@walkeros/cli 4.8.1-next-1792019907609 → 4.8.2

package/dist/index.d.ts

@@ -230,9 +230,9 @@ declare function buildDataPayload(flowSettings: Flow): Record<string, unknown>;
  */
 /**
  * Preview activation wiring. When present and enabled, the generated entry
- * imports the activator from core and lets it decide whether a preview bundle
- * boots in place of this flow. The bundle carries only PUBLIC values: a keyring,
- * an issuer, and opaque bindings. Never a project id, never a secret.
+ * imports the activator from web-core and lets it decide whether a preview
+ * bundle boots in place of this flow. The bundle carries only PUBLIC values: a
+ * keyring, an issuer, and opaque bindings. Never a project id, never a secret.
  */
 interface WrapEntryPreview {
     enabled: boolean;
@@ -341,31 +341,8 @@ declare function bundle(configOrPath: unknown, options?: {
  */
 type Platform = 'web' | 'server';
 
-/**
- * Resolve a bearer for an API call, refreshing the stored session when needed.
- *
- * Priority: `WALKEROS_TOKEN`, then a legacy static token, then the OAuth
- * session. Returns null when nothing can be resolved, which callers render as
- * "run `walkeros auth login`".
- *
- * Throws when a refresh was needed but could not be carried out, which is a
- * different problem from having no session and must not be reported as one.
- */
-declare function resolveAccessToken(opts?: {
-    fetch?: typeof fetch;
-    now?: () => number;
-}): Promise<string | null>;
-/**
- * Authorization header for the resolved credential, or an empty object when
- * there is none. Async because resolving may have to refresh the session.
- */
-declare function getAuthHeaders(): Promise<Record<string, string>>;
-/**
- * Where a credential would come from, without resolving or refreshing it.
- * For commands that want to send someone to `walkeros auth login` before spending
- * a network round trip.
- */
-declare function credentialSource(): 'env' | 'config' | null;
+/** The one credential the CLI sends: WALKEROS_TOKEN, a token from Account > Automation tokens. */
+declare function resolveAccessToken(): string | null;
 
 /** A network call a web run (push or simulate) recorded instead of sending (fetch, sendBeacon, XHR) */
 interface NetworkCall {
@@ -700,7 +677,7 @@ type ValidateOptions = z.infer<typeof ValidateOptionsSchema>;
  * Every code an error, warning or skip of `validate` can carry. Agents and
  * tests branch on these, never on message text.
  */
-declare const VALIDATE_CODES: readonly ["INPUT_ERROR", "SERIALIZATION_ERROR", "OPTION_NOT_APPLICABLE", "FLOW_NOT_FOUND", "ENTRY_NOT_FOUND", "AMBIGUOUS_ENTRY", "UNSUPPORTED_SECTION", "INVALID_PATH", "SCHEMA_VALIDATION", "CONFIG_WARNING", "EMPTY_FLOWS", "UNKNOWN_KEY", "CONFLICT", "MISSING_PACKAGE", "OBSOLETE_CODE_STRING", "INVALID_IMPORT", "INVALID_CODE_SHAPE", "PACKAGE_VERSION_MISSING", "DEPRECATED_PACKAGE", "UNKNOWN_ROUTE_TARGET", "ROUTE_DEAD_CODE", "ROUTE_EMPTY_MANY", "ROUTE_SINGLE_MANY", "ROUTE_FIRST_MATCH", "INCOMPATIBLE_EXAMPLES", "EXAMPLES_INCOMPLETE", "CONTRACT_VIOLATION", "MAPPING_DOT_KEY", "FLOW_REF_WARNING", "FLOW_CYCLE", "VAR_CYCLE", "INVALID_COMPONENT_NAME", "INVALID_REFERENCE", "STORE_REFERENCE_NOT_FOUND", "STATE_STORE_UNKNOWN", "STATE_STORE_FILE", "TRANSFORMER_MAPPING_NO_OP", "UNRESOLVED_REFERENCE", "MISSING_ENV", "WEB_SECRET_REF", "UNRESOLVED_CONTRACT", "ENTRY_SCHEMA", "NO_CONTRACT_SECTION", "INVALID_CONTRACT", "FLAT_CONTRACT_SHAPE", "INVALID_CONTRACT_ENTRY", "UNKNOWN_CONTRACT_KEY", "INVALID_TAGGING", "INVALID_SCHEMA", "INVALID_EXTENDS", "INVALID_SECTION", "INVALID_EVENTS", "CIRCULAR_EXTENDS", "INVALID_ENTITY_KEY", "INVALID_ENTITY", "INVALID_ACTION_KEY", "INVALID_SCHEMA_ENTRY", "NOT_AN_OBJECT", "MISSING_EVENT_NAME", "EMPTY_EVENT_NAME", "INVALID_EVENT_NAME", "INVALID_MAPPING_TYPE", "INVALID_EVENT_PATTERN", "INVALID_RULE_TYPE", "CATCH_ALL_NOT_LAST", "GATED_BY_ERRORS", "CONTRACT_NOT_STATIC", "NO_PACKAGE", "NO_SETTINGS_SCHEMA", "SCHEMA_UNAVAILABLE"];
+declare const VALIDATE_CODES: readonly ["INPUT_ERROR", "SERIALIZATION_ERROR", "OPTION_NOT_APPLICABLE", "FLOW_NOT_FOUND", "ENTRY_NOT_FOUND", "AMBIGUOUS_ENTRY", "UNSUPPORTED_SECTION", "INVALID_PATH", "SCHEMA_VALIDATION", "CONFIG_WARNING", "EMPTY_FLOWS", "UNKNOWN_KEY", "CONFLICT", "MISSING_PACKAGE", "OBSOLETE_CODE_STRING", "INVALID_IMPORT", "INVALID_CODE_SHAPE", "PACKAGE_VERSION_MISSING", "DEPRECATED_PACKAGE", "UNKNOWN_ROUTE_TARGET", "ROUTE_DEAD_CODE", "ROUTE_EMPTY_MANY", "ROUTE_SINGLE_MANY", "ROUTE_FIRST_MATCH", "INCOMPATIBLE_EXAMPLES", "EXAMPLES_INCOMPLETE", "CONTRACT_VIOLATION", "MAPPING_DOT_KEY", "FLOW_REF_WARNING", "WEB_LOGGER_FORMAT", "FLOW_CYCLE", "VAR_CYCLE", "INVALID_COMPONENT_NAME", "INVALID_REFERENCE", "STORE_REFERENCE_NOT_FOUND", "STATE_STORE_UNKNOWN", "STATE_STORE_FILE", "MAPPING_NO_OP", "MAPPING_VALUE_NO_OPERATOR", "MAPPING_VALUE_PRODUCERS", "BATCH_WITHOUT_PUSH_BATCH", "MALFORMED_REFERENCE", "UNRESOLVED_REFERENCE", "MISSING_ENV", "WEB_SECRET_REF", "UNRESOLVED_CONTRACT", "ENTRY_SCHEMA", "NO_CONTRACT_SECTION", "INVALID_CONTRACT", "FLAT_CONTRACT_SHAPE", "INVALID_CONTRACT_ENTRY", "UNKNOWN_CONTRACT_KEY", "INVALID_TAGGING", "INVALID_SCHEMA", "INVALID_EXTENDS", "INVALID_EVENTS", "CIRCULAR_EXTENDS", "INVALID_ENTITY_KEY", "INVALID_ENTITY", "INVALID_ACTION_KEY", "INVALID_SCHEMA_ENTRY", "NOT_AN_OBJECT", "MISSING_EVENT_NAME", "EMPTY_EVENT_NAME", "INVALID_EVENT_NAME", "INVALID_MAPPING_TYPE", "INVALID_EVENT_PATTERN", "INVALID_RULE_TYPE", "CATCH_ALL_NOT_LAST", "GATED_BY_ERRORS", "CONTRACT_NOT_STATIC", "NO_PACKAGE", "NO_SETTINGS_SCHEMA", "SCHEMA_UNAVAILABLE"];
 type ValidateCode = (typeof VALIDATE_CODES)[number];
 /**
  * Named checks a run includes (`details.scope.checks`). `file:` checks run
@@ -802,95 +779,6 @@ interface GlobalOptions {
     silent?: boolean;
 }
 
-interface LoginCommandOptions extends GlobalOptions {
-    url?: string;
-    json?: boolean;
-}
-interface LoginResult {
-    success: boolean;
-    email?: string;
-    configPath?: string;
-    error?: string;
-}
-interface LoginOptions {
-    url?: string;
-    /** Override browser opener for testing */
-    openUrl?: (url: string) => Promise<void>;
-    /** Override fetch for testing */
-    fetch?: typeof globalThis.fetch;
-    /** Max poll attempts before giving up (for testing) */
-    maxPollAttempts?: number;
-    /** Poll interval, replacing the server's stated one (for testing) */
-    pollIntervalMs?: number;
-}
-/**
- * The outcome of finishing a device authorization.
- *
- * It carries no token material. `completeDeviceLogin` stores the session
- * itself, so the credential file keeps exactly one writer and a caller can
- * neither persist nor leak what came back.
- *
- * `pending` and `slow_down` both mean the window closed with the approval
- * still outstanding: the device code is untouched, so the same code can be
- * handed back in. `slow_down` is that same situation with the server asking
- * for a wider gap before the next attempt.
- */
-type DeviceLoginResult = {
-    status: 'ok';
-} | {
-    status: 'pending';
-} | {
-    status: 'slow_down';
-} | {
-    status: 'denied';
-} | {
-    status: 'expired';
-} | {
-    status: 'error';
-    error: string;
-};
-interface CompleteDeviceLoginOptions {
-    /** App to poll. Defaults to the resolved app URL. */
-    url?: string;
-    /** Stop polling after this long. */
-    timeoutMs?: number;
-    /** Wait between polls, before any `slow_down` widens it. */
-    intervalMs?: number;
-    /** Override fetch for testing */
-    fetch?: typeof globalThis.fetch;
-    /** Max poll attempts before giving up (for testing) */
-    maxPollAttempts?: number;
-}
-declare function loginCommand(options: LoginCommandOptions): Promise<void>;
-/**
- * Poll a device authorization to its end and store the session it yields.
- *
- * Split out from `login` so a caller holding only a device code can finish an
- * authorization that is already under way. `login` cannot serve that: it
- * starts a fresh authorization on every call, which would strand the code the
- * person is looking at.
- */
-declare function completeDeviceLogin(deviceCode: string, options?: CompleteDeviceLoginOptions): Promise<DeviceLoginResult>;
-declare function login(options?: LoginOptions): Promise<LoginResult>;
-
-interface LogoutCommandOptions extends GlobalOptions {
-    json?: boolean;
-}
-declare function logoutCommand(options: LogoutCommandOptions): Promise<void>;
-interface LogoutResult {
-    deleted: boolean;
-    /** A different session reached the config while the revocation was in flight. */
-    superseded: boolean;
-}
-/**
- * Revoke the stored refresh token, then drop the local config.
- *
- * Revocation first, because deleting the file alone would leave a credential
- * alive on the server that nothing can ever reach to retire. It is best
- * effort: a logout on a plane still has to clear the machine.
- */
-declare function logout(): Promise<LogoutResult>;
-
 /** Who the current credential belongs to, as the app answers it. */
 declare function whoami(): Promise<unknown>;
 interface WhoamiCommandOptions extends GlobalOptions {
@@ -1057,10 +945,10 @@ declare const BuildBundleArtifactSchema: z.ZodObject<{
     contentType: z.ZodOptional<z.ZodString>;
     headers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
     target: z.ZodEnum<{
-        runner: "runner";
         push: "push";
         cdn: "cdn";
         "cdn-skeleton": "cdn-skeleton";
+        runner: "runner";
         simulate: "simulate";
     }>;
 }, z.core.$strict>;
@@ -1180,10 +1068,10 @@ declare const BuildArtifactSchema: z.ZodUnion<readonly [z.ZodObject<{
     contentType: z.ZodOptional<z.ZodString>;
     headers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
     target: z.ZodEnum<{
-        runner: "runner";
         push: "push";
         cdn: "cdn";
         "cdn-skeleton": "cdn-skeleton";
+        runner: "runner";
         simulate: "simulate";
     }>;
 }, z.core.$strict>, z.ZodObject<{
@@ -1261,10 +1149,10 @@ declare const BuildManifestSchema: z.ZodObject<{
         contentType: z.ZodOptional<z.ZodString>;
         headers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
         target: z.ZodEnum<{
-            runner: "runner";
             push: "push";
             cdn: "cdn";
             "cdn-skeleton": "cdn-skeleton";
+            runner: "runner";
             simulate: "simulate";
         }>;
     }, z.core.$strict>, z.ZodObject<{
@@ -1420,20 +1308,6 @@ declare function runBuildManifest(source: string, retry?: BuildRetryOptions): Pr
 /** Resolve the `--manifest` value, falling back to the env for a bare flag. */
 declare function resolveManifestSource(manifest: string | true, env?: Record<string, string | undefined>): string;
 
-interface DeviceAuthorization {
-    deviceCode: string;
-    userCode: string;
-    verificationUri: string;
-    verificationUriComplete: string;
-    expiresIn: number;
-    interval: number;
-}
-/**
- * RFC 8628 section 3.1. Ask for a device code and the URL to send the person
- * to. Unauthenticated: the code is worth nothing until somebody approves it.
- */
-declare function startDeviceAuthorization(appUrl: string, fetchFn?: typeof fetch): Promise<DeviceAuthorization>;
-
 interface ApiErrorDetail {
     path: string;
     message: string;
@@ -1511,35 +1385,24 @@ declare function appErrorMessage(body: unknown): string | undefined;
 declare function appFetch(path: string, init?: AppFetchInit): Promise<Response>;
 
 /**
- * The app operations the CLI itself calls: the OAuth device flow, identity,
- * health, telemetry and the public API document. The app keeps every one in
- * its public API set, so its change rule protects them. The only file in the
- * CLI that names an app path; `walkeros api` takes its path from the person.
+ * The app operations the CLI itself calls: identity, health, telemetry and
+ * the public API document. The app keeps every one in its public API set, so
+ * its change rule protects them. The only file in the CLI that names an app
+ * path; `walkeros api` takes its path from the person.
  */
 declare const APP_PATHS: {
-    readonly deviceAuthorization: "/api/oauth/device_authorization";
-    readonly token: "/api/oauth/token";
-    readonly revoke: "/api/oauth/revoke";
     readonly whoami: "/api/auth/whoami";
     readonly health: "/api/health";
     readonly telemetry: "/api/telemetry";
     readonly openapi: "/api/openapi.json";
 };
 
+/**
+ * The CLI's own settings. It holds no credential: the CLI authenticates with
+ * WALKEROS_TOKEN only, and sign-in fields an older CLI left in the file are
+ * never read.
+ */
 interface WalkerOSConfig {
-    /**
-     * Static bearer written by the pre-OAuth CLI. Honored until it expires, and
-     * the first use in a process prints a one-line notice naming
-     * `walkeros auth login`, which replaces it with a refreshable session.
-     */
-    token?: string;
-    /** Short-lived bearer from the device authorization grant. */
-    accessToken?: string;
-    /** ISO 8601 instant at which `accessToken` stops being accepted. */
-    accessTokenExpiresAt?: string;
-    /** Single-use credential that buys a new `accessToken`. */
-    refreshToken?: string;
-    email?: string;
     appUrl?: string;
     anonymousFeedback?: boolean;
     defaultProjectId?: string;
@@ -1564,35 +1427,12 @@ declare function readConfig(): WalkerOSConfig | null;
  * Merge `config` into the stored config and write the result.
  *
  * Merging rather than replacing, because the file holds fields owned by
- * unrelated commands: a writer that knows only about tokens would otherwise
- * drop `defaultProjectId`, `installationId`, `telemetryEnabled` and
- * `anonymousFeedback` every time somebody logs in.
+ * unrelated commands: a writer that knows only about telemetry would otherwise
+ * drop `appUrl`, `defaultProjectId` and `anonymousFeedback`.
  *
- * A key passed explicitly as `undefined` is removed from the written file,
- * which is how login drops the legacy static token it replaces.
+ * A key passed explicitly as `undefined` is removed from the written file.
  */
 declare function writeConfig(config: WalkerOSConfig): void;
-/**
- * Remove every credential field, keeping the rest of the config.
- *
- * Used when the stored session is known to be dead, so the next command can
- * say "run `walkeros auth login`" instead of failing against the API.
- */
-declare function clearAuthFields(): void;
-/**
- * Delete the config file (logout)
- */
-declare function deleteConfig(): boolean;
-/**
- * Resolve the API token using priority order:
- * 1. WALKEROS_TOKEN env var
- * 2. Config file (~/.config/walkeros/config.json)
- * 3. null (not authenticated)
- */
-declare function resolveToken(): {
-    token: string;
-    source: 'env' | 'config';
-} | null;
 /**
  * Resolve the app URL.
  * WALKEROS_APP_URL env var > config file > default.
@@ -1887,4 +1727,4 @@ declare module '@walkeros/core' {
     }
 }
 
-export { APP_PATHS, ApiError, type ApiErrorDetail, type AppFetchInit, BUILD_ERROR_CODES, BUILD_MANIFEST_ENV, BUILD_MANIFEST_VERSION, type BuildArtifact, BuildArtifactSchema, BuildBundleArtifactSchema, type BuildErrorCode, type BuildManifest, BuildManifestSchema, type BuildOptions, type BuildResult, BuildResultSchema, BuildWrapArtifactSchema, type BuildWrapOptions, BuildWrapOptionsSchema, type BundleStats, type CLIBuildOptions, type ClientContext, type ClientType, type CompleteDeviceLoginOptions, type DeviceAuthorization, type DeviceLoginResult, type GlobalOptions, type LoginOptions, type LoginResult, type MinifyOptions, type PrepareInput, type PreparedFlow, type PushResult, type RunBuildManifestResult, type SimulateCollectorOptions, type SimulateDataOptions, type SimulateDestinationOptions, type SimulateSourceOptions, type SimulateTransformerOptions, VALIDATE_CODES, VERSION, type ValidateCheck, type ValidateCode, type ValidateDeferred, type ValidateResult, type ValidateScope, type ValidateSkip, type ValidationError, type ValidationWarning, type WalkerOSConfig, type WrapSkeletonOptions, appErrorMessage, appFetch, buildDataPayload, bundle, bundleCommand, classifyStepProperties, clearAuthFields, clientContextHeaders, collectKnownSecrets, completeDeviceLogin, containsCodeMarkers, credentialSource, deleteConfig, formatPushResult, getAuthHeaders, getClientContext, loadConfig, loadJsonConfig, login, loginCommand, logout, logoutCommand, push, pushCommand, readConfig, resetClientContext, resolveAccessToken, resolveAppUrl, resolveExportName, resolveManifestSource, resolveToken, runBuildManifest, selectDevExamples, setClientContext, simulateCollector, simulateDestination, simulateSource, simulateTransformer, startDeviceAuthorization, index as telemetry, telemetryDisableCommand, telemetryEnableCommand, telemetryStatusCommand, validate, validateCommand, whoami, whoamiCommand, wrapSkeleton, writeConfig };
+export { APP_PATHS, ApiError, type ApiErrorDetail, type AppFetchInit, BUILD_ERROR_CODES, BUILD_MANIFEST_ENV, BUILD_MANIFEST_VERSION, type BuildArtifact, BuildArtifactSchema, BuildBundleArtifactSchema, type BuildErrorCode, type BuildManifest, BuildManifestSchema, type BuildOptions, type BuildResult, BuildResultSchema, BuildWrapArtifactSchema, type BuildWrapOptions, BuildWrapOptionsSchema, type BundleStats, type CLIBuildOptions, type ClientContext, type ClientType, type GlobalOptions, type MinifyOptions, type PrepareInput, type PreparedFlow, type PushResult, type RunBuildManifestResult, type SimulateCollectorOptions, type SimulateDataOptions, type SimulateDestinationOptions, type SimulateSourceOptions, type SimulateTransformerOptions, VALIDATE_CODES, VERSION, type ValidateCheck, type ValidateCode, type ValidateDeferred, type ValidateResult, type ValidateScope, type ValidateSkip, type ValidationError, type ValidationWarning, type WalkerOSConfig, type WrapSkeletonOptions, appErrorMessage, appFetch, buildDataPayload, bundle, bundleCommand, classifyStepProperties, clientContextHeaders, collectKnownSecrets, containsCodeMarkers, formatPushResult, getClientContext, loadConfig, loadJsonConfig, push, pushCommand, readConfig, resetClientContext, resolveAccessToken, resolveAppUrl, resolveExportName, resolveManifestSource, runBuildManifest, selectDevExamples, setClientContext, simulateCollector, simulateDestination, simulateSource, simulateTransformer, index as telemetry, telemetryDisableCommand, telemetryEnableCommand, telemetryStatusCommand, validate, validateCommand, whoami, whoamiCommand, wrapSkeleton, writeConfig };