@walkeros/cli 4.8.1 → 4.8.3-next-1793115089237

package/dist/examples/shared/README.md

@@ -20,3 +20,7 @@ walkeros bundle packages/cli/examples/flow-complete.json -f web -o packages/cli/
 walkeros bundle packages/cli/examples/flow-complete.json -f server -o dist/server.mjs
 runneros start dist/server.mjs -p 8080 --env-file .env
 ```
+
+- `runneros` refuses an `.env` that group or other can read
+  (`Refusing to load env file ".env": it is readable by group or other`);
+  restrict it with `chmod 600 .env`.

package/dist/index.d.ts

@@ -1,9 +1,49 @@
-import { Flow, PreviewKey, Elb, Simulation, Ingest, WalkerOS, ObserveWeb, MoinTarget } from '@walkeros/core';
+import { Flow, StepType, PreviewKey, Elb, Simulation, Ingest, WalkerOS, ObserveWeb, MoinTarget } from '@walkeros/core';
 export { Flow } from '@walkeros/core';
 import { BuildOptions as BuildOptions$1 } from 'esbuild';
 import { z, ValidateResult as ValidateResult$1, ValidationError as ValidationError$1, ValidationWarning as ValidationWarning$1, ValidationType } from '@walkeros/core/dev';
 export { ValidationType, validateFlowStructure } from '@walkeros/core/dev';
 
+/**
+ * Shared resolver for the export name to import from a flow component's
+ * package.
+ *
+ * Both `walkeros bundle` and `walkeros setup` need to know which named export
+ * (or default) to pull off a package referenced by a flow component. The
+ * precedence chain is:
+ *
+ * 1. `flow.<kind>.<id>.import` if set (named export selector at the step).
+ * 2. `flow.config.bundle.packages[<package>].imports[0]` if set.
+ * 3. Otherwise undefined; the caller falls back to the package's `default`
+ *    export.
+ *
+ * This lives in `cli/src/core/` so both `commands/bundle/*` and
+ * `commands/setup/*` import the same function. Duplicating the chain is how
+ * setup ended up out of sync with bundle (Bug F: `setup destination.pubsub`
+ * routed through BigQuery's setup because it ignored the `code` field and
+ * always grabbed `mod.default`).
+ */
+
+type ComponentKind = StepType;
+type ResolveSource = 'import' | 'imports' | 'default';
+interface ResolvedExportName {
+    /**
+     * The named export to pull off the imported module, or `undefined` to
+     * indicate the caller should use the package's `default` export.
+     */
+    exportName: string | undefined;
+    /** Which precedence step produced the result (useful for diagnostics). */
+    source: ResolveSource;
+}
+/**
+ * Resolve the export name to import for a flow component's package.
+ *
+ * See module docs for the precedence chain. Inline code (`code` is an object)
+ * doesn't enter this resolver at all — setup rejects inline code at a higher
+ * layer.
+ */
+declare function resolveExportName(flow: Flow, kind: ComponentKind, id: string): ResolvedExportName;
+
 /**
  * CLI Build Configuration
  *
@@ -230,9 +270,9 @@ declare function buildDataPayload(flowSettings: Flow): Record<string, unknown>;
  */
 /**
  * Preview activation wiring. When present and enabled, the generated entry
- * imports the activator from core and lets it decide whether a preview bundle
- * boots in place of this flow. The bundle carries only PUBLIC values: a keyring,
- * an issuer, and opaque bindings. Never a project id, never a secret.
+ * imports the activator from web-core and lets it decide whether a preview
+ * bundle boots in place of this flow. The bundle carries only PUBLIC values: a
+ * keyring, an issuer, and opaque bindings. Never a project id, never a secret.
  */
 interface WrapEntryPreview {
     enabled: boolean;
@@ -341,31 +381,8 @@ declare function bundle(configOrPath: unknown, options?: {
  */
 type Platform = 'web' | 'server';
 
-/**
- * Resolve a bearer for an API call, refreshing the stored session when needed.
- *
- * Priority: `WALKEROS_TOKEN`, then a legacy static token, then the OAuth
- * session. Returns null when nothing can be resolved, which callers render as
- * "run `walkeros auth login`".
- *
- * Throws when a refresh was needed but could not be carried out, which is a
- * different problem from having no session and must not be reported as one.
- */
-declare function resolveAccessToken(opts?: {
-    fetch?: typeof fetch;
-    now?: () => number;
-}): Promise<string | null>;
-/**
- * Authorization header for the resolved credential, or an empty object when
- * there is none. Async because resolving may have to refresh the session.
- */
-declare function getAuthHeaders(): Promise<Record<string, string>>;
-/**
- * Where a credential would come from, without resolving or refreshing it.
- * For commands that want to send someone to `walkeros auth login` before spending
- * a network round trip.
- */
-declare function credentialSource(): 'env' | 'config' | null;
+/** The one credential the CLI sends: WALKEROS_TOKEN, a token from Account > Automation tokens. */
+declare function resolveAccessToken(): string | null;
 
 /** A network call a web run (push or simulate) recorded instead of sending (fetch, sendBeacon, XHR) */
 interface NetworkCall {
@@ -700,7 +717,7 @@ type ValidateOptions = z.infer<typeof ValidateOptionsSchema>;
  * Every code an error, warning or skip of `validate` can carry. Agents and
  * tests branch on these, never on message text.
  */
-declare const VALIDATE_CODES: readonly ["INPUT_ERROR", "SERIALIZATION_ERROR", "OPTION_NOT_APPLICABLE", "FLOW_NOT_FOUND", "ENTRY_NOT_FOUND", "AMBIGUOUS_ENTRY", "UNSUPPORTED_SECTION", "INVALID_PATH", "SCHEMA_VALIDATION", "CONFIG_WARNING", "EMPTY_FLOWS", "UNKNOWN_KEY", "CONFLICT", "MISSING_PACKAGE", "OBSOLETE_CODE_STRING", "INVALID_IMPORT", "INVALID_CODE_SHAPE", "PACKAGE_VERSION_MISSING", "DEPRECATED_PACKAGE", "UNKNOWN_ROUTE_TARGET", "ROUTE_DEAD_CODE", "ROUTE_EMPTY_MANY", "ROUTE_SINGLE_MANY", "ROUTE_FIRST_MATCH", "INCOMPATIBLE_EXAMPLES", "EXAMPLES_INCOMPLETE", "CONTRACT_VIOLATION", "MAPPING_DOT_KEY", "FLOW_REF_WARNING", "FLOW_CYCLE", "VAR_CYCLE", "INVALID_COMPONENT_NAME", "INVALID_REFERENCE", "STORE_REFERENCE_NOT_FOUND", "STATE_STORE_UNKNOWN", "STATE_STORE_FILE", "TRANSFORMER_MAPPING_NO_OP", "UNRESOLVED_REFERENCE", "MISSING_ENV", "WEB_SECRET_REF", "UNRESOLVED_CONTRACT", "ENTRY_SCHEMA", "NO_CONTRACT_SECTION", "INVALID_CONTRACT", "FLAT_CONTRACT_SHAPE", "INVALID_CONTRACT_ENTRY", "UNKNOWN_CONTRACT_KEY", "INVALID_TAGGING", "INVALID_SCHEMA", "INVALID_EXTENDS", "INVALID_SECTION", "INVALID_EVENTS", "CIRCULAR_EXTENDS", "INVALID_ENTITY_KEY", "INVALID_ENTITY", "INVALID_ACTION_KEY", "INVALID_SCHEMA_ENTRY", "NOT_AN_OBJECT", "MISSING_EVENT_NAME", "EMPTY_EVENT_NAME", "INVALID_EVENT_NAME", "INVALID_MAPPING_TYPE", "INVALID_EVENT_PATTERN", "INVALID_RULE_TYPE", "CATCH_ALL_NOT_LAST", "GATED_BY_ERRORS", "CONTRACT_NOT_STATIC", "NO_PACKAGE", "NO_SETTINGS_SCHEMA", "SCHEMA_UNAVAILABLE"];
+declare const VALIDATE_CODES: readonly ["INPUT_ERROR", "SERIALIZATION_ERROR", "OPTION_NOT_APPLICABLE", "FLOW_NOT_FOUND", "ENTRY_NOT_FOUND", "AMBIGUOUS_ENTRY", "UNSUPPORTED_SECTION", "INVALID_PATH", "SCHEMA_VALIDATION", "CONFIG_WARNING", "EMPTY_FLOWS", "UNKNOWN_KEY", "CONFLICT", "MISSING_PACKAGE", "OBSOLETE_CODE_STRING", "INVALID_IMPORT", "INVALID_CODE_SHAPE", "PACKAGE_VERSION_MISSING", "DEPRECATED_PACKAGE", "UNKNOWN_ROUTE_TARGET", "ROUTE_DEAD_CODE", "ROUTE_EMPTY_MANY", "ROUTE_SINGLE_MANY", "ROUTE_FIRST_MATCH", "INCOMPATIBLE_EXAMPLES", "EXAMPLES_INCOMPLETE", "CONTRACT_VIOLATION", "MAPPING_DOT_KEY", "FLOW_REF_WARNING", "WEB_LOGGER_FORMAT", "FLOW_CYCLE", "VAR_CYCLE", "INVALID_COMPONENT_NAME", "INVALID_REFERENCE", "STORE_REFERENCE_NOT_FOUND", "STATE_STORE_UNKNOWN", "STATE_STORE_FILE", "MAPPING_NO_OP", "MAPPING_VALUE_NO_OPERATOR", "MAPPING_VALUE_PRODUCERS", "BATCH_WITHOUT_PUSH_BATCH", "MALFORMED_REFERENCE", "UNRESOLVED_REFERENCE", "MISSING_ENV", "WEB_SECRET_REF", "UNRESOLVED_CONTRACT", "ENTRY_SCHEMA", "NO_CONTRACT_SECTION", "INVALID_CONTRACT", "FLAT_CONTRACT_SHAPE", "INVALID_CONTRACT_ENTRY", "UNKNOWN_CONTRACT_KEY", "INVALID_TAGGING", "INVALID_SCHEMA", "INVALID_EXTENDS", "INVALID_EVENTS", "CIRCULAR_EXTENDS", "INVALID_ENTITY_KEY", "INVALID_ENTITY", "INVALID_ACTION_KEY", "INVALID_SCHEMA_ENTRY", "NOT_AN_OBJECT", "MISSING_EVENT_NAME", "EMPTY_EVENT_NAME", "INVALID_EVENT_NAME", "INVALID_MAPPING_TYPE", "INVALID_EVENT_PATTERN", "INVALID_RULE_TYPE", "CATCH_ALL_NOT_LAST", "GATED_BY_ERRORS", "CONTRACT_NOT_STATIC", "NO_PACKAGE", "NO_SETTINGS_SCHEMA", "SCHEMA_UNAVAILABLE"];
 type ValidateCode = (typeof VALIDATE_CODES)[number];
 /**
  * Named checks a run includes (`details.scope.checks`). `file:` checks run
@@ -802,95 +819,6 @@ interface GlobalOptions {
     silent?: boolean;
 }
 
-interface LoginCommandOptions extends GlobalOptions {
-    url?: string;
-    json?: boolean;
-}
-interface LoginResult {
-    success: boolean;
-    email?: string;
-    configPath?: string;
-    error?: string;
-}
-interface LoginOptions {
-    url?: string;
-    /** Override browser opener for testing */
-    openUrl?: (url: string) => Promise<void>;
-    /** Override fetch for testing */
-    fetch?: typeof globalThis.fetch;
-    /** Max poll attempts before giving up (for testing) */
-    maxPollAttempts?: number;
-    /** Poll interval, replacing the server's stated one (for testing) */
-    pollIntervalMs?: number;
-}
-/**
- * The outcome of finishing a device authorization.
- *
- * It carries no token material. `completeDeviceLogin` stores the session
- * itself, so the credential file keeps exactly one writer and a caller can
- * neither persist nor leak what came back.
- *
- * `pending` and `slow_down` both mean the window closed with the approval
- * still outstanding: the device code is untouched, so the same code can be
- * handed back in. `slow_down` is that same situation with the server asking
- * for a wider gap before the next attempt.
- */
-type DeviceLoginResult = {
-    status: 'ok';
-} | {
-    status: 'pending';
-} | {
-    status: 'slow_down';
-} | {
-    status: 'denied';
-} | {
-    status: 'expired';
-} | {
-    status: 'error';
-    error: string;
-};
-interface CompleteDeviceLoginOptions {
-    /** App to poll. Defaults to the resolved app URL. */
-    url?: string;
-    /** Stop polling after this long. */
-    timeoutMs?: number;
-    /** Wait between polls, before any `slow_down` widens it. */
-    intervalMs?: number;
-    /** Override fetch for testing */
-    fetch?: typeof globalThis.fetch;
-    /** Max poll attempts before giving up (for testing) */
-    maxPollAttempts?: number;
-}
-declare function loginCommand(options: LoginCommandOptions): Promise<void>;
-/**
- * Poll a device authorization to its end and store the session it yields.
- *
- * Split out from `login` so a caller holding only a device code can finish an
- * authorization that is already under way. `login` cannot serve that: it
- * starts a fresh authorization on every call, which would strand the code the
- * person is looking at.
- */
-declare function completeDeviceLogin(deviceCode: string, options?: CompleteDeviceLoginOptions): Promise<DeviceLoginResult>;
-declare function login(options?: LoginOptions): Promise<LoginResult>;
-
-interface LogoutCommandOptions extends GlobalOptions {
-    json?: boolean;
-}
-declare function logoutCommand(options: LogoutCommandOptions): Promise<void>;
-interface LogoutResult {
-    deleted: boolean;
-    /** A different session reached the config while the revocation was in flight. */
-    superseded: boolean;
-}
-/**
- * Revoke the stored refresh token, then drop the local config.
- *
- * Revocation first, because deleting the file alone would leave a credential
- * alive on the server that nothing can ever reach to retire. It is best
- * effort: a logout on a plane still has to clear the machine.
- */
-declare function logout(): Promise<LogoutResult>;
-
 /** Who the current credential belongs to, as the app answers it. */
 declare function whoami(): Promise<unknown>;
 interface WhoamiCommandOptions extends GlobalOptions {
@@ -1057,10 +985,10 @@ declare const BuildBundleArtifactSchema: z.ZodObject<{
     contentType: z.ZodOptional<z.ZodString>;
     headers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
     target: z.ZodEnum<{
-        runner: "runner";
         push: "push";
         cdn: "cdn";
         "cdn-skeleton": "cdn-skeleton";
+        runner: "runner";
         simulate: "simulate";
     }>;
 }, z.core.$strict>;
@@ -1180,10 +1108,10 @@ declare const BuildArtifactSchema: z.ZodUnion<readonly [z.ZodObject<{
     contentType: z.ZodOptional<z.ZodString>;
     headers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
     target: z.ZodEnum<{
-        runner: "runner";
         push: "push";
         cdn: "cdn";
         "cdn-skeleton": "cdn-skeleton";
+        runner: "runner";
         simulate: "simulate";
     }>;
 }, z.core.$strict>, z.ZodObject<{
@@ -1261,10 +1189,10 @@ declare const BuildManifestSchema: z.ZodObject<{
         contentType: z.ZodOptional<z.ZodString>;
         headers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
         target: z.ZodEnum<{
-            runner: "runner";
             push: "push";
             cdn: "cdn";
             "cdn-skeleton": "cdn-skeleton";
+            runner: "runner";
             simulate: "simulate";
         }>;
     }, z.core.$strict>, z.ZodObject<{
@@ -1420,20 +1348,6 @@ declare function runBuildManifest(source: string, retry?: BuildRetryOptions): Pr
 /** Resolve the `--manifest` value, falling back to the env for a bare flag. */
 declare function resolveManifestSource(manifest: string | true, env?: Record<string, string | undefined>): string;
 
-interface DeviceAuthorization {
-    deviceCode: string;
-    userCode: string;
-    verificationUri: string;
-    verificationUriComplete: string;
-    expiresIn: number;
-    interval: number;
-}
-/**
- * RFC 8628 section 3.1. Ask for a device code and the URL to send the person
- * to. Unauthenticated: the code is worth nothing until somebody approves it.
- */
-declare function startDeviceAuthorization(appUrl: string, fetchFn?: typeof fetch): Promise<DeviceAuthorization>;
-
 interface ApiErrorDetail {
     path: string;
     message: string;
@@ -1511,35 +1425,24 @@ declare function appErrorMessage(body: unknown): string | undefined;
 declare function appFetch(path: string, init?: AppFetchInit): Promise<Response>;
 
 /**
- * The app operations the CLI itself calls: the OAuth device flow, identity,
- * health, telemetry and the public API document. The app keeps every one in
- * its public API set, so its change rule protects them. The only file in the
- * CLI that names an app path; `walkeros api` takes its path from the person.
+ * The app operations the CLI itself calls: identity, health, telemetry and
+ * the public API document. The app keeps every one in its public API set, so
+ * its change rule protects them. The only file in the CLI that names an app
+ * path; `walkeros api` takes its path from the person.
  */
 declare const APP_PATHS: {
-    readonly deviceAuthorization: "/api/oauth/device_authorization";
-    readonly token: "/api/oauth/token";
-    readonly revoke: "/api/oauth/revoke";
     readonly whoami: "/api/auth/whoami";
     readonly health: "/api/health";
     readonly telemetry: "/api/telemetry";
     readonly openapi: "/api/openapi.json";
 };
 
+/**
+ * The CLI's own settings. It holds no credential: the CLI authenticates with
+ * WALKEROS_TOKEN only, and sign-in fields an older CLI left in the file are
+ * never read.
+ */
 interface WalkerOSConfig {
-    /**
-     * Static bearer written by the pre-OAuth CLI. Honored until it expires, and
-     * the first use in a process prints a one-line notice naming
-     * `walkeros auth login`, which replaces it with a refreshable session.
-     */
-    token?: string;
-    /** Short-lived bearer from the device authorization grant. */
-    accessToken?: string;
-    /** ISO 8601 instant at which `accessToken` stops being accepted. */
-    accessTokenExpiresAt?: string;
-    /** Single-use credential that buys a new `accessToken`. */
-    refreshToken?: string;
-    email?: string;
     appUrl?: string;
     anonymousFeedback?: boolean;
     defaultProjectId?: string;
@@ -1564,35 +1467,12 @@ declare function readConfig(): WalkerOSConfig | null;
  * Merge `config` into the stored config and write the result.
  *
  * Merging rather than replacing, because the file holds fields owned by
- * unrelated commands: a writer that knows only about tokens would otherwise
- * drop `defaultProjectId`, `installationId`, `telemetryEnabled` and
- * `anonymousFeedback` every time somebody logs in.
+ * unrelated commands: a writer that knows only about telemetry would otherwise
+ * drop `appUrl`, `defaultProjectId` and `anonymousFeedback`.
  *
- * A key passed explicitly as `undefined` is removed from the written file,
- * which is how login drops the legacy static token it replaces.
+ * A key passed explicitly as `undefined` is removed from the written file.
  */
 declare function writeConfig(config: WalkerOSConfig): void;
-/**
- * Remove every credential field, keeping the rest of the config.
- *
- * Used when the stored session is known to be dead, so the next command can
- * say "run `walkeros auth login`" instead of failing against the API.
- */
-declare function clearAuthFields(): void;
-/**
- * Delete the config file (logout)
- */
-declare function deleteConfig(): boolean;
-/**
- * Resolve the API token using priority order:
- * 1. WALKEROS_TOKEN env var
- * 2. Config file (~/.config/walkeros/config.json)
- * 3. null (not authenticated)
- */
-declare function resolveToken(): {
-    token: string;
-    source: 'env' | 'config';
-} | null;
 /**
  * Resolve the app URL.
  * WALKEROS_APP_URL env var > config file > default.
@@ -1670,46 +1550,6 @@ declare function loadJsonConfig<T>(configPath: string): Promise<T>;
  */
 declare function collectKnownSecrets(flow: Flow.Json, env?: NodeJS.ProcessEnv): string[];
 
-/**
- * Shared resolver for the export name to import from a flow component's
- * package.
- *
- * Both `walkeros bundle` and `walkeros setup` need to know which named export
- * (or default) to pull off a package referenced by a flow component. The
- * precedence chain is:
- *
- * 1. `flow.<kind>.<id>.import` if set (named export selector at the step).
- * 2. `flow.config.bundle.packages[<package>].imports[0]` if set.
- * 3. Otherwise undefined; the caller falls back to the package's `default`
- *    export.
- *
- * This lives in `cli/src/core/` so both `commands/bundle/*` and
- * `commands/setup/*` import the same function. Duplicating the chain is how
- * setup ended up out of sync with bundle (Bug F: `setup destination.pubsub`
- * routed through BigQuery's setup because it ignored the `code` field and
- * always grabbed `mod.default`).
- */
-
-type ComponentKind = 'source' | 'transformer' | 'destination' | 'store';
-type ResolveSource = 'import' | 'imports' | 'default';
-interface ResolvedExportName {
-    /**
-     * The named export to pull off the imported module, or `undefined` to
-     * indicate the caller should use the package's `default` export.
-     */
-    exportName: string | undefined;
-    /** Which precedence step produced the result (useful for diagnostics). */
-    source: ResolveSource;
-}
-/**
- * Resolve the export name to import for a flow component's package.
- *
- * See module docs for the precedence chain. Inline code (`code` is an object)
- * doesn't enter this resolver at all — setup rejects inline code at a higher
- * layer.
- */
-declare function resolveExportName(flow: Flow, kind: ComponentKind, id: string): ResolvedExportName;
-
 /**
  * Selects the dev examples of one export from a package's awaited `/dev`
  * module.
@@ -1887,4 +1727,4 @@ declare module '@walkeros/core' {
     }
 }
 
-export { APP_PATHS, ApiError, type ApiErrorDetail, type AppFetchInit, BUILD_ERROR_CODES, BUILD_MANIFEST_ENV, BUILD_MANIFEST_VERSION, type BuildArtifact, BuildArtifactSchema, BuildBundleArtifactSchema, type BuildErrorCode, type BuildManifest, BuildManifestSchema, type BuildOptions, type BuildResult, BuildResultSchema, BuildWrapArtifactSchema, type BuildWrapOptions, BuildWrapOptionsSchema, type BundleStats, type CLIBuildOptions, type ClientContext, type ClientType, type CompleteDeviceLoginOptions, type DeviceAuthorization, type DeviceLoginResult, type GlobalOptions, type LoginOptions, type LoginResult, type MinifyOptions, type PrepareInput, type PreparedFlow, type PushResult, type RunBuildManifestResult, type SimulateCollectorOptions, type SimulateDataOptions, type SimulateDestinationOptions, type SimulateSourceOptions, type SimulateTransformerOptions, VALIDATE_CODES, VERSION, type ValidateCheck, type ValidateCode, type ValidateDeferred, type ValidateResult, type ValidateScope, type ValidateSkip, type ValidationError, type ValidationWarning, type WalkerOSConfig, type WrapSkeletonOptions, appErrorMessage, appFetch, buildDataPayload, bundle, bundleCommand, classifyStepProperties, clearAuthFields, clientContextHeaders, collectKnownSecrets, completeDeviceLogin, containsCodeMarkers, credentialSource, deleteConfig, formatPushResult, getAuthHeaders, getClientContext, loadConfig, loadJsonConfig, login, loginCommand, logout, logoutCommand, push, pushCommand, readConfig, resetClientContext, resolveAccessToken, resolveAppUrl, resolveExportName, resolveManifestSource, resolveToken, runBuildManifest, selectDevExamples, setClientContext, simulateCollector, simulateDestination, simulateSource, simulateTransformer, startDeviceAuthorization, index as telemetry, telemetryDisableCommand, telemetryEnableCommand, telemetryStatusCommand, validate, validateCommand, whoami, whoamiCommand, wrapSkeleton, writeConfig };
+export { APP_PATHS, ApiError, type ApiErrorDetail, type AppFetchInit, BUILD_ERROR_CODES, BUILD_MANIFEST_ENV, BUILD_MANIFEST_VERSION, type BuildArtifact, BuildArtifactSchema, BuildBundleArtifactSchema, type BuildErrorCode, type BuildManifest, BuildManifestSchema, type BuildOptions, type BuildResult, BuildResultSchema, BuildWrapArtifactSchema, type BuildWrapOptions, BuildWrapOptionsSchema, type BundleStats, type CLIBuildOptions, type ClientContext, type ClientType, type GlobalOptions, type MinifyOptions, type PrepareInput, type PreparedFlow, type PushResult, type RunBuildManifestResult, type SimulateCollectorOptions, type SimulateDataOptions, type SimulateDestinationOptions, type SimulateSourceOptions, type SimulateTransformerOptions, VALIDATE_CODES, VERSION, type ValidateCheck, type ValidateCode, type ValidateDeferred, type ValidateResult, type ValidateScope, type ValidateSkip, type ValidationError, type ValidationWarning, type WalkerOSConfig, type WrapSkeletonOptions, appErrorMessage, appFetch, buildDataPayload, bundle, bundleCommand, classifyStepProperties, clientContextHeaders, collectKnownSecrets, containsCodeMarkers, formatPushResult, getClientContext, loadConfig, loadJsonConfig, push, pushCommand, readConfig, resetClientContext, resolveAccessToken, resolveAppUrl, resolveExportName, resolveManifestSource, runBuildManifest, selectDevExamples, setClientContext, simulateCollector, simulateDestination, simulateSource, simulateTransformer, index as telemetry, telemetryDisableCommand, telemetryEnableCommand, telemetryStatusCommand, validate, validateCommand, whoami, whoamiCommand, wrapSkeleton, writeConfig };