if (parts.length < 3 || parts[0] !== "components") {
+    throw new Error(`unsupported $ref: ${ref}`);
+  }
+  return { section: parts[1], name: parts[2] };
+}
+function pruneComponents(components, roots) {
+  const referenced = /* @__PURE__ */ new Map();
+  const pending = [];
+  const queue = (node) => {
+    const refs = /* @__PURE__ */ new Set();
+    collectRefs(node, refs);
+    pending.push(...refs);
+  };
+  for (const root of roots) queue(root);
+  if (isRecord(components.securitySchemes)) queue(components.securitySchemes);
+  for (let ref = pending.pop(); ref !== void 0; ref = pending.pop()) {
+    const { section, name } = componentOf(ref);
+    const names = referenced.get(section) ?? /* @__PURE__ */ new Set();
+    if (names.has(name)) continue;
+    const entries = components[section];
+    if (!isRecord(entries) || !(name in entries)) {
+      throw new Error(`$ref target not in input: ${ref}`);
+    }
+    names.add(name);
+    referenced.set(section, names);
+    queue(entries[name]);
+  }
+  const out = {};
+  for (const [section, entries] of Object.entries(components)) {
+    if (!isRecord(entries)) continue;
+    if (section === "securitySchemes") {
+      out[section] = entries;
+      continue;
+    }
+    const names = referenced.get(section);
+    if (!names) continue;
+    const kept = {};
+    for (const [name, node] of Object.entries(entries)) {
+      if (names.has(name)) kept[name] = node;
+    }
+    out[section] = kept;
+  }
+  return Object.keys(out).length > 0 ? out : void 0;
+}
+function pruneToOperations(doc, ops) {
+  if (!isRecord(doc) || !isRecord(doc.paths)) {
+    throw new Error("input is not an OpenAPI document with paths");
+  }
+  for (const op of ops) {
+    if (!hasOperation(doc, op)) {
+      throw new Error(`manifest operation not in input: ${op}`);
+    }
+  }
+  const listed = new Set(
+    ops.map((op) => {
+      const { method, path: path23 } = parseOperation(op);
+      return `${method} ${path23}`;
+    })
+  );
+  const stripped = stripDocument(doc);
+  const allPaths = isRecord(stripped.paths) ? stripped.paths : {};
+  const paths = {};
+  for (const [path23, item] of Object.entries(allPaths)) {
+    if (!isRecord(item)) continue;
+    const kept = {};
+    let operations = 0;
+    for (const [key, value] of Object.entries(item)) {
+      if (!HTTP_METHODS.has(key)) kept[key] = value;
+      else if (listed.has(`${key} ${path23}`)) {
+        kept[key] = value;
+        operations += 1;
+      }
+    }
+    if (operations > 0) paths[path23] = kept;
+  }
+  const out = {};
+  const roots = [];
+  for (const [key, value] of Object.entries(stripped)) {
+    if (key === "components") continue;
+    out[key] = key === "paths" ? paths : value;
+    roots.push(out[key]);
+  }
+  if (isRecord(stripped.components)) {
+    const components = pruneComponents(stripped.components, roots);
+    if (components) out.components = components;
+  }
+  return out;
+}
+function resolveRef(doc, ref) {
+  const { section, name } = componentOf(ref);
+  const components = isRecord(doc.components) ? doc.components : {};
+  const entries = components[section];
+  return isRecord(entries) ? entries[name] : void 0;
+}
+function inlineRefs(node, doc, stack) {
+  if (Array.isArray(node)) {
+    return node.map((item) => inlineRefs(item, doc, stack));
+  }
+  if (!isRecord(node)) return node;
+  const out = {};
+  for (const [key, value] of Object.entries(node)) {
+    if (key === "$ref" && typeof value === "string" && !stack.includes(value)) {
+      out[key] = inlineRefs(resolveRef(doc, value), doc, [...stack, value]);
+    } else if (key === "$ref") out[key] = value;
+    else if (NAME_MAPS.has(key) && isRecord(value)) {
+      const named = {};
+      for (const [name, child] of Object.entries(value)) {
+        named[name] = inlineRefs(child, doc, stack);
+      }
+      out[key] = named;
+    } else if (isVerbatim(key)) out[key] = value;
+    else out[key] = inlineRefs(value, doc, stack);
+  }
+  return out;
+}
+function operationDigests(doc, ops) {
+  const present = ops.filter((op) => hasOperation(doc, op));
+  const pruned = pruneToOperations(doc, present);
+  const paths = isRecord(pruned.paths) ? pruned.paths : {};
+  const digests = {};
+  for (const op of present) {
+    const { method, path: path23 } = parseOperation(op);
+    const item = paths[path23];
+    if (!isRecord(item)) continue;
+    const subtree = inlineRefs(
+      { pathParameters: item.parameters ?? [], operation: item[method] },
+      pruned,
+      []
+    );
+    digests[op] = createHash("sha256").update(JSON.stringify(canonicalize(subtree))).digest("hex");
+  }
+  return digests;
+}
+
+// src/core/api-request.ts
+var DEPLOY_TOKEN_MISSING = "No authentication token available. Set WALKEROS_DEPLOY_TOKEN or run walkeros auth login.";
+function operationTarget(op, path23, query) {
+  const template = parseOperation(op).path;
+  const filled = template.replace(/\{([^}]+)\}/g, (_match, name) => {
+    const value = path23?.[name];
+    if (value === void 0) {
+      throw new Error(`${op}: path parameter ${name} is missing`);
+    }
+    return encodeURIComponent(String(value));
+  });
+  const search = new URLSearchParams();
+  for (const [key, value] of Object.entries(query ?? {})) {
+    if (value === void 0 || value === null) continue;
+    for (const item of Array.isArray(value) ? value : [value]) {
+      search.append(key, String(item));
+    }
+  }
+  const serialized = search.toString();
+  return serialized ? `${filled}?${serialized}` : filled;
+}
+function hasHeader(headers, name) {
+  const lower = name.toLowerCase();
+  return Object.keys(headers).some((key) => key.toLowerCase() === lower);
+}
+function mergeHeaders(...layers) {
+  const merged = {};
+  for (const layer of layers) {
+    for (const [name, value] of Object.entries(layer)) {
+      const lower = name.toLowerCase();
+      for (const existing of Object.keys(merged)) {
+        if (existing.toLowerCase() === lower) delete merged[existing];
+      }
+      merged[name] = value;
+    }
+  }
+  return merged;
+}
+function formBody(form) {
+  const params = new URLSearchParams();
+  for (const [key, value] of Object.entries(form)) {
+    if (value !== void 0 && value !== null)
+      params.append(key, String(value));
+  }
+  return params.toString();
+}
+function requestParts(op, init) {
+  const method = parseOperation(op).method.toUpperCase();
+  const headers = { ...init.headers };
+  if (init.form !== void 0) {
+    if (!hasHeader(headers, "Content-Type")) {
+      headers["Content-Type"] = "application/x-www-form-urlencoded";
+    }
+    return { method, headers, body: formBody(init.form) };
+  }
+  if (init.body !== void 0) {
+    if (!hasHeader(headers, "Content-Type")) {
+      headers["Content-Type"] = "application/json";
+    }
+    return { method, headers, body: JSON.stringify(init.body) };
+  }
+  return { method, headers };
+}
+function requestInit(parts, init, headers) {
+  const request = {};
+  if (parts.method !== "GET") request.method = parts.method;
+  if (Object.keys(headers).length > 0) request.headers = headers;
+  if (parts.body !== void 0) request.body = parts.body;
+  if (init.signal) request.signal = init.signal;
+  if (init.redirect) request.redirect = init.redirect;
+  return request;
+}
+async function credential(auth) {
+  if (auth === "none") return null;
+  if (auth === "user") return resolveAccessToken();
+  if (auth === "deploy") {
+    const token = resolveDeployToken() ?? await resolveAccessToken();
+    if (!token) throw new Error(DEPLOY_TOKEN_MISSING);
+    return token;
+  }
+  return auth.token;
+}
+async function apiRequest(op, init = {}) {
+  const target = operationTarget(op, init.path, init.query);
+  const parts = requestParts(op, init);
+  const auth = init.auth ?? "user";
+  if (init.baseUrl === void 0 && init.fetch === void 0 && typeof auth === "string") {
+    const request = requestInit(parts, init, parts.headers);
+    const send2 = auth === "user" ? apiFetch : auth === "deploy" ? deployFetch : publicFetch;
+    return Object.keys(request).length > 0 ? send2(target, request) : send2(target);
+  }
+  const url = `${init.baseUrl ?? resolveAppUrl()}${target}`;
+  const token = await credential(auth);
+  if (token) requireSecureUrl(url);
+  const headers = mergeHeaders(
+    clientContextHeaders(),
+    parts.headers,
+    token ? { Authorization: `Bearer ${token}` } : {}
+  );
+  const send = init.fetch ?? fetch;
+  return send(url, requestInit(parts, init, headers));
+}
+function operationUrl(op, init) {
+  return `${init.baseUrl}${operationTarget(op, init.path, init.query)}`;
+}
+
+// src/core/oauth-client.ts
 var CLI_CLIENT_ID = "walkeros-cli";
 var CLI_SCOPE = "read write offline_access";
 var DEVICE_CODE_GRANT = "urn:ietf:params:oauth:grant-type:device_code";
 var REFRESH_TIMEOUT_MS = 1e4;
 var REVOKE_TIMEOUT_MS = 5e3;
 var DEVICE_AUTHORIZATION_TIMEOUT_MS = 1e4;
-var FORM_HEADERS = {
-  "Content-Type": "application/x-www-form-urlencoded",
-  Accept: "application/json"
-};
 var DeviceAuthorizationSchema = z.object({
   device_code: z.string().min(1),
   user_code: z.string().min(1),
@@ -310,14 +722,15 @@ function describe(response, body) {
   }
   return `HTTP ${response.status}`;
 }
-function post(fetchFn, url, form, signal) {
-  return fetchFn(requireSecureUrl(url), {
-    method: "POST",
-    headers: { ...FORM_HEADERS },
-    body: new URLSearchParams(form).toString(),
+function credentialTransport(appUrl, fetchFn, signal) {
+  return {
+    auth: "none",
+    baseUrl: requireSecureUrl(appUrl),
+    fetch: fetchFn,
+    headers: { Accept: "application/json" },
     redirect: "error",
     ...signal ? { signal } : {}
-  });
+  };
 }
 function toTokenSet(body) {
   const parsed = TokenSchema.safeParse(body);
@@ -331,18 +744,20 @@ function toTokenSet(body) {
   };
 }
 async function startDeviceAuthorization(appUrl, fetchFn = globalThis.fetch) {
-  const response = await post(
-    fetchFn,
-    `${appUrl}/api/oauth/device_authorization`,
-    {
+  const response = await apiRequest("POST /api/oauth/device_authorization", {
+    ...credentialTransport(
+      appUrl,
+      fetchFn,
+      AbortSignal.timeout(DEVICE_AUTHORIZATION_TIMEOUT_MS)
+    ),
+    form: {
       client_id: CLI_CLIENT_ID,
       scope: CLI_SCOPE,
       // RFC 8707. The token comes back bound to the API, so a leaked CLI token
       // cannot be replayed against the MCP resource.
       resource: `${appUrl}/api`
-    },
-    AbortSignal.timeout(DEVICE_AUTHORIZATION_TIMEOUT_MS)
-  );
+    }
+  });
   const body = await readJson(response);
   if (!response.ok) throw new Error(describe(response, body));
   const parsed = DeviceAuthorizationSchema.safeParse(body);
@@ -360,16 +775,14 @@ async function startDeviceAuthorization(appUrl, fetchFn = globalThis.fetch) {
 async function pollDeviceToken(appUrl, deviceCode, fetchFn = globalThis.fetch, signal) {
   let response;
   try {
-    response = await post(
-      fetchFn,
-      `${appUrl}/api/oauth/token`,
-      {
+    response = await apiRequest("POST /api/oauth/token", {
+      ...credentialTransport(appUrl, fetchFn, signal),
+      form: {
         grant_type: DEVICE_CODE_GRANT,
         device_code: deviceCode,
         client_id: CLI_CLIENT_ID
-      },
-      signal
-    );
+      }
+    });
   } catch (error) {
     if (signal?.aborted) return { status: "pending" };
     throw error;
@@ -399,16 +812,18 @@ async function pollDeviceToken(appUrl, deviceCode, fetchFn = globalThis.fetch, s
   }
 }
 async function refreshTokens(appUrl, refreshToken, fetchFn = globalThis.fetch) {
-  const response = await post(
-    fetchFn,
-    `${appUrl}/api/oauth/token`,
-    {
+  const response = await apiRequest("POST /api/oauth/token", {
+    ...credentialTransport(
+      appUrl,
+      fetchFn,
+      AbortSignal.timeout(REFRESH_TIMEOUT_MS)
+    ),
+    form: {
       grant_type: "refresh_token",
       refresh_token: refreshToken,
       client_id: CLI_CLIENT_ID
-    },
-    AbortSignal.timeout(REFRESH_TIMEOUT_MS)
-  );
+    }
+  });
   const body = await readJson(response);
   if (!response.ok) {
     if (errorCode(body) === "invalid_grant") return null;
@@ -418,16 +833,18 @@ async function refreshTokens(appUrl, refreshToken, fetchFn = globalThis.fetch) {
 }
 async function revokeRefreshToken(appUrl, refreshToken, fetchFn = globalThis.fetch) {
   try {
-    await post(
-      fetchFn,
-      `${appUrl}/api/oauth/revoke`,
-      {
+    await apiRequest("POST /api/oauth/revoke", {
+      ...credentialTransport(
+        appUrl,
+        fetchFn,
+        AbortSignal.timeout(REVOKE_TIMEOUT_MS)
+      ),
+      form: {
         token: refreshToken,
         token_type_hint: "refresh_token",
         client_id: CLI_CLIENT_ID
-      },
-      AbortSignal.timeout(REVOKE_TIMEOUT_MS)
-    );
+      }
+    });
   } catch {
   }
 }
@@ -513,28 +930,6 @@ function requireProjectId() {
   return projectId;
 }
 
-// src/core/client-context.ts
-var context;
-function setClientContext(input) {
-  const envType = process.env.WALKEROS_CLIENT_TYPE;
-  const type = envType ?? input.type ?? "cli";
-  context = { type, version: input.version };
-}
-function getClientContext() {
-  return context;
-}
-function resetClientContext() {
-  context = void 0;
-}
-function clientContextHeaders() {
-  if (!context) return {};
-  return {
-    "User-Agent": `walkeros-${context.type}/${context.version}`,
-    "X-WalkerOS-Client": context.type,
-    "X-WalkerOS-Client-Version": context.version
-  };
-}
-
 // src/core/http.ts
 function normalizeHeaders(headers) {
   if (!headers) return {};
@@ -1060,16 +1455,16 @@ import fs8 from "fs-extra";
 import { getFlowSettings, getPlatform } from "@walkeros/core";
 
 // src/core/content-digest.ts
-import { createHash } from "crypto";
+import { createHash as createHash2 } from "crypto";
 import path7 from "path";
 import fs7 from "fs-extra";
 var DIGEST_LENGTH = 12;
-function isRecord(value) {
+function isRecord2(value) {
   return value !== null && typeof value === "object" && !Array.isArray(value);
 }
 function canonicalJson(value) {
   return JSON.stringify(value, (_key, inner) => {
-    if (!isRecord(inner)) return inner;
+    if (!isRecord2(inner)) return inner;
     const sorted = {};
     for (const key of Object.keys(inner).sort()) sorted[key] = inner[key];
     return sorted;
@@ -1087,10 +1482,10 @@ function configDigest(flowSettings, flowName) {
     ...config,
     bundle: { ...config.bundle, env: Object.keys(declaredEnv).sort() }
   } : config;
-  return createHash("sha256").update(canonicalJson({ ...flowSettings, config: hashedConfig, collector })).digest("hex");
+  return createHash2("sha256").update(canonicalJson({ ...flowSettings, config: hashedConfig, collector })).digest("hex");
 }
 async function hashInstalledDir(dir) {
-  const hash = createHash("sha256");
+  const hash = createHash2("sha256");
   for (const rel of await listFiles(dir, "")) {
     const abs = path7.join(dir, rel);
     const stat2 = await fs7.lstat(abs);
@@ -1115,7 +1510,7 @@ async function listFiles(root, rel) {
   return files.sort();
 }
 function releaseDigest(input) {
-  return createHash("sha256").update(
+  return createHash2("sha256").update(
     canonicalJson({
       config: input.configDigest,
       versions: input.versions,
@@ -1300,7 +1695,7 @@ import {
   ENV_MARKER_PREFIX,
   SECRET_MARKER_PREFIX as SECRET_MARKER_PREFIX2,
   isPathStepEntry,
-  isObject as isObject2
+  isObject as isObject3
 } from "@walkeros/core";
 
 // src/commands/bundle/config-classifier.ts
@@ -2475,6 +2870,63 @@ async function resolveSiblingOrAncestor(consumerDir, depName, root) {
   }
 }
 
+// src/commands/bundle/build-flags.ts
+import { isObject as isObject2 } from "@walkeros/core";
+function carriesState(step) {
+  if (step.state !== void 0) return true;
+  if (step.config === void 0) return false;
+  return !isObject2(step.config) || step.config.state !== void 0;
+}
+function flowNeeds(flow) {
+  const steps = [
+    ...Object.values(flow.sources ?? {}),
+    ...Object.values(flow.transformers ?? {}),
+    ...Object.values(flow.destinations ?? {})
+  ];
+  return {
+    observe: flow.config?.observe !== void 0 || flow.collector?.observe !== void 0,
+    stores: Object.keys(flow.stores ?? {}).length > 0,
+    state: steps.some(carriesState)
+  };
+}
+function buildFlagDefines(needs) {
+  if (!needs) {
+    return {
+      __WALKEROS_OBSERVE__: "true",
+      __WALKEROS_STORES__: "true",
+      __WALKEROS_STATE__: "true",
+      __WALKEROS_VALIDATE__: "true"
+    };
+  }
+  return {
+    __WALKEROS_OBSERVE__: String(needs.observe),
+    __WALKEROS_STORES__: String(needs.stores),
+    __WALKEROS_STATE__: String(needs.state),
+    __WALKEROS_VALIDATE__: "false"
+  };
+}
+var NEEDS_MARKER = "walkeros:needs";
+function needsMarker(needs) {
+  return `/* ${NEEDS_MARKER} ${JSON.stringify(needs)} */`;
+}
+function readNeedsMarker(skeleton) {
+  const match = new RegExp(`/\\* ${NEEDS_MARKER} (\\{[^}]*\\}) \\*/\\s*$`).exec(
+    skeleton
+  );
+  if (!match) return void 0;
+  let parsed;
+  try {
+    parsed = JSON.parse(match[1]);
+  } catch {
+    return void 0;
+  }
+  if (!isObject2(parsed)) return void 0;
+  const { observe, stores, state } = parsed;
+  if (typeof observe !== "boolean" || typeof stores !== "boolean" || typeof state !== "boolean")
+    return void 0;
+  return { observe, stores, state };
+}
+
 // src/commands/bundle/bundler.ts
 import { getHashServer as getHashServer3 } from "@walkeros/server-core";
 
@@ -2887,9 +3339,12 @@ async function bundleCore(flowSettings, buildOptions, logger, showStats = false,
       const dataDeclaration = `const __configData = ${dataPayload};
 export { __configData };`;
       const banner = buildOptions.platform === "node" ? `import { createRequire } from 'module';const require = createRequire(import.meta.url);
+` : "";
+      const needs = buildOptions.platform === "browser" ? `
+${needsMarker(flowNeeds(flowSettings))}
 ` : "";
       const esmOutput = `${banner}${compiledCode}
-${dataDeclaration}`;
+${dataDeclaration}${needs}`;
       await fs14.writeFile(outputPath, esmOutput);
     } else {
       const stage2Entry = (buildOptions.platform || "node") === "browser" ? generateWebEntry(stage1Path, dataPayload, {
@@ -2921,7 +3376,8 @@ ${dataDeclaration}`;
         stage2Options.format = "iife";
         stage2Options.define = {
           "process.env.NODE_ENV": '"production"',
-          global: "globalThis"
+          global: "globalThis",
+          ...buildFlagDefines(flowNeeds(flowSettings))
         };
         stage2Options.target = resolveTarget(buildOptions);
       } else {
@@ -3259,9 +3715,9 @@ function packageSpecName(spec) {
   return parsePackageSpec(spec).name;
 }
 function readSourceElb(source) {
-  if (!isObject2(source.config)) return void 0;
+  if (!isObject3(source.config)) return void 0;
   const settings = source.config.settings;
-  if (!isObject2(settings)) return void 0;
+  if (!isObject3(settings)) return void 0;
   return typeof settings.elb === "string" ? settings.elb : void 0;
 }
 function bridgeWindowElb(flow, logger) {
@@ -3289,8 +3745,8 @@ function bridgeWindowElb(flow, logger) {
   }
   const nextSources = { ...sources };
   for (const [id, source] of toForward) {
-    const config = isObject2(source.config) ? source.config : {};
-    const settings = isObject2(config.settings) ? config.settings : {};
+    const config = isObject3(source.config) ? source.config : {};
+    const settings = isObject3(config.settings) ? config.settings : {};
     nextSources[id] = {
       ...source,
       config: { ...config, settings: { ...settings, elb: windowElb } }
@@ -4404,7 +4860,11 @@ function applyOverrides(config, overrides) {
 // src/commands/push/flow-context.ts
 import path16 from "path";
 import { pathToFileURL } from "url";
-import { JSDOM, VirtualConsole } from "jsdom";
+import {
+  JSDOM,
+  VirtualConsole,
+  requestInterceptor
+} from "jsdom";
 
 // src/commands/push/async-drain.ts
 function installTimerInterception(options = {}) {
@@ -4561,7 +5021,10 @@ var DOM_GLOBALS = [
   "Element",
   "HTMLElement",
   "Document",
-  "ShadowRoot"
+  "ShadowRoot",
+  "XMLHttpRequest",
+  "location",
+  "self"
 ];
 function exposeDomGlobals(domWindow) {
   const saved = DOM_GLOBALS.map(
@@ -4601,7 +5064,8 @@ async function withFlowContext(options, fn, onError) {
     networkCalls,
     asyncDrain,
     drainPump,
-    pageUrl
+    pageUrl,
+    offline
   } = options;
   const startTime = Date.now();
   const g = global;
@@ -4615,7 +5079,7 @@ async function withFlowContext(options, fn, onError) {
     dom = new JSDOM("<!DOCTYPE html><html><body></body></html>", {
       url: pageUrl ?? "http://localhost",
       runScripts: "dangerously",
-      resources: "usable",
+      resources: offline ? offlineResources() : "usable",
       virtualConsole
     });
     savedWindow = g.window;
@@ -4745,6 +5209,111 @@ function applyNetworkPolyfills(dom, networkCalls) {
     networkCalls.push({ type: "beacon", url, body, timestamp: Date.now() });
     return true;
   };
+  Object.defineProperty(dom.window, "XMLHttpRequest", {
+    value: createRecordingXhr(dom, networkCalls),
+    configurable: true,
+    writable: true
+  });
+}
+function createRecordingXhr(dom, networkCalls) {
+  const PageEvent = dom.window.Event;
+  return class XMLHttpRequest extends dom.window.EventTarget {
+    static UNSENT = 0;
+    static OPENED = 1;
+    static HEADERS_RECEIVED = 2;
+    static LOADING = 3;
+    static DONE = 4;
+    UNSENT = 0;
+    OPENED = 1;
+    HEADERS_RECEIVED = 2;
+    LOADING = 3;
+    DONE = 4;
+    readyState = 0;
+    status = 0;
+    statusText = "";
+    responseType = "";
+    response = "";
+    responseText = "";
+    responseURL = "";
+    timeout = 0;
+    withCredentials = false;
+    onreadystatechange = null;
+    onload = null;
+    onabort = null;
+    onloadend = null;
+    #method = "GET";
+    #url = "";
+    #async = true;
+    #headers = {};
+    #pending = false;
+    open(method, url, async = true) {
+      this.#method = method.toUpperCase();
+      this.#url = String(url);
+      this.#async = async;
+      this.#headers = {};
+      this.#pending = false;
+      this.readyState = 1;
+    }
+    setRequestHeader(name, value) {
+      this.#headers[name] = value;
+    }
+    getResponseHeader() {
+      return null;
+    }
+    getAllResponseHeaders() {
+      return "";
+    }
+    overrideMimeType() {
+    }
+    abort() {
+      const pending = this.#pending;
+      this.#pending = false;
+      if (!pending && this.readyState !== 4) return;
+      this.status = 0;
+      this.statusText = "";
+      if (pending) this.#finish("abort", this.onabort);
+      this.readyState = 0;
+    }
+    send(body) {
+      networkCalls.push({
+        type: "xhr",
+        url: this.#url,
+        method: this.#method,
+        body: body !== void 0 && body !== null ? String(body) : null,
+        headers: { ...this.#headers },
+        timestamp: Date.now()
+      });
+      this.#pending = true;
+      if (this.#async) queueMicrotask(() => this.#complete());
+      else this.#complete();
+    }
+    #complete() {
+      if (!this.#pending) return;
+      this.#pending = false;
+      this.status = 200;
+      this.statusText = "OK";
+      this.responseURL = this.#url;
+      this.#finish("load", this.onload);
+    }
+    #finish(outcome, onOutcome) {
+      this.readyState = 4;
+      const handlers = [
+        ["readystatechange", this.onreadystatechange],
+        [outcome, onOutcome],
+        ["loadend", this.onloadend]
+      ];
+      for (const [type, handler] of handlers) {
+        const event = new PageEvent(type);
+        this.dispatchEvent(event);
+        handler?.call(this, event);
+      }
+    }
+  };
+}
+function offlineResources() {
+  return {
+    interceptors: [requestInterceptor(() => new Response("", { status: 200 }))]
+  };
 }
 function cleanupNetworkPolyfills(savedFetch) {
   global.fetch = savedFetch;
@@ -4897,7 +5466,7 @@ function dispatchSimulate(flags) {
 }
 
 // src/commands/push/run.ts
-import { isObject as isObject3 } from "@walkeros/core";
+import { isObject as isObject4 } from "@walkeros/core";
 function simulationToPushResult(result) {
   return {
     success: !result.error,
@@ -4911,7 +5480,7 @@ var CONSENT_SCOPE_ERROR = "--consent sets the collector's starting consent for a
 var CONSENT_SHAPE_ERROR = "--consent must be a JSON object of booleans";
 var COMMAND_SCOPE_ERROR = "--command applies to destination simulation only.";
 function isConsent(value) {
-  return isObject3(value) && Object.values(value).every((granted) => typeof granted === "boolean");
+  return isObject4(value) && Object.values(value).every((granted) => typeof granted === "boolean");
 }
 async function resolveConsent(options) {
   if (options.consentSource === void 0) return options.consent;
@@ -4934,7 +5503,7 @@ async function resolveIngest(options) {
   const loaded = await loadJsonFromSource(options.ingestSource, {
     name: "ingest"
   });
-  if (!isObject3(loaded)) throw new Error("--ingest must be a JSON object");
+  if (!isObject4(loaded)) throw new Error("--ingest must be a JSON object");
   return loaded;
 }
 async function runPushCommandWithSecrets(options) {
@@ -5092,22 +5661,22 @@ async function runDestinationSimulationLoop(config, event, destinationIds, optio
 }
 
 // src/commands/push/dev-examples.ts
-function isRecord2(value) {
+function isRecord3(value) {
   return value !== null && typeof value === "object";
 }
 function selectDevExamples(devModule, exportName) {
-  if (!isRecord2(devModule)) return void 0;
+  if (!isRecord3(devModule)) return void 0;
   const map = devModule.exportExamples;
-  if (isRecord2(map) && exportName !== void 0) {
+  if (isRecord3(map) && exportName !== void 0) {
     const selected = map[exportName];
-    return isRecord2(selected) ? selected : void 0;
+    return isRecord3(selected) ? selected : void 0;
   }
   const examples = devModule.examples;
-  return isRecord2(examples) ? examples : void 0;
+  return isRecord3(examples) ? examples : void 0;
 }
 function legacyExportRefusal(devModule, packageExports, packageName, exportName) {
   if (exportName === void 0) return void 0;
-  if (isRecord2(devModule) && isRecord2(devModule.exportExamples))
+  if (isRecord3(devModule) && isRecord3(devModule.exportExamples))
     return void 0;
   if (packageExports) {
     const declared = packageExports[packageName];
@@ -5155,11 +5724,11 @@ function resolveExportName(flow, kind, id) {
 }
 
 // src/commands/push/index.ts
-function isRecord3(value) {
+function isRecord4(value) {
   return value !== null && typeof value === "object";
 }
 function isFlowJson(value) {
-  return isRecord3(value) && isRecord3(value.flows);
+  return isRecord4(value) && isRecord4(value.flows);
 }
 function isString(value) {
   return typeof value === "string";
@@ -5177,9 +5746,9 @@ function getDevEnv(devModule, exportName) {
   const examples = selectDevExamples(devModule, exportName);
   if (!examples || !("env" in examples)) return void 0;
   const env = examples.env;
-  if (!isRecord3(env)) return void 0;
+  if (!isRecord4(env)) return void 0;
   const result = {};
-  if ("push" in env && isRecord3(env.push)) result.push = env.push;
+  if ("push" in env && isRecord4(env.push)) result.push = env.push;
   if ("simulation" in env && isStringArray(env.simulation))
     result.simulation = env.simulation;
   return result;
@@ -5187,14 +5756,14 @@ function getDevEnv(devModule, exportName) {
 async function applyStoreMockEnvs(flowConfig, flowSettings, devExports) {
   const unmocked = [];
   const stores = flowConfig.stores;
-  if (!isRecord3(stores)) return unmocked;
+  if (!isRecord4(stores)) return unmocked;
   for (const [storeId, storeDef] of Object.entries(stores)) {
     const packageName = flowSettings.stores?.[storeId]?.package;
     const loadDev = packageName ? devExports?.[packageName] : void 0;
     const devModule = typeof loadDev === "function" ? await loadDev() : void 0;
     const { exportName } = resolveExportName(flowSettings, "store", storeId);
     const push2 = getDevEnv(devModule, exportName)?.push;
-    if (!push2 || !isRecord3(storeDef)) {
+    if (!push2 || !isRecord4(storeDef)) {
       unmocked.push(storeId);
       continue;
     }
@@ -5345,7 +5914,7 @@ function formatPushResult(result, options = {}) {
   const lines = [];
   lines.push(`success: ${result.success}`);
   if (result.success) {
-    const elbResult = isRecord3(result.elbResult) ? result.elbResult : void 0;
+    const elbResult = isRecord4(result.elbResult) ? result.elbResult : void 0;
     if (elbResult) {
       if (typeof elbResult.id === "string")
         lines.push(`  Event ID: ${elbResult.id}`);
@@ -5538,9 +6107,9 @@ function resolvePageUrl(input, pageUrl) {
   return parsed.href;
 }
 function triggerUrl(input) {
-  if (!isRecord3(input) || !isRecord3(input.trigger)) return void 0;
+  if (!isRecord4(input) || !isRecord4(input.trigger)) return void 0;
   const { options } = input.trigger;
-  return isRecord3(options) && isString(options.url) ? options.url : void 0;
+  return isRecord4(options) && isString(options.url) ? options.url : void 0;
 }
 function isSourceInit(value) {
   return typeof value === "function";
@@ -5628,6 +6197,7 @@ async function simulateSource(configOrPath, input, options) {
         logger,
         snapshotCode,
         networkCalls,
+        offline: true,
         pageUrl
       },
       async (module) => {
@@ -5666,14 +6236,15 @@ async function simulateSource(configOrPath, input, options) {
             `Stores without a mock env run as configured: ${unmockedStores.join(", ")}`
           );
         const wiredSources = flowConfig.sources;
-        const wiredSource = isRecord3(wiredSources) ? wiredSources[options.sourceId] : void 0;
-        const source = isRecord3(
+        const wiredSource = isRecord4(wiredSources) ? wiredSources[options.sourceId] : void 0;
+        const source = isRecord4(
           wiredSource
         ) ? {
           ...wiredSource,
-          ...isRecord3(wiredSource.config) ? { config: { ...wiredSource.config } } : {}
+          ...isRecord4(wiredSource.config) ? { config: { ...wiredSource.config } } : {}
         } : void 0;
         flowConfig.sources = source ? { [options.sourceId]: source } : {};
+        if (flowConfig.destinations) flowConfig.destinations = {};
         const commandCalls = [];
         if (source && isSourceInit(source.code))
           source.code = recordSourceCommands(source.code, commandCalls);
@@ -5685,7 +6256,7 @@ async function simulateSource(configOrPath, input, options) {
             simulation: devEnv.simulation
           });
           source.env = {
-            ...isRecord3(source.env) ? source.env : {},
+            ...isRecord4(source.env) ? source.env : {},
             ...wrappedEnv
           };
           trackedCalls = calls;
@@ -5820,7 +6391,8 @@ async function simulateTransformer(configOrPath, event, options) {
         platform: prepared.platform,
         logger,
         snapshotCode,
-        networkCalls
+        networkCalls,
+        offline: true
       },
       async (module) => {
         const flowConfig = module.wireConfig(
@@ -5967,7 +6539,8 @@ async function simulateCollector(configOrPath, event, options) {
         platform: prepared.platform,
         logger,
         snapshotCode,
-        networkCalls
+        networkCalls,
+        offline: true
       },
       async (module) => {
         const flowConfig = module.wireConfig(
@@ -6036,10 +6609,10 @@ async function simulateCollector(configOrPath, event, options) {
   }
 }
 function isConsentRecord(value) {
-  return isRecord3(value) && Object.values(value).every((granted) => typeof granted === "boolean");
+  return isRecord4(value) && Object.values(value).every((granted) => typeof granted === "boolean");
 }
 function pendingRequire(definition) {
-  if (!isRecord3(definition) || !isRecord3(definition.config)) return [];
+  if (!isRecord4(definition) || !isRecord4(definition.config)) return [];
   const { require: require2 } = definition.config;
   return isStringArray(require2) ? require2 : [];
 }
@@ -6102,23 +6675,24 @@ async function simulateDestination(configOrPath, event, options) {
         platform: prepared.platform,
         logger,
         snapshotCode,
-        networkCalls
+        networkCalls,
+        offline: true
       },
       async (module) => {
         const flowConfig = module.wireConfig(
           options.data ?? module.__configData ?? void 0
         );
         const wiredDestinations = flowConfig.destinations;
-        const wiredTarget = isRecord3(wiredDestinations) ? wiredDestinations[options.destinationId] : void 0;
-        if (!isRecord3(wiredTarget)) {
-          const available = isRecord3(wiredDestinations) ? Object.keys(wiredDestinations).join(", ") : "";
+        const wiredTarget = isRecord4(wiredDestinations) ? wiredDestinations[options.destinationId] : void 0;
+        if (!isRecord4(wiredTarget)) {
+          const available = isRecord4(wiredDestinations) ? Object.keys(wiredDestinations).join(", ") : "";
           throw new Error(
             `Destination "${options.destinationId}" not found in collector. Available: ${available || "none"}`
           );
         }
         const target = {
           ...wiredTarget,
-          config: isRecord3(wiredTarget.config) ? { ...wiredTarget.config } : {}
+          config: isRecord4(wiredTarget.config) ? { ...wiredTarget.config } : {}
         };
         flowConfig.destinations = { [options.destinationId]: target };
         if (flowConfig.sources) flowConfig.sources = {};
@@ -6158,7 +6732,7 @@ async function simulateDestination(configOrPath, event, options) {
             );
           }
           const destConfig = target.config;
-          if (isRecord3(destConfig)) {
+          if (isRecord4(destConfig)) {
             destConfig.env = devEnv.push;
           }
           if (devEnv.simulation?.length) {
@@ -6167,7 +6741,7 @@ async function simulateDestination(configOrPath, event, options) {
               simulation: devEnv.simulation
             };
             const { wrappedEnv, calls } = wrapEnv(combined);
-            if (isRecord3(destConfig)) destConfig.env = wrappedEnv;
+            if (isRecord4(destConfig)) destConfig.env = wrappedEnv;
             trackedCalls = calls;
           }
         }
@@ -6257,10 +6831,10 @@ async function simulateDestination(configOrPath, event, options) {
 import * as fs20 from "fs";
 import * as path20 from "path";
 import chalk2 from "chalk";
-import { isObject as isObject9 } from "@walkeros/core";
+import { isObject as isObject10 } from "@walkeros/core";
 
 // src/commands/validate/validators/contract.ts
-import { isObject as isObject4 } from "@walkeros/core";
+import { isObject as isObject5 } from "@walkeros/core";
 var SECTION_KEYS = ["globals", "context", "custom", "user", "consent"];
 var KNOWN_KEYS = /* @__PURE__ */ new Set([
   "extend",
@@ -6310,7 +6884,7 @@ function validateContract(input) {
     const keys = Object.keys(obj);
     const unknownKeys = keys.filter((k) => !KNOWN_KEYS.has(k));
     const hasKnownKey = keys.some((k) => KNOWN_KEYS.has(k));
-    const objectValuedUnknown = unknownKeys.filter((k) => isObject4(obj[k]));
+    const objectValuedUnknown = unknownKeys.filter((k) => isObject5(obj[k]));
     if (!hasKnownKey && objectValuedUnknown.length > 0) {
       errors.push({
         path: name,
@@ -6333,7 +6907,7 @@ function validateContract(input) {
         code: "INVALID_TAGGING"
       });
     }
-    if (obj.schema !== void 0 && !isObject4(obj.schema)) {
+    if (obj.schema !== void 0 && !isObject5(obj.schema)) {
       errors.push({
         path: `${name}.schema`,
         message: "schema must be a JSON Schema object",
@@ -6405,7 +6979,7 @@ function validateContract(input) {
       }
       chain.push(current);
       const entry = contracts[current];
-      current = isObject4(entry) && typeof entry.extend === "string" ? entry.extend : "";
+      current = isObject5(entry) && typeof entry.extend === "string" ? entry.extend : "";
     }
   }
   return {
@@ -6476,7 +7050,7 @@ import {
   ENV_MARKER_PREFIX as ENV_MARKER_PREFIX3,
   getByPath,
   getRouteGraph,
-  isObject as isObject7,
+  isObject as isObject8,
   REF_CONTRACT,
   resolveContracts,
   validateStepEntry
@@ -6487,9 +7061,9 @@ import {
 } from "@walkeros/transformer-validate";
 
 // src/commands/validate/scope.ts
-import { isObject as isObject5 } from "@walkeros/core";
+import { isObject as isObject6 } from "@walkeros/core";
 function isFlowJson2(value) {
-  return isObject5(value) && "version" in value && isObject5(value.flows);
+  return isObject6(value) && "version" in value && isObject6(value.flows);
 }
 var ENTRY_SECTIONS = [
   "sources",
@@ -6501,8 +7075,8 @@ function isEntrySection(value) {
   return ENTRY_SECTIONS.some((section) => section === value);
 }
 function resolveScope(config, options = {}) {
-  const flowsValue = isObject5(config) ? config.flows : void 0;
-  const flowMap = isObject5(flowsValue) ? flowsValue : {};
+  const flowsValue = isObject6(config) ? config.flows : void 0;
+  const flowMap = isObject6(flowsValue) ? flowsValue : {};
   const allFlows = Object.keys(flowMap);
   let flows = allFlows;
   if (options.flow !== void 0) {
@@ -6570,12 +7144,12 @@ function resolveScope(config, options = {}) {
   const entries = [];
   for (const flow of flows) {
     const flowValue = flowMap[flow];
-    if (!isObject5(flowValue)) continue;
+    if (!isObject6(flowValue)) continue;
     for (const candidate of sections) {
       const sectionValue = flowValue[candidate];
-      if (!isObject5(sectionValue)) continue;
+      if (!isObject6(sectionValue)) continue;
       const entry = sectionValue[key];
-      if (isObject5(entry))
+      if (isObject6(entry))
         entries.push({ flow, section: candidate, key, entry });
     }
   }
@@ -6677,12 +7251,12 @@ import {
   ENV_MARKER_PREFIX as ENV_MARKER_PREFIX2,
   fetchPackage,
   getErrorMessage as getErrorMessage3,
-  isObject as isObject6,
+  isObject as isObject7,
   REF_CODE_PREFIX,
   REF_STORE,
   SECRET_MARKER_PREFIX as SECRET_MARKER_PREFIX3
 } from "@walkeros/core";
-var CLIENT_HEADER = "walkeros-cli/4.7.0";
+var CLIENT_HEADER = "walkeros-cli/4.7.1-next-1791015692826";
 function createSettingsContext(configDir) {
   return { configDir, cache: /* @__PURE__ */ new Map(), compiled: /* @__PURE__ */ new Map() };
 }
@@ -6693,7 +7267,7 @@ function selectSettingsSchema(pkg, packageLabel, exportName) {
       pkg.exportSchemas,
       exportName
     ) ? pkg.exportSchemas[exportName] : void 0;
-    if (!isObject6(entry))
+    if (!isObject7(entry))
       return {
         ok: false,
         reason: `${packageLabel} has no export "${exportName}"`
@@ -6721,7 +7295,7 @@ function valueAt(root, segments) {
   let current = root;
   for (const segment of segments) {
     if (Array.isArray(current)) current = current[Number(segment)];
-    else if (isObject6(current)) current = current[segment];
+    else if (isObject7(current)) current = current[segment];
     else return void 0;
   }
   return current;
@@ -6736,7 +7310,7 @@ function prepareSettings(settings) {
   const walk = (value, segments) => {
     if (Array.isArray(value))
       return value.map((item, index) => walk(item, [...segments, `${index}`]));
-    if (isObject6(value))
+    if (isObject7(value))
       return Object.fromEntries(
         Object.entries(value).map(([key, item]) => [
           key,
@@ -6781,11 +7355,11 @@ function isUnder(segments, prefix) {
   return prefix.every((segment, index) => segments[index] === segment);
 }
 function bundlePin(rawFlow, name) {
-  const config = isObject6(rawFlow) ? rawFlow.config : void 0;
-  const bundle2 = isObject6(config) ? config.bundle : void 0;
-  const packages = isObject6(bundle2) ? bundle2.packages : void 0;
-  const pin = isObject6(packages) ? packages[name] : void 0;
-  if (!isObject6(pin)) return {};
+  const config = isObject7(rawFlow) ? rawFlow.config : void 0;
+  const bundle2 = isObject7(config) ? config.bundle : void 0;
+  const packages = isObject7(bundle2) ? bundle2.packages : void 0;
+  const pin = isObject7(packages) ? packages[name] : void 0;
+  if (!isObject7(pin)) return {};
   return {
     ...typeof pin.version === "string" ? { version: pin.version } : {},
     ...typeof pin.path === "string" ? { path: pin.path } : {}
@@ -6814,15 +7388,15 @@ function readLocalSchema(source, configDir) {
   const meta = readJson2(file);
   const pkgFile = path19.join(root, "package.json");
   const pkg = fs19.existsSync(pkgFile) ? readJson2(pkgFile) : void 0;
-  const schemas6 = isObject6(meta) ? meta.schemas : void 0;
-  const exportSchemas = isObject6(meta) ? meta.exportSchemas : void 0;
-  const declared = isObject6(meta) && isObject6(meta.$meta) ? meta.$meta.exports : void 0;
-  const version = isObject6(pkg) && typeof pkg.version === "string" ? pkg.version : void 0;
+  const schemas6 = isObject7(meta) ? meta.schemas : void 0;
+  const exportSchemas = isObject7(meta) ? meta.exportSchemas : void 0;
+  const declared = isObject7(meta) && isObject7(meta.$meta) ? meta.$meta.exports : void 0;
+  const version = isObject7(pkg) && typeof pkg.version === "string" ? pkg.version : void 0;
   return {
     ...version ? { version } : {},
-    settings: isObject6(schemas6) ? schemas6.settings : void 0,
-    ...isObject6(exportSchemas) ? { exportSchemas } : {},
-    ...isObject6(declared) ? { exports: Object.keys(declared) } : {}
+    settings: isObject7(schemas6) ? schemas6.settings : void 0,
+    ...isObject7(exportSchemas) ? { exportSchemas } : {},
+    ...isObject7(declared) ? { exports: Object.keys(declared) } : {}
   };
 }
 async function loadSchema(source, context2) {
@@ -6846,7 +7420,7 @@ async function loadSchema(source, context2) {
   };
 }
 function compileSettings(settings) {
-  if (!isObject6(settings)) return void 0;
+  if (!isObject7(settings)) return void 0;
   const ajv = new Ajv({ allErrors: true, validateFormats: false });
   try {
     return { ok: true, validate: ajv.compile(settings) };
@@ -6950,7 +7524,7 @@ async function checkStepSettings(target, resolvedFlow, rawFlow, check, context2)
   }
   const validate2 = compiled.validate;
   const step = stepOf(resolvedFlow, target.section, target.key);
-  const config = isObject6(step?.config) ? step.config : {};
+  const config = isObject7(step?.config) ? step.config : {};
   const prepared = prepareSettings(config.settings ?? {});
   const base = `${at}.config.settings`;
   for (const { segments, reference } of prepared.deferred) {
@@ -7029,9 +7603,9 @@ async function validateFlowWithPackages(input, options = {}) {
       continue;
     }
     for (const section of ENTRY_SECTIONS) {
-      const steps = isObject7(rawFlow[section]) ? rawFlow[section] : {};
+      const steps = isObject8(rawFlow[section]) ? rawFlow[section] : {};
       for (const [key, entry] of Object.entries(steps)) {
-        if (!isObject7(entry) || entry.package === void 0) continue;
+        if (!isObject8(entry) || entry.package === void 0) continue;
         const target = { flow: name, section, key, entry };
         pending.push(
           checkStepSettings(
@@ -7090,9 +7664,9 @@ function runFlowChecks(input, options) {
     };
   }
   errors.push(...scope.errors);
-  const config = isObject7(input) ? input : {};
+  const config = isObject8(input) ? input : {};
   const flowsValue = config.flows;
-  const flows = isObject7(flowsValue) ? flowsValue : void 0;
+  const flows = isObject8(flowsValue) ? flowsValue : void 0;
   const allFlows = scope.allFlows;
   const inScope = (path23) => {
     const flow = flowOfPath(path23, allFlows);
@@ -7130,13 +7704,13 @@ function runFlowChecks(input, options) {
   checks.push("flow:steps");
   for (const flowName of scope.flows) {
     const flowValue = flows?.[flowName];
-    if (!isObject7(flowValue)) continue;
+    if (!isObject8(flowValue)) continue;
     const transformersValue = flowValue.transformers;
-    if (isObject7(transformersValue)) {
+    if (isObject8(transformersValue)) {
       for (const [name, transformerValue] of Object.entries(
         transformersValue
       )) {
-        if (!isObject7(transformerValue)) continue;
+        if (!isObject8(transformerValue)) continue;
         const result2 = validateStepEntry(transformerValue, "Transformer");
         if (!result2.ok) {
           errors.push({
@@ -7149,9 +7723,9 @@ function runFlowChecks(input, options) {
     }
     for (const [section, kind] of OPEN_STEP_KINDS) {
       const steps = flowValue[section];
-      if (!isObject7(steps)) continue;
+      if (!isObject8(steps)) continue;
       for (const [name, step] of Object.entries(steps)) {
-        if (!isObject7(step)) continue;
+        if (!isObject8(step)) continue;
         const at = `flows.${flowName}.${section}.${name}`;
         for (const key of unknownStepKeys(step, kind)) {
           warnings.push({
@@ -7180,15 +7754,15 @@ function runFlowChecks(input, options) {
   let totalPackageCount = 0;
   for (const flowName of scope.flows) {
     const flowValue = flows?.[flowName];
-    if (!isObject7(flowValue)) continue;
+    if (!isObject8(flowValue)) continue;
     const flowConfig = flowValue.config;
-    if (!isObject7(flowConfig)) continue;
+    if (!isObject8(flowConfig)) continue;
     const bundle2 = flowConfig.bundle;
-    if (!isObject7(bundle2)) continue;
+    if (!isObject8(bundle2)) continue;
     const packages = bundle2.packages;
-    if (!isObject7(packages)) continue;
+    if (!isObject8(packages)) continue;
     for (const [pkgName, pkgConfigValue] of Object.entries(packages)) {
-      if (!isObject7(pkgConfigValue)) continue;
+      if (!isObject8(pkgConfigValue)) continue;
       if (!pkgConfigValue.version && !pkgConfigValue.path) {
         warnings.push({
           path: `flows.${flowName}.config.bundle.packages.${pkgName}`,
@@ -7275,13 +7849,13 @@ function runFlowChecks(input, options) {
           warnings,
           options.strict === true,
           skipped,
-          isObject7(resolvedConfig) && isObject7(resolvedConfig.settings) ? resolvedConfig.settings : void 0
+          isObject8(resolvedConfig) && isObject8(resolvedConfig.settings) ? resolvedConfig.settings : void 0
         );
       }
       for (const [destName, dest] of Object.entries(flow.destinations || {})) {
-        if (!isObject7(dest.config)) continue;
+        if (!isObject8(dest.config)) continue;
         const mapping = dest.config.mapping;
-        if (!isObject7(mapping)) continue;
+        if (!isObject8(mapping)) continue;
         for (const key of Object.keys(mapping)) {
           if (key.includes(".") && !key.includes(" ")) {
             const parts = key.split(".");
@@ -7449,21 +8023,21 @@ function isStepOut(value) {
   return Array.isArray(value) && value.every((entry) => Array.isArray(entry) && typeof entry[0] === "string");
 }
 function returnedEvents(value) {
-  if (isObject7(value)) return [isObject7(value.event) ? value.event : value];
+  if (isObject8(value)) return [isObject8(value.event) ? value.event : value];
   if (Array.isArray(value)) return value.flatMap(returnedEvents);
   return [];
 }
 function outEvents(out) {
   if (isStepOut(out)) {
     return out.flatMap(([head, first]) => {
-      if (head === "elb") return isObject7(first) ? [first] : [];
+      if (head === "elb") return isObject8(first) ? [first] : [];
       if (head === "return") return returnedEvents(first);
       return [];
     });
   }
   if (Array.isArray(out) || typeof out === "string")
     return out.length > 0 ? [out] : [];
-  return isObject7(out) && Object.keys(out).length > 0 ? [out] : [];
+  return isObject8(out) && Object.keys(out).length > 0 ? [out] : [];
 }
 function hasComparableOut(out) {
   return outEvents(out).length > 0;
@@ -7505,7 +8079,7 @@ function routeAt(spec, path23) {
   for (const key of path23) {
     if (typeof key === "number")
       current = Array.isArray(current) ? current[key] : void 0;
-    else current = isObject7(current) ? current[key] : void 0;
+    else current = isObject8(current) ? current[key] : void 0;
   }
   return current;
 }
@@ -7530,7 +8104,7 @@ function lintRoute(spec, position, known, errors, warnings) {
     if (node.stop && !node.match && node.kind !== "many") {
       const self = routeAt(spec, node.path);
       const list = routeAt(spec, node.path.slice(0, -1));
-      if (isObject7(self) && self.stop === true && typeof last === "number" && Array.isArray(list) && last < list.length - 1 && once(`stop:${where(node.path)}`)) {
+      if (isObject8(self) && self.stop === true && typeof last === "number" && Array.isArray(list) && last < list.length - 1 && once(`stop:${where(node.path)}`)) {
         const at = where(node.path);
         warnings.push({
           path: at,
@@ -7596,7 +8170,7 @@ function resolveStepContracts(entries, contract) {
   }
   const sources = [];
   for (const [index, entry] of entries.entries()) {
-    if (isObject7(entry)) {
+    if (isObject8(entry)) {
       sources.push(entry);
       continue;
     }
@@ -7614,7 +8188,7 @@ function resolveStepContracts(entries, contract) {
         message: `contract "${match[1]}" is not defined in the root contract (defined: ${Object.keys(resolved).join(", ") || "none"})`
       };
     const rule = match[2] ? getByPath(resolved[match[1]], match[2]) : resolved[match[1]];
-    if (!isObject7(rule))
+    if (!isObject8(rule))
       return {
         ok: false,
         index,
@@ -7625,7 +8199,7 @@ function resolveStepContracts(entries, contract) {
   return { ok: true, sources };
 }
 function checkValidateStepExamples(stepPath, step, contract, errors, warnings, strict, skipped, resolvedSettings) {
-  const settings = resolvedSettings ?? (isObject7(step.config) && isObject7(step.config.settings) ? step.config.settings : {});
+  const settings = resolvedSettings ?? (isObject8(step.config) && isObject8(step.config.settings) ? step.config.settings : {});
   const contractPath = `${stepPath}.config.settings.contract`;
   if (settings.contract !== void 0 && !Array.isArray(settings.contract)) {
     if (step.examples)
@@ -7650,10 +8224,10 @@ function checkValidateStepExamples(stepPath, step, contract, errors, warnings, s
   const contracts = resolution.sources;
   const mode = settings.mode === "strict" ? "strict" : "pass";
   const format = settings.format === true;
-  const output = isObject7(settings.output) ? settings.output : {};
+  const output = isObject8(settings.output) ? settings.output : {};
   const isValidPath = typeof output.isValid === "string" ? output.isValid : "source.valid";
   for (const [exName, example] of Object.entries(step.examples)) {
-    if (example.command || !isObject7(example.in)) continue;
+    if (example.command || !isObject8(example.in)) continue;
     if (example.out === void 0) continue;
     const event = example.in;
     const verdict = validateEventAgainstContract(event, void 0, {
@@ -7691,14 +8265,14 @@ function checkValidateStepExamples(stepPath, step, contract, errors, warnings, s
 }
 
 // src/commands/validate/validators/mapping.ts
-import { isObject as isObject8 } from "@walkeros/core";
+import { isObject as isObject9 } from "@walkeros/core";
 import { schemas as schemas5 } from "@walkeros/core/dev";
 var { RuleSchema } = schemas5.MappingSchemas;
 function isRule(value) {
-  return isObject8(value) && RuleSchema.safeParse(value).success;
+  return isObject9(value) && RuleSchema.safeParse(value).success;
 }
 function isNestedActions(key, value) {
-  if (key.includes(" ") || !isObject8(value)) return false;
+  if (key.includes(" ") || !isObject9(value)) return false;
   const rules = Object.values(value);
   return rules.length > 0 && rules.every(
     (rule) => Array.isArray(rule) ? rule.length > 0 && rule.every(isRule) : isRule(rule)
@@ -7708,7 +8282,7 @@ function validateMapping(input) {
   const errors = [];
   const warnings = [];
   const details = {};
-  if (!isObject8(input)) {
+  if (!isObject9(input)) {
     errors.push({
       path: "root",
       message: "Mapping must be an object with event patterns as keys",
@@ -7931,7 +8505,7 @@ function inapplicableOptions(type, options) {
 }
 function validateContractInput(input) {
   if (!isFlowJson2(input)) return validateContract(input);
-  const contract = isObject9(input) ? input.contract : void 0;
+  const contract = isObject10(input) ? input.contract : void 0;
   if (contract === void 0) {
     return {
       valid: false,
@@ -8194,8 +8768,10 @@ async function loginCommand(options) {
 }
 async function fetchEmail(appUrl, accessToken, fetchFn) {
   try {
-    const response = await fetchFn(`${appUrl}/api/auth/whoami`, {
-      headers: { Authorization: `Bearer ${accessToken}` },
+    const response = await apiRequest("GET /api/auth/whoami", {
+      auth: { token: accessToken },
+      baseUrl: appUrl,
+      fetch: fetchFn,
       signal: AbortSignal.timeout(WHOAMI_TIMEOUT_MS)
     });
     if (!response.ok) return void 0;
@@ -8334,121 +8910,6 @@ async function logout() {
 
 // src/core/api-client.ts
 import createClient from "openapi-fetch";
-
-// src/core/contract.ts
-import { createHash as createHash2 } from "crypto";
-import semver4 from "semver";
-var bakedContractVersion = true ? "4.7.0" : PLACEHOLDER;
-var bakedContractHash = true ? "1758bf6b37ad72eb37dd8176f240ae64b16c5b1f9da376cab6357027c835a833" : "";
-function isRecord4(value) {
-  return value !== null && typeof value === "object" && !Array.isArray(value);
-}
-function canonicalize(value) {
-  if (Array.isArray(value)) {
-    return value.map(canonicalize);
-  }
-  if (isRecord4(value)) {
-    const result = {};
-    for (const key of Object.keys(value).sort()) {
-      result[key] = canonicalize(value[key]);
-    }
-    return result;
-  }
-  return value;
-}
-function stripInfoVersion(doc) {
-  if (!isRecord4(doc) || !isRecord4(doc.info)) {
-    return doc;
-  }
-  const restInfo = {};
-  for (const [key, value] of Object.entries(doc.info)) {
-    if (key !== "version") restInfo[key] = value;
-  }
-  return { ...doc, info: restInfo };
-}
-function canonicalContractHash(doc) {
-  const canonical = canonicalize(stripInfoVersion(doc));
-  return createHash2("sha256").update(JSON.stringify(canonical)).digest("hex");
-}
-var HEALTH_TIMEOUT_MS = 5e3;
-async function fetchHealth(baseUrl) {
-  try {
-    const res = await fetch(`${baseUrl ?? resolveAppUrl()}/api/health`, {
-      signal: AbortSignal.timeout(HEALTH_TIMEOUT_MS)
-    });
-    const body = await res.json().catch(() => void 0);
-    const result = { reachable: true };
-    if (isRecord4(body)) {
-      const record = body;
-      if (typeof record.status === "string") result.status = record.status;
-      if (typeof record.appVersion === "string")
-        result.appVersion = record.appVersion;
-      if (typeof record.contractVersion === "string")
-        result.contractVersion = record.contractVersion;
-      if (typeof record.contractHash === "string")
-        result.contractHash = record.contractHash;
-    }
-    return result;
-  } catch {
-    return { reachable: false };
-  }
-}
-async function compareContract(input = {}) {
-  const bakedVersion = input.bakedVersion ?? bakedContractVersion;
-  const bakedHash = input.bakedHash ?? bakedContractHash;
-  const health = await fetchHealth(input.baseUrl);
-  if (!health.reachable || health.contractVersion === void 0 || health.contractHash === void 0) {
-    return { verdict: "unknown", bakedVersion };
-  }
-  const liveVersion = health.contractVersion;
-  if (health.contractHash === bakedHash) {
-    return { verdict: "in-sync", bakedVersion, liveVersion };
-  }
-  const liveNewer = semver4.valid(liveVersion) && semver4.valid(bakedVersion) ? semver4.gt(liveVersion, bakedVersion) : liveVersion > bakedVersion;
-  if (liveNewer) {
-    return {
-      verdict: "client-older",
-      bakedVersion,
-      liveVersion,
-      action: `upgrade @walkeros/cli to >= ${liveVersion}`
-    };
-  }
-  return { verdict: "client-newer", bakedVersion, liveVersion };
-}
-async function annotateErrorWithDrift(error, input = {}) {
-  const comparison = await compareContract(input).catch(
-    () => ({
-      verdict: "unknown",
-      bakedVersion: input.bakedVersion ?? bakedContractVersion
-    })
-  );
-  if (comparison.verdict !== "client-older" || !comparison.action) {
-    return error;
-  }
-  const annotated = new Error(
-    `${error.message}
-
-The server runs contract ${comparison.liveVersion}, this client was built against ${comparison.bakedVersion}. This may be the cause: ${comparison.action}.`
-  );
-  annotated.stack = error.stack;
-  return annotated;
-}
-
-// src/core/api-client.ts
-var driftWarned = false;
-function emitDriftWarning(responseHeaders) {
-  if (driftWarned) return;
-  const serverVersion = responseHeaders.get("X-WalkerOS-Server-Version");
-  if (!serverVersion) return;
-  if (serverVersion === bakedContractVersion) return;
-  driftWarned = true;
-  const minClient = responseHeaders.get("X-WalkerOS-Min-Client");
-  const minNote = minClient ? ` (min client ${minClient})` : "";
-  process.stderr.write(
-    `walkerOS: server contract version is ${serverVersion}${minNote}, this client was built against ${bakedContractVersion}. Run \`walkeros diagnostics\` or upgrade @walkeros/cli if commands misbehave.
-`
-  );
-}
 function createApiClient() {
   const client = createClient({
     baseUrl: resolveAppUrl(),
@@ -8468,12 +8929,6 @@ function createApiClient() {
       requireSecureUrl(request.url);
       request.headers.set("Authorization", `Bearer ${token}`);
       return request;
-    },
-    // Surface contract drift once per process from any response's version
-    // headers. openapi-fetch ^0.17 supports `use({ onResponse })`.
-    onResponse({ response }) {
-      emitDriftWarning(response.headers);
-      return void 0;
     }
   });
   return client;
@@ -8896,9 +9351,10 @@ async function getAvailableFlowNames(options) {
 var DEFAULT_DEPLOY_WAIT_MS = 12 * 60 * 1e3;
 async function streamDeploymentStatus(projectId, deploymentId, options) {
   const timeoutMs = options.timeout ?? DEFAULT_DEPLOY_WAIT_MS;
-  const response = await apiFetch(
-    `/api/projects/${projectId}/deployments/${deploymentId}/stream`,
+  const response = await apiRequest(
+    "GET /api/projects/{projectId}/deployments/{deploymentId}/stream",
     {
+      path: { projectId, deploymentId },
       headers: { Accept: "text/event-stream" },
       signal: options.signal ?? AbortSignal.timeout(timeoutMs)
     }
@@ -8987,9 +9443,12 @@ Available: ${names.join(", ")}`,
 }
 async function deploySettings(options) {
   const { flowId, projectId, settingsId } = options;
-  const triggerDeploy = () => apiFetch(
-    `/api/projects/${projectId}/flows/${flowId}/settings/${settingsId}/deploy`,
-    { method: "POST", headers: { "Idempotency-Key": randomUUID() } }
+  const triggerDeploy = () => apiRequest(
+    "POST /api/projects/{projectId}/flows/{flowId}/settings/{settingsId}/deploy",
+    {
+      path: { projectId, flowId, settingsId },
+      headers: { "Idempotency-Key": randomUUID() }
+    }
   );
   let response = await triggerDeploy();
   if (!response.ok && options.wait) {
@@ -9037,8 +9496,9 @@ async function getDeployment(options) {
       projectId,
       flowName: options.flowName
     });
-    const response = await apiFetch(
-      `/api/projects/${projectId}/flows/${options.flowId}/settings/${settingsId}/deploy`
+    const response = await apiRequest(
+      "GET /api/projects/{projectId}/flows/{flowId}/settings/{settingsId}/deploy",
+      { path: { projectId, flowId: options.flowId, settingsId } }
     );
     if (!response.ok) {
       const body = await response.json().catch(() => ({}));
@@ -9133,18 +9593,39 @@ async function getDeploymentCommand(flowId, options) {
 }
 
 // src/commands/deployments/index.ts
-import { getPlatform as getPlatform4, isObject as isObject10 } from "@walkeros/core";
+import { getPlatform as getPlatform4, isObject as isObject11 } from "@walkeros/core";
+var DEPLOYMENT_STATUSES = {
+  idle: true,
+  deploying: true,
+  published: true,
+  active: true,
+  stopped: true,
+  failed: true
+};
+var DEPLOYMENT_TYPES = {
+  web: true,
+  server: true
+};
+function isMember(members, value) {
+  return Object.hasOwn(members, value);
+}
+function isDeploymentStatus(value) {
+  return isMember(DEPLOYMENT_STATUSES, value);
+}
 async function listDeployments(options = {}) {
   const id = options.projectId ?? requireProjectId();
-  const params = new URLSearchParams();
-  if (options.type) params.set("type", options.type);
-  if (options.status) params.set("status", options.status);
-  if (options.flowId) params.set("flowId", options.flowId);
-  if (options.cursor) params.set("cursor", options.cursor);
-  if (options.limit !== void 0) params.set("limit", String(options.limit));
-  const qs = params.toString();
-  const response = await apiFetch(
-    `/api/projects/${id}/deployments${qs ? `?${qs}` : ""}`
+  const response = await apiRequest(
+    "GET /api/projects/{projectId}/deployments",
+    {
+      path: { projectId: id },
+      query: {
+        type: options.type,
+        status: options.status,
+        flowId: options.flowId || void 0,
+        cursor: options.cursor || void 0,
+        limit: options.limit
+      }
+    }
   );
   if (!response.ok) {
     const body = await response.json().catch(() => ({}));
@@ -9191,8 +9672,9 @@ async function deleteDeploymentByFlowId(options) {
 }
 async function getDeploymentBySlug(options) {
   const id = options.projectId ?? requireProjectId();
-  const response = await apiFetch(
-    `/api/projects/${id}/deployments/${options.slug}`
+  const response = await apiRequest(
+    "GET /api/projects/{projectId}/deployments/{deploymentId}",
+    { path: { projectId: id, deploymentId: options.slug } }
   );
   if (!response.ok) {
     const body = await response.json().catch(() => ({}));
@@ -9202,11 +9684,13 @@ async function getDeploymentBySlug(options) {
 }
 async function createDeployment(options) {
   const id = options.projectId ?? requireProjectId();
-  const response = await apiFetch(`/api/projects/${id}/deployments`, {
-    method: "POST",
-    headers: { "Content-Type": "application/json" },
-    body: JSON.stringify({ type: options.type, label: options.label })
-  });
+  const response = await apiRequest(
+    "POST /api/projects/{projectId}/deployments",
+    {
+      path: { projectId: id },
+      body: { type: options.type, label: options.label }
+    }
+  );
   if (!response.ok) {
     const body = await response.json().catch(() => ({}));
     throwApiError(body, "Failed to create deployment");
@@ -9215,9 +9699,9 @@ async function createDeployment(options) {
 }
 async function deleteDeployment(options) {
   const id = options.projectId ?? requireProjectId();
-  const response = await apiFetch(
-    `/api/projects/${id}/deployments/${options.slug}`,
-    { method: "DELETE" }
+  const response = await apiRequest(
+    "DELETE /api/projects/{projectId}/deployments/{deploymentId}",
+    { path: { projectId: id, deploymentId: options.slug } }
   );
   if (!response.ok) {
     const body = await response.json().catch(() => ({}));
@@ -9226,6 +9710,11 @@ async function deleteDeployment(options) {
   const data = await response.json().catch(() => null);
   return data ?? { success: true };
 }
+function flagValue(flag, value, members) {
+  if (value === void 0) return void 0;
+  if (isMember(members, value)) return value;
+  throw new Error(`${flag} must be one of: ${Object.keys(members).join(", ")}`);
+}
 async function handleResult3(fn, options) {
   try {
     const result = await fn();
@@ -9238,8 +9727,8 @@ async function listDeploymentsCommand(options) {
   await handleResult3(
     () => listDeployments({
       projectId: options.project,
-      type: options.type,
-      status: options.status,
+      type: flagValue("--type", options.type, DEPLOYMENT_TYPES),
+      status: flagValue("--status", options.status, DEPLOYMENT_STATUSES),
       cursor: options.cursor,
       limit: options.limit
     }),
@@ -9281,21 +9770,23 @@ async function createDeployCommand(config, options) {
     const isRemoteFlow = config.startsWith("cfg_");
     if (isRemoteFlow) {
       const id = options.project ?? requireProjectId();
-      const resp = await apiFetch(`/api/projects/${id}/flows/${config}`);
+      const resp = await apiRequest(
+        "GET /api/projects/{projectId}/flows/{flowId}",
+        { path: { projectId: id, flowId: config } }
+      );
       if (!resp.ok) {
         const body = await resp.json().catch(() => ({}));
         throwApiError(body, `Failed to fetch flow ${config}`);
       }
       const flow = await resp.json();
       if (!flow.config) throw new Error("Flow has no config");
-      const flowConfig = flow.config;
-      const flows = flowConfig.flows;
+      const flows = flow.config.flows;
       if (!flows) throw new Error("Invalid flow config: missing flows");
       const flowName = options.flow ?? Object.keys(flows)[0];
       if (!flowName) throw new Error("No flows found in config");
       const flowSettings = flows[flowName];
-      if (!isObject10(flowSettings)) throw new Error("Invalid flow config");
-      const platform = isObject10(flowSettings.config) ? flowSettings.config.platform : void 0;
+      if (!isObject11(flowSettings)) throw new Error("Invalid flow config");
+      const platform = isObject11(flowSettings.config) ? flowSettings.config.platform : void 0;
       if (platform !== "web" && platform !== "server")
         throw new Error(
           `Flow "${flowName}" must have config.platform set to "web" or "server"`
@@ -9375,10 +9866,9 @@ async function feedback(text, options) {
       payload.projectId = projectId;
     }
   }
-  const response = await publicFetch("/api/feedback", {
-    method: "POST",
-    headers: { "Content-Type": "application/json" },
-    body: JSON.stringify(payload)
+  const response = await apiRequest("POST /api/feedback", {
+    auth: "none",
+    body: payload
   });
   if (!response.ok) {
     throw new Error(
@@ -9591,9 +10081,16 @@ async function wrapSkeleton(options) {
     };
     if (platform === "browser") {
       esbuildOptions.format = "iife";
+      const needs = readNeedsMarker(skeletonText);
       esbuildOptions.define = {
         "process.env.NODE_ENV": '"production"',
-        global: "globalThis"
+        global: "globalThis",
+        ...buildFlagDefines(
+          needs && {
+            ...needs,
+            observe: needs.observe || options.observe !== void 0
+          }
+        )
       };
       esbuildOptions.external = devExternals;
       esbuildOptions.target = target ?? "es2018";
@@ -10094,11 +10591,219 @@ function resolveManifestSource(manifest, env = process.env) {
   return fromEnv;
 }
 
+// src/core/contract.ts
+import { createHash as createHash3 } from "crypto";
+import semver4 from "semver";
+var bakedContractVersion = true ? "4.7.0+80fb4d79" : PLACEHOLDER;
+var bakedContractHash = true ? "7096fd745fbe3993fe5f1f90d87aec45b20ff8d15adce2c3b0f871f99b0183de" : "";
+var bakedClientOperations = typeof define_CLIENT_OPERATION_DIGESTS_default === "object" ? define_CLIENT_OPERATION_DIGESTS_default : [];
+function isRecord5(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function stripInfoVersion(doc) {
+  if (!isRecord5(doc) || !isRecord5(doc.info)) {
+    return doc;
+  }
+  const restInfo = {};
+  for (const [key, value] of Object.entries(doc.info)) {
+    if (key !== "version") restInfo[key] = value;
+  }
+  return { ...doc, info: restInfo };
+}
+function canonicalContractHash(doc) {
+  const canonical = canonicalize(stripInfoVersion(doc));
+  return createHash3("sha256").update(JSON.stringify(canonical)).digest("hex");
+}
+var HEALTH_TIMEOUT_MS = 5e3;
+var OPENAPI_TIMEOUT_MS = 1e4;
+function trimTrailingSlashes(url) {
+  return url.replace(/\/+$/, "");
+}
+function failureReason(error, timeoutMs) {
+  if (!isRecord5(error)) return String(error);
+  if (error.name === "TimeoutError") return `timeout after ${timeoutMs} ms`;
+  const message = typeof error.message === "string" ? error.message : String(error);
+  const cause = error.cause;
+  const code = isRecord5(cause) && typeof cause.code === "string" ? cause.code : void 0;
+  return code ? `${message} (${code})` : message;
+}
+async function fetchHealth(baseUrl) {
+  try {
+    const res = await apiRequest("GET /api/health", {
+      auth: "none",
+      signal: AbortSignal.timeout(HEALTH_TIMEOUT_MS),
+      ...baseUrl === void 0 ? {} : { baseUrl }
+    });
+    const body = await res.json().catch(() => void 0);
+    const result = { reachable: true };
+    if (!res.ok) result.httpStatus = res.status;
+    if (isRecord5(body)) {
+      if (typeof body.status === "string") result.status = body.status;
+      if (typeof body.appVersion === "string")
+        result.appVersion = body.appVersion;
+      if (typeof body.contractVersion === "string")
+        result.contractVersion = body.contractVersion;
+      if (typeof body.contractHash === "string")
+        result.contractHash = body.contractHash;
+      if (typeof body.minSupportedClient === "string")
+        result.minSupportedClient = body.minSupportedClient;
+    }
+    return result;
+  } catch (error) {
+    return {
+      reachable: false,
+      error: failureReason(error, HEALTH_TIMEOUT_MS)
+    };
+  }
+}
+async function fetchOpenApi(baseUrl) {
+  const base = baseUrl ?? trimTrailingSlashes(resolveAppUrl());
+  const url = operationUrl("GET /api/openapi.json", { baseUrl: base });
+  let res;
+  try {
+    res = await apiRequest("GET /api/openapi.json", {
+      auth: "none",
+      baseUrl: base,
+      signal: AbortSignal.timeout(OPENAPI_TIMEOUT_MS)
+    });
+  } catch (error) {
+    return { ok: false, url, error: failureReason(error, OPENAPI_TIMEOUT_MS) };
+  }
+  if (!res.ok) return { ok: false, url, error: `HTTP ${res.status}` };
+  const document = await res.json().catch(() => void 0);
+  if (!isRecord5(document)) {
+    return { ok: false, url, error: "response is not JSON" };
+  }
+  if (!isRecord5(document.paths)) return { ok: false, url, error: "no paths" };
+  return { ok: true, url, document };
+}
+function isBelow(version, floor) {
+  return semver4.valid(version) !== null && semver4.valid(floor) !== null && semver4.lt(version, floor);
+}
+function serverFloorBelow(server, client) {
+  if (server === void 0 || !server.includes("+")) return true;
+  if (semver4.valid(server) === null) return true;
+  return isBelow(server, client);
+}
+function documentLabel(document) {
+  const info = document.info;
+  return isRecord5(info) && typeof info.version === "string" ? info.version : void 0;
+}
+async function compareContract(input = {}) {
+  const appUrl = trimTrailingSlashes(input.baseUrl ?? resolveAppUrl());
+  const context2 = input.client ?? getClientContext() ?? { type: "cli", version: VERSION };
+  const client = {
+    package: `@walkeros/${context2.type}`,
+    version: context2.version,
+    contract: input.bakedVersion ?? bakedContractVersion
+  };
+  const operations = input.operations ?? bakedClientOperations;
+  const health = await fetchHealth(appUrl);
+  if (!health.reachable) {
+    const url = operationUrl("GET /api/health", { baseUrl: appUrl });
+    return {
+      verdict: "unknown",
+      appUrl,
+      client,
+      reason: `GET ${url}: ${health.error ?? "no response"}`
+    };
+  }
+  const known = {
+    verdict: "unknown",
+    appUrl,
+    client,
+    ...health.contractVersion !== void 0 && {
+      server: health.contractVersion
+    },
+    ...health.minSupportedClient !== void 0 && {
+      minSupportedClient: health.minSupportedClient
+    }
+  };
+  if (health.minSupportedClient !== void 0 && isBelow(client.version, health.minSupportedClient)) {
+    return {
+      ...known,
+      verdict: "client-outdated",
+      requires: { package: client.package, version: health.minSupportedClient }
+    };
+  }
+  if (operations.length === 0) {
+    return { ...known, reason: "no baked client operations" };
+  }
+  const live = await fetchOpenApi(appUrl);
+  if (!live.ok) {
+    return { ...known, reason: `GET ${live.url}: ${live.error}` };
+  }
+  let liveDigests;
+  try {
+    liveDigests = operationDigests(
+      live.document,
+      operations.map(({ op }) => op)
+    );
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    return { ...known, reason: `GET ${live.url}: ${message}` };
+  }
+  const missing = operations.filter(({ op }) => !Object.hasOwn(liveDigests, op)).map(({ op, usedBy }) => ({ op, usedBy }));
+  const changed = operations.filter(({ op, digest }) => {
+    return Object.hasOwn(liveDigests, op) && liveDigests[op] !== digest;
+  }).map(({ op }) => op);
+  const server = known.server ?? documentLabel(live.document);
+  const compared = {
+    ...known,
+    ...server !== void 0 && { server },
+    operations: operations.length,
+    missing,
+    changed
+  };
+  if (missing.length > 0) return { ...compared, verdict: "server-older" };
+  if (changed.length > 0) {
+    const older = serverFloorBelow(server, client.contract);
+    return { ...compared, verdict: older ? "server-older" : "changed" };
+  }
+  return { ...compared, verdict: "in-sync" };
+}
+function missingList(missing) {
+  return missing.map(
+    ({ op, usedBy }) => usedBy.length > 0 ? `${op} (${usedBy.join(", ")})` : op
+  ).join(", ");
+}
+function formatContract(c) {
+  const server = c.server ?? "without a label";
+  const labels = `server ${server}, client ${c.client.contract}`;
+  const missing = c.missing ?? [];
+  const changed = c.changed ?? [];
+  switch (c.verdict) {
+    case "in-sync":
+      return `contract: in-sync (${labels}, ${c.operations ?? 0} operations)`;
+    case "changed":
+      return `contract: changed (${labels}); changed: ${changed.join(", ")}`;
+    case "server-older": {
+      const parts = [`contract: server-older (${labels})`];
+      if (missing.length > 0) {
+        parts.push(`not offered (${missing.length}): ${missingList(missing)}`);
+      }
+      if (changed.length > 0) parts.push(`changed: ${changed.length}`);
+      return parts.join("; ");
+    }
+    case "client-outdated": {
+      const pkg = c.requires?.package ?? c.client.package;
+      const floor = c.requires?.version ?? c.minSupportedClient;
+      const requires = floor === void 0 ? "" : ` requires ${pkg} >= ${floor}`;
+      return `contract: client-outdated (${c.appUrl}${requires}; this is ${c.client.version})`;
+    }
+    case "unknown":
+      return `contract: unknown (${c.reason ?? "no reason given"})`;
+    case "in-process":
+      return `contract: in-process (server ${server})`;
+  }
+}
+
 // src/commands/previews/index.ts
 async function listPreviews(options) {
   const pid = options.projectId ?? requireProjectId();
-  const response = await apiFetch(
-    `/api/projects/${pid}/flows/${options.flowId}/previews`
+  const response = await apiRequest(
+    "GET /api/projects/{projectId}/flows/{flowId}/previews",
+    { path: { projectId: pid, flowId: options.flowId } }
   );
   if (!response.ok) {
     const body = await response.json().catch(() => ({}));
@@ -10108,8 +10813,15 @@ async function listPreviews(options) {
 }
 async function getPreview(options) {
   const pid = options.projectId ?? requireProjectId();
-  const response = await apiFetch(
-    `/api/projects/${pid}/flows/${options.flowId}/previews/${options.previewId}`
+  const response = await apiRequest(
+    "GET /api/projects/{projectId}/flows/{flowId}/previews/{previewId}",
+    {
+      path: {
+        projectId: pid,
+        flowId: options.flowId,
+        previewId: options.previewId
+      }
+    }
   );
   if (!response.ok) {
     const body = await response.json().catch(() => ({}));
@@ -10142,15 +10854,14 @@ async function createPreview(options) {
     }
     settingsId = match.id;
   }
-  const response = await apiFetch(
-    `/api/projects/${pid}/flows/${options.flowId}/previews`,
+  const response = await apiRequest(
+    "POST /api/projects/{projectId}/flows/{flowId}/previews",
     {
-      method: "POST",
-      headers: { "Content-Type": "application/json" },
-      body: JSON.stringify({
+      path: { projectId: pid, flowId: options.flowId },
+      body: {
         flowSettingsId: settingsId,
         ...options.source ? { source: options.source } : {}
-      })
+      }
     }
   );
   if (!response.ok) {
@@ -10159,12 +10870,11 @@ async function createPreview(options) {
   }
   const created = await response.json();
   if (origin === void 0) return created;
-  const grantResponse = await apiFetch(
-    `/api/projects/${pid}/flows/${options.flowId}/previews/${created.id}/grant`,
+  const grantResponse = await apiRequest(
+    "POST /api/projects/{projectId}/flows/{flowId}/previews/{previewId}/grant",
     {
-      method: "POST",
-      headers: { "Content-Type": "application/json" },
-      body: JSON.stringify({ origins: [origin] })
+      path: { projectId: pid, flowId: options.flowId, previewId: created.id },
+      body: { origins: [origin] }
     }
   );
   if (!grantResponse.ok) {
@@ -10183,15 +10893,18 @@ async function createPreview(options) {
 }
 async function regrantPreview(options) {
   const pid = options.projectId ?? requireProjectId();
-  const response = await apiFetch(
-    `/api/projects/${pid}/flows/${options.flowId}/previews/${options.previewId}/grant`,
+  const response = await apiRequest(
+    "POST /api/projects/{projectId}/flows/{flowId}/previews/{previewId}/grant",
     {
-      method: "POST",
-      headers: { "Content-Type": "application/json" },
-      body: JSON.stringify({
+      path: {
+        projectId: pid,
+        flowId: options.flowId,
+        previewId: options.previewId
+      },
+      body: {
         origins: options.origins,
         ...options.sessionId ? { sessionId: options.sessionId } : {}
-      })
+      }
     }
   );
   if (!response.ok) {
@@ -10202,9 +10915,15 @@ async function regrantPreview(options) {
 }
 async function deletePreview(options) {
   const pid = options.projectId ?? requireProjectId();
-  const response = await apiFetch(
-    `/api/projects/${pid}/flows/${options.flowId}/previews/${options.previewId}`,
-    { method: "DELETE" }
+  const response = await apiRequest(
+    "DELETE /api/projects/{projectId}/flows/{flowId}/previews/{previewId}",
+    {
+      path: {
+        projectId: pid,
+        flowId: options.flowId,
+        previewId: options.previewId
+      }
+    }
   );
   if (!response.ok) {
     const body = await response.json().catch(() => ({}));
@@ -10218,12 +10937,12 @@ async function deletePreview(options) {
 // src/commands/journeys/index.ts
 async function listJourneys(options) {
   const id = options.projectId ?? requireProjectId();
-  const params = new URLSearchParams();
-  if (options.traceId) params.set("traceId", options.traceId);
-  if (options.limit !== void 0) params.set("limit", String(options.limit));
-  const qs = params.toString();
-  const response = await apiFetch(
-    `/api/projects/${id}/flows/${options.flowId}/journeys${qs ? `?${qs}` : ""}`
+  const response = await apiRequest(
+    "GET /api/projects/{projectId}/flows/{flowId}/journeys",
+    {
+      path: { projectId: id, flowId: options.flowId },
+      query: { traceId: options.traceId || void 0, limit: options.limit }
+    }
   );
   if (!response.ok) {
     const body = await response.json().catch(() => ({}));
@@ -10243,13 +10962,9 @@ async function startObserveSession(options) {
     // omitted rather than sent as a bare [] the app would have to interpret.
     ...options.origins?.length ? { origins: options.origins } : {}
   };
-  const response = await apiFetch(
-    `/api/projects/${pid}/flows/${options.flowId}/observe-sessions`,
-    {
-      method: "POST",
-      headers: { "Content-Type": "application/json" },
-      body: JSON.stringify(body)
-    }
+  const response = await apiRequest(
+    "POST /api/projects/{projectId}/flows/{flowId}/observe-sessions",
+    { path: { projectId: pid, flowId: options.flowId }, body }
   );
   if (!response.ok) {
     const errorBody = await response.json().catch(() => ({}));
@@ -10263,8 +10978,15 @@ async function startObserveSession(options) {
 }
 async function getObserveSession(options) {
   const pid = options.projectId ?? requireProjectId();
-  const response = await apiFetch(
-    `/api/projects/${pid}/flows/${options.flowId}/observe-sessions/${options.sessionId}`
+  const response = await apiRequest(
+    "GET /api/projects/{projectId}/flows/{flowId}/observe-sessions/{sessionId}",
+    {
+      path: {
+        projectId: pid,
+        flowId: options.flowId,
+        sessionId: options.sessionId
+      }
+    }
   );
   if (!response.ok) {
     const errorBody = await response.json().catch(() => ({}));
@@ -10274,9 +10996,15 @@ async function getObserveSession(options) {
 }
 async function endObserveSession(options) {
   const pid = options.projectId ?? requireProjectId();
-  const response = await apiFetch(
-    `/api/projects/${pid}/flows/${options.flowId}/observe-sessions/${options.sessionId}`,
-    { method: "DELETE" }
+  const response = await apiRequest(
+    "DELETE /api/projects/{projectId}/flows/{flowId}/observe-sessions/{sessionId}",
+    {
+      path: {
+        projectId: pid,
+        flowId: options.flowId,
+        sessionId: options.sessionId
+      }
+    }
   );
   if (!response.ok) {
     const errorBody = await response.json().catch(() => ({}));
@@ -10294,103 +11022,110 @@ async function readJson3(response, fallback) {
 }
 async function listReleases(options) {
   const pid = options.projectId ?? requireProjectId();
-  const params = new URLSearchParams({ rationale: "true" });
-  if (options.limit !== void 0) params.set("limit", String(options.limit));
-  if (options.offset !== void 0)
-    params.set("offset", String(options.offset));
-  const response = await apiFetch(
-    `/api/projects/${pid}/flows/${options.flowId}/releases?${params.toString()}`
+  const response = await apiRequest(
+    "GET /api/projects/{projectId}/flows/{flowId}/releases",
+    {
+      path: { projectId: pid, flowId: options.flowId },
+      query: {
+        rationale: "true",
+        limit: options.limit,
+        offset: options.offset
+      }
+    }
   );
   return readJson3(response, "Failed to list releases");
 }
 async function getRelease(options) {
   const pid = options.projectId ?? requireProjectId();
   const segment = "versionId" in options.ref ? options.ref.versionId : String(options.ref.versionNumber);
-  const response = await apiFetch(
-    `/api/projects/${pid}/flows/${options.flowId}/releases/${encodeURIComponent(segment)}`
+  const response = await apiRequest(
+    "GET /api/projects/{projectId}/flows/{flowId}/releases/{versionId}",
+    { path: { projectId: pid, flowId: options.flowId, versionId: segment } }
   );
   return readJson3(response, "Failed to read release");
 }
 async function listStepHistory(options) {
   const pid = options.projectId ?? requireProjectId();
-  const params = new URLSearchParams({ step: options.step });
-  if (options.flow !== void 0) params.set("flow", options.flow);
-  if (options.limit !== void 0) params.set("limit", String(options.limit));
-  const response = await apiFetch(
-    `/api/projects/${pid}/flows/${options.flowId}/releases/step-history?${params.toString()}`
+  const response = await apiRequest(
+    "GET /api/projects/{projectId}/flows/{flowId}/releases/step-history",
+    {
+      path: { projectId: pid, flowId: options.flowId },
+      query: { step: options.step, flow: options.flow, limit: options.limit }
+    }
   );
   return readJson3(response, "Failed to read step history");
 }
 async function setReleaseRationale(options) {
   const pid = options.projectId ?? requireProjectId();
-  const response = await apiFetch(
-    `/api/projects/${pid}/flows/${options.flowId}/releases/annotations`,
+  const response = await apiRequest(
+    "PUT /api/projects/{projectId}/flows/{flowId}/releases/annotations",
     {
-      method: "PUT",
-      headers: { "Content-Type": "application/json" },
-      body: JSON.stringify({
-        versionId: options.versionId,
-        humanText: options.text
-      })
+      path: { projectId: pid, flowId: options.flowId },
+      body: { versionId: options.versionId, humanText: options.text }
     }
   );
   return readJson3(response, "Failed to write release rationale");
 }
 async function listThreads(options) {
   const pid = options.projectId ?? requireProjectId();
-  const params = new URLSearchParams();
-  if (options.anchorType !== void 0)
-    params.set("anchorType", options.anchorType);
-  if (options.anchorKey !== void 0)
-    params.set("anchorKey", options.anchorKey);
-  if (options.status !== void 0) params.set("status", options.status);
-  params.set("includeMessages", options.includeMessages ? "true" : "false");
-  if (options.limit !== void 0) params.set("limit", String(options.limit));
-  const response = await apiFetch(
-    `/api/projects/${pid}/flows/${options.flowId}/threads?${params.toString()}`
+  const response = await apiRequest(
+    "GET /api/projects/{projectId}/flows/{flowId}/threads",
+    {
+      path: { projectId: pid, flowId: options.flowId },
+      query: {
+        anchorType: options.anchorType,
+        anchorKey: options.anchorKey,
+        status: options.status,
+        includeMessages: options.includeMessages ? "true" : "false",
+        limit: options.limit
+      }
+    }
   );
   return readJson3(response, "Failed to list threads");
 }
 async function createThread(options) {
   const pid = options.projectId ?? requireProjectId();
-  const response = await apiFetch(
-    `/api/projects/${pid}/flows/${options.flowId}/threads`,
+  const response = await apiRequest(
+    "POST /api/projects/{projectId}/flows/{flowId}/threads",
     {
-      method: "POST",
-      headers: { "Content-Type": "application/json" },
-      body: JSON.stringify({
+      path: { projectId: pid, flowId: options.flowId },
+      body: {
         anchorType: options.anchorType,
         anchorKey: options.anchorKey,
         ...options.anchorLabel !== void 0 ? { anchorLabel: options.anchorLabel } : {},
         text: options.text
-      })
+      }
     }
   );
   return readJson3(response, "Failed to open thread");
 }
 async function addThreadMessage(options) {
   const pid = options.projectId ?? requireProjectId();
-  const response = await apiFetch(
-    `/api/projects/${pid}/flows/${options.flowId}/threads/${encodeURIComponent(options.threadId)}/messages`,
+  const response = await apiRequest(
+    "POST /api/projects/{projectId}/flows/{flowId}/threads/{threadId}/messages",
     {
-      method: "POST",
-      headers: { "Content-Type": "application/json" },
-      body: JSON.stringify({ text: options.text })
+      path: {
+        projectId: pid,
+        flowId: options.flowId,
+        threadId: options.threadId
+      },
+      body: { text: options.text }
     }
   );
   return readJson3(response, "Failed to add message");
 }
 async function listKnowledge(options) {
   const pid = options.projectId ?? requireProjectId();
-  const params = new URLSearchParams();
-  if (options.pageKey !== void 0) params.set("pageKey", options.pageKey);
-  if (options.frameId !== void 0) params.set("frameId", options.frameId);
-  if (options.markId !== void 0) params.set("markId", options.markId);
-  params.set("includeMessages", options.includeMessages ? "true" : "false");
-  if (options.limit !== void 0) params.set("limit", String(options.limit));
-  const response = await apiFetch(
-    `/api/projects/${pid}/knowledge?${params.toString()}`
-  );
+  const response = await apiRequest("GET /api/projects/{projectId}/knowledge", {
+    path: { projectId: pid },
+    query: {
+      pageKey: options.pageKey,
+      frameId: options.frameId,
+      markId: options.markId,
+      includeMessages: options.includeMessages ? "true" : "false",
+      limit: options.limit
+    }
+  });
   return readJson3(response, "Failed to read knowledge");
 }
 
@@ -10404,21 +11139,24 @@ async function readJson4(response, fallback) {
 }
 async function listFrames(options = {}) {
   const pid = options.projectId ?? requireProjectId();
-  const response = await apiFetch(`/api/projects/${pid}/frames`);
+  const response = await apiRequest("GET /api/projects/{projectId}/frames", {
+    path: { projectId: pid }
+  });
   return readJson4(response, "Failed to list frames");
 }
 async function listPageFrames(options) {
   const pid = options.projectId ?? requireProjectId();
-  const params = new URLSearchParams({ pageKey: options.pageKey });
-  const response = await apiFetch(
-    `/api/projects/${pid}/frames?${params.toString()}`
-  );
+  const response = await apiRequest("GET /api/projects/{projectId}/frames", {
+    path: { projectId: pid },
+    query: { pageKey: options.pageKey }
+  });
   return readJson4(response, "Failed to list page frames");
 }
 async function getFrame(options) {
   const pid = options.projectId ?? requireProjectId();
-  const response = await apiFetch(
-    `/api/projects/${pid}/frames/${encodeURIComponent(options.frameId)}`
+  const response = await apiRequest(
+    "GET /api/projects/{projectId}/frames/{frameId}",
+    { path: { projectId: pid, frameId: options.frameId } }
   );
   return readJson4(response, "Failed to read frame");
 }
@@ -10426,8 +11164,9 @@ async function getFrame(options) {
 // src/commands/secrets/index.ts
 async function listSecrets(options) {
   const pid = options.projectId ?? requireProjectId();
-  const response = await apiFetch(
-    `/api/projects/${pid}/flows/${options.flowId}/secrets`
+  const response = await apiRequest(
+    "GET /api/projects/{projectId}/flows/{flowId}/secrets",
+    { path: { projectId: pid, flowId: options.flowId } }
   );
   if (!response.ok) {
     const body = await response.json().catch(() => ({}));
@@ -10437,12 +11176,11 @@ async function listSecrets(options) {
 }
 async function createSecret(options) {
   const pid = options.projectId ?? requireProjectId();
-  const response = await apiFetch(
-    `/api/projects/${pid}/flows/${options.flowId}/secrets`,
+  const response = await apiRequest(
+    "POST /api/projects/{projectId}/flows/{flowId}/secrets",
     {
-      method: "POST",
-      headers: { "Content-Type": "application/json" },
-      body: JSON.stringify({ name: options.name, value: options.value })
+      path: { projectId: pid, flowId: options.flowId },
+      body: { name: options.name, value: options.value }
     }
   );
   if (!response.ok) {
@@ -10453,12 +11191,15 @@ async function createSecret(options) {
 }
 async function updateSecret(options) {
   const pid = options.projectId ?? requireProjectId();
-  const response = await apiFetch(
-    `/api/projects/${pid}/flows/${options.flowId}/secrets/${options.secretId}`,
+  const response = await apiRequest(
+    "PUT /api/projects/{projectId}/flows/{flowId}/secrets/{secretId}",
     {
-      method: "PUT",
-      headers: { "Content-Type": "application/json" },
-      body: JSON.stringify({ value: options.value })
+      path: {
+        projectId: pid,
+        flowId: options.flowId,
+        secretId: options.secretId
+      },
+      body: { value: options.value }
     }
   );
   if (!response.ok) {
@@ -10469,9 +11210,15 @@ async function updateSecret(options) {
 }
 async function deleteSecret(options) {
   const pid = options.projectId ?? requireProjectId();
-  const response = await apiFetch(
-    `/api/projects/${pid}/flows/${options.flowId}/secrets/${options.secretId}`,
-    { method: "DELETE" }
+  const response = await apiRequest(
+    "DELETE /api/projects/{projectId}/flows/{flowId}/secrets/{secretId}",
+    {
+      path: {
+        projectId: pid,
+        flowId: options.flowId,
+        secretId: options.secretId
+      }
+    }
   );
   if (!response.ok) {
     const body = await response.json().catch(() => ({}));
@@ -10658,7 +11405,9 @@ async function createEmitter(opts) {
 function resolveTelemetryEndpoint() {
   const appUrl = resolveAppUrl();
   if (!appUrl) return void 0;
-  return `${appUrl.replace(/\/$/, "")}/api/telemetry`;
+  return operationUrl("POST /api/telemetry", {
+    baseUrl: appUrl.replace(/\/$/, "")
+  });
 }
 async function withTimeout(p, ms) {
   return Promise.race([
@@ -10689,12 +11438,15 @@ export {
   BuildResultSchema,
   BuildWrapArtifactSchema,
   BuildWrapOptionsSchema,
+  DEPLOYMENT_STATUSES,
+  DEPLOYMENT_TYPES,
   DeploymentAmbiguityError,
   VALIDATE_CODES,
   VERSION,
   addThreadMessage,
-  annotateErrorWithDrift,
   apiFetch,
+  apiRequest,
+  bakedClientOperations,
   bakedContractHash,
   bakedContractVersion,
   buildDataPayload,
@@ -10739,6 +11491,8 @@ export {
   feedback,
   feedbackCommand,
   fetchHealth,
+  fetchOpenApi,
+  formatContract,
   formatPushResult,
   getAuthHeaders,
   getClientContext,
@@ -10756,6 +11510,7 @@ export {
   getProject,
   getProjectCommand,
   getRelease,
+  isDeploymentStatus,
   listAllFlows,
   listDeployments,
   listDeploymentsCommand,
@@ -10779,6 +11534,7 @@ export {
   logout,
   logoutCommand,
   mergeAuthHeaders,
+  operationUrl,
   parseSSEEvents,
   publicFetch,
   push,