@walkeros/cli 4.8.1 → 4.8.3-next-1793115089237

package/dist/index.js

@@ -350,479 +350,10 @@ async function readStdinToTempFile(label) {
   return tmpPath;
 }
 
-// src/lib/config-file.ts
-import {
-  readFileSync,
-  writeFileSync,
-  mkdirSync,
-  unlinkSync,
-  existsSync,
-  chmodSync,
-  renameSync
-} from "fs";
-import { randomBytes } from "crypto";
-import { join } from "path";
-import { homedir } from "os";
-function getConfigDir() {
-  const xdgConfig = process.env.XDG_CONFIG_HOME;
-  const base = xdgConfig || join(homedir(), ".config");
-  return join(base, "walkeros");
-}
-function getConfigPath() {
-  return join(getConfigDir(), "config.json");
-}
-function readConfig() {
-  const configPath = getConfigPath();
-  try {
-    const content = readFileSync(configPath, "utf-8");
-    return JSON.parse(content);
-  } catch {
-    return null;
-  }
-}
-function replaceConfigFile(config) {
-  const dir = getConfigDir();
-  mkdirSync(dir, { recursive: true, mode: 448 });
-  const configPath = getConfigPath();
-  const tempPath = `${configPath}.${process.pid}.${randomBytes(6).toString("hex")}.tmp`;
-  try {
-    writeFileSync(tempPath, JSON.stringify(config, null, 2), { mode: 384 });
-    chmodSync(tempPath, 384);
-    renameSync(tempPath, configPath);
-  } catch (error) {
-    try {
-      unlinkSync(tempPath);
-    } catch {
-    }
-    throw error;
-  }
-}
-function writeConfig(config) {
-  replaceConfigFile({ ...readConfig() ?? {}, ...config });
-}
-function clearAuthFields() {
-  const config = readConfig();
-  if (!config) return;
-  const {
-    token: _token,
-    accessToken: _accessToken,
-    accessTokenExpiresAt: _accessTokenExpiresAt,
-    refreshToken: _refreshToken,
-    email: _email,
-    ...rest
-  } = config;
-  replaceConfigFile(rest);
-}
-function writeTelemetryOnlyConfig(partial) {
-  writeConfig(partial);
-}
-function deleteConfig() {
-  const configPath = getConfigPath();
-  if (existsSync(configPath)) {
-    unlinkSync(configPath);
-    return true;
-  }
-  return false;
-}
-function hasStoredCredential(config) {
-  return Boolean(config?.token || config?.accessToken);
-}
-function resolveToken() {
-  const envToken = process.env.WALKEROS_TOKEN;
-  if (envToken) return { token: envToken, source: "env" };
-  const config = readConfig();
-  if (config?.token) return { token: config.token, source: "config" };
-  return null;
-}
-function resolveAppUrl() {
-  const envUrl = process.env.WALKEROS_APP_URL;
-  if (envUrl) return envUrl;
-  const config = readConfig();
-  if (config?.appUrl) return config.appUrl;
-  return "https://app.walkeros.io";
-}
-
-// src/lib/config-lock.ts
-import { closeSync, mkdirSync as mkdirSync2, openSync, statSync, unlinkSync as unlinkSync2 } from "fs";
-var STALE_MS = 15e3;
-var RETRY_MS = 100;
-var TIMEOUT_MS = 1e4;
-function getConfigLockPath() {
-  return `${getConfigPath()}.lock`;
-}
-function hasCode(value) {
-  return typeof value === "object" && value !== null && "code" in value;
-}
-function isAlreadyLocked(error) {
-  return hasCode(error) && error.code === "EEXIST";
-}
-function delay(ms) {
-  return new Promise((resolve5) => setTimeout(resolve5, ms));
-}
-function breakIfStale(lockPath) {
-  try {
-    const age = Date.now() - statSync(lockPath).mtimeMs;
-    if (age < STALE_MS) return false;
-    unlinkSync2(lockPath);
-    return true;
-  } catch {
-    return false;
-  }
-}
-async function withConfigLock(fn) {
-  const lockPath = getConfigLockPath();
-  mkdirSync2(getConfigDir(), { recursive: true, mode: 448 });
-  const deadline = Date.now() + TIMEOUT_MS;
-  for (; ; ) {
-    let handle;
-    try {
-      handle = openSync(lockPath, "wx", 384);
-    } catch (error) {
-      if (!isAlreadyLocked(error)) throw error;
-      if (breakIfStale(lockPath)) continue;
-      if (Date.now() >= deadline) {
-        throw new Error(
-          `Timed out waiting for the walkerOS config lock at ${lockPath}. Remove the file if no other walkeros process is running.`
-        );
-      }
-      await delay(RETRY_MS);
-      continue;
-    }
-    closeSync(handle);
-    try {
-      return await fn();
-    } finally {
-      try {
-        unlinkSync2(lockPath);
-      } catch {
-      }
-    }
-  }
-}
-
-// src/core/oauth-client.ts
-import { z as z2 } from "zod";
-
-// src/lib/secure-url.ts
-function isLoopback(hostname) {
-  return hostname === "localhost" || hostname === "127.0.0.1" || hostname === "[::1]";
-}
-function requireSecureUrl(url) {
-  let parsed;
-  try {
-    parsed = new URL(url);
-  } catch {
-    return url;
-  }
-  if (parsed.protocol !== "http:" || isLoopback(parsed.hostname)) return url;
-  throw new Error(
-    `Refusing to send walkerOS credentials over plain http to ${url}. Use https, or localhost / 127.0.0.1 / [::1] for local development.`
-  );
-}
-
-// src/core/app-fetch.ts
-import { z } from "zod";
-
-// src/core/client-context.ts
-var context;
-function setClientContext(input) {
-  const envType = process.env.WALKEROS_CLIENT_TYPE;
-  const type = envType ?? input.type ?? "cli";
-  context = { type, version: input.version };
-}
-function getClientContext() {
-  return context;
-}
-function resetClientContext() {
-  context = void 0;
-}
-function clientContextHeaders() {
-  if (!context) return {};
-  return {
-    "User-Agent": `walkeros-${context.type}/${context.version}`,
-    "X-WalkerOS-Client": context.type,
-    "X-WalkerOS-Client-Version": context.version
-  };
-}
-
-// src/core/app-fetch.ts
-var AppErrorSchema = z.object({
-  error: z.object({ message: z.string().min(1) })
-});
-function appErrorMessage(body) {
-  const parsed = AppErrorSchema.safeParse(body);
-  return parsed.success ? parsed.data.error.message : void 0;
-}
-async function appFetch(path23, init = {}) {
-  const url = `${(init.baseUrl ?? resolveAppUrl()).replace(/\/+$/, "")}${path23}`;
-  const headers = new Headers(clientContextHeaders());
-  for (const [name, value] of Object.entries(init.headers ?? {}))
-    headers.set(name, value);
-  if (init.token && !headers.has("Authorization"))
-    headers.set("Authorization", `Bearer ${init.token}`);
-  if (headers.has("Authorization")) requireSecureUrl(url);
-  const request = { headers };
-  if (init.method && init.method !== "GET") request.method = init.method;
-  if (init.body !== void 0) request.body = init.body;
-  if (init.signal) request.signal = init.signal;
-  if (init.redirect) request.redirect = init.redirect;
-  return (init.fetch ?? fetch)(url, request);
-}
-
-// src/core/app-paths.ts
-var APP_PATHS = {
-  deviceAuthorization: "/api/oauth/device_authorization",
-  token: "/api/oauth/token",
-  revoke: "/api/oauth/revoke",
-  whoami: "/api/auth/whoami",
-  health: "/api/health",
-  telemetry: "/api/telemetry",
-  openapi: "/api/openapi.json"
-};
-
-// src/core/oauth-client.ts
-var CLI_CLIENT_ID = "walkeros-cli";
-var CLI_SCOPE = "read write offline_access";
-var DEVICE_CODE_GRANT = "urn:ietf:params:oauth:grant-type:device_code";
-var REFRESH_TIMEOUT_MS = 1e4;
-var REVOKE_TIMEOUT_MS = 5e3;
-var DEVICE_AUTHORIZATION_TIMEOUT_MS = 1e4;
-var DeviceAuthorizationSchema = z2.object({
-  device_code: z2.string().min(1),
-  user_code: z2.string().min(1),
-  verification_uri: z2.string().min(1),
-  verification_uri_complete: z2.string().min(1).optional(),
-  expires_in: z2.number().int().nonnegative(),
-  interval: z2.number().int().nonnegative()
-});
-var TokenSchema = z2.object({
-  access_token: z2.string().min(1),
-  expires_in: z2.number().int().nonnegative(),
-  refresh_token: z2.string().min(1).optional()
-});
-var ErrorSchema = z2.object({
-  error: z2.string().min(1),
-  error_description: z2.string().optional()
-});
-async function readJson(response) {
-  try {
-    return await response.json();
-  } catch {
-    return null;
-  }
-}
-function errorCode(body) {
-  const parsed = ErrorSchema.safeParse(body);
-  return parsed.success ? parsed.data.error : null;
-}
-function describe(response, body) {
-  const parsed = ErrorSchema.safeParse(body);
-  if (parsed.success) {
-    return parsed.data.error_description ? `${parsed.data.error}: ${parsed.data.error_description}` : parsed.data.error;
-  }
-  return appErrorMessage(body) ?? `HTTP ${response.status}`;
-}
-function postForm(appUrl, path23, form, fetchFn, signal) {
-  return appFetch(path23, {
-    method: "POST",
-    baseUrl: requireSecureUrl(appUrl),
-    headers: {
-      Accept: "application/json",
-      "Content-Type": "application/x-www-form-urlencoded"
-    },
-    body: new URLSearchParams(form).toString(),
-    redirect: "error",
-    fetch: fetchFn,
-    signal
-  });
-}
-function toTokenSet(body) {
-  const parsed = TokenSchema.safeParse(body);
-  if (!parsed.success) throw new Error("Malformed token response");
-  return {
-    accessToken: parsed.data.access_token,
-    accessTokenExpiresAt: new Date(
-      Date.now() + parsed.data.expires_in * 1e3
-    ).toISOString(),
-    refreshToken: parsed.data.refresh_token ?? null
-  };
-}
-async function startDeviceAuthorization(appUrl, fetchFn = globalThis.fetch) {
-  const response = await postForm(
-    appUrl,
-    APP_PATHS.deviceAuthorization,
-    {
-      client_id: CLI_CLIENT_ID,
-      scope: CLI_SCOPE,
-      // RFC 8707. The token comes back bound to the API, so a leaked CLI token
-      // cannot be replayed against the MCP resource.
-      resource: `${appUrl}/api`
-    },
-    fetchFn,
-    AbortSignal.timeout(DEVICE_AUTHORIZATION_TIMEOUT_MS)
-  );
-  const body = await readJson(response);
-  if (!response.ok) throw new Error(describe(response, body));
-  const parsed = DeviceAuthorizationSchema.safeParse(body);
-  if (!parsed.success)
-    throw new Error("Malformed device authorization response");
-  return {
-    deviceCode: parsed.data.device_code,
-    userCode: parsed.data.user_code,
-    verificationUri: parsed.data.verification_uri,
-    verificationUriComplete: parsed.data.verification_uri_complete ?? parsed.data.verification_uri,
-    expiresIn: parsed.data.expires_in,
-    interval: parsed.data.interval
-  };
-}
-async function pollDeviceToken(appUrl, deviceCode, fetchFn = globalThis.fetch, signal) {
-  let response;
-  try {
-    response = await postForm(
-      appUrl,
-      APP_PATHS.token,
-      {
-        grant_type: DEVICE_CODE_GRANT,
-        device_code: deviceCode,
-        client_id: CLI_CLIENT_ID
-      },
-      fetchFn,
-      signal
-    );
-  } catch (error) {
-    if (signal?.aborted) return { status: "pending" };
-    throw error;
-  }
-  const body = await readJson(response);
-  if (response.ok) {
-    try {
-      return { status: "ok", tokens: toTokenSet(body) };
-    } catch (error) {
-      return {
-        status: "error",
-        error: error instanceof Error ? error.message : String(error)
-      };
-    }
-  }
-  switch (errorCode(body)) {
-    case "authorization_pending":
-      return { status: "pending" };
-    case "slow_down":
-      return { status: "slow_down" };
-    case "access_denied":
-      return { status: "denied" };
-    case "expired_token":
-      return { status: "expired" };
-    default:
-      return { status: "error", error: describe(response, body) };
-  }
-}
-async function refreshTokens(appUrl, refreshToken, fetchFn = globalThis.fetch) {
-  const response = await postForm(
-    appUrl,
-    APP_PATHS.token,
-    {
-      grant_type: "refresh_token",
-      refresh_token: refreshToken,
-      client_id: CLI_CLIENT_ID
-    },
-    fetchFn,
-    AbortSignal.timeout(REFRESH_TIMEOUT_MS)
-  );
-  const body = await readJson(response);
-  if (!response.ok) {
-    if (errorCode(body) === "invalid_grant") return null;
-    throw new Error(describe(response, body));
-  }
-  return toTokenSet(body);
-}
-async function revokeRefreshToken(appUrl, refreshToken, fetchFn = globalThis.fetch) {
-  try {
-    await postForm(
-      appUrl,
-      APP_PATHS.revoke,
-      {
-        token: refreshToken,
-        token_type_hint: "refresh_token",
-        client_id: CLI_CLIENT_ID
-      },
-      fetchFn,
-      AbortSignal.timeout(REVOKE_TIMEOUT_MS)
-    );
-  } catch {
-  }
-}
-
 // src/core/auth.ts
-var REFRESH_SKEW_MS = 6e4;
-var legacyNoticeShown = false;
-function noticeLegacyToken() {
-  if (legacyNoticeShown) return;
-  legacyNoticeShown = true;
-  process.stderr.write(
-    "walkerOS: using a static token from your config. Run `walkeros auth login` to switch to a session that refreshes automatically.\n"
-  );
-}
-function isFresh(config, nowMs) {
-  if (!config.accessToken || !config.accessTokenExpiresAt) return false;
-  const expiresAt = Date.parse(config.accessTokenExpiresAt);
-  if (Number.isNaN(expiresAt)) return false;
-  return expiresAt - nowMs > REFRESH_SKEW_MS;
-}
-async function resolveAccessToken(opts) {
-  const envToken = process.env.WALKEROS_TOKEN;
-  if (envToken) return envToken;
-  const now = opts?.now ?? Date.now;
-  const config = readConfig();
-  if (!config) return null;
-  if (config.token) {
-    noticeLegacyToken();
-    return config.token;
-  }
-  if (!config.refreshToken) {
-    return isFresh(config, now()) ? config.accessToken ?? null : null;
-  }
-  if (isFresh(config, now())) return config.accessToken ?? null;
-  return withConfigLock(async () => {
-    const current = readConfig();
-    if (!current?.refreshToken) return current?.accessToken ?? null;
-    if (isFresh(current, now())) return current.accessToken ?? null;
-    let rotated;
-    try {
-      rotated = await refreshTokens(
-        resolveAppUrl(),
-        current.refreshToken,
-        opts?.fetch
-      );
-    } catch (error) {
-      const reason = error instanceof Error ? error.message : String(error);
-      throw new Error(
-        `Could not reach ${resolveAppUrl()} to refresh your session: ${reason}. Your saved session was kept, so try again once the connection is back.`
-      );
-    }
-    if (rotated === null) {
-      clearAuthFields();
-      return null;
-    }
-    writeConfig({
-      accessToken: rotated.accessToken,
-      accessTokenExpiresAt: rotated.accessTokenExpiresAt,
-      // A server that rotates no new refresh token leaves the current one in
-      // force; overwriting it with null would end the session on the next call.
-      refreshToken: rotated.refreshToken ?? current.refreshToken
-    });
-    return rotated.accessToken;
-  });
-}
-async function getAuthHeaders() {
-  const token = await resolveAccessToken();
-  if (!token) return {};
-  return { Authorization: `Bearer ${token}` };
-}
-function credentialSource() {
-  if (process.env.WALKEROS_TOKEN) return "env";
-  if (hasStoredCredential(readConfig())) return "config";
-  return null;
+function resolveAccessToken() {
+  const token = process.env.WALKEROS_TOKEN;
+  return token ? token : null;
 }
 
 // src/core/event-validation.ts
@@ -1017,6 +548,7 @@ function getDefaultOutput(platform) {
 import path8 from "path";
 import fs8 from "fs-extra";
 import { getFlowSettings, getPlatform } from "@walkeros/core";
+import { validateFlowStructure } from "@walkeros/core/dev";
 
 // src/core/content-digest.ts
 import { createHash } from "crypto";
@@ -1095,11 +627,22 @@ function assertWindowCollector(value, source = {}) {
 
 // src/config/loader.ts
 var DEFAULT_INCLUDE_FOLDER = "./shared";
+function assertFlowStructure(config, flowName) {
+  const { errors } = validateFlowStructure({
+    ...config,
+    flows: { [flowName]: config.flows[flowName] }
+  });
+  if (errors.length === 0) return;
+  const lines = errors.map((error) => `  - ${error.path}: ${error.message}`);
+  throw new Error(`Invalid configuration:
+${lines.join("\n")}`);
+}
 function loadBundleConfig(rawConfig, options) {
   const sanitized = stripLegacyBundleExternal(rawConfig, options.logger);
   const config = validateFlowConfig(sanitized);
   const availableFlows = getAvailableFlows(config);
   const flowName = resolveFlow(config, options.flowName, availableFlows);
+  assertFlowStructure(config, flowName);
   assertLiteralBuildEnv(config, flowName);
   let flowSettings = getFlowSettings(config, flowName, { deferred: true });
   const platform = getPlatform(flowSettings);
@@ -1255,10 +798,12 @@ import path14 from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
 import fs14 from "fs-extra";
 import {
+  getPlatform as getPlatform2,
   packageNameToVariable as packageNameToVariable2,
   getStepRuntimeProps,
   ENV_MARKER_PREFIX,
   SECRET_MARKER_PREFIX as SECRET_MARKER_PREFIX2,
+  STEP_FUNCTION_KEYS,
   isPathStepEntry,
   isObject as isObject3
 } from "@walkeros/core";
@@ -1317,6 +862,9 @@ function getFlowSection(flow, section) {
       return flow.stores;
   }
 }
+function isLocalPath(spec) {
+  return spec.startsWith(".") || spec.startsWith("/");
+}
 function parsePackageSpec(spec) {
   const at = spec.lastIndexOf("@");
   if (at <= 0) return { name: spec };
@@ -1372,8 +920,7 @@ function applyStepPackages(flowSettings, packages, logger) {
     }
   };
   for (const pkg of stepPackages) {
-    const isLocalPath = pkg.startsWith(".") || pkg.startsWith("/");
-    if (isLocalPath) {
+    if (isLocalPath(pkg)) {
       const varName = packageNameToVariable(pkg);
       if (!packages[varName]) {
         packages[varName] = {
@@ -1418,6 +965,40 @@ function applyStepPackages(flowSettings, packages, logger) {
     }
   }
 }
+var KIND_TO_SECTION = {
+  source: "sources",
+  transformer: "transformers",
+  destination: "destinations",
+  store: "stores"
+};
+function resolveStepPackage(flow, kind, id, logger) {
+  const normalizedFlow = structuredClone(flow);
+  const packages = structuredClone(
+    normalizedFlow.config?.bundle?.packages ?? {}
+  );
+  applyStepPackages(normalizedFlow, packages, logger);
+  const bucket = getFlowSection(normalizedFlow, KIND_TO_SECTION[kind]);
+  const step = bucket?.[id];
+  if (!step) {
+    const available = Object.keys(bucket ?? {}).join(", ") || "(none)";
+    throw new Error(
+      `${kind} "${id}" not found in flow. Available: ${available}`
+    );
+  }
+  if (typeof step.package !== "string") {
+    throw new Error(
+      `${kind}.${id} has no "package" (inline code cannot be set up).`
+    );
+  }
+  const declared = getFlowSection(flow, KIND_TO_SECTION[kind])?.[id]?.package;
+  return {
+    packageName: step.package,
+    label: declared !== void 0 && isLocalPath(declared) ? declared : step.package,
+    spec: packages[step.package] ?? {},
+    overrides: normalizedFlow.config?.bundle?.overrides ?? {},
+    normalizedFlow
+  };
+}
 
 // src/core/package-manager.ts
 import pacote from "pacote";
@@ -1473,7 +1054,7 @@ function tempSibling(dest) {
   ).join("");
   return `${dest}${TMP_INFIX}${rand}`;
 }
-function errorCode2(error) {
+function errorCode(error) {
   if (typeof error === "object" && error !== null && "code" in error) {
     const code = error.code;
     return typeof code === "string" ? code : void 0;
@@ -1481,7 +1062,7 @@ function errorCode2(error) {
   return void 0;
 }
 function isOccupied(error) {
-  const code = errorCode2(error);
+  const code = errorCode(error);
   return code === "EEXIST" || code === "ENOTEMPTY";
 }
 function isCacheTempName(name) {
@@ -1520,7 +1101,7 @@ async function replaceIncomplete(tmp, dest) {
     await fs9.rename(dest, aside);
     moved = true;
   } catch (error) {
-    if (errorCode2(error) !== "ENOENT") throw error;
+    if (errorCode(error) !== "ENOENT") throw error;
   }
   const restore = moved && await isCacheDirComplete(aside);
   const winner = restore ? aside : tmp;
@@ -1698,7 +1279,7 @@ function backoffForAttempt(index) {
   const spread = base * JITTER;
   return base + (Math.random() * 2 - 1) * spread;
 }
-function delay2(ms) {
+function delay(ms) {
   return new Promise((resolve5) => {
     setTimeout(resolve5, ms);
   });
@@ -1740,7 +1321,7 @@ async function withPacoteRetry(fn, label, options = {}) {
       maxTotalMs - (Date.now() - start)
     );
     if (sleepMs <= 0) break;
-    await delay2(sleepMs);
+    await delay(sleepMs);
   }
   throw new Error(
     `Failed ${label} after ${made} attempts: ${describeError(lastError)}`
@@ -2567,21 +2148,21 @@ async function ensureCodeOnDisk(codeContent, compiledCode, tmpDir, inputs) {
 }
 
 // src/version.ts
-import { readFileSync as readFileSync2 } from "fs";
+import { readFileSync } from "fs";
 import { fileURLToPath } from "url";
-import { dirname as dirname3, join as join4 } from "path";
+import { dirname as dirname3, join as join3 } from "path";
 var versionFilename = fileURLToPath(import.meta.url);
 var versionDirname = dirname3(versionFilename);
 function findPackageJson() {
   const paths = [
-    join4(versionDirname, "../package.json"),
+    join3(versionDirname, "../package.json"),
     // dist/ or src/
-    join4(versionDirname, "../../package.json")
+    join3(versionDirname, "../../package.json")
     // src/core/ (not used, but safe)
   ];
   for (const p of paths) {
     try {
-      return readFileSync2(p, "utf-8");
+      return readFileSync(p, "utf-8");
     } catch {
     }
   }
@@ -2597,9 +2178,11 @@ function hasCodeReference(code) {
   return isInlineCode(code) || typeof code === "string";
 }
 function generateInlineCode(inline, runtimeProps, isDestination) {
-  const pushFn = inline.push.replace("$code:", "");
-  const initFn = inline.init ? inline.init.replace("$code:", "") : void 0;
   const typeLine = inline.type ? `type: '${inline.type}',` : "";
+  const functionLines = STEP_FUNCTION_KEYS.flatMap((key) => {
+    const fn = inline[key];
+    return fn ? [`${key}: ${fn.replace("$code:", "")}`] : [];
+  }).join(",\n        ");
   const props = {
     config: {},
     env: {},
@@ -2611,8 +2194,7 @@ function generateInlineCode(inline, runtimeProps, isDestination) {
       code: {
         ${typeLine}
         config: ${processConfigValue(props.config)},
-        ${initFn ? `init: ${initFn},` : ""}
-        push: ${pushFn}
+        ${functionLines}
       },
       ${propLines}
     }`;
@@ -2621,8 +2203,7 @@ function generateInlineCode(inline, runtimeProps, isDestination) {
       code: async (context) => ({
         ${typeLine}
         config: context.config,
-        ${initFn ? `init: ${initFn},` : ""}
-        push: ${pushFn}
+        ${functionLines}
       }),
       ${propLines}
     }`;
@@ -2768,6 +2349,7 @@ async function bundleCore(flowSettings, buildOptions, logger, showStats = false,
       packagePaths
     );
     const versionsHash = await getHashServer3(sortedVersions.join("\n"), 12);
+    applyCollectorDefaults(flowSettings);
     if (provenance) {
       applyCollectorProvenance(
         flowSettings,
@@ -2939,7 +2521,7 @@ ${dataDeclaration}${needs}`;
       };
       if (buildOptions.platform === "browser") {
         stage2Options.format = "iife";
-        stage2Options.plugins = [cliCorePlugin()];
+        stage2Options.plugins = [cliPackagesPlugin()];
         stage2Options.define = {
           "process.env.NODE_ENV": '"production"',
           global: "globalThis",
@@ -3107,22 +2689,25 @@ function getNodeExternals() {
   }
   return externals;
 }
-var CLI_CORE = "walkeros-cli-core";
-function cliCorePlugin() {
+var CLI_PACKAGES = "walkeros-cli-packages";
+function cliPackagesPlugin() {
   const resolveDir = path14.dirname(fileURLToPath2(import.meta.url));
   return {
-    name: CLI_CORE,
+    name: CLI_PACKAGES,
     setup(build2) {
-      build2.onResolve({ filter: /^@walkeros\/core$/ }, async (args) => {
-        if (args.pluginData === CLI_CORE) return void 0;
-        const resolved = await build2.resolve(args.path, {
-          kind: args.kind,
-          resolveDir,
-          pluginData: CLI_CORE
-        });
-        if (resolved.errors.length > 0) return { errors: resolved.errors };
-        return { path: resolved.path, sideEffects: resolved.sideEffects };
-      });
+      build2.onResolve(
+        { filter: /^@walkeros\/(core|web-core)$/ },
+        async (args) => {
+          if (args.pluginData === CLI_PACKAGES) return void 0;
+          const resolved = await build2.resolve(args.path, {
+            kind: args.kind,
+            resolveDir,
+            pluginData: CLI_PACKAGES
+          });
+          if (resolved.errors.length > 0) return { errors: resolved.errors };
+          return { path: resolved.path, sideEffects: resolved.sideEffects };
+        }
+      );
     }
   };
 }
@@ -3439,6 +3024,12 @@ ${firstError.text}`
 function buildDataPayload(flowSettings) {
   return buildSplitConfigObject(flowSettings, detectNamedImports(flowSettings)).dataPayloadObj;
 }
+function applyCollectorDefaults(flowSettings) {
+  if (getPlatform2(flowSettings) !== "server") return;
+  const collector = flowSettings.collector ?? {};
+  collector.consentDenied ??= "skip";
+  flowSettings.collector = collector;
+}
 function applyCollectorProvenance(flowSettings, flowName, release2, fallback) {
   const collector = flowSettings.collector ?? {};
   collector.name ??= flowName;
@@ -3557,6 +3148,34 @@ export function wireConfig(__data) {
 
 export { startFlow };`;
 }
+var HOST_LOGGER_MERGE = `  // The host's logger (masking, its error ring) joins the flow's own: the
+  // flow's level and format win, unless the host forces a level (--verbose);
+  // the flow's handler runs first, then the host's, once per line, always.
+  // The flow handler's originalHandler does nothing, so no line prints a
+  // second time unmasked. The host learns the flow's settings before the
+  // collector starts, so every line, the first included, has its format.
+  if (context.logger) {
+    const own = config.logger || {};
+    const host = context.logger;
+    if (context.onLogger) context.onLogger({ level: own.level, format: own.format });
+    const level = context.logLevel ?? own.level ?? host.level;
+    const printedByHost = () => {};
+    const handler = own.handler && host.handler
+      ? (lvl, message, ctx, scope) => {
+          try {
+            own.handler(lvl, message, ctx, scope, printedByHost);
+          } finally {
+            host.handler(lvl, message, ctx, scope, printedByHost);
+          }
+        }
+      : host.handler || own.handler;
+    config.logger = {
+      ...host,
+      ...(level !== undefined ? { level } : {}),
+      ...(own.format ? { format: own.format } : {}),
+      ...(handler ? { handler } : {}),
+    };
+  }`;
 function generateServerEntry(stage1Path, dataPayload) {
   const stage1Specifier = toFileImportSpecifier(stage1Path);
   return `import { startFlow, wireConfig } from '${stage1Specifier}';
@@ -3566,7 +3185,7 @@ const __configData = ${dataPayload};
 export default async function(context = {}) {
   const config = wireConfig(__configData);
 
-  if (context.logger) config.logger = context.logger;
+${HOST_LOGGER_MERGE}
 
   if (context.sourceSettings && config.sources) {
     for (const src of Object.values(config.sources)) {
@@ -3626,6 +3245,7 @@ function readObserveConnect(flowSettings, logger) {
   );
   return void 0;
 }
+var OBSERVE_SLOT_IMPORT = "import { pageObserveSlot } from '@walkeros/web-core';\n";
 function emitObserveAssignment(observe) {
   const literal = {
     url: observe.url,
@@ -3635,9 +3255,9 @@ function emitObserveAssignment(observe) {
     ...observe.sample !== void 0 ? { sample: observe.sample } : {}
   };
   return `
-  config.observe = ${JSON.stringify(literal)};`;
+  config.observe = { ...${JSON.stringify(literal)}, slot: pageObserveSlot() };`;
 }
-var MOIN_IMPORT = "import { moin } from '@walkeros/core';\n";
+var MOIN_IMPORT = "import { moin } from '@walkeros/web-core';\n";
 function emitMoinCall(target) {
   if (!target)
     return `
@@ -3685,10 +3305,11 @@ function generateWebEntry(stage1Path, dataPayload, options = {}) {
     }
   }` : "";
   const stage1Specifier = toFileImportSpecifier(stage1Path);
+  const observeImport = options.observe ? OBSERVE_SLOT_IMPORT : "";
   const observeBlock = options.observe ? emitObserveAssignment(options.observe) : "";
   const loaderImport = platform === "browser" ? MOIN_IMPORT : "";
   const loaderCall = platform === "browser" ? emitMoinCall() : "";
-  return `${loaderImport}import { startFlow, wireConfig } from '${stage1Specifier}';
+  return `${loaderImport}${observeImport}import { startFlow, wireConfig } from '${stage1Specifier}';
 
 const __configData = ${dataPayload};
 
@@ -3712,7 +3333,7 @@ function generateWrapEntry(stage1Path, options = {}) {
   }
   const preview = options.preview;
   const previewEnabled = !!preview?.enabled;
-  const previewImport = previewEnabled ? `import { browserSwapActivator } from '@walkeros/core';
+  const previewImport = previewEnabled ? `import { browserSwapActivator } from '@walkeros/web-core';
 ` : "";
   const grantTargets = options.previewGrantTargets ?? [];
   const previewGrantBlock = grantTargets.length > 0 ? `
@@ -3762,10 +3383,11 @@ ${grantTargets.map((key) => {
     }
   }` : "";
   const stage1Specifier = toFileImportSpecifier(stage1Path);
+  const observeImport = options.observe ? OBSERVE_SLOT_IMPORT : "";
   const observeBlock = options.observe ? emitObserveAssignment(options.observe) : "";
   const loaderImport = platform === "browser" ? MOIN_IMPORT : "";
   const loaderCall = platform === "browser" ? emitMoinCall(options.moin) : "";
-  return `${loaderImport}${previewImport}import { startFlow, wireConfig, __configData } from '${stage1Specifier}';
+  return `${loaderImport}${previewImport}${observeImport}import { startFlow, wireConfig, __configData } from '${stage1Specifier}';
 
 (async () => {${loaderCall}${previewBlock}
   const config = wireConfig(__configData);${envBlock}${previewGrantBlock}${observeBlock}
@@ -3782,7 +3404,7 @@ function generateWrapEntryServer(stage1Path) {
 export default async function(context = {}) {
   const config = wireConfig(__configData);
 
-  if (context.logger) config.logger = context.logger;
+${HOST_LOGGER_MERGE}
 
   if (context.sourceSettings && config.sources) {
     for (const src of Object.values(config.sources)) {
@@ -4268,7 +3890,7 @@ async function bundle(configOrPath, options = {}) {
 // src/commands/push/index.ts
 import path18 from "path";
 import fs18 from "fs-extra";
-import { createIngest, getPlatform as getPlatform3, stepId } from "@walkeros/core";
+import { createIngest, getPlatform as getPlatform4, stepId } from "@walkeros/core";
 import {
   enrichEvent,
   transformerInit,
@@ -4497,13 +4119,13 @@ function installTimerInterception(options = {}) {
       setInterval: Reflect.get(target, "setInterval"),
       clearInterval: Reflect.get(target, "clearInterval")
     });
-    const trackedSetTimeout = (callback, delay4, ...args) => {
+    const trackedSetTimeout = (callback, delay2, ...args) => {
       if (typeof callback !== "function") return 0;
       const id = nextId++;
       pending.set(id, {
         id,
         callback,
-        delay: delay4 ?? 0,
+        delay: delay2 ?? 0,
         type: "timeout",
         args,
         cleared: false
@@ -4516,13 +4138,13 @@ function installTimerInterception(options = {}) {
       const entry = pending.get(numId);
       if (entry) entry.cleared = true;
     };
-    const trackedSetInterval = (callback, delay4, ...args) => {
+    const trackedSetInterval = (callback, delay2, ...args) => {
       if (typeof callback !== "function") return 0;
       const id = nextId++;
       pending.set(id, {
         id,
         callback,
-        delay: delay4 ?? 0,
+        delay: delay2 ?? 0,
         type: "interval",
         args,
         cleared: false
@@ -4962,7 +4584,7 @@ function buildSimulationResult(args) {
 // src/commands/push/prepare.ts
 import path17 from "path";
 import fs17 from "fs-extra";
-import { getPlatform as getPlatform2 } from "@walkeros/core";
+import { getPlatform as getPlatform3 } from "@walkeros/core";
 
 // src/core/known-secrets.ts
 import { REF_SECRET } from "@walkeros/core";
@@ -5004,7 +4626,7 @@ async function prepareFlow(input) {
     configPath: process.cwd(),
     flowName: input.flow
   });
-  const platform = getPlatform2(flowSettings);
+  const platform = getPlatform3(flowSettings);
   const overrides = buildOverrides(
     { simulate: input.simulate, mock: input.mock },
     flowSettings
@@ -5580,7 +5202,7 @@ async function executeConfigPush(options, validatedEvent, logger, setTempDir, lo
     logger,
     raw: loaded.raw
   });
-  const platform = getPlatform3(flowSettings);
+  const platform = getPlatform4(flowSettings);
   const overrides = buildOverrides({ mock: options.mock }, flowSettings);
   logger.debug("Bundling flow configuration");
   const tempDir = await tmpRunDir("push");
@@ -6448,19 +6070,12 @@ async function simulateDestination(configOrPath, event, options) {
 import * as fs20 from "fs";
 import * as path20 from "path";
 import chalk2 from "chalk";
-import { isObject as isObject10 } from "@walkeros/core";
+import { isObject as isObject11 } from "@walkeros/core";
 
 // src/commands/validate/validators/contract.ts
-import { isObject as isObject5 } from "@walkeros/core";
+import { CONTRACT_RULE_KEYS, isObject as isObject5 } from "@walkeros/core";
+var KNOWN_KEYS = new Set(CONTRACT_RULE_KEYS);
 var SECTION_KEYS = ["globals", "context", "custom", "user", "consent"];
-var KNOWN_KEYS = /* @__PURE__ */ new Set([
-  "extend",
-  "tagging",
-  "description",
-  "events",
-  "schema",
-  ...SECTION_KEYS
-]);
 function validateContract(input) {
   const errors = [];
   const warnings = [];
@@ -6501,7 +6116,9 @@ function validateContract(input) {
     const keys = Object.keys(obj);
     const unknownKeys = keys.filter((k) => !KNOWN_KEYS.has(k));
     const hasKnownKey = keys.some((k) => KNOWN_KEYS.has(k));
-    const objectValuedUnknown = unknownKeys.filter((k) => isObject5(obj[k]));
+    const objectValuedUnknown = unknownKeys.filter(
+      (k) => isObject5(obj[k]) && !SECTION_KEYS.includes(k)
+    );
     if (!hasKnownKey && objectValuedUnknown.length > 0) {
       errors.push({
         path: name,
@@ -6511,9 +6128,9 @@ function validateContract(input) {
       continue;
     }
     for (const key of unknownKeys) {
-      warnings.push({
+      errors.push({
         path: `${name}.${key}`,
-        message: `Unknown contract key "${key}" is ignored`,
+        message: SECTION_KEYS.includes(key) ? `Contract section "${key}" is not enforced: the validate transformer reads only "events" and "schema". Put the rule into "schema" (a JSON Schema for the whole event), for example "schema": { "properties": { "${key}": { ... } } }.` : `Unknown contract key "${key}" is not supported. Known keys: ${[...KNOWN_KEYS].join(", ")}.`,
         code: "UNKNOWN_CONTRACT_KEY"
       });
     }
@@ -6542,21 +6159,9 @@ function validateContract(input) {
         errors.push({
           path: `${name}.extend`,
           message: `extend references non-existent contract "${obj.extend}"`,
-          value: obj.extend,
-          code: "INVALID_EXTENDS"
-        });
-      }
-    }
-    for (const key of SECTION_KEYS) {
-      if (key in obj) {
-        if (typeof obj[key] !== "object" || obj[key] === null) {
-          errors.push({
-            path: `${name}.${key}`,
-            message: `Section "${key}" must be a JSON Schema object`,
-            value: obj[key],
-            code: "INVALID_SECTION"
-          });
-        }
+          value: obj.extend,
+          code: "INVALID_EXTENDS"
+        });
       }
     }
     if (obj.events !== void 0) {
@@ -6667,12 +6272,17 @@ import {
   ENV_MARKER_PREFIX as ENV_MARKER_PREFIX3,
   getByPath,
   getRouteGraph,
-  isObject as isObject8,
+  isObject as isObject9,
   REF_CONTRACT,
   resolveContracts,
+  SECRET_MARKER_PREFIX as SECRET_MARKER_PREFIX4,
   validateStepEntry
 } from "@walkeros/core";
-import { schemas as schemas4, validateFlowStructure } from "@walkeros/core/dev";
+import {
+  checkStepKeys,
+  schemas as schemas4,
+  validateFlowStructure as validateFlowStructure2
+} from "@walkeros/core/dev";
 import {
   validateEventAgainstContract
 } from "@walkeros/transformer-validate";
@@ -6861,19 +6471,52 @@ function resolutionCode(error) {
 }
 
 // src/commands/validate/validators/settings.ts
-import * as fs19 from "fs";
-import * as path19 from "path";
 import Ajv from "ajv";
 import {
+  createLogger,
   ENV_MARKER_PREFIX as ENV_MARKER_PREFIX2,
-  fetchPackage,
   getErrorMessage as getErrorMessage3,
-  isObject as isObject7,
+  isObject as isObject8,
   REF_CODE_PREFIX,
   REF_STORE,
   SECRET_MARKER_PREFIX as SECRET_MARKER_PREFIX3
 } from "@walkeros/core";
-var CLIENT_HEADER = "walkeros-cli/4.8.1";
+
+// src/core/package-info.ts
+import * as fs19 from "fs";
+import * as path19 from "path";
+import { fetchPackage, isObject as isObject7, parseWalkerOSJson } from "@walkeros/core";
+function readJson(file) {
+  return JSON.parse(fs19.readFileSync(file, "utf-8"));
+}
+async function readStepPackageInfo(resolved, options) {
+  const { packageName, spec } = resolved;
+  if (spec.path === void 0)
+    return fetchPackage(packageName, {
+      ...spec.version ? { version: spec.version } : {},
+      client: options.client
+    });
+  if (options.configDir === void 0)
+    throw new Error(
+      "it is a local path package and the input is not a file, so there is no directory to read it from"
+    );
+  const root = path19.isAbsolute(spec.path) ? spec.path : path19.resolve(options.configDir, spec.path);
+  const file = [
+    path19.join(root, "dist", "walkerOS.json"),
+    path19.join(root, "walkerOS.json")
+  ].find((candidate) => fs19.existsSync(candidate));
+  if (!file) throw new Error(`no walkerOS.json under ${root}`);
+  const meta = readJson(file);
+  if (!isObject7(meta)) throw new Error(`${file} is not a JSON object`);
+  const pkgFile = path19.join(root, "package.json");
+  const pkg = fs19.existsSync(pkgFile) ? readJson(pkgFile) : void 0;
+  const version = isObject7(pkg) && typeof pkg.version === "string" ? pkg.version : void 0;
+  return { ...parseWalkerOSJson(meta), ...version ? { version } : {} };
+}
+
+// src/commands/validate/validators/settings.ts
+var CLIENT_HEADER = "walkeros-cli/4.8.3-next-1793115089237";
+var LOGGER = createLogger();
 function createSettingsContext(configDir) {
   return { configDir, cache: /* @__PURE__ */ new Map(), compiled: /* @__PURE__ */ new Map() };
 }
@@ -6884,7 +6527,7 @@ function selectSettingsSchema(pkg, packageLabel, exportName) {
       pkg.exportSchemas,
       exportName
     ) ? pkg.exportSchemas[exportName] : void 0;
-    if (!isObject7(entry))
+    if (!isObject8(entry))
       return {
         ok: false,
         reason: `${packageLabel} has no export "${exportName}"`
@@ -6912,7 +6555,7 @@ function valueAt(root, segments) {
   let current = root;
   for (const segment of segments) {
     if (Array.isArray(current)) current = current[Number(segment)];
-    else if (isObject7(current)) current = current[segment];
+    else if (isObject8(current)) current = current[segment];
     else return void 0;
   }
   return current;
@@ -6927,7 +6570,7 @@ function prepareSettings(settings) {
   const walk = (value, segments) => {
     if (Array.isArray(value))
       return value.map((item, index) => walk(item, [...segments, `${index}`]));
-    if (isObject7(value))
+    if (isObject8(value))
       return Object.fromEntries(
         Object.entries(value).map(([key, item]) => [
           key,
@@ -6971,62 +6614,9 @@ function prepareSettings(settings) {
 function isUnder(segments, prefix) {
   return prefix.every((segment, index) => segments[index] === segment);
 }
-function bundlePin(rawFlow, name) {
-  const config = isObject7(rawFlow) ? rawFlow.config : void 0;
-  const bundle2 = isObject7(config) ? config.bundle : void 0;
-  const packages = isObject7(bundle2) ? bundle2.packages : void 0;
-  const pin = isObject7(packages) ? packages[name] : void 0;
-  if (!isObject7(pin)) return {};
-  return {
-    ...typeof pin.version === "string" ? { version: pin.version } : {},
-    ...typeof pin.path === "string" ? { path: pin.path } : {}
-  };
-}
-function packageSource(spec, rawFlow) {
-  if (spec.startsWith(".") || spec.startsWith("/"))
-    return { name: spec, localPath: spec };
-  const { name, version } = parsePackageSpec(spec);
-  const pin = bundlePin(rawFlow, name);
-  if (pin.path) return { name, localPath: pin.path };
-  const pinned = pin.version ?? version;
-  return pinned ? { name, version: pinned } : { name };
-}
-function readJson2(file) {
-  return JSON.parse(fs19.readFileSync(file, "utf-8"));
-}
-function readLocalSchema(source, configDir) {
-  const localPath = source.localPath ?? "";
-  const root = path19.isAbsolute(localPath) ? localPath : path19.resolve(configDir, localPath);
-  const file = [
-    path19.join(root, "dist", "walkerOS.json"),
-    path19.join(root, "walkerOS.json")
-  ].find((candidate) => fs19.existsSync(candidate));
-  if (!file) throw new Error(`no walkerOS.json under ${root}`);
-  const meta = readJson2(file);
-  const pkgFile = path19.join(root, "package.json");
-  const pkg = fs19.existsSync(pkgFile) ? readJson2(pkgFile) : void 0;
-  const schemas6 = isObject7(meta) ? meta.schemas : void 0;
-  const exportSchemas = isObject7(meta) ? meta.exportSchemas : void 0;
-  const declared = isObject7(meta) && isObject7(meta.$meta) ? meta.$meta.exports : void 0;
-  const version = isObject7(pkg) && typeof pkg.version === "string" ? pkg.version : void 0;
-  return {
-    ...version ? { version } : {},
-    settings: isObject7(schemas6) ? schemas6.settings : void 0,
-    ...isObject7(exportSchemas) ? { exportSchemas } : {},
-    ...isObject7(declared) ? { exports: Object.keys(declared) } : {}
-  };
-}
-async function loadSchema(source, context2) {
-  if (source.localPath !== void 0) {
-    const configDir = context2.configDir;
-    if (configDir === void 0)
-      throw new Error(
-        "it is a local path package and the input is not a file, so there is no directory to read it from"
-      );
-    return readLocalSchema(source, configDir);
-  }
-  const info = await fetchPackage(source.name, {
-    ...source.version ? { version: source.version } : {},
+async function loadSchema(resolved, context2) {
+  const info = await readStepPackageInfo(resolved, {
+    configDir: context2.configDir,
     client: CLIENT_HEADER
   });
   return {
@@ -7037,7 +6627,7 @@ async function loadSchema(source, context2) {
   };
 }
 function compileSettings(settings) {
-  if (!isObject7(settings)) return void 0;
+  if (!isObject8(settings)) return void 0;
   const ajv = new Ajv({ allErrors: true, validateFormats: false });
   try {
     return { ok: true, validate: ajv.compile(settings) };
@@ -7045,26 +6635,26 @@ function compileSettings(settings) {
     return { ok: false, message: getErrorMessage3(error) };
   }
 }
-function sourceKey(source) {
-  return source.localPath ? `path:${source.localPath}` : `${source.name}@${source.version ?? "latest"}`;
+function sourceKey({ packageName, spec }) {
+  return spec.path !== void 0 ? `path:${spec.path}` : `${packageName}@${spec.version ?? "latest"}`;
 }
-function cachedSchema(source, context2) {
-  const key = sourceKey(source);
+function cachedSchema(resolved, context2) {
+  const key = sourceKey(resolved);
   let pending = context2.cache.get(key);
   if (!pending) {
-    pending = loadSchema(source, context2);
+    pending = loadSchema(resolved, context2);
     context2.cache.set(key, pending);
   }
   return pending;
 }
-function cachedCompile(source, exportName, settings, context2) {
-  const key = `${sourceKey(source)}#${exportName ?? ""}`;
+function cachedCompile(resolved, exportName, settings, context2) {
+  const key = `${sourceKey(resolved)}#${exportName ?? ""}`;
   if (context2.compiled.has(key)) return context2.compiled.get(key);
   const compiled = compileSettings(settings);
   context2.compiled.set(key, compiled);
   return compiled;
 }
-async function checkStepSettings(target, resolvedFlow, rawFlow, check, context2) {
+async function checkStepSettings(target, resolvedFlow, check, context2) {
   const at = `flows.${target.flow}.${target.section}.${target.key}`;
   const outcome = { findings: [], skipped: [], deferred: [] };
   const spec = typeof target.entry.package === "string" ? target.entry.package : "";
@@ -7077,33 +6667,51 @@ async function checkStepSettings(target, resolvedFlow, rawFlow, check, context2)
     });
     return outcome;
   }
-  const source = packageSource(spec, rawFlow);
+  let resolved;
+  try {
+    resolved = resolveStepPackage(
+      resolvedFlow,
+      SECTION_KIND[target.section],
+      target.key,
+      LOGGER
+    );
+  } catch (error) {
+    outcome.skipped.push({
+      path: at,
+      check,
+      reason: `Schema for ${spec} could not be loaded: ${getErrorMessage3(error)}`,
+      code: "SCHEMA_UNAVAILABLE"
+    });
+    return outcome;
+  }
+  const { label } = resolved;
+  const pinned = resolved.spec.path === void 0 ? resolved.spec.version : void 0;
   let schema;
   try {
-    schema = await cachedSchema(source, context2);
+    schema = await cachedSchema(resolved, context2);
   } catch (error) {
     outcome.skipped.push({
       path: at,
       check,
-      reason: `Schema for ${source.name}${source.version ? `@${source.version}` : ""} could not be loaded: ${getErrorMessage3(error)}`,
+      reason: `Schema for ${label}${pinned ? `@${pinned}` : ""} could not be loaded: ${getErrorMessage3(error)}`,
       code: "SCHEMA_UNAVAILABLE"
     });
     return outcome;
   }
   outcome.checked = {
     path: at,
-    package: source.name,
+    package: label,
     ...schema.version ? { version: schema.version } : {}
   };
   const { exportName } = resolveExportName(
-    resolvedFlow,
+    resolved.normalizedFlow,
     SECTION_KIND[target.section],
     target.key
   );
-  const version = schema.version ?? source.version;
+  const version = schema.version ?? pinned;
   const selection = selectSettingsSchema(
     schema,
-    version ? `${source.name}@${version}` : source.name,
+    version ? `${label}@${version}` : label,
     exportName
   );
   if (!selection.ok) {
@@ -7116,7 +6724,7 @@ async function checkStepSettings(target, resolvedFlow, rawFlow, check, context2)
     return outcome;
   }
   const compiled = cachedCompile(
-    source,
+    resolved,
     exportName,
     selection.settings,
     context2
@@ -7125,7 +6733,7 @@ async function checkStepSettings(target, resolvedFlow, rawFlow, check, context2)
     outcome.skipped.push({
       path: at,
       check,
-      reason: `Package ${source.name} has no settings schema`,
+      reason: `Package ${label} has no settings schema`,
       code: "NO_SETTINGS_SCHEMA"
     });
     return outcome;
@@ -7134,14 +6742,14 @@ async function checkStepSettings(target, resolvedFlow, rawFlow, check, context2)
     outcome.skipped.push({
       path: at,
       check,
-      reason: `The settings schema of ${source.name} cannot be compiled: ${compiled.message}`,
+      reason: `The settings schema of ${label} cannot be compiled: ${compiled.message}`,
       code: "SCHEMA_UNAVAILABLE"
     });
     return outcome;
   }
   const validate2 = compiled.validate;
   const step = stepOf(resolvedFlow, target.section, target.key);
-  const config = isObject7(step?.config) ? step.config : {};
+  const config = isObject8(step?.config) ? step.config : {};
   const prepared = prepareSettings(config.settings ?? {});
   const base = `${at}.config.settings`;
   for (const { segments, reference } of prepared.deferred) {
@@ -7188,7 +6796,9 @@ var { validateFlowConfig: validateFlowConfig2 } = schemas4;
 var DEPRECATED_PACKAGES = {
   "@walkeros/store-memory": "has been removed. Use the built-in cache by omitting cache.store, or remove the store declaration if it was only used as a cache target."
 };
-var OPEN_STEP_KINDS = [
+var STEP_KINDS2 = [
+  ["sources", "Source"],
+  ["transformers", "Transformer"],
   ["destinations", "Destination"],
   ["stores", "Store"]
 ];
@@ -7220,24 +6830,22 @@ async function validateFlowWithPackages(input, options = {}) {
       continue;
     }
     for (const section of ENTRY_SECTIONS) {
-      const steps = isObject8(rawFlow[section]) ? rawFlow[section] : {};
+      const steps = isObject9(rawFlow[section]) ? rawFlow[section] : {};
       for (const [key, entry] of Object.entries(steps)) {
-        if (!isObject8(entry) || entry.package === void 0) continue;
+        if (!isObject9(entry) || entry.package === void 0) continue;
         const target = { flow: name, section, key, entry };
         pending.push(
-          checkStepSettings(
-            target,
-            flow,
-            rawFlow,
-            "flow:package-settings",
-            context2
-          )
+          checkStepSettings(target, flow, "flow:package-settings", context2)
         );
       }
     }
   }
   for (const outcome of await Promise.all(pending)) {
-    result.warnings.push(...outcome.findings);
+    for (const finding of outcome.findings) {
+      if (finding.keyword === "additionalProperties")
+        result.errors.push(finding);
+      else result.warnings.push(finding);
+    }
     run.skipped.push(...outcome.skipped);
     deferred.push(...outcome.deferred);
     if (outcome.checked) packages.push(outcome.checked);
@@ -7245,6 +6853,7 @@ async function validateFlowWithPackages(input, options = {}) {
   result.details.scope = describeScope(scope, run.checks);
   result.details.deferred = [...result.details.deferred ?? [], ...deferred];
   if (packages.length > 0) result.details.packages = packages;
+  result.valid = result.errors.length === 0;
   return result;
 }
 function runFlowChecks(input, options) {
@@ -7281,9 +6890,9 @@ function runFlowChecks(input, options) {
     };
   }
   errors.push(...scope.errors);
-  const config = isObject8(input) ? input : {};
+  const config = isObject9(input) ? input : {};
   const flowsValue = config.flows;
-  const flows = isObject8(flowsValue) ? flowsValue : void 0;
+  const flows = isObject9(flowsValue) ? flowsValue : void 0;
   const allFlows = scope.allFlows;
   const inScope = (path23) => {
     const flow = flowOfPath(path23, allFlows);
@@ -7303,8 +6912,13 @@ function runFlowChecks(input, options) {
   for (const issue of coreResult.errors) {
     const path23 = issue.path || "root";
     if (!inScope(path23)) continue;
-    if (path23 === "contract" && contractErrors > 0) continue;
-    errors.push({ path: path23, message: issue.message, code: "SCHEMA_VALIDATION" });
+    if ((path23 === "contract" || path23.startsWith("contract.")) && contractErrors > 0)
+      continue;
+    errors.push({
+      path: path23,
+      message: issue.message,
+      code: issue.code ?? "SCHEMA_VALIDATION"
+    });
   }
   for (const issue of coreResult.warnings) {
     const path23 = issue.path || "root";
@@ -7321,13 +6935,13 @@ function runFlowChecks(input, options) {
   checks.push("flow:steps");
   for (const flowName of scope.flows) {
     const flowValue = flows?.[flowName];
-    if (!isObject8(flowValue)) continue;
+    if (!isObject9(flowValue)) continue;
     const transformersValue = flowValue.transformers;
-    if (isObject8(transformersValue)) {
+    if (isObject9(transformersValue)) {
       for (const [name, transformerValue] of Object.entries(
         transformersValue
       )) {
-        if (!isObject8(transformerValue)) continue;
+        if (!isObject9(transformerValue)) continue;
         const result2 = validateStepEntry(transformerValue, "Transformer");
         if (!result2.ok) {
           errors.push({
@@ -7338,20 +6952,13 @@ function runFlowChecks(input, options) {
         }
       }
     }
-    for (const [section, kind] of OPEN_STEP_KINDS) {
+    for (const [section, kind] of STEP_KINDS2) {
       const steps = flowValue[section];
-      if (!isObject8(steps)) continue;
+      if (!isObject9(steps)) continue;
       for (const [name, step] of Object.entries(steps)) {
-        if (!isObject8(step)) continue;
+        if (!isObject9(step)) continue;
         const at = `flows.${flowName}.${section}.${name}`;
-        for (const key of unknownStepKeys(step, kind)) {
-          warnings.push({
-            path: `${at}.${key}`,
-            message: `Unknown key "${key}" on ${kind} is ignored by the runtime`,
-            suggestion: "Remove the key, or move it to where it belongs.",
-            code: "UNKNOWN_KEY"
-          });
-        }
+        errors.push(...checkStepKeys(step, kind, at));
         const pkg = step.package;
         if (typeof pkg === "string" && pkg in DEPRECATED_PACKAGES) {
           warnings.push({
@@ -7362,6 +6969,7 @@ function runFlowChecks(input, options) {
         }
       }
     }
+    checkWebLoggerFormat(flowName, flowValue, errors);
   }
   if (flows) {
     details.flowNames = allFlows;
@@ -7371,15 +6979,15 @@ function runFlowChecks(input, options) {
   let totalPackageCount = 0;
   for (const flowName of scope.flows) {
     const flowValue = flows?.[flowName];
-    if (!isObject8(flowValue)) continue;
+    if (!isObject9(flowValue)) continue;
     const flowConfig = flowValue.config;
-    if (!isObject8(flowConfig)) continue;
+    if (!isObject9(flowConfig)) continue;
     const bundle2 = flowConfig.bundle;
-    if (!isObject8(bundle2)) continue;
+    if (!isObject9(bundle2)) continue;
     const packages = bundle2.packages;
-    if (!isObject8(packages)) continue;
+    if (!isObject9(packages)) continue;
     for (const [pkgName, pkgConfigValue] of Object.entries(packages)) {
-      if (!isObject8(pkgConfigValue)) continue;
+      if (!isObject9(pkgConfigValue)) continue;
       if (!pkgConfigValue.version && !pkgConfigValue.path) {
         warnings.push({
           path: `flows.${flowName}.config.bundle.packages.${pkgName}`,
@@ -7425,7 +7033,7 @@ function runFlowChecks(input, options) {
     }
   };
   perFlow(["flow:structure"], (name, flow, file) => {
-    const structure = validateFlowStructure({
+    const structure = validateFlowStructure2({
       ...file,
       flows: { [name]: flow }
     });
@@ -7467,13 +7075,13 @@ function runFlowChecks(input, options) {
           warnings,
           options.strict === true,
           skipped,
-          isObject8(resolvedConfig) && isObject8(resolvedConfig.settings) ? resolvedConfig.settings : void 0
+          isObject9(resolvedConfig) && isObject9(resolvedConfig.settings) ? resolvedConfig.settings : void 0
         );
       }
       for (const [destName, dest] of Object.entries(flow.destinations || {})) {
-        if (!isObject8(dest.config)) continue;
+        if (!isObject9(dest.config)) continue;
         const mapping = dest.config.mapping;
-        if (!isObject8(mapping)) continue;
+        if (!isObject9(mapping)) continue;
         for (const key of Object.keys(mapping)) {
           if (key.includes(".") && !key.includes(" ")) {
             const parts = key.split(".");
@@ -7533,16 +7141,31 @@ function checkResolvedWindowCollector(name, raw, flow, errors, deferred) {
     code: "SCHEMA_VALIDATION"
   });
 }
-function unknownStepKeys(step, kind) {
-  const unknown = [];
-  const rest = { ...step };
-  for (; ; ) {
-    const verdict = validateStepEntry(rest, kind);
-    if (verdict.code !== "UNKNOWN_KEY" || verdict.key === void 0) break;
-    unknown.push(verdict.key);
-    Reflect.deleteProperty(rest, verdict.key);
+function checkWebLoggerFormat(flowName, flow, errors) {
+  if (!isObject9(flow.config) || flow.config.platform !== "web") return;
+  const at = `flows.${flowName}`;
+  const loggers = [];
+  if (isObject9(flow.collector))
+    loggers.push([`${at}.collector.logger`, flow.collector.logger]);
+  for (const [section] of STEP_KINDS2) {
+    const steps = flow[section];
+    if (!isObject9(steps)) continue;
+    for (const [name, step] of Object.entries(steps)) {
+      if (isObject9(step) && isObject9(step.config))
+        loggers.push([
+          `${at}.${section}.${name}.config.logger`,
+          step.config.logger
+        ]);
+    }
+  }
+  for (const [path23, logger] of loggers) {
+    if (!isObject9(logger) || logger.format === void 0) continue;
+    errors.push({
+      path: `${path23}.format`,
+      message: "logger.format applies to server flows only: a web flow logs to the browser console, which has no output format. Remove it.",
+      code: "WEB_LOGGER_FORMAT"
+    });
   }
-  return unknown;
 }
 function routeTargets(spec) {
   if (spec === void 0) return [];
@@ -7641,21 +7264,21 @@ function isStepOut(value) {
   return Array.isArray(value) && value.every((entry) => Array.isArray(entry) && typeof entry[0] === "string");
 }
 function returnedEvents(value) {
-  if (isObject8(value)) return [isObject8(value.event) ? value.event : value];
+  if (isObject9(value)) return [isObject9(value.event) ? value.event : value];
   if (Array.isArray(value)) return value.flatMap(returnedEvents);
   return [];
 }
 function outEvents(out) {
   if (isStepOut(out)) {
     return out.flatMap(([head, first]) => {
-      if (head === "elb") return isObject8(first) ? [first] : [];
+      if (head === "elb") return isObject9(first) ? [first] : [];
       if (head === "return") return returnedEvents(first);
       return [];
     });
   }
   if (Array.isArray(out) || typeof out === "string")
     return out.length > 0 ? [out] : [];
-  return isObject8(out) && Object.keys(out).length > 0 ? [out] : [];
+  return isObject9(out) && Object.keys(out).length > 0 ? [out] : [];
 }
 function hasComparableOut(out) {
   return outEvents(out).length > 0;
@@ -7697,7 +7320,7 @@ function routeAt(spec, path23) {
   for (const key of path23) {
     if (typeof key === "number")
       current = Array.isArray(current) ? current[key] : void 0;
-    else current = isObject8(current) ? current[key] : void 0;
+    else current = isObject9(current) ? current[key] : void 0;
   }
   return current;
 }
@@ -7722,7 +7345,7 @@ function lintRoute(spec, position, known, errors, warnings) {
     if (node.stop && !node.match && node.kind !== "many") {
       const self = routeAt(spec, node.path);
       const list = routeAt(spec, node.path.slice(0, -1));
-      if (isObject8(self) && self.stop === true && typeof last === "number" && Array.isArray(list) && last < list.length - 1 && once2(`stop:${where(node.path)}`)) {
+      if (isObject9(self) && self.stop === true && typeof last === "number" && Array.isArray(list) && last < list.length - 1 && once2(`stop:${where(node.path)}`)) {
         const at = where(node.path);
         warnings.push({
           path: at,
@@ -7770,6 +7393,12 @@ function lintRoute(spec, position, known, errors, warnings) {
     }
   }
 }
+function hasRuntimeValue(value) {
+  if (typeof value === "string")
+    return value.includes(ENV_MARKER_PREFIX3) || value.startsWith(SECRET_MARKER_PREFIX4) || /\$(?:env|secret)\./.test(value);
+  if (Array.isArray(value)) return value.some(hasRuntimeValue);
+  return isObject9(value) && Object.values(value).some(hasRuntimeValue);
+}
 var VALIDATE_PACKAGE = "@walkeros/transformer-validate";
 function isValidateStep(step) {
   return step.package === VALIDATE_PACKAGE;
@@ -7788,7 +7417,7 @@ function resolveStepContracts(entries, contract) {
   }
   const sources = [];
   for (const [index, entry] of entries.entries()) {
-    if (isObject8(entry)) {
+    if (isObject9(entry)) {
       sources.push(entry);
       continue;
     }
@@ -7806,7 +7435,7 @@ function resolveStepContracts(entries, contract) {
         message: `contract "${match[1]}" is not defined in the root contract (defined: ${Object.keys(resolved).join(", ") || "none"})`
       };
     const rule = match[2] ? getByPath(resolved[match[1]], match[2]) : resolved[match[1]];
-    if (!isObject8(rule))
+    if (!isObject9(rule))
       return {
         ok: false,
         index,
@@ -7817,7 +7446,7 @@ function resolveStepContracts(entries, contract) {
   return { ok: true, sources };
 }
 function checkValidateStepExamples(stepPath, step, contract, errors, warnings, strict, skipped, resolvedSettings) {
-  const settings = resolvedSettings ?? (isObject8(step.config) && isObject8(step.config.settings) ? step.config.settings : {});
+  const settings = resolvedSettings ?? (isObject9(step.config) && isObject9(step.config.settings) ? step.config.settings : {});
   const contractPath = `${stepPath}.config.settings.contract`;
   if (settings.contract !== void 0 && !Array.isArray(settings.contract)) {
     if (step.examples)
@@ -7840,12 +7469,21 @@ function checkValidateStepExamples(stepPath, step, contract, errors, warnings, s
   }
   if (!step.examples) return;
   const contracts = resolution.sources;
+  if (contracts.some(hasRuntimeValue)) {
+    skipped?.push({
+      path: stepPath,
+      check: "flow:contract-examples",
+      reason: "the contract uses a $env or $secret value, known only when the bundle builds or runs, so the examples cannot be judged statically",
+      code: "CONTRACT_NOT_STATIC"
+    });
+    return;
+  }
   const mode = settings.mode === "strict" ? "strict" : "pass";
   const format = settings.format === true;
-  const output = isObject8(settings.output) ? settings.output : {};
+  const output = isObject9(settings.output) ? settings.output : {};
   const isValidPath = typeof output.isValid === "string" ? output.isValid : "source.valid";
   for (const [exName, example] of Object.entries(step.examples)) {
-    if (example.command || !isObject8(example.in)) continue;
+    if (example.command || !isObject9(example.in)) continue;
     if (example.out === void 0) continue;
     const event = example.in;
     const verdict = validateEventAgainstContract(event, void 0, {
@@ -7883,14 +7521,14 @@ function checkValidateStepExamples(stepPath, step, contract, errors, warnings, s
 }
 
 // src/commands/validate/validators/mapping.ts
-import { isObject as isObject9 } from "@walkeros/core";
+import { isObject as isObject10 } from "@walkeros/core";
 import { schemas as schemas5 } from "@walkeros/core/dev";
 var { RuleSchema } = schemas5.MappingSchemas;
 function isRule(value) {
-  return isObject9(value) && RuleSchema.safeParse(value).success;
+  return isObject10(value) && RuleSchema.safeParse(value).success;
 }
 function isNestedActions(key, value) {
-  if (key.includes(" ") || !isObject9(value)) return false;
+  if (key.includes(" ") || !isObject10(value)) return false;
   const rules = Object.values(value);
   return rules.length > 0 && rules.every(
     (rule) => Array.isArray(rule) ? rule.length > 0 && rule.every(isRule) : isRule(rule)
@@ -7900,7 +7538,7 @@ function validateMapping(input) {
   const errors = [];
   const warnings = [];
   const details = {};
-  if (!isObject9(input)) {
+  if (!isObject10(input)) {
     errors.push({
       path: "root",
       message: "Mapping must be an object with event patterns as keys",
@@ -7989,7 +7627,6 @@ async function validateEntry(path23, flowConfig, options = {}) {
     const outcome = await checkStepSettings(
       target,
       resolution.flow,
-      file?.flows[target.flow],
       "entry:settings",
       context2
     );
@@ -8046,6 +7683,7 @@ var VALIDATE_CODES = [
   "CONTRACT_VIOLATION",
   "MAPPING_DOT_KEY",
   "FLOW_REF_WARNING",
+  "WEB_LOGGER_FORMAT",
   "FLOW_CYCLE",
   "VAR_CYCLE",
   // Structure (the bundler's own preflight, validateFlowStructure)
@@ -8054,7 +7692,11 @@ var VALIDATE_CODES = [
   "STORE_REFERENCE_NOT_FOUND",
   "STATE_STORE_UNKNOWN",
   "STATE_STORE_FILE",
-  "TRANSFORMER_MAPPING_NO_OP",
+  "MAPPING_NO_OP",
+  "MAPPING_VALUE_NO_OPERATOR",
+  "MAPPING_VALUE_PRODUCERS",
+  "BATCH_WITHOUT_PUSH_BATCH",
+  "MALFORMED_REFERENCE",
   // Resolution (getFlowSettings, as the bundler resolves the flow)
   "UNRESOLVED_REFERENCE",
   "MISSING_ENV",
@@ -8071,7 +7713,6 @@ var VALIDATE_CODES = [
   "INVALID_TAGGING",
   "INVALID_SCHEMA",
   "INVALID_EXTENDS",
-  "INVALID_SECTION",
   "INVALID_EVENTS",
   "CIRCULAR_EXTENDS",
   "INVALID_ENTITY_KEY",
@@ -8126,7 +7767,7 @@ function inapplicableOptions(type, options) {
 }
 function validateContractInput(input) {
   if (!isFlowJson2(input)) return validateContract(input);
-  const contract = isObject10(input) ? input.contract : void 0;
+  const contract = isObject11(input) ? input.contract : void 0;
   if (contract === void 0) {
     return {
       valid: false,
@@ -8346,191 +7987,8 @@ function exitCodeOf(result, strict) {
   return result.valid ? 0 : 1;
 }
 
-// src/commands/login/index.ts
-import { z as z3 } from "zod";
-var POLL_TIMEOUT_BUFFER_MS = 5e3;
-var DEFAULT_POLL_INTERVAL_MS = 5e3;
-var MIN_SERVER_POLL_INTERVAL_MS = 1e3;
-var DEFAULT_POLL_TIMEOUT_MS = 9e5;
-var SLOW_DOWN_STEP_MS = 5e3;
-var WHOAMI_TIMEOUT_MS = 1e4;
-var TIMED_OUT = "Authorization timed out. Please try again.";
-var WhoamiSchema = z3.object({ email: z3.string().min(1) });
-async function openInBrowser(url) {
-  const { default: open } = await import("open");
-  await open(url);
-}
-function delay3(ms) {
-  return new Promise((resolve5) => setTimeout(resolve5, ms));
-}
-async function loginCommand(options) {
-  const logger = createCLILogger(options);
-  try {
-    const result = await login({ url: options.url });
-    if (options.json) {
-      logger.json(result);
-    } else if (result.success) {
-      if (result.email) logger.info(`Logged in as ${result.email}`);
-      else logger.info("Logged in.");
-      logger.info(`Session stored in ${result.configPath}`);
-    } else if (result.error) {
-      logger.error(result.error);
-    }
-    process.exit(result.success ? 0 : 1);
-  } catch (error) {
-    const message = error instanceof Error ? error.message : String(error);
-    if (options.json) {
-      logger.json({ success: false, error: message });
-    } else {
-      logger.error(message);
-    }
-    process.exit(1);
-  }
-}
-async function fetchEmail(appUrl, accessToken, fetchFn) {
-  try {
-    const response = await appFetch(APP_PATHS.whoami, {
-      baseUrl: appUrl,
-      token: accessToken,
-      fetch: fetchFn,
-      signal: AbortSignal.timeout(WHOAMI_TIMEOUT_MS)
-    });
-    if (!response.ok) return void 0;
-    const parsed = WhoamiSchema.safeParse(await response.json());
-    return parsed.success ? parsed.data.email : void 0;
-  } catch {
-    return void 0;
-  }
-}
-async function persistSession(appUrl, tokens, fetchFn) {
-  writeConfig({
-    accessToken: tokens.accessToken,
-    accessTokenExpiresAt: tokens.accessTokenExpiresAt,
-    refreshToken: tokens.refreshToken ?? void 0,
-    appUrl,
-    // Drop the static token this session replaces, so the deprecated path
-    // cannot outlive the login that retired it.
-    token: void 0
-  });
-  const email = await fetchEmail(appUrl, tokens.accessToken, fetchFn);
-  writeConfig({ email });
-}
-async function completeDeviceLogin(deviceCode, options = {}) {
-  const fetchFn = options.fetch ?? globalThis.fetch;
-  const appUrl = requireSecureUrl(options.url || resolveAppUrl());
-  const deadline = Date.now() + (options.timeoutMs ?? DEFAULT_POLL_TIMEOUT_MS);
-  let intervalMs = options.intervalMs ?? DEFAULT_POLL_INTERVAL_MS;
-  let attempts = 0;
-  let waiting = "pending";
-  while (Date.now() + intervalMs <= deadline) {
-    if (options.maxPollAttempts !== void 0 && attempts >= options.maxPollAttempts)
-      break;
-    attempts += 1;
-    await delay3(intervalMs);
-    const signal = AbortSignal.timeout(Math.max(1, deadline - Date.now()));
-    const poll = await pollDeviceToken(appUrl, deviceCode, fetchFn, signal);
-    if (poll.status === "pending") {
-      waiting = "pending";
-      if (signal.aborted) break;
-      continue;
-    }
-    if (poll.status === "slow_down") {
-      waiting = "slow_down";
-      intervalMs += SLOW_DOWN_STEP_MS;
-      continue;
-    }
-    if (poll.status !== "ok") return poll;
-    await persistSession(appUrl, poll.tokens, fetchFn);
-    return { status: "ok" };
-  }
-  return { status: waiting };
-}
-async function login(options = {}) {
-  const fetchFn = options.fetch ?? globalThis.fetch;
-  const appUrl = requireSecureUrl(options.url || resolveAppUrl());
-  let authorization;
-  try {
-    authorization = await startDeviceAuthorization(appUrl, fetchFn);
-  } catch {
-    return { success: false, error: "Failed to request device code" };
-  }
-  const target = authorization.verificationUriComplete;
-  const prompt = (message) => process.stderr.write(message + "\n");
-  prompt(`
-! Your one-time code: ${authorization.userCode}`);
-  prompt(`  Authorize here: ${target}
-`);
-  const opener = options.openUrl ?? openInBrowser;
-  try {
-    await opener(target);
-    prompt("  Opening browser...");
-  } catch {
-    prompt("  Could not open browser. Visit the URL manually.");
-  }
-  prompt("  Waiting for authorization... (press Ctrl+C to cancel)\n");
-  const outcome = await completeDeviceLogin(authorization.deviceCode, {
-    url: appUrl,
-    fetch: fetchFn,
-    timeoutMs: authorization.expiresIn * 1e3 + POLL_TIMEOUT_BUFFER_MS,
-    // Clamped here, at the one place a server's number enters the loop. The
-    // helper takes its caller's interval as stated, which is what keeps a
-    // stated 0 from becoming a poll flood without making the helper's own
-    // option untestably slow.
-    intervalMs: options.pollIntervalMs ?? Math.max(MIN_SERVER_POLL_INTERVAL_MS, authorization.interval * 1e3),
-    ...options.maxPollAttempts !== void 0 ? { maxPollAttempts: options.maxPollAttempts } : {}
-  });
-  switch (outcome.status) {
-    case "ok": {
-      const email = readConfig()?.email;
-      return {
-        success: true,
-        ...email ? { email } : {},
-        configPath: getConfigPath()
-      };
-    }
-    case "denied":
-      return { success: false, error: "Authorization was denied." };
-    case "error":
-      return { success: false, error: outcome.error };
-    default:
-      return { success: false, error: TIMED_OUT };
-  }
-}
-
-// src/commands/logout/index.ts
-async function logoutCommand(options) {
-  const logger = createCLILogger(options);
-  const { deleted, superseded } = await logout();
-  const configPath = getConfigPath();
-  if (options.json) {
-    logger.json({ success: true, deleted, superseded });
-  } else if (superseded) {
-    logger.info(
-      "A newer session was stored while logging out, and was kept. Run `walkeros auth logout` again to remove it."
-    );
-  } else if (deleted) {
-    logger.info(`Logged out. Session removed from ${configPath}`);
-  } else {
-    logger.info("No stored credentials found.");
-  }
-  process.exit(0);
-}
-function sameSession(before, after) {
-  return before?.accessToken === after.accessToken && before?.refreshToken === after.refreshToken && before?.token === after.token;
-}
-async function logout() {
-  const before = readConfig();
-  if (before?.refreshToken) {
-    await revokeRefreshToken(resolveAppUrl(), before.refreshToken);
-  }
-  const after = readConfig();
-  if (after && !sameSession(before, after))
-    return { deleted: false, superseded: true };
-  return { deleted: deleteConfig(), superseded: false };
-}
-
 // src/commands/auth/index.ts
-import { z as z5 } from "zod";
+import { z as z3 } from "zod";
 
 // src/core/api-error.ts
 var EXIT_RETRYABLE = 75;
@@ -8588,31 +8046,166 @@ ${err.message}
   process.exit(1);
 }
 
+// src/core/app-fetch.ts
+import { z } from "zod";
+
+// src/lib/config-file.ts
+import {
+  readFileSync as readFileSync3,
+  writeFileSync,
+  mkdirSync,
+  unlinkSync,
+  chmodSync,
+  renameSync
+} from "fs";
+import { randomBytes } from "crypto";
+import { join as join5 } from "path";
+import { homedir } from "os";
+function getConfigDir() {
+  const xdgConfig = process.env.XDG_CONFIG_HOME;
+  const base = xdgConfig || join5(homedir(), ".config");
+  return join5(base, "walkeros");
+}
+function getConfigPath() {
+  return join5(getConfigDir(), "config.json");
+}
+function readConfig() {
+  const configPath = getConfigPath();
+  try {
+    const content = readFileSync3(configPath, "utf-8");
+    return JSON.parse(content);
+  } catch {
+    return null;
+  }
+}
+function replaceConfigFile(config) {
+  const dir = getConfigDir();
+  mkdirSync(dir, { recursive: true, mode: 448 });
+  const configPath = getConfigPath();
+  const tempPath = `${configPath}.${process.pid}.${randomBytes(6).toString("hex")}.tmp`;
+  try {
+    writeFileSync(tempPath, JSON.stringify(config, null, 2), { mode: 384 });
+    chmodSync(tempPath, 384);
+    renameSync(tempPath, configPath);
+  } catch (error) {
+    try {
+      unlinkSync(tempPath);
+    } catch {
+    }
+    throw error;
+  }
+}
+function writeConfig(config) {
+  replaceConfigFile({ ...readConfig() ?? {}, ...config });
+}
+function writeTelemetryOnlyConfig(partial) {
+  writeConfig(partial);
+}
+function resolveAppUrl() {
+  const envUrl = process.env.WALKEROS_APP_URL;
+  if (envUrl) return envUrl;
+  const config = readConfig();
+  if (config?.appUrl) return config.appUrl;
+  return "https://app.walkeros.io";
+}
+
+// src/lib/secure-url.ts
+function isLoopback(hostname) {
+  return hostname === "localhost" || hostname === "127.0.0.1" || hostname === "[::1]";
+}
+function requireSecureUrl(url) {
+  let parsed;
+  try {
+    parsed = new URL(url);
+  } catch {
+    return url;
+  }
+  if (parsed.protocol !== "http:" || isLoopback(parsed.hostname)) return url;
+  throw new Error(
+    `Refusing to send walkerOS credentials over plain http to ${url}. Use https, or localhost / 127.0.0.1 / [::1] for local development.`
+  );
+}
+
+// src/core/client-context.ts
+var context;
+function setClientContext(input) {
+  const envType = process.env.WALKEROS_CLIENT_TYPE;
+  const type = envType ?? input.type ?? "cli";
+  context = { type, version: input.version };
+}
+function getClientContext() {
+  return context;
+}
+function resetClientContext() {
+  context = void 0;
+}
+function clientContextHeaders() {
+  if (!context) return {};
+  return {
+    "User-Agent": `walkeros-${context.type}/${context.version}`,
+    "X-WalkerOS-Client": context.type,
+    "X-WalkerOS-Client-Version": context.version
+  };
+}
+
+// src/core/app-fetch.ts
+var AppErrorSchema = z.object({
+  error: z.object({ message: z.string().min(1) })
+});
+function appErrorMessage(body) {
+  const parsed = AppErrorSchema.safeParse(body);
+  return parsed.success ? parsed.data.error.message : void 0;
+}
+async function appFetch(path23, init = {}) {
+  const url = `${(init.baseUrl ?? resolveAppUrl()).replace(/\/+$/, "")}${path23}`;
+  const headers = new Headers(clientContextHeaders());
+  for (const [name, value] of Object.entries(init.headers ?? {}))
+    headers.set(name, value);
+  if (init.token && !headers.has("Authorization"))
+    headers.set("Authorization", `Bearer ${init.token}`);
+  if (headers.has("Authorization")) requireSecureUrl(url);
+  const request = { headers };
+  if (init.method && init.method !== "GET") request.method = init.method;
+  if (init.body !== void 0) request.body = init.body;
+  if (init.signal) request.signal = init.signal;
+  if (init.redirect) request.redirect = init.redirect;
+  return (init.fetch ?? fetch)(url, request);
+}
+
+// src/core/app-paths.ts
+var APP_PATHS = {
+  whoami: "/api/auth/whoami",
+  health: "/api/health",
+  telemetry: "/api/telemetry",
+  openapi: "/api/openapi.json"
+};
+
 // src/commands/api/index.ts
 import { once } from "events";
 import { readFile as readFile2 } from "fs/promises";
-import { z as z4 } from "zod";
+import { z as z2 } from "zod";
+var NOT_SIGNED_IN = "no token: set WALKEROS_TOKEN to a token from Account > Automation tokens in the walkerOS app";
 var ERROR_BODY_LIMIT = 64 * 1024;
-var DocumentSchema = z4.object({
-  paths: z4.record(z4.string(), z4.record(z4.string(), z4.unknown())),
-  components: z4.record(z4.string(), z4.record(z4.string(), z4.unknown())).optional()
+var DocumentSchema = z2.object({
+  paths: z2.record(z2.string(), z2.record(z2.string(), z2.unknown())),
+  components: z2.record(z2.string(), z2.record(z2.string(), z2.unknown())).optional()
 });
-var OperationSchema = z4.object({
-  summary: z4.string().optional(),
-  description: z4.string().optional(),
-  parameters: z4.array(z4.unknown()).optional(),
-  requestBody: z4.unknown().optional(),
-  responses: z4.record(z4.string(), z4.unknown()).optional()
+var OperationSchema = z2.object({
+  summary: z2.string().optional(),
+  description: z2.string().optional(),
+  parameters: z2.array(z2.unknown()).optional(),
+  requestBody: z2.unknown().optional(),
+  responses: z2.record(z2.string(), z2.unknown()).optional()
 });
-var OptionsSchema = z4.object({
-  data: z4.string().optional(),
-  header: z4.array(z4.string()).default([]),
-  project: z4.string().optional(),
-  yes: z4.boolean().optional()
+var OptionsSchema = z2.object({
+  data: z2.string().optional(),
+  header: z2.array(z2.string()).default([]),
+  project: z2.string().optional(),
+  yes: z2.boolean().optional()
 });
 
 // src/commands/auth/index.ts
-async function readJson3(response) {
+async function readJson2(response) {
   try {
     return await response.json();
   } catch {
@@ -8620,19 +8213,17 @@ async function readJson3(response) {
   }
 }
 async function whoami() {
-  const token = await resolveAccessToken();
-  if (!token)
-    throw new Error("Not authenticated. Run `walkeros auth login` first.");
+  const token = resolveAccessToken();
+  if (!token) throw new Error(NOT_SIGNED_IN);
   const response = await appFetch(APP_PATHS.whoami, { token });
-  const body = await readJson3(response);
+  const body = await readJson2(response);
   if (!response.ok)
     throw new Error(appErrorMessage(body) ?? `HTTP ${response.status}`);
   return body;
 }
-var IdentitySchema = z5.object({
-  email: z5.string().optional(),
-  userId: z5.string().optional(),
-  projectId: z5.string().nullish()
+var IdentitySchema = z3.object({
+  email: z3.string().optional(),
+  userId: z3.string().optional()
 });
 async function whoamiCommand(options) {
   const logger = createCLILogger(options);
@@ -8649,7 +8240,6 @@ async function whoamiCommand(options) {
       const data = identity.data;
       if (data.email) logger.info(data.email);
       if (data.userId) logger.info(`User: ${data.userId}`);
-      if (data.projectId) logger.info(`Project: ${data.projectId}`);
     }
   } catch (error) {
     handleCliError(error);
@@ -8724,7 +8314,7 @@ function telemetryDisableCommand() {
 }
 
 // src/index.ts
-import { validateFlowStructure as validateFlowStructure2 } from "@walkeros/core/dev";
+import { validateFlowStructure as validateFlowStructure3 } from "@walkeros/core/dev";
 
 // src/commands/bundle/wrap.ts
 import * as path21 from "path";
@@ -8800,11 +8390,12 @@ async function wrapSkeleton(options) {
       format: "esm",
       platform,
       outfile: outputPath,
-      // Resolve `@walkeros/core` (used by the preview activator) from the CLI
-      // package's own dependency tree and the workspace root. Without this,
-      // esbuild looks under the temp entryDir which has no node_modules.
-      // The wrap step always runs from inside the CLI process; both the
-      // CLI's local node_modules and the workspace root are safe anchors.
+      // Resolve `@walkeros/web-core` (the Tag Mode loader and the preview
+      // activator) from the CLI package's own dependency tree and the
+      // workspace root. Without this, esbuild looks under the temp entryDir
+      // which has no node_modules. The wrap step always runs from inside the
+      // CLI process; both the CLI's local node_modules and the workspace root
+      // are safe anchors.
       nodePaths: getNodeResolutionPaths(),
       treeShaking: true,
       logLevel: "error",
@@ -8819,7 +8410,7 @@ async function wrapSkeleton(options) {
     };
     if (platform === "browser") {
       esbuildOptions.format = "iife";
-      esbuildOptions.plugins = [cliCorePlugin()];
+      esbuildOptions.plugins = [cliPackagesPlugin()];
       const needs = readNeedsMarker(skeletonText);
       esbuildOptions.define = {
         "process.env.NODE_ENV": '"production"',
@@ -8854,10 +8445,10 @@ import fs22 from "fs-extra";
 import { FlowReferenceError as FlowReferenceError2 } from "@walkeros/core";
 
 // src/schemas/build-manifest.ts
-import { z as z6 } from "@walkeros/core/dev";
+import { z as z4 } from "@walkeros/core/dev";
 var BUILD_MANIFEST_VERSION = 1;
-var HttpUrlSchema = z6.url({ protocol: /^https?$/ });
-var OutputNameSchema = z6.string().regex(/^[A-Za-z0-9][A-Za-z0-9._-]*$/, "Must be a bare file name").describe("Output file name; its extension picks the format (.tar.gz packs)");
+var HttpUrlSchema = z4.url({ protocol: /^https?$/ });
+var OutputNameSchema = z4.string().regex(/^[A-Za-z0-9][A-Za-z0-9._-]*$/, "Must be a bare file name").describe("Output file name; its extension picks the format (.tar.gz packs)");
 var BUNDLE_TARGET_NAMES = [
   "cdn",
   "cdn-skeleton",
@@ -8873,8 +8464,8 @@ var RESERVED_HEADERS = /* @__PURE__ */ new Set([
 var OutputFields = {
   outputName: OutputNameSchema,
   putUrl: HttpUrlSchema.describe("Presigned PUT for exactly this output"),
-  contentType: z6.string().min(1).optional().describe("Content-Type sent with the PUT (must match a signed header)"),
-  headers: z6.record(z6.string().min(1), z6.string()).refine(
+  contentType: z4.string().min(1).optional().describe("Content-Type sent with the PUT (must match a signed header)"),
+  headers: z4.record(z4.string().min(1), z4.string()).refine(
     (headers) => Object.keys(headers).every(
       (name) => !RESERVED_HEADERS.has(name.toLowerCase())
     ),
@@ -8883,68 +8474,68 @@ var OutputFields = {
     "Extra headers sent with the PUT (for headers a presign signs); never logged"
   )
 };
-var BuildBundleArtifactSchema = z6.object({
-  target: z6.enum(BUNDLE_TARGET_NAMES).describe("Named bundle target"),
+var BuildBundleArtifactSchema = z4.object({
+  target: z4.enum(BUNDLE_TARGET_NAMES).describe("Named bundle target"),
   ...OutputFields
 }).strict();
-var BuildWrapOptionsSchema = z6.object({
-  windowCollector: z6.string().min(1).optional(),
-  windowElb: z6.string().min(1).optional(),
-  preview: z6.object({
-    enabled: z6.boolean(),
-    keyring: z6.array(
-      z6.object({ kid: z6.string(), spki: z6.string() }).strict()
+var BuildWrapOptionsSchema = z4.object({
+  windowCollector: z4.string().min(1).optional(),
+  windowElb: z4.string().min(1).optional(),
+  preview: z4.object({
+    enabled: z4.boolean(),
+    keyring: z4.array(
+      z4.object({ kid: z4.string(), spki: z4.string() }).strict()
     ),
-    iss: z6.string(),
-    pb: z6.string().optional(),
-    acceptForeign: z6.boolean().optional(),
-    demoAllowlist: z6.array(z6.string()).optional(),
-    previewOrigin: z6.string()
+    iss: z4.string(),
+    pb: z4.string().optional(),
+    acceptForeign: z4.boolean().optional(),
+    demoAllowlist: z4.array(z4.string()).optional(),
+    previewOrigin: z4.string()
   }).strict().optional(),
-  previewGrantTargets: z6.array(z6.string()).optional(),
-  observe: z6.object({
-    url: z6.string(),
-    binding: z6.string(),
-    flowId: z6.string().optional(),
-    level: z6.enum(["off", "standard", "trace"]).optional(),
-    sample: z6.number().min(0).max(1).optional()
+  previewGrantTargets: z4.array(z4.string()).optional(),
+  observe: z4.object({
+    url: z4.string(),
+    binding: z4.string(),
+    flowId: z4.string().optional(),
+    level: z4.enum(["off", "standard", "trace"]).optional(),
+    sample: z4.number().min(0).max(1).optional()
   }).strict().optional(),
-  moin: z6.object({ app: z6.string(), base: z6.string() }).strict().optional().describe("Tag Mode loader target; absent, the production app"),
-  minify: z6.boolean().optional(),
-  minifyOptions: z6.object({
-    identifiers: z6.boolean().optional(),
-    syntax: z6.boolean().optional(),
-    whitespace: z6.boolean().optional(),
-    keepNames: z6.boolean().optional(),
-    legalComments: z6.enum(["none", "inline", "eof", "linked", "external"]).optional()
+  moin: z4.object({ app: z4.string(), base: z4.string() }).strict().optional().describe("Tag Mode loader target; absent, the production app"),
+  minify: z4.boolean().optional(),
+  minifyOptions: z4.object({
+    identifiers: z4.boolean().optional(),
+    syntax: z4.boolean().optional(),
+    whitespace: z4.boolean().optional(),
+    keepNames: z4.boolean().optional(),
+    legalComments: z4.enum(["none", "inline", "eof", "linked", "external"]).optional()
   }).strict().optional(),
-  target: z6.string().min(1).optional().describe("esbuild target")
+  target: z4.string().min(1).optional().describe("esbuild target")
 }).strict().describe("Options forwarded to wrapSkeleton");
-var BuildWrapArtifactSchema = z6.object({
-  target: z6.literal("wrap"),
-  platform: z6.enum(["browser", "node"]),
-  skeleton: z6.union([
-    z6.object({ url: HttpUrlSchema }).strict(),
-    z6.object({ artifact: OutputNameSchema }).strict()
+var BuildWrapArtifactSchema = z4.object({
+  target: z4.literal("wrap"),
+  platform: z4.enum(["browser", "node"]),
+  skeleton: z4.union([
+    z4.object({ url: HttpUrlSchema }).strict(),
+    z4.object({ artifact: OutputNameSchema }).strict()
   ]).describe(
     "The skeleton to wrap: a GET URL, or the outputName of an earlier bundle artifact in this manifest"
   ),
   options: BuildWrapOptionsSchema.optional(),
   ...OutputFields
 }).strict();
-var BuildArtifactSchema = z6.union([
+var BuildArtifactSchema = z4.union([
   BuildBundleArtifactSchema,
   BuildWrapArtifactSchema
 ]);
-var BuildManifestSchema = z6.object({
-  version: z6.literal(BUILD_MANIFEST_VERSION),
-  toolchain: z6.string().min(1).describe("Exact @walkeros/cli version; any other version refuses"),
-  flowConfig: z6.record(z6.string(), z6.unknown()).optional().describe("Flow.Json to bundle; required when any bundle artifact is"),
-  flowName: z6.string().min(1).optional(),
-  buildEnv: z6.record(z6.string(), z6.string()).optional().describe(
+var BuildManifestSchema = z4.object({
+  version: z4.literal(BUILD_MANIFEST_VERSION),
+  toolchain: z4.string().min(1).describe("Exact @walkeros/cli version; any other version refuses"),
+  flowConfig: z4.record(z4.string(), z4.unknown()).optional().describe("Flow.Json to bundle; required when any bundle artifact is"),
+  flowName: z4.string().min(1).optional(),
+  buildEnv: z4.record(z4.string(), z4.string()).optional().describe(
     "Base env for web $env, beneath config.bundle.env. Never the CLI process's own env"
   ),
-  artifacts: z6.array(BuildArtifactSchema).min(1),
+  artifacts: z4.array(BuildArtifactSchema).min(1),
   resultPutUrl: HttpUrlSchema.describe("Presigned PUT for the result JSON")
 }).loose().superRefine((manifest, ctx) => {
   const seen = /* @__PURE__ */ new Set();
@@ -8987,21 +8578,21 @@ var BUILD_ERROR_CODES = [
   "BUILD_FAILED",
   "UPLOAD_FAILED"
 ];
-var BuildResultSchema = z6.object({
-  ok: z6.boolean(),
-  toolchain: z6.string().describe("The CLI version that ran the build"),
-  artifacts: z6.array(
-    z6.object({
-      target: z6.string(),
-      outputName: z6.string(),
-      bytes: z6.number().int().nonnegative(),
-      sha256: z6.string()
+var BuildResultSchema = z4.object({
+  ok: z4.boolean(),
+  toolchain: z4.string().describe("The CLI version that ran the build"),
+  artifacts: z4.array(
+    z4.object({
+      target: z4.string(),
+      outputName: z4.string(),
+      bytes: z4.number().int().nonnegative(),
+      sha256: z4.string()
     })
   ).describe("Outputs PUT successfully, in manifest order"),
-  error: z6.object({
-    code: z6.enum(BUILD_ERROR_CODES),
-    message: z6.string(),
-    outputName: z6.string().optional().describe("The artifact being built when the error occurred")
+  error: z4.object({
+    code: z4.enum(BUILD_ERROR_CODES),
+    message: z4.string(),
+    outputName: z4.string().optional().describe("The artifact being built when the error occurred")
   }).optional()
 }).meta({ id: "BuildResult", title: "walkeros bundle --manifest result" });
 
@@ -9052,16 +8643,16 @@ async function fetchWithRetry(url, init, options) {
     if (failure instanceof Response && !isTransientStatus(failure.status)) {
       throw new Error(`${label} failed: ${reason}`);
     }
-    const delay4 = BACKOFF_MS[attempt - 1];
-    if (delay4 === void 0) {
+    const delay2 = BACKOFF_MS[attempt - 1];
+    if (delay2 === void 0) {
       throw new Error(
         `${label} failed after ${maxAttempts} attempts: ${reason}`
       );
     }
     warn?.(
-      `${label} attempt ${attempt}/${maxAttempts} failed: ${reason}, retrying in ${delay4 / 1e3}s`
+      `${label} attempt ${attempt}/${maxAttempts} failed: ${reason}, retrying in ${delay2 / 1e3}s`
     );
-    await sleep(delay4);
+    await sleep(delay2);
   }
 }
 
@@ -9549,22 +9140,13 @@ export {
   bundle,
   bundleCommand,
   classifyStepProperties,
-  clearAuthFields,
   clientContextHeaders,
   collectKnownSecrets,
-  completeDeviceLogin,
   containsCodeMarkers,
-  credentialSource,
-  deleteConfig,
   formatPushResult,
-  getAuthHeaders,
   getClientContext,
   loadConfig,
   loadJsonConfig,
-  login,
-  loginCommand,
-  logout,
-  logoutCommand,
   push,
   pushCommand,
   readConfig,
@@ -9573,7 +9155,6 @@ export {
   resolveAppUrl,
   resolveExportName,
   resolveManifestSource,
-  resolveToken,
   runBuildManifest,
   selectDevExamples,
   setClientContext,
@@ -9581,14 +9162,13 @@ export {
   simulateDestination,
   simulateSource,
   simulateTransformer,
-  startDeviceAuthorization,
   telemetry_exports as telemetry,
   telemetryDisableCommand,
   telemetryEnableCommand,
   telemetryStatusCommand,
   validate,
   validateCommand,
-  validateFlowStructure2 as validateFlowStructure,
+  validateFlowStructure3 as validateFlowStructure,
   whoami,
   whoamiCommand,
   wrapSkeleton,