@walkeros/cli 4.8.1-next-1792019907609 → 4.8.2

package/dist/index.js

@@ -350,479 +350,10 @@ async function readStdinToTempFile(label) {
   return tmpPath;
 }
 
-// src/lib/config-file.ts
-import {
-  readFileSync,
-  writeFileSync,
-  mkdirSync,
-  unlinkSync,
-  existsSync,
-  chmodSync,
-  renameSync
-} from "fs";
-import { randomBytes } from "crypto";
-import { join } from "path";
-import { homedir } from "os";
-function getConfigDir() {
-  const xdgConfig = process.env.XDG_CONFIG_HOME;
-  const base = xdgConfig || join(homedir(), ".config");
-  return join(base, "walkeros");
-}
-function getConfigPath() {
-  return join(getConfigDir(), "config.json");
-}
-function readConfig() {
-  const configPath = getConfigPath();
-  try {
-    const content = readFileSync(configPath, "utf-8");
-    return JSON.parse(content);
-  } catch {
-    return null;
-  }
-}
-function replaceConfigFile(config) {
-  const dir = getConfigDir();
-  mkdirSync(dir, { recursive: true, mode: 448 });
-  const configPath = getConfigPath();
-  const tempPath = `${configPath}.${process.pid}.${randomBytes(6).toString("hex")}.tmp`;
-  try {
-    writeFileSync(tempPath, JSON.stringify(config, null, 2), { mode: 384 });
-    chmodSync(tempPath, 384);
-    renameSync(tempPath, configPath);
-  } catch (error) {
-    try {
-      unlinkSync(tempPath);
-    } catch {
-    }
-    throw error;
-  }
-}
-function writeConfig(config) {
-  replaceConfigFile({ ...readConfig() ?? {}, ...config });
-}
-function clearAuthFields() {
-  const config = readConfig();
-  if (!config) return;
-  const {
-    token: _token,
-    accessToken: _accessToken,
-    accessTokenExpiresAt: _accessTokenExpiresAt,
-    refreshToken: _refreshToken,
-    email: _email,
-    ...rest
-  } = config;
-  replaceConfigFile(rest);
-}
-function writeTelemetryOnlyConfig(partial) {
-  writeConfig(partial);
-}
-function deleteConfig() {
-  const configPath = getConfigPath();
-  if (existsSync(configPath)) {
-    unlinkSync(configPath);
-    return true;
-  }
-  return false;
-}
-function hasStoredCredential(config) {
-  return Boolean(config?.token || config?.accessToken);
-}
-function resolveToken() {
-  const envToken = process.env.WALKEROS_TOKEN;
-  if (envToken) return { token: envToken, source: "env" };
-  const config = readConfig();
-  if (config?.token) return { token: config.token, source: "config" };
-  return null;
-}
-function resolveAppUrl() {
-  const envUrl = process.env.WALKEROS_APP_URL;
-  if (envUrl) return envUrl;
-  const config = readConfig();
-  if (config?.appUrl) return config.appUrl;
-  return "https://app.walkeros.io";
-}
-
-// src/lib/config-lock.ts
-import { closeSync, mkdirSync as mkdirSync2, openSync, statSync, unlinkSync as unlinkSync2 } from "fs";
-var STALE_MS = 15e3;
-var RETRY_MS = 100;
-var TIMEOUT_MS = 1e4;
-function getConfigLockPath() {
-  return `${getConfigPath()}.lock`;
-}
-function hasCode(value) {
-  return typeof value === "object" && value !== null && "code" in value;
-}
-function isAlreadyLocked(error) {
-  return hasCode(error) && error.code === "EEXIST";
-}
-function delay(ms) {
-  return new Promise((resolve5) => setTimeout(resolve5, ms));
-}
-function breakIfStale(lockPath) {
-  try {
-    const age = Date.now() - statSync(lockPath).mtimeMs;
-    if (age < STALE_MS) return false;
-    unlinkSync2(lockPath);
-    return true;
-  } catch {
-    return false;
-  }
-}
-async function withConfigLock(fn) {
-  const lockPath = getConfigLockPath();
-  mkdirSync2(getConfigDir(), { recursive: true, mode: 448 });
-  const deadline = Date.now() + TIMEOUT_MS;
-  for (; ; ) {
-    let handle;
-    try {
-      handle = openSync(lockPath, "wx", 384);
-    } catch (error) {
-      if (!isAlreadyLocked(error)) throw error;
-      if (breakIfStale(lockPath)) continue;
-      if (Date.now() >= deadline) {
-        throw new Error(
-          `Timed out waiting for the walkerOS config lock at ${lockPath}. Remove the file if no other walkeros process is running.`
-        );
-      }
-      await delay(RETRY_MS);
-      continue;
-    }
-    closeSync(handle);
-    try {
-      return await fn();
-    } finally {
-      try {
-        unlinkSync2(lockPath);
-      } catch {
-      }
-    }
-  }
-}
-
-// src/core/oauth-client.ts
-import { z as z2 } from "zod";
-
-// src/lib/secure-url.ts
-function isLoopback(hostname) {
-  return hostname === "localhost" || hostname === "127.0.0.1" || hostname === "[::1]";
-}
-function requireSecureUrl(url) {
-  let parsed;
-  try {
-    parsed = new URL(url);
-  } catch {
-    return url;
-  }
-  if (parsed.protocol !== "http:" || isLoopback(parsed.hostname)) return url;
-  throw new Error(
-    `Refusing to send walkerOS credentials over plain http to ${url}. Use https, or localhost / 127.0.0.1 / [::1] for local development.`
-  );
-}
-
-// src/core/app-fetch.ts
-import { z } from "zod";
-
-// src/core/client-context.ts
-var context;
-function setClientContext(input) {
-  const envType = process.env.WALKEROS_CLIENT_TYPE;
-  const type = envType ?? input.type ?? "cli";
-  context = { type, version: input.version };
-}
-function getClientContext() {
-  return context;
-}
-function resetClientContext() {
-  context = void 0;
-}
-function clientContextHeaders() {
-  if (!context) return {};
-  return {
-    "User-Agent": `walkeros-${context.type}/${context.version}`,
-    "X-WalkerOS-Client": context.type,
-    "X-WalkerOS-Client-Version": context.version
-  };
-}
-
-// src/core/app-fetch.ts
-var AppErrorSchema = z.object({
-  error: z.object({ message: z.string().min(1) })
-});
-function appErrorMessage(body) {
-  const parsed = AppErrorSchema.safeParse(body);
-  return parsed.success ? parsed.data.error.message : void 0;
-}
-async function appFetch(path23, init = {}) {
-  const url = `${(init.baseUrl ?? resolveAppUrl()).replace(/\/+$/, "")}${path23}`;
-  const headers = new Headers(clientContextHeaders());
-  for (const [name, value] of Object.entries(init.headers ?? {}))
-    headers.set(name, value);
-  if (init.token && !headers.has("Authorization"))
-    headers.set("Authorization", `Bearer ${init.token}`);
-  if (headers.has("Authorization")) requireSecureUrl(url);
-  const request = { headers };
-  if (init.method && init.method !== "GET") request.method = init.method;
-  if (init.body !== void 0) request.body = init.body;
-  if (init.signal) request.signal = init.signal;
-  if (init.redirect) request.redirect = init.redirect;
-  return (init.fetch ?? fetch)(url, request);
-}
-
-// src/core/app-paths.ts
-var APP_PATHS = {
-  deviceAuthorization: "/api/oauth/device_authorization",
-  token: "/api/oauth/token",
-  revoke: "/api/oauth/revoke",
-  whoami: "/api/auth/whoami",
-  health: "/api/health",
-  telemetry: "/api/telemetry",
-  openapi: "/api/openapi.json"
-};
-
-// src/core/oauth-client.ts
-var CLI_CLIENT_ID = "walkeros-cli";
-var CLI_SCOPE = "read write offline_access";
-var DEVICE_CODE_GRANT = "urn:ietf:params:oauth:grant-type:device_code";
-var REFRESH_TIMEOUT_MS = 1e4;
-var REVOKE_TIMEOUT_MS = 5e3;
-var DEVICE_AUTHORIZATION_TIMEOUT_MS = 1e4;
-var DeviceAuthorizationSchema = z2.object({
-  device_code: z2.string().min(1),
-  user_code: z2.string().min(1),
-  verification_uri: z2.string().min(1),
-  verification_uri_complete: z2.string().min(1).optional(),
-  expires_in: z2.number().int().nonnegative(),
-  interval: z2.number().int().nonnegative()
-});
-var TokenSchema = z2.object({
-  access_token: z2.string().min(1),
-  expires_in: z2.number().int().nonnegative(),
-  refresh_token: z2.string().min(1).optional()
-});
-var ErrorSchema = z2.object({
-  error: z2.string().min(1),
-  error_description: z2.string().optional()
-});
-async function readJson(response) {
-  try {
-    return await response.json();
-  } catch {
-    return null;
-  }
-}
-function errorCode(body) {
-  const parsed = ErrorSchema.safeParse(body);
-  return parsed.success ? parsed.data.error : null;
-}
-function describe(response, body) {
-  const parsed = ErrorSchema.safeParse(body);
-  if (parsed.success) {
-    return parsed.data.error_description ? `${parsed.data.error}: ${parsed.data.error_description}` : parsed.data.error;
-  }
-  return appErrorMessage(body) ?? `HTTP ${response.status}`;
-}
-function postForm(appUrl, path23, form, fetchFn, signal) {
-  return appFetch(path23, {
-    method: "POST",
-    baseUrl: requireSecureUrl(appUrl),
-    headers: {
-      Accept: "application/json",
-      "Content-Type": "application/x-www-form-urlencoded"
-    },
-    body: new URLSearchParams(form).toString(),
-    redirect: "error",
-    fetch: fetchFn,
-    signal
-  });
-}
-function toTokenSet(body) {
-  const parsed = TokenSchema.safeParse(body);
-  if (!parsed.success) throw new Error("Malformed token response");
-  return {
-    accessToken: parsed.data.access_token,
-    accessTokenExpiresAt: new Date(
-      Date.now() + parsed.data.expires_in * 1e3
-    ).toISOString(),
-    refreshToken: parsed.data.refresh_token ?? null
-  };
-}
-async function startDeviceAuthorization(appUrl, fetchFn = globalThis.fetch) {
-  const response = await postForm(
-    appUrl,
-    APP_PATHS.deviceAuthorization,
-    {
-      client_id: CLI_CLIENT_ID,
-      scope: CLI_SCOPE,
-      // RFC 8707. The token comes back bound to the API, so a leaked CLI token
-      // cannot be replayed against the MCP resource.
-      resource: `${appUrl}/api`
-    },
-    fetchFn,
-    AbortSignal.timeout(DEVICE_AUTHORIZATION_TIMEOUT_MS)
-  );
-  const body = await readJson(response);
-  if (!response.ok) throw new Error(describe(response, body));
-  const parsed = DeviceAuthorizationSchema.safeParse(body);
-  if (!parsed.success)
-    throw new Error("Malformed device authorization response");
-  return {
-    deviceCode: parsed.data.device_code,
-    userCode: parsed.data.user_code,
-    verificationUri: parsed.data.verification_uri,
-    verificationUriComplete: parsed.data.verification_uri_complete ?? parsed.data.verification_uri,
-    expiresIn: parsed.data.expires_in,
-    interval: parsed.data.interval
-  };
-}
-async function pollDeviceToken(appUrl, deviceCode, fetchFn = globalThis.fetch, signal) {
-  let response;
-  try {
-    response = await postForm(
-      appUrl,
-      APP_PATHS.token,
-      {
-        grant_type: DEVICE_CODE_GRANT,
-        device_code: deviceCode,
-        client_id: CLI_CLIENT_ID
-      },
-      fetchFn,
-      signal
-    );
-  } catch (error) {
-    if (signal?.aborted) return { status: "pending" };
-    throw error;
-  }
-  const body = await readJson(response);
-  if (response.ok) {
-    try {
-      return { status: "ok", tokens: toTokenSet(body) };
-    } catch (error) {
-      return {
-        status: "error",
-        error: error instanceof Error ? error.message : String(error)
-      };
-    }
-  }
-  switch (errorCode(body)) {
-    case "authorization_pending":
-      return { status: "pending" };
-    case "slow_down":
-      return { status: "slow_down" };
-    case "access_denied":
-      return { status: "denied" };
-    case "expired_token":
-      return { status: "expired" };
-    default:
-      return { status: "error", error: describe(response, body) };
-  }
-}
-async function refreshTokens(appUrl, refreshToken, fetchFn = globalThis.fetch) {
-  const response = await postForm(
-    appUrl,
-    APP_PATHS.token,
-    {
-      grant_type: "refresh_token",
-      refresh_token: refreshToken,
-      client_id: CLI_CLIENT_ID
-    },
-    fetchFn,
-    AbortSignal.timeout(REFRESH_TIMEOUT_MS)
-  );
-  const body = await readJson(response);
-  if (!response.ok) {
-    if (errorCode(body) === "invalid_grant") return null;
-    throw new Error(describe(response, body));
-  }
-  return toTokenSet(body);
-}
-async function revokeRefreshToken(appUrl, refreshToken, fetchFn = globalThis.fetch) {
-  try {
-    await postForm(
-      appUrl,
-      APP_PATHS.revoke,
-      {
-        token: refreshToken,
-        token_type_hint: "refresh_token",
-        client_id: CLI_CLIENT_ID
-      },
-      fetchFn,
-      AbortSignal.timeout(REVOKE_TIMEOUT_MS)
-    );
-  } catch {
-  }
-}
-
 // src/core/auth.ts
-var REFRESH_SKEW_MS = 6e4;
-var legacyNoticeShown = false;
-function noticeLegacyToken() {
-  if (legacyNoticeShown) return;
-  legacyNoticeShown = true;
-  process.stderr.write(
-    "walkerOS: using a static token from your config. Run `walkeros auth login` to switch to a session that refreshes automatically.\n"
-  );
-}
-function isFresh(config, nowMs) {
-  if (!config.accessToken || !config.accessTokenExpiresAt) return false;
-  const expiresAt = Date.parse(config.accessTokenExpiresAt);
-  if (Number.isNaN(expiresAt)) return false;
-  return expiresAt - nowMs > REFRESH_SKEW_MS;
-}
-async function resolveAccessToken(opts) {
-  const envToken = process.env.WALKEROS_TOKEN;
-  if (envToken) return envToken;
-  const now = opts?.now ?? Date.now;
-  const config = readConfig();
-  if (!config) return null;
-  if (config.token) {
-    noticeLegacyToken();
-    return config.token;
-  }
-  if (!config.refreshToken) {
-    return isFresh(config, now()) ? config.accessToken ?? null : null;
-  }
-  if (isFresh(config, now())) return config.accessToken ?? null;
-  return withConfigLock(async () => {
-    const current = readConfig();
-    if (!current?.refreshToken) return current?.accessToken ?? null;
-    if (isFresh(current, now())) return current.accessToken ?? null;
-    let rotated;
-    try {
-      rotated = await refreshTokens(
-        resolveAppUrl(),
-        current.refreshToken,
-        opts?.fetch
-      );
-    } catch (error) {
-      const reason = error instanceof Error ? error.message : String(error);
-      throw new Error(
-        `Could not reach ${resolveAppUrl()} to refresh your session: ${reason}. Your saved session was kept, so try again once the connection is back.`
-      );
-    }
-    if (rotated === null) {
-      clearAuthFields();
-      return null;
-    }
-    writeConfig({
-      accessToken: rotated.accessToken,
-      accessTokenExpiresAt: rotated.accessTokenExpiresAt,
-      // A server that rotates no new refresh token leaves the current one in
-      // force; overwriting it with null would end the session on the next call.
-      refreshToken: rotated.refreshToken ?? current.refreshToken
-    });
-    return rotated.accessToken;
-  });
-}
-async function getAuthHeaders() {
-  const token = await resolveAccessToken();
-  if (!token) return {};
-  return { Authorization: `Bearer ${token}` };
-}
-function credentialSource() {
-  if (process.env.WALKEROS_TOKEN) return "env";
-  if (hasStoredCredential(readConfig())) return "config";
-  return null;
+function resolveAccessToken() {
+  const token = process.env.WALKEROS_TOKEN;
+  return token ? token : null;
 }
 
 // src/core/event-validation.ts
@@ -1017,6 +548,7 @@ function getDefaultOutput(platform) {
 import path8 from "path";
 import fs8 from "fs-extra";
 import { getFlowSettings, getPlatform } from "@walkeros/core";
+import { validateFlowStructure } from "@walkeros/core/dev";
 
 // src/core/content-digest.ts
 import { createHash } from "crypto";
@@ -1095,11 +627,22 @@ function assertWindowCollector(value, source = {}) {
 
 // src/config/loader.ts
 var DEFAULT_INCLUDE_FOLDER = "./shared";
+function assertFlowStructure(config, flowName) {
+  const { errors } = validateFlowStructure({
+    ...config,
+    flows: { [flowName]: config.flows[flowName] }
+  });
+  if (errors.length === 0) return;
+  const lines = errors.map((error) => `  - ${error.path}: ${error.message}`);
+  throw new Error(`Invalid configuration:
+${lines.join("\n")}`);
+}
 function loadBundleConfig(rawConfig, options) {
   const sanitized = stripLegacyBundleExternal(rawConfig, options.logger);
   const config = validateFlowConfig(sanitized);
   const availableFlows = getAvailableFlows(config);
   const flowName = resolveFlow(config, options.flowName, availableFlows);
+  assertFlowStructure(config, flowName);
   assertLiteralBuildEnv(config, flowName);
   let flowSettings = getFlowSettings(config, flowName, { deferred: true });
   const platform = getPlatform(flowSettings);
@@ -1255,10 +798,12 @@ import path14 from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
 import fs14 from "fs-extra";
 import {
+  getPlatform as getPlatform2,
   packageNameToVariable as packageNameToVariable2,
   getStepRuntimeProps,
   ENV_MARKER_PREFIX,
   SECRET_MARKER_PREFIX as SECRET_MARKER_PREFIX2,
+  STEP_FUNCTION_KEYS,
   isPathStepEntry,
   isObject as isObject3
 } from "@walkeros/core";
@@ -1473,7 +1018,7 @@ function tempSibling(dest) {
   ).join("");
   return `${dest}${TMP_INFIX}${rand}`;
 }
-function errorCode2(error) {
+function errorCode(error) {
   if (typeof error === "object" && error !== null && "code" in error) {
     const code = error.code;
     return typeof code === "string" ? code : void 0;
@@ -1481,7 +1026,7 @@ function errorCode2(error) {
   return void 0;
 }
 function isOccupied(error) {
-  const code = errorCode2(error);
+  const code = errorCode(error);
   return code === "EEXIST" || code === "ENOTEMPTY";
 }
 function isCacheTempName(name) {
@@ -1520,7 +1065,7 @@ async function replaceIncomplete(tmp, dest) {
     await fs9.rename(dest, aside);
     moved = true;
   } catch (error) {
-    if (errorCode2(error) !== "ENOENT") throw error;
+    if (errorCode(error) !== "ENOENT") throw error;
   }
   const restore = moved && await isCacheDirComplete(aside);
   const winner = restore ? aside : tmp;
@@ -1698,7 +1243,7 @@ function backoffForAttempt(index) {
   const spread = base * JITTER;
   return base + (Math.random() * 2 - 1) * spread;
 }
-function delay2(ms) {
+function delay(ms) {
   return new Promise((resolve5) => {
     setTimeout(resolve5, ms);
   });
@@ -1740,7 +1285,7 @@ async function withPacoteRetry(fn, label, options = {}) {
       maxTotalMs - (Date.now() - start)
     );
     if (sleepMs <= 0) break;
-    await delay2(sleepMs);
+    await delay(sleepMs);
   }
   throw new Error(
     `Failed ${label} after ${made} attempts: ${describeError(lastError)}`
@@ -2567,21 +2112,21 @@ async function ensureCodeOnDisk(codeContent, compiledCode, tmpDir, inputs) {
 }
 
 // src/version.ts
-import { readFileSync as readFileSync2 } from "fs";
+import { readFileSync } from "fs";
 import { fileURLToPath } from "url";
-import { dirname as dirname3, join as join4 } from "path";
+import { dirname as dirname3, join as join3 } from "path";
 var versionFilename = fileURLToPath(import.meta.url);
 var versionDirname = dirname3(versionFilename);
 function findPackageJson() {
   const paths = [
-    join4(versionDirname, "../package.json"),
+    join3(versionDirname, "../package.json"),
     // dist/ or src/
-    join4(versionDirname, "../../package.json")
+    join3(versionDirname, "../../package.json")
     // src/core/ (not used, but safe)
   ];
   for (const p of paths) {
     try {
-      return readFileSync2(p, "utf-8");
+      return readFileSync(p, "utf-8");
     } catch {
     }
   }
@@ -2597,9 +2142,11 @@ function hasCodeReference(code) {
   return isInlineCode(code) || typeof code === "string";
 }
 function generateInlineCode(inline, runtimeProps, isDestination) {
-  const pushFn = inline.push.replace("$code:", "");
-  const initFn = inline.init ? inline.init.replace("$code:", "") : void 0;
   const typeLine = inline.type ? `type: '${inline.type}',` : "";
+  const functionLines = STEP_FUNCTION_KEYS.flatMap((key) => {
+    const fn = inline[key];
+    return fn ? [`${key}: ${fn.replace("$code:", "")}`] : [];
+  }).join(",\n        ");
   const props = {
     config: {},
     env: {},
@@ -2611,8 +2158,7 @@ function generateInlineCode(inline, runtimeProps, isDestination) {
       code: {
         ${typeLine}
         config: ${processConfigValue(props.config)},
-        ${initFn ? `init: ${initFn},` : ""}
-        push: ${pushFn}
+        ${functionLines}
       },
       ${propLines}
     }`;
@@ -2621,8 +2167,7 @@ function generateInlineCode(inline, runtimeProps, isDestination) {
       code: async (context) => ({
         ${typeLine}
         config: context.config,
-        ${initFn ? `init: ${initFn},` : ""}
-        push: ${pushFn}
+        ${functionLines}
       }),
       ${propLines}
     }`;
@@ -2768,6 +2313,7 @@ async function bundleCore(flowSettings, buildOptions, logger, showStats = false,
       packagePaths
     );
     const versionsHash = await getHashServer3(sortedVersions.join("\n"), 12);
+    applyCollectorDefaults(flowSettings);
     if (provenance) {
       applyCollectorProvenance(
         flowSettings,
@@ -2939,7 +2485,7 @@ ${dataDeclaration}${needs}`;
       };
       if (buildOptions.platform === "browser") {
         stage2Options.format = "iife";
-        stage2Options.plugins = [cliCorePlugin()];
+        stage2Options.plugins = [cliPackagesPlugin()];
         stage2Options.define = {
           "process.env.NODE_ENV": '"production"',
           global: "globalThis",
@@ -3107,22 +2653,25 @@ function getNodeExternals() {
   }
   return externals;
 }
-var CLI_CORE = "walkeros-cli-core";
-function cliCorePlugin() {
+var CLI_PACKAGES = "walkeros-cli-packages";
+function cliPackagesPlugin() {
   const resolveDir = path14.dirname(fileURLToPath2(import.meta.url));
   return {
-    name: CLI_CORE,
+    name: CLI_PACKAGES,
     setup(build2) {
-      build2.onResolve({ filter: /^@walkeros\/core$/ }, async (args) => {
-        if (args.pluginData === CLI_CORE) return void 0;
-        const resolved = await build2.resolve(args.path, {
-          kind: args.kind,
-          resolveDir,
-          pluginData: CLI_CORE
-        });
-        if (resolved.errors.length > 0) return { errors: resolved.errors };
-        return { path: resolved.path, sideEffects: resolved.sideEffects };
-      });
+      build2.onResolve(
+        { filter: /^@walkeros\/(core|web-core)$/ },
+        async (args) => {
+          if (args.pluginData === CLI_PACKAGES) return void 0;
+          const resolved = await build2.resolve(args.path, {
+            kind: args.kind,
+            resolveDir,
+            pluginData: CLI_PACKAGES
+          });
+          if (resolved.errors.length > 0) return { errors: resolved.errors };
+          return { path: resolved.path, sideEffects: resolved.sideEffects };
+        }
+      );
     }
   };
 }
@@ -3439,6 +2988,12 @@ ${firstError.text}`
 function buildDataPayload(flowSettings) {
   return buildSplitConfigObject(flowSettings, detectNamedImports(flowSettings)).dataPayloadObj;
 }
+function applyCollectorDefaults(flowSettings) {
+  if (getPlatform2(flowSettings) !== "server") return;
+  const collector = flowSettings.collector ?? {};
+  collector.consentDenied ??= "skip";
+  flowSettings.collector = collector;
+}
 function applyCollectorProvenance(flowSettings, flowName, release2, fallback) {
   const collector = flowSettings.collector ?? {};
   collector.name ??= flowName;
@@ -3557,6 +3112,34 @@ export function wireConfig(__data) {
 
 export { startFlow };`;
 }
+var HOST_LOGGER_MERGE = `  // The host's logger (masking, its error ring) joins the flow's own: the
+  // flow's level and format win, unless the host forces a level (--verbose);
+  // the flow's handler runs first, then the host's, once per line, always.
+  // The flow handler's originalHandler does nothing, so no line prints a
+  // second time unmasked. The host learns the flow's settings before the
+  // collector starts, so every line, the first included, has its format.
+  if (context.logger) {
+    const own = config.logger || {};
+    const host = context.logger;
+    if (context.onLogger) context.onLogger({ level: own.level, format: own.format });
+    const level = context.logLevel ?? own.level ?? host.level;
+    const printedByHost = () => {};
+    const handler = own.handler && host.handler
+      ? (lvl, message, ctx, scope) => {
+          try {
+            own.handler(lvl, message, ctx, scope, printedByHost);
+          } finally {
+            host.handler(lvl, message, ctx, scope, printedByHost);
+          }
+        }
+      : host.handler || own.handler;
+    config.logger = {
+      ...host,
+      ...(level !== undefined ? { level } : {}),
+      ...(own.format ? { format: own.format } : {}),
+      ...(handler ? { handler } : {}),
+    };
+  }`;
 function generateServerEntry(stage1Path, dataPayload) {
   const stage1Specifier = toFileImportSpecifier(stage1Path);
   return `import { startFlow, wireConfig } from '${stage1Specifier}';
@@ -3566,7 +3149,7 @@ const __configData = ${dataPayload};
 export default async function(context = {}) {
   const config = wireConfig(__configData);
 
-  if (context.logger) config.logger = context.logger;
+${HOST_LOGGER_MERGE}
 
   if (context.sourceSettings && config.sources) {
     for (const src of Object.values(config.sources)) {
@@ -3626,6 +3209,7 @@ function readObserveConnect(flowSettings, logger) {
   );
   return void 0;
 }
+var OBSERVE_SLOT_IMPORT = "import { pageObserveSlot } from '@walkeros/web-core';\n";
 function emitObserveAssignment(observe) {
   const literal = {
     url: observe.url,
@@ -3635,9 +3219,9 @@ function emitObserveAssignment(observe) {
     ...observe.sample !== void 0 ? { sample: observe.sample } : {}
   };
   return `
-  config.observe = ${JSON.stringify(literal)};`;
+  config.observe = { ...${JSON.stringify(literal)}, slot: pageObserveSlot() };`;
 }
-var MOIN_IMPORT = "import { moin } from '@walkeros/core';\n";
+var MOIN_IMPORT = "import { moin } from '@walkeros/web-core';\n";
 function emitMoinCall(target) {
   if (!target)
     return `
@@ -3685,10 +3269,11 @@ function generateWebEntry(stage1Path, dataPayload, options = {}) {
     }
   }` : "";
   const stage1Specifier = toFileImportSpecifier(stage1Path);
+  const observeImport = options.observe ? OBSERVE_SLOT_IMPORT : "";
   const observeBlock = options.observe ? emitObserveAssignment(options.observe) : "";
   const loaderImport = platform === "browser" ? MOIN_IMPORT : "";
   const loaderCall = platform === "browser" ? emitMoinCall() : "";
-  return `${loaderImport}import { startFlow, wireConfig } from '${stage1Specifier}';
+  return `${loaderImport}${observeImport}import { startFlow, wireConfig } from '${stage1Specifier}';
 
 const __configData = ${dataPayload};
 
@@ -3712,7 +3297,7 @@ function generateWrapEntry(stage1Path, options = {}) {
   }
   const preview = options.preview;
   const previewEnabled = !!preview?.enabled;
-  const previewImport = previewEnabled ? `import { browserSwapActivator } from '@walkeros/core';
+  const previewImport = previewEnabled ? `import { browserSwapActivator } from '@walkeros/web-core';
 ` : "";
   const grantTargets = options.previewGrantTargets ?? [];
   const previewGrantBlock = grantTargets.length > 0 ? `
@@ -3762,10 +3347,11 @@ ${grantTargets.map((key) => {
     }
   }` : "";
   const stage1Specifier = toFileImportSpecifier(stage1Path);
+  const observeImport = options.observe ? OBSERVE_SLOT_IMPORT : "";
   const observeBlock = options.observe ? emitObserveAssignment(options.observe) : "";
   const loaderImport = platform === "browser" ? MOIN_IMPORT : "";
   const loaderCall = platform === "browser" ? emitMoinCall(options.moin) : "";
-  return `${loaderImport}${previewImport}import { startFlow, wireConfig, __configData } from '${stage1Specifier}';
+  return `${loaderImport}${previewImport}${observeImport}import { startFlow, wireConfig, __configData } from '${stage1Specifier}';
 
 (async () => {${loaderCall}${previewBlock}
   const config = wireConfig(__configData);${envBlock}${previewGrantBlock}${observeBlock}
@@ -3782,7 +3368,7 @@ function generateWrapEntryServer(stage1Path) {
 export default async function(context = {}) {
   const config = wireConfig(__configData);
 
-  if (context.logger) config.logger = context.logger;
+${HOST_LOGGER_MERGE}
 
   if (context.sourceSettings && config.sources) {
     for (const src of Object.values(config.sources)) {
@@ -4268,7 +3854,7 @@ async function bundle(configOrPath, options = {}) {
 // src/commands/push/index.ts
 import path18 from "path";
 import fs18 from "fs-extra";
-import { createIngest, getPlatform as getPlatform3, stepId } from "@walkeros/core";
+import { createIngest, getPlatform as getPlatform4, stepId } from "@walkeros/core";
 import {
   enrichEvent,
   transformerInit,
@@ -4497,13 +4083,13 @@ function installTimerInterception(options = {}) {
       setInterval: Reflect.get(target, "setInterval"),
       clearInterval: Reflect.get(target, "clearInterval")
     });
-    const trackedSetTimeout = (callback, delay4, ...args) => {
+    const trackedSetTimeout = (callback, delay2, ...args) => {
       if (typeof callback !== "function") return 0;
       const id = nextId++;
       pending.set(id, {
         id,
         callback,
-        delay: delay4 ?? 0,
+        delay: delay2 ?? 0,
         type: "timeout",
         args,
         cleared: false
@@ -4516,13 +4102,13 @@ function installTimerInterception(options = {}) {
       const entry = pending.get(numId);
       if (entry) entry.cleared = true;
     };
-    const trackedSetInterval = (callback, delay4, ...args) => {
+    const trackedSetInterval = (callback, delay2, ...args) => {
       if (typeof callback !== "function") return 0;
       const id = nextId++;
       pending.set(id, {
         id,
         callback,
-        delay: delay4 ?? 0,
+        delay: delay2 ?? 0,
         type: "interval",
         args,
         cleared: false
@@ -4962,7 +4548,7 @@ function buildSimulationResult(args) {
 // src/commands/push/prepare.ts
 import path17 from "path";
 import fs17 from "fs-extra";
-import { getPlatform as getPlatform2 } from "@walkeros/core";
+import { getPlatform as getPlatform3 } from "@walkeros/core";
 
 // src/core/known-secrets.ts
 import { REF_SECRET } from "@walkeros/core";
@@ -5004,7 +4590,7 @@ async function prepareFlow(input) {
     configPath: process.cwd(),
     flowName: input.flow
   });
-  const platform = getPlatform2(flowSettings);
+  const platform = getPlatform3(flowSettings);
   const overrides = buildOverrides(
     { simulate: input.simulate, mock: input.mock },
     flowSettings
@@ -5580,7 +5166,7 @@ async function executeConfigPush(options, validatedEvent, logger, setTempDir, lo
     logger,
     raw: loaded.raw
   });
-  const platform = getPlatform3(flowSettings);
+  const platform = getPlatform4(flowSettings);
   const overrides = buildOverrides({ mock: options.mock }, flowSettings);
   logger.debug("Bundling flow configuration");
   const tempDir = await tmpRunDir("push");
@@ -6451,16 +6037,9 @@ import chalk2 from "chalk";
 import { isObject as isObject10 } from "@walkeros/core";
 
 // src/commands/validate/validators/contract.ts
-import { isObject as isObject5 } from "@walkeros/core";
+import { CONTRACT_RULE_KEYS, isObject as isObject5 } from "@walkeros/core";
+var KNOWN_KEYS = new Set(CONTRACT_RULE_KEYS);
 var SECTION_KEYS = ["globals", "context", "custom", "user", "consent"];
-var KNOWN_KEYS = /* @__PURE__ */ new Set([
-  "extend",
-  "tagging",
-  "description",
-  "events",
-  "schema",
-  ...SECTION_KEYS
-]);
 function validateContract(input) {
   const errors = [];
   const warnings = [];
@@ -6501,7 +6080,9 @@ function validateContract(input) {
     const keys = Object.keys(obj);
     const unknownKeys = keys.filter((k) => !KNOWN_KEYS.has(k));
     const hasKnownKey = keys.some((k) => KNOWN_KEYS.has(k));
-    const objectValuedUnknown = unknownKeys.filter((k) => isObject5(obj[k]));
+    const objectValuedUnknown = unknownKeys.filter(
+      (k) => isObject5(obj[k]) && !SECTION_KEYS.includes(k)
+    );
     if (!hasKnownKey && objectValuedUnknown.length > 0) {
       errors.push({
         path: name,
@@ -6511,9 +6092,9 @@ function validateContract(input) {
       continue;
     }
     for (const key of unknownKeys) {
-      warnings.push({
+      errors.push({
         path: `${name}.${key}`,
-        message: `Unknown contract key "${key}" is ignored`,
+        message: SECTION_KEYS.includes(key) ? `Contract section "${key}" is not enforced: the validate transformer reads only "events" and "schema". Put the rule into "schema" (a JSON Schema for the whole event), for example "schema": { "properties": { "${key}": { ... } } }.` : `Unknown contract key "${key}" is not supported. Known keys: ${[...KNOWN_KEYS].join(", ")}.`,
         code: "UNKNOWN_CONTRACT_KEY"
       });
     }
@@ -6547,18 +6128,6 @@ function validateContract(input) {
         });
       }
     }
-    for (const key of SECTION_KEYS) {
-      if (key in obj) {
-        if (typeof obj[key] !== "object" || obj[key] === null) {
-          errors.push({
-            path: `${name}.${key}`,
-            message: `Section "${key}" must be a JSON Schema object`,
-            value: obj[key],
-            code: "INVALID_SECTION"
-          });
-        }
-      }
-    }
     if (obj.events !== void 0) {
       if (typeof obj.events !== "object" || obj.events === null) {
         errors.push({
@@ -6670,9 +6239,14 @@ import {
   isObject as isObject8,
   REF_CONTRACT,
   resolveContracts,
+  SECRET_MARKER_PREFIX as SECRET_MARKER_PREFIX4,
   validateStepEntry
 } from "@walkeros/core";
-import { schemas as schemas4, validateFlowStructure } from "@walkeros/core/dev";
+import {
+  checkStepKeys,
+  schemas as schemas4,
+  validateFlowStructure as validateFlowStructure2
+} from "@walkeros/core/dev";
 import {
   validateEventAgainstContract
 } from "@walkeros/transformer-validate";
@@ -6873,7 +6447,7 @@ import {
   REF_STORE,
   SECRET_MARKER_PREFIX as SECRET_MARKER_PREFIX3
 } from "@walkeros/core";
-var CLIENT_HEADER = "walkeros-cli/4.8.1-next-1792019907609";
+var CLIENT_HEADER = "walkeros-cli/4.8.2";
 function createSettingsContext(configDir) {
   return { configDir, cache: /* @__PURE__ */ new Map(), compiled: /* @__PURE__ */ new Map() };
 }
@@ -6991,7 +6565,7 @@ function packageSource(spec, rawFlow) {
   const pinned = pin.version ?? version;
   return pinned ? { name, version: pinned } : { name };
 }
-function readJson2(file) {
+function readJson(file) {
   return JSON.parse(fs19.readFileSync(file, "utf-8"));
 }
 function readLocalSchema(source, configDir) {
@@ -7002,9 +6576,9 @@ function readLocalSchema(source, configDir) {
     path19.join(root, "walkerOS.json")
   ].find((candidate) => fs19.existsSync(candidate));
   if (!file) throw new Error(`no walkerOS.json under ${root}`);
-  const meta = readJson2(file);
+  const meta = readJson(file);
   const pkgFile = path19.join(root, "package.json");
-  const pkg = fs19.existsSync(pkgFile) ? readJson2(pkgFile) : void 0;
+  const pkg = fs19.existsSync(pkgFile) ? readJson(pkgFile) : void 0;
   const schemas6 = isObject7(meta) ? meta.schemas : void 0;
   const exportSchemas = isObject7(meta) ? meta.exportSchemas : void 0;
   const declared = isObject7(meta) && isObject7(meta.$meta) ? meta.$meta.exports : void 0;
@@ -7188,7 +6762,9 @@ var { validateFlowConfig: validateFlowConfig2 } = schemas4;
 var DEPRECATED_PACKAGES = {
   "@walkeros/store-memory": "has been removed. Use the built-in cache by omitting cache.store, or remove the store declaration if it was only used as a cache target."
 };
-var OPEN_STEP_KINDS = [
+var STEP_KINDS2 = [
+  ["sources", "Source"],
+  ["transformers", "Transformer"],
   ["destinations", "Destination"],
   ["stores", "Store"]
 ];
@@ -7237,7 +6813,11 @@ async function validateFlowWithPackages(input, options = {}) {
     }
   }
   for (const outcome of await Promise.all(pending)) {
-    result.warnings.push(...outcome.findings);
+    for (const finding of outcome.findings) {
+      if (finding.keyword === "additionalProperties")
+        result.errors.push(finding);
+      else result.warnings.push(finding);
+    }
     run.skipped.push(...outcome.skipped);
     deferred.push(...outcome.deferred);
     if (outcome.checked) packages.push(outcome.checked);
@@ -7245,6 +6825,7 @@ async function validateFlowWithPackages(input, options = {}) {
   result.details.scope = describeScope(scope, run.checks);
   result.details.deferred = [...result.details.deferred ?? [], ...deferred];
   if (packages.length > 0) result.details.packages = packages;
+  result.valid = result.errors.length === 0;
   return result;
 }
 function runFlowChecks(input, options) {
@@ -7303,8 +6884,13 @@ function runFlowChecks(input, options) {
   for (const issue of coreResult.errors) {
     const path23 = issue.path || "root";
     if (!inScope(path23)) continue;
-    if (path23 === "contract" && contractErrors > 0) continue;
-    errors.push({ path: path23, message: issue.message, code: "SCHEMA_VALIDATION" });
+    if ((path23 === "contract" || path23.startsWith("contract.")) && contractErrors > 0)
+      continue;
+    errors.push({
+      path: path23,
+      message: issue.message,
+      code: issue.code ?? "SCHEMA_VALIDATION"
+    });
   }
   for (const issue of coreResult.warnings) {
     const path23 = issue.path || "root";
@@ -7338,20 +6924,13 @@ function runFlowChecks(input, options) {
         }
       }
     }
-    for (const [section, kind] of OPEN_STEP_KINDS) {
+    for (const [section, kind] of STEP_KINDS2) {
       const steps = flowValue[section];
       if (!isObject8(steps)) continue;
       for (const [name, step] of Object.entries(steps)) {
         if (!isObject8(step)) continue;
         const at = `flows.${flowName}.${section}.${name}`;
-        for (const key of unknownStepKeys(step, kind)) {
-          warnings.push({
-            path: `${at}.${key}`,
-            message: `Unknown key "${key}" on ${kind} is ignored by the runtime`,
-            suggestion: "Remove the key, or move it to where it belongs.",
-            code: "UNKNOWN_KEY"
-          });
-        }
+        errors.push(...checkStepKeys(step, kind, at));
         const pkg = step.package;
         if (typeof pkg === "string" && pkg in DEPRECATED_PACKAGES) {
           warnings.push({
@@ -7362,6 +6941,7 @@ function runFlowChecks(input, options) {
         }
       }
     }
+    checkWebLoggerFormat(flowName, flowValue, errors);
   }
   if (flows) {
     details.flowNames = allFlows;
@@ -7425,7 +7005,7 @@ function runFlowChecks(input, options) {
     }
   };
   perFlow(["flow:structure"], (name, flow, file) => {
-    const structure = validateFlowStructure({
+    const structure = validateFlowStructure2({
       ...file,
       flows: { [name]: flow }
     });
@@ -7533,16 +7113,31 @@ function checkResolvedWindowCollector(name, raw, flow, errors, deferred) {
     code: "SCHEMA_VALIDATION"
   });
 }
-function unknownStepKeys(step, kind) {
-  const unknown = [];
-  const rest = { ...step };
-  for (; ; ) {
-    const verdict = validateStepEntry(rest, kind);
-    if (verdict.code !== "UNKNOWN_KEY" || verdict.key === void 0) break;
-    unknown.push(verdict.key);
-    Reflect.deleteProperty(rest, verdict.key);
+function checkWebLoggerFormat(flowName, flow, errors) {
+  if (!isObject8(flow.config) || flow.config.platform !== "web") return;
+  const at = `flows.${flowName}`;
+  const loggers = [];
+  if (isObject8(flow.collector))
+    loggers.push([`${at}.collector.logger`, flow.collector.logger]);
+  for (const [section] of STEP_KINDS2) {
+    const steps = flow[section];
+    if (!isObject8(steps)) continue;
+    for (const [name, step] of Object.entries(steps)) {
+      if (isObject8(step) && isObject8(step.config))
+        loggers.push([
+          `${at}.${section}.${name}.config.logger`,
+          step.config.logger
+        ]);
+    }
+  }
+  for (const [path23, logger] of loggers) {
+    if (!isObject8(logger) || logger.format === void 0) continue;
+    errors.push({
+      path: `${path23}.format`,
+      message: "logger.format applies to server flows only: a web flow logs to the browser console, which has no output format. Remove it.",
+      code: "WEB_LOGGER_FORMAT"
+    });
   }
-  return unknown;
 }
 function routeTargets(spec) {
   if (spec === void 0) return [];
@@ -7770,6 +7365,12 @@ function lintRoute(spec, position, known, errors, warnings) {
     }
   }
 }
+function hasRuntimeValue(value) {
+  if (typeof value === "string")
+    return value.includes(ENV_MARKER_PREFIX3) || value.startsWith(SECRET_MARKER_PREFIX4) || /\$(?:env|secret)\./.test(value);
+  if (Array.isArray(value)) return value.some(hasRuntimeValue);
+  return isObject8(value) && Object.values(value).some(hasRuntimeValue);
+}
 var VALIDATE_PACKAGE = "@walkeros/transformer-validate";
 function isValidateStep(step) {
   return step.package === VALIDATE_PACKAGE;
@@ -7840,6 +7441,15 @@ function checkValidateStepExamples(stepPath, step, contract, errors, warnings, s
   }
   if (!step.examples) return;
   const contracts = resolution.sources;
+  if (contracts.some(hasRuntimeValue)) {
+    skipped?.push({
+      path: stepPath,
+      check: "flow:contract-examples",
+      reason: "the contract uses a $env or $secret value, known only when the bundle builds or runs, so the examples cannot be judged statically",
+      code: "CONTRACT_NOT_STATIC"
+    });
+    return;
+  }
   const mode = settings.mode === "strict" ? "strict" : "pass";
   const format = settings.format === true;
   const output = isObject8(settings.output) ? settings.output : {};
@@ -8046,6 +7656,7 @@ var VALIDATE_CODES = [
   "CONTRACT_VIOLATION",
   "MAPPING_DOT_KEY",
   "FLOW_REF_WARNING",
+  "WEB_LOGGER_FORMAT",
   "FLOW_CYCLE",
   "VAR_CYCLE",
   // Structure (the bundler's own preflight, validateFlowStructure)
@@ -8054,7 +7665,11 @@ var VALIDATE_CODES = [
   "STORE_REFERENCE_NOT_FOUND",
   "STATE_STORE_UNKNOWN",
   "STATE_STORE_FILE",
-  "TRANSFORMER_MAPPING_NO_OP",
+  "MAPPING_NO_OP",
+  "MAPPING_VALUE_NO_OPERATOR",
+  "MAPPING_VALUE_PRODUCERS",
+  "BATCH_WITHOUT_PUSH_BATCH",
+  "MALFORMED_REFERENCE",
   // Resolution (getFlowSettings, as the bundler resolves the flow)
   "UNRESOLVED_REFERENCE",
   "MISSING_ENV",
@@ -8071,7 +7686,6 @@ var VALIDATE_CODES = [
   "INVALID_TAGGING",
   "INVALID_SCHEMA",
   "INVALID_EXTENDS",
-  "INVALID_SECTION",
   "INVALID_EVENTS",
   "CIRCULAR_EXTENDS",
   "INVALID_ENTITY_KEY",
@@ -8346,191 +7960,8 @@ function exitCodeOf(result, strict) {
   return result.valid ? 0 : 1;
 }
 
-// src/commands/login/index.ts
-import { z as z3 } from "zod";
-var POLL_TIMEOUT_BUFFER_MS = 5e3;
-var DEFAULT_POLL_INTERVAL_MS = 5e3;
-var MIN_SERVER_POLL_INTERVAL_MS = 1e3;
-var DEFAULT_POLL_TIMEOUT_MS = 9e5;
-var SLOW_DOWN_STEP_MS = 5e3;
-var WHOAMI_TIMEOUT_MS = 1e4;
-var TIMED_OUT = "Authorization timed out. Please try again.";
-var WhoamiSchema = z3.object({ email: z3.string().min(1) });
-async function openInBrowser(url) {
-  const { default: open } = await import("open");
-  await open(url);
-}
-function delay3(ms) {
-  return new Promise((resolve5) => setTimeout(resolve5, ms));
-}
-async function loginCommand(options) {
-  const logger = createCLILogger(options);
-  try {
-    const result = await login({ url: options.url });
-    if (options.json) {
-      logger.json(result);
-    } else if (result.success) {
-      if (result.email) logger.info(`Logged in as ${result.email}`);
-      else logger.info("Logged in.");
-      logger.info(`Session stored in ${result.configPath}`);
-    } else if (result.error) {
-      logger.error(result.error);
-    }
-    process.exit(result.success ? 0 : 1);
-  } catch (error) {
-    const message = error instanceof Error ? error.message : String(error);
-    if (options.json) {
-      logger.json({ success: false, error: message });
-    } else {
-      logger.error(message);
-    }
-    process.exit(1);
-  }
-}
-async function fetchEmail(appUrl, accessToken, fetchFn) {
-  try {
-    const response = await appFetch(APP_PATHS.whoami, {
-      baseUrl: appUrl,
-      token: accessToken,
-      fetch: fetchFn,
-      signal: AbortSignal.timeout(WHOAMI_TIMEOUT_MS)
-    });
-    if (!response.ok) return void 0;
-    const parsed = WhoamiSchema.safeParse(await response.json());
-    return parsed.success ? parsed.data.email : void 0;
-  } catch {
-    return void 0;
-  }
-}
-async function persistSession(appUrl, tokens, fetchFn) {
-  writeConfig({
-    accessToken: tokens.accessToken,
-    accessTokenExpiresAt: tokens.accessTokenExpiresAt,
-    refreshToken: tokens.refreshToken ?? void 0,
-    appUrl,
-    // Drop the static token this session replaces, so the deprecated path
-    // cannot outlive the login that retired it.
-    token: void 0
-  });
-  const email = await fetchEmail(appUrl, tokens.accessToken, fetchFn);
-  writeConfig({ email });
-}
-async function completeDeviceLogin(deviceCode, options = {}) {
-  const fetchFn = options.fetch ?? globalThis.fetch;
-  const appUrl = requireSecureUrl(options.url || resolveAppUrl());
-  const deadline = Date.now() + (options.timeoutMs ?? DEFAULT_POLL_TIMEOUT_MS);
-  let intervalMs = options.intervalMs ?? DEFAULT_POLL_INTERVAL_MS;
-  let attempts = 0;
-  let waiting = "pending";
-  while (Date.now() + intervalMs <= deadline) {
-    if (options.maxPollAttempts !== void 0 && attempts >= options.maxPollAttempts)
-      break;
-    attempts += 1;
-    await delay3(intervalMs);
-    const signal = AbortSignal.timeout(Math.max(1, deadline - Date.now()));
-    const poll = await pollDeviceToken(appUrl, deviceCode, fetchFn, signal);
-    if (poll.status === "pending") {
-      waiting = "pending";
-      if (signal.aborted) break;
-      continue;
-    }
-    if (poll.status === "slow_down") {
-      waiting = "slow_down";
-      intervalMs += SLOW_DOWN_STEP_MS;
-      continue;
-    }
-    if (poll.status !== "ok") return poll;
-    await persistSession(appUrl, poll.tokens, fetchFn);
-    return { status: "ok" };
-  }
-  return { status: waiting };
-}
-async function login(options = {}) {
-  const fetchFn = options.fetch ?? globalThis.fetch;
-  const appUrl = requireSecureUrl(options.url || resolveAppUrl());
-  let authorization;
-  try {
-    authorization = await startDeviceAuthorization(appUrl, fetchFn);
-  } catch {
-    return { success: false, error: "Failed to request device code" };
-  }
-  const target = authorization.verificationUriComplete;
-  const prompt = (message) => process.stderr.write(message + "\n");
-  prompt(`
-! Your one-time code: ${authorization.userCode}`);
-  prompt(`  Authorize here: ${target}
-`);
-  const opener = options.openUrl ?? openInBrowser;
-  try {
-    await opener(target);
-    prompt("  Opening browser...");
-  } catch {
-    prompt("  Could not open browser. Visit the URL manually.");
-  }
-  prompt("  Waiting for authorization... (press Ctrl+C to cancel)\n");
-  const outcome = await completeDeviceLogin(authorization.deviceCode, {
-    url: appUrl,
-    fetch: fetchFn,
-    timeoutMs: authorization.expiresIn * 1e3 + POLL_TIMEOUT_BUFFER_MS,
-    // Clamped here, at the one place a server's number enters the loop. The
-    // helper takes its caller's interval as stated, which is what keeps a
-    // stated 0 from becoming a poll flood without making the helper's own
-    // option untestably slow.
-    intervalMs: options.pollIntervalMs ?? Math.max(MIN_SERVER_POLL_INTERVAL_MS, authorization.interval * 1e3),
-    ...options.maxPollAttempts !== void 0 ? { maxPollAttempts: options.maxPollAttempts } : {}
-  });
-  switch (outcome.status) {
-    case "ok": {
-      const email = readConfig()?.email;
-      return {
-        success: true,
-        ...email ? { email } : {},
-        configPath: getConfigPath()
-      };
-    }
-    case "denied":
-      return { success: false, error: "Authorization was denied." };
-    case "error":
-      return { success: false, error: outcome.error };
-    default:
-      return { success: false, error: TIMED_OUT };
-  }
-}
-
-// src/commands/logout/index.ts
-async function logoutCommand(options) {
-  const logger = createCLILogger(options);
-  const { deleted, superseded } = await logout();
-  const configPath = getConfigPath();
-  if (options.json) {
-    logger.json({ success: true, deleted, superseded });
-  } else if (superseded) {
-    logger.info(
-      "A newer session was stored while logging out, and was kept. Run `walkeros auth logout` again to remove it."
-    );
-  } else if (deleted) {
-    logger.info(`Logged out. Session removed from ${configPath}`);
-  } else {
-    logger.info("No stored credentials found.");
-  }
-  process.exit(0);
-}
-function sameSession(before, after) {
-  return before?.accessToken === after.accessToken && before?.refreshToken === after.refreshToken && before?.token === after.token;
-}
-async function logout() {
-  const before = readConfig();
-  if (before?.refreshToken) {
-    await revokeRefreshToken(resolveAppUrl(), before.refreshToken);
-  }
-  const after = readConfig();
-  if (after && !sameSession(before, after))
-    return { deleted: false, superseded: true };
-  return { deleted: deleteConfig(), superseded: false };
-}
-
 // src/commands/auth/index.ts
-import { z as z5 } from "zod";
+import { z as z3 } from "zod";
 
 // src/core/api-error.ts
 var EXIT_RETRYABLE = 75;
@@ -8588,31 +8019,166 @@ ${err.message}
   process.exit(1);
 }
 
+// src/core/app-fetch.ts
+import { z } from "zod";
+
+// src/lib/config-file.ts
+import {
+  readFileSync as readFileSync3,
+  writeFileSync,
+  mkdirSync,
+  unlinkSync,
+  chmodSync,
+  renameSync
+} from "fs";
+import { randomBytes } from "crypto";
+import { join as join5 } from "path";
+import { homedir } from "os";
+function getConfigDir() {
+  const xdgConfig = process.env.XDG_CONFIG_HOME;
+  const base = xdgConfig || join5(homedir(), ".config");
+  return join5(base, "walkeros");
+}
+function getConfigPath() {
+  return join5(getConfigDir(), "config.json");
+}
+function readConfig() {
+  const configPath = getConfigPath();
+  try {
+    const content = readFileSync3(configPath, "utf-8");
+    return JSON.parse(content);
+  } catch {
+    return null;
+  }
+}
+function replaceConfigFile(config) {
+  const dir = getConfigDir();
+  mkdirSync(dir, { recursive: true, mode: 448 });
+  const configPath = getConfigPath();
+  const tempPath = `${configPath}.${process.pid}.${randomBytes(6).toString("hex")}.tmp`;
+  try {
+    writeFileSync(tempPath, JSON.stringify(config, null, 2), { mode: 384 });
+    chmodSync(tempPath, 384);
+    renameSync(tempPath, configPath);
+  } catch (error) {
+    try {
+      unlinkSync(tempPath);
+    } catch {
+    }
+    throw error;
+  }
+}
+function writeConfig(config) {
+  replaceConfigFile({ ...readConfig() ?? {}, ...config });
+}
+function writeTelemetryOnlyConfig(partial) {
+  writeConfig(partial);
+}
+function resolveAppUrl() {
+  const envUrl = process.env.WALKEROS_APP_URL;
+  if (envUrl) return envUrl;
+  const config = readConfig();
+  if (config?.appUrl) return config.appUrl;
+  return "https://app.walkeros.io";
+}
+
+// src/lib/secure-url.ts
+function isLoopback(hostname) {
+  return hostname === "localhost" || hostname === "127.0.0.1" || hostname === "[::1]";
+}
+function requireSecureUrl(url) {
+  let parsed;
+  try {
+    parsed = new URL(url);
+  } catch {
+    return url;
+  }
+  if (parsed.protocol !== "http:" || isLoopback(parsed.hostname)) return url;
+  throw new Error(
+    `Refusing to send walkerOS credentials over plain http to ${url}. Use https, or localhost / 127.0.0.1 / [::1] for local development.`
+  );
+}
+
+// src/core/client-context.ts
+var context;
+function setClientContext(input) {
+  const envType = process.env.WALKEROS_CLIENT_TYPE;
+  const type = envType ?? input.type ?? "cli";
+  context = { type, version: input.version };
+}
+function getClientContext() {
+  return context;
+}
+function resetClientContext() {
+  context = void 0;
+}
+function clientContextHeaders() {
+  if (!context) return {};
+  return {
+    "User-Agent": `walkeros-${context.type}/${context.version}`,
+    "X-WalkerOS-Client": context.type,
+    "X-WalkerOS-Client-Version": context.version
+  };
+}
+
+// src/core/app-fetch.ts
+var AppErrorSchema = z.object({
+  error: z.object({ message: z.string().min(1) })
+});
+function appErrorMessage(body) {
+  const parsed = AppErrorSchema.safeParse(body);
+  return parsed.success ? parsed.data.error.message : void 0;
+}
+async function appFetch(path23, init = {}) {
+  const url = `${(init.baseUrl ?? resolveAppUrl()).replace(/\/+$/, "")}${path23}`;
+  const headers = new Headers(clientContextHeaders());
+  for (const [name, value] of Object.entries(init.headers ?? {}))
+    headers.set(name, value);
+  if (init.token && !headers.has("Authorization"))
+    headers.set("Authorization", `Bearer ${init.token}`);
+  if (headers.has("Authorization")) requireSecureUrl(url);
+  const request = { headers };
+  if (init.method && init.method !== "GET") request.method = init.method;
+  if (init.body !== void 0) request.body = init.body;
+  if (init.signal) request.signal = init.signal;
+  if (init.redirect) request.redirect = init.redirect;
+  return (init.fetch ?? fetch)(url, request);
+}
+
+// src/core/app-paths.ts
+var APP_PATHS = {
+  whoami: "/api/auth/whoami",
+  health: "/api/health",
+  telemetry: "/api/telemetry",
+  openapi: "/api/openapi.json"
+};
+
 // src/commands/api/index.ts
 import { once } from "events";
 import { readFile as readFile2 } from "fs/promises";
-import { z as z4 } from "zod";
+import { z as z2 } from "zod";
+var NOT_SIGNED_IN = "no token: set WALKEROS_TOKEN to a token from Account > Automation tokens in the walkerOS app";
 var ERROR_BODY_LIMIT = 64 * 1024;
-var DocumentSchema = z4.object({
-  paths: z4.record(z4.string(), z4.record(z4.string(), z4.unknown())),
-  components: z4.record(z4.string(), z4.record(z4.string(), z4.unknown())).optional()
+var DocumentSchema = z2.object({
+  paths: z2.record(z2.string(), z2.record(z2.string(), z2.unknown())),
+  components: z2.record(z2.string(), z2.record(z2.string(), z2.unknown())).optional()
 });
-var OperationSchema = z4.object({
-  summary: z4.string().optional(),
-  description: z4.string().optional(),
-  parameters: z4.array(z4.unknown()).optional(),
-  requestBody: z4.unknown().optional(),
-  responses: z4.record(z4.string(), z4.unknown()).optional()
+var OperationSchema = z2.object({
+  summary: z2.string().optional(),
+  description: z2.string().optional(),
+  parameters: z2.array(z2.unknown()).optional(),
+  requestBody: z2.unknown().optional(),
+  responses: z2.record(z2.string(), z2.unknown()).optional()
 });
-var OptionsSchema = z4.object({
-  data: z4.string().optional(),
-  header: z4.array(z4.string()).default([]),
-  project: z4.string().optional(),
-  yes: z4.boolean().optional()
+var OptionsSchema = z2.object({
+  data: z2.string().optional(),
+  header: z2.array(z2.string()).default([]),
+  project: z2.string().optional(),
+  yes: z2.boolean().optional()
 });
 
 // src/commands/auth/index.ts
-async function readJson3(response) {
+async function readJson2(response) {
   try {
     return await response.json();
   } catch {
@@ -8620,19 +8186,17 @@ async function readJson3(response) {
   }
 }
 async function whoami() {
-  const token = await resolveAccessToken();
-  if (!token)
-    throw new Error("Not authenticated. Run `walkeros auth login` first.");
+  const token = resolveAccessToken();
+  if (!token) throw new Error(NOT_SIGNED_IN);
   const response = await appFetch(APP_PATHS.whoami, { token });
-  const body = await readJson3(response);
+  const body = await readJson2(response);
   if (!response.ok)
     throw new Error(appErrorMessage(body) ?? `HTTP ${response.status}`);
   return body;
 }
-var IdentitySchema = z5.object({
-  email: z5.string().optional(),
-  userId: z5.string().optional(),
-  projectId: z5.string().nullish()
+var IdentitySchema = z3.object({
+  email: z3.string().optional(),
+  userId: z3.string().optional()
 });
 async function whoamiCommand(options) {
   const logger = createCLILogger(options);
@@ -8649,7 +8213,6 @@ async function whoamiCommand(options) {
       const data = identity.data;
       if (data.email) logger.info(data.email);
       if (data.userId) logger.info(`User: ${data.userId}`);
-      if (data.projectId) logger.info(`Project: ${data.projectId}`);
     }
   } catch (error) {
     handleCliError(error);
@@ -8724,7 +8287,7 @@ function telemetryDisableCommand() {
 }
 
 // src/index.ts
-import { validateFlowStructure as validateFlowStructure2 } from "@walkeros/core/dev";
+import { validateFlowStructure as validateFlowStructure3 } from "@walkeros/core/dev";
 
 // src/commands/bundle/wrap.ts
 import * as path21 from "path";
@@ -8800,11 +8363,12 @@ async function wrapSkeleton(options) {
       format: "esm",
       platform,
       outfile: outputPath,
-      // Resolve `@walkeros/core` (used by the preview activator) from the CLI
-      // package's own dependency tree and the workspace root. Without this,
-      // esbuild looks under the temp entryDir which has no node_modules.
-      // The wrap step always runs from inside the CLI process; both the
-      // CLI's local node_modules and the workspace root are safe anchors.
+      // Resolve `@walkeros/web-core` (the Tag Mode loader and the preview
+      // activator) from the CLI package's own dependency tree and the
+      // workspace root. Without this, esbuild looks under the temp entryDir
+      // which has no node_modules. The wrap step always runs from inside the
+      // CLI process; both the CLI's local node_modules and the workspace root
+      // are safe anchors.
       nodePaths: getNodeResolutionPaths(),
       treeShaking: true,
       logLevel: "error",
@@ -8819,7 +8383,7 @@ async function wrapSkeleton(options) {
     };
     if (platform === "browser") {
       esbuildOptions.format = "iife";
-      esbuildOptions.plugins = [cliCorePlugin()];
+      esbuildOptions.plugins = [cliPackagesPlugin()];
       const needs = readNeedsMarker(skeletonText);
       esbuildOptions.define = {
         "process.env.NODE_ENV": '"production"',
@@ -8854,10 +8418,10 @@ import fs22 from "fs-extra";
 import { FlowReferenceError as FlowReferenceError2 } from "@walkeros/core";
 
 // src/schemas/build-manifest.ts
-import { z as z6 } from "@walkeros/core/dev";
+import { z as z4 } from "@walkeros/core/dev";
 var BUILD_MANIFEST_VERSION = 1;
-var HttpUrlSchema = z6.url({ protocol: /^https?$/ });
-var OutputNameSchema = z6.string().regex(/^[A-Za-z0-9][A-Za-z0-9._-]*$/, "Must be a bare file name").describe("Output file name; its extension picks the format (.tar.gz packs)");
+var HttpUrlSchema = z4.url({ protocol: /^https?$/ });
+var OutputNameSchema = z4.string().regex(/^[A-Za-z0-9][A-Za-z0-9._-]*$/, "Must be a bare file name").describe("Output file name; its extension picks the format (.tar.gz packs)");
 var BUNDLE_TARGET_NAMES = [
   "cdn",
   "cdn-skeleton",
@@ -8873,8 +8437,8 @@ var RESERVED_HEADERS = /* @__PURE__ */ new Set([
 var OutputFields = {
   outputName: OutputNameSchema,
   putUrl: HttpUrlSchema.describe("Presigned PUT for exactly this output"),
-  contentType: z6.string().min(1).optional().describe("Content-Type sent with the PUT (must match a signed header)"),
-  headers: z6.record(z6.string().min(1), z6.string()).refine(
+  contentType: z4.string().min(1).optional().describe("Content-Type sent with the PUT (must match a signed header)"),
+  headers: z4.record(z4.string().min(1), z4.string()).refine(
     (headers) => Object.keys(headers).every(
       (name) => !RESERVED_HEADERS.has(name.toLowerCase())
     ),
@@ -8883,68 +8447,68 @@ var OutputFields = {
     "Extra headers sent with the PUT (for headers a presign signs); never logged"
   )
 };
-var BuildBundleArtifactSchema = z6.object({
-  target: z6.enum(BUNDLE_TARGET_NAMES).describe("Named bundle target"),
+var BuildBundleArtifactSchema = z4.object({
+  target: z4.enum(BUNDLE_TARGET_NAMES).describe("Named bundle target"),
   ...OutputFields
 }).strict();
-var BuildWrapOptionsSchema = z6.object({
-  windowCollector: z6.string().min(1).optional(),
-  windowElb: z6.string().min(1).optional(),
-  preview: z6.object({
-    enabled: z6.boolean(),
-    keyring: z6.array(
-      z6.object({ kid: z6.string(), spki: z6.string() }).strict()
+var BuildWrapOptionsSchema = z4.object({
+  windowCollector: z4.string().min(1).optional(),
+  windowElb: z4.string().min(1).optional(),
+  preview: z4.object({
+    enabled: z4.boolean(),
+    keyring: z4.array(
+      z4.object({ kid: z4.string(), spki: z4.string() }).strict()
     ),
-    iss: z6.string(),
-    pb: z6.string().optional(),
-    acceptForeign: z6.boolean().optional(),
-    demoAllowlist: z6.array(z6.string()).optional(),
-    previewOrigin: z6.string()
+    iss: z4.string(),
+    pb: z4.string().optional(),
+    acceptForeign: z4.boolean().optional(),
+    demoAllowlist: z4.array(z4.string()).optional(),
+    previewOrigin: z4.string()
   }).strict().optional(),
-  previewGrantTargets: z6.array(z6.string()).optional(),
-  observe: z6.object({
-    url: z6.string(),
-    binding: z6.string(),
-    flowId: z6.string().optional(),
-    level: z6.enum(["off", "standard", "trace"]).optional(),
-    sample: z6.number().min(0).max(1).optional()
+  previewGrantTargets: z4.array(z4.string()).optional(),
+  observe: z4.object({
+    url: z4.string(),
+    binding: z4.string(),
+    flowId: z4.string().optional(),
+    level: z4.enum(["off", "standard", "trace"]).optional(),
+    sample: z4.number().min(0).max(1).optional()
   }).strict().optional(),
-  moin: z6.object({ app: z6.string(), base: z6.string() }).strict().optional().describe("Tag Mode loader target; absent, the production app"),
-  minify: z6.boolean().optional(),
-  minifyOptions: z6.object({
-    identifiers: z6.boolean().optional(),
-    syntax: z6.boolean().optional(),
-    whitespace: z6.boolean().optional(),
-    keepNames: z6.boolean().optional(),
-    legalComments: z6.enum(["none", "inline", "eof", "linked", "external"]).optional()
+  moin: z4.object({ app: z4.string(), base: z4.string() }).strict().optional().describe("Tag Mode loader target; absent, the production app"),
+  minify: z4.boolean().optional(),
+  minifyOptions: z4.object({
+    identifiers: z4.boolean().optional(),
+    syntax: z4.boolean().optional(),
+    whitespace: z4.boolean().optional(),
+    keepNames: z4.boolean().optional(),
+    legalComments: z4.enum(["none", "inline", "eof", "linked", "external"]).optional()
   }).strict().optional(),
-  target: z6.string().min(1).optional().describe("esbuild target")
+  target: z4.string().min(1).optional().describe("esbuild target")
 }).strict().describe("Options forwarded to wrapSkeleton");
-var BuildWrapArtifactSchema = z6.object({
-  target: z6.literal("wrap"),
-  platform: z6.enum(["browser", "node"]),
-  skeleton: z6.union([
-    z6.object({ url: HttpUrlSchema }).strict(),
-    z6.object({ artifact: OutputNameSchema }).strict()
+var BuildWrapArtifactSchema = z4.object({
+  target: z4.literal("wrap"),
+  platform: z4.enum(["browser", "node"]),
+  skeleton: z4.union([
+    z4.object({ url: HttpUrlSchema }).strict(),
+    z4.object({ artifact: OutputNameSchema }).strict()
   ]).describe(
     "The skeleton to wrap: a GET URL, or the outputName of an earlier bundle artifact in this manifest"
   ),
   options: BuildWrapOptionsSchema.optional(),
   ...OutputFields
 }).strict();
-var BuildArtifactSchema = z6.union([
+var BuildArtifactSchema = z4.union([
   BuildBundleArtifactSchema,
   BuildWrapArtifactSchema
 ]);
-var BuildManifestSchema = z6.object({
-  version: z6.literal(BUILD_MANIFEST_VERSION),
-  toolchain: z6.string().min(1).describe("Exact @walkeros/cli version; any other version refuses"),
-  flowConfig: z6.record(z6.string(), z6.unknown()).optional().describe("Flow.Json to bundle; required when any bundle artifact is"),
-  flowName: z6.string().min(1).optional(),
-  buildEnv: z6.record(z6.string(), z6.string()).optional().describe(
+var BuildManifestSchema = z4.object({
+  version: z4.literal(BUILD_MANIFEST_VERSION),
+  toolchain: z4.string().min(1).describe("Exact @walkeros/cli version; any other version refuses"),
+  flowConfig: z4.record(z4.string(), z4.unknown()).optional().describe("Flow.Json to bundle; required when any bundle artifact is"),
+  flowName: z4.string().min(1).optional(),
+  buildEnv: z4.record(z4.string(), z4.string()).optional().describe(
     "Base env for web $env, beneath config.bundle.env. Never the CLI process's own env"
   ),
-  artifacts: z6.array(BuildArtifactSchema).min(1),
+  artifacts: z4.array(BuildArtifactSchema).min(1),
   resultPutUrl: HttpUrlSchema.describe("Presigned PUT for the result JSON")
 }).loose().superRefine((manifest, ctx) => {
   const seen = /* @__PURE__ */ new Set();
@@ -8987,21 +8551,21 @@ var BUILD_ERROR_CODES = [
   "BUILD_FAILED",
   "UPLOAD_FAILED"
 ];
-var BuildResultSchema = z6.object({
-  ok: z6.boolean(),
-  toolchain: z6.string().describe("The CLI version that ran the build"),
-  artifacts: z6.array(
-    z6.object({
-      target: z6.string(),
-      outputName: z6.string(),
-      bytes: z6.number().int().nonnegative(),
-      sha256: z6.string()
+var BuildResultSchema = z4.object({
+  ok: z4.boolean(),
+  toolchain: z4.string().describe("The CLI version that ran the build"),
+  artifacts: z4.array(
+    z4.object({
+      target: z4.string(),
+      outputName: z4.string(),
+      bytes: z4.number().int().nonnegative(),
+      sha256: z4.string()
     })
   ).describe("Outputs PUT successfully, in manifest order"),
-  error: z6.object({
-    code: z6.enum(BUILD_ERROR_CODES),
-    message: z6.string(),
-    outputName: z6.string().optional().describe("The artifact being built when the error occurred")
+  error: z4.object({
+    code: z4.enum(BUILD_ERROR_CODES),
+    message: z4.string(),
+    outputName: z4.string().optional().describe("The artifact being built when the error occurred")
   }).optional()
 }).meta({ id: "BuildResult", title: "walkeros bundle --manifest result" });
 
@@ -9052,16 +8616,16 @@ async function fetchWithRetry(url, init, options) {
     if (failure instanceof Response && !isTransientStatus(failure.status)) {
       throw new Error(`${label} failed: ${reason}`);
     }
-    const delay4 = BACKOFF_MS[attempt - 1];
-    if (delay4 === void 0) {
+    const delay2 = BACKOFF_MS[attempt - 1];
+    if (delay2 === void 0) {
       throw new Error(
         `${label} failed after ${maxAttempts} attempts: ${reason}`
       );
     }
     warn?.(
-      `${label} attempt ${attempt}/${maxAttempts} failed: ${reason}, retrying in ${delay4 / 1e3}s`
+      `${label} attempt ${attempt}/${maxAttempts} failed: ${reason}, retrying in ${delay2 / 1e3}s`
     );
-    await sleep(delay4);
+    await sleep(delay2);
   }
 }
 
@@ -9549,22 +9113,13 @@ export {
   bundle,
   bundleCommand,
   classifyStepProperties,
-  clearAuthFields,
   clientContextHeaders,
   collectKnownSecrets,
-  completeDeviceLogin,
   containsCodeMarkers,
-  credentialSource,
-  deleteConfig,
   formatPushResult,
-  getAuthHeaders,
   getClientContext,
   loadConfig,
   loadJsonConfig,
-  login,
-  loginCommand,
-  logout,
-  logoutCommand,
   push,
   pushCommand,
   readConfig,
@@ -9573,7 +9128,6 @@ export {
   resolveAppUrl,
   resolveExportName,
   resolveManifestSource,
-  resolveToken,
   runBuildManifest,
   selectDevExamples,
   setClientContext,
@@ -9581,14 +9135,13 @@ export {
   simulateDestination,
   simulateSource,
   simulateTransformer,
-  startDeviceAuthorization,
   telemetry_exports as telemetry,
   telemetryDisableCommand,
   telemetryEnableCommand,
   telemetryStatusCommand,
   validate,
   validateCommand,
-  validateFlowStructure2 as validateFlowStructure,
+  validateFlowStructure3 as validateFlowStructure,
   whoami,
   whoamiCommand,
   wrapSkeleton,