@walkeros/cli 4.8.1 → 4.8.3-next-1793115089237

package/dist/validate.js

@@ -2,7 +2,7 @@
 import * as fs9 from "fs";
 import * as path3 from "path";
 import chalk2 from "chalk";
-import { isObject as isObject7 } from "@walkeros/core";
+import { isObject as isObject8 } from "@walkeros/core";
 
 // src/core/cli-logger.ts
 import chalk from "chalk";
@@ -133,34 +133,6 @@ import fs4 from "fs-extra";
 // src/core/stdin.ts
 import fs5 from "fs-extra";
 
-// src/core/oauth-client.ts
-import { z as z2 } from "zod";
-
-// src/core/app-fetch.ts
-import { z } from "zod";
-var AppErrorSchema = z.object({
-  error: z.object({ message: z.string().min(1) })
-});
-
-// src/core/oauth-client.ts
-var DeviceAuthorizationSchema = z2.object({
-  device_code: z2.string().min(1),
-  user_code: z2.string().min(1),
-  verification_uri: z2.string().min(1),
-  verification_uri_complete: z2.string().min(1).optional(),
-  expires_in: z2.number().int().nonnegative(),
-  interval: z2.number().int().nonnegative()
-});
-var TokenSchema = z2.object({
-  access_token: z2.string().min(1),
-  expires_in: z2.number().int().nonnegative(),
-  refresh_token: z2.string().min(1).optional()
-});
-var ErrorSchema = z2.object({
-  error: z2.string().min(1),
-  error_description: z2.string().optional()
-});
-
 // src/core/event-validation.ts
 import { schemas } from "@walkeros/core/dev";
 var { PartialEventSchema } = schemas;
@@ -256,6 +228,7 @@ var { safeParseConfig } = schemas2;
 // src/config/loader.ts
 import fs7 from "fs-extra";
 import { getFlowSettings, getPlatform } from "@walkeros/core";
+import { validateFlowStructure } from "@walkeros/core/dev";
 
 // src/core/content-digest.ts
 import { createHash } from "crypto";
@@ -265,16 +238,9 @@ import fs6 from "fs-extra";
 import { checkWindowCollector } from "@walkeros/core";
 
 // src/commands/validate/validators/contract.ts
-import { isObject as isObject2 } from "@walkeros/core";
+import { CONTRACT_RULE_KEYS, isObject as isObject2 } from "@walkeros/core";
+var KNOWN_KEYS = new Set(CONTRACT_RULE_KEYS);
 var SECTION_KEYS = ["globals", "context", "custom", "user", "consent"];
-var KNOWN_KEYS = /* @__PURE__ */ new Set([
-  "extend",
-  "tagging",
-  "description",
-  "events",
-  "schema",
-  ...SECTION_KEYS
-]);
 function validateContract(input) {
   const errors = [];
   const warnings = [];
@@ -315,7 +281,9 @@ function validateContract(input) {
     const keys = Object.keys(obj);
     const unknownKeys = keys.filter((k) => !KNOWN_KEYS.has(k));
     const hasKnownKey = keys.some((k) => KNOWN_KEYS.has(k));
-    const objectValuedUnknown = unknownKeys.filter((k) => isObject2(obj[k]));
+    const objectValuedUnknown = unknownKeys.filter(
+      (k) => isObject2(obj[k]) && !SECTION_KEYS.includes(k)
+    );
     if (!hasKnownKey && objectValuedUnknown.length > 0) {
       errors.push({
         path: name,
@@ -325,9 +293,9 @@ function validateContract(input) {
       continue;
     }
     for (const key of unknownKeys) {
-      warnings.push({
+      errors.push({
         path: `${name}.${key}`,
-        message: `Unknown contract key "${key}" is ignored`,
+        message: SECTION_KEYS.includes(key) ? `Contract section "${key}" is not enforced: the validate transformer reads only "events" and "schema". Put the rule into "schema" (a JSON Schema for the whole event), for example "schema": { "properties": { "${key}": { ... } } }.` : `Unknown contract key "${key}" is not supported. Known keys: ${[...KNOWN_KEYS].join(", ")}.`,
         code: "UNKNOWN_CONTRACT_KEY"
       });
     }
@@ -361,18 +329,6 @@ function validateContract(input) {
         });
       }
     }
-    for (const key of SECTION_KEYS) {
-      if (key in obj) {
-        if (typeof obj[key] !== "object" || obj[key] === null) {
-          errors.push({
-            path: `${name}.${key}`,
-            message: `Section "${key}" must be a JSON Schema object`,
-            value: obj[key],
-            code: "INVALID_SECTION"
-          });
-        }
-      }
-    }
     if (obj.events !== void 0) {
       if (typeof obj.events !== "object" || obj.events === null) {
         errors.push({
@@ -481,12 +437,17 @@ import {
   ENV_MARKER_PREFIX as ENV_MARKER_PREFIX2,
   getByPath,
   getRouteGraph,
-  isObject as isObject5,
+  isObject as isObject6,
   REF_CONTRACT,
   resolveContracts,
+  SECRET_MARKER_PREFIX as SECRET_MARKER_PREFIX2,
   validateStepEntry
 } from "@walkeros/core";
-import { schemas as schemas3, validateFlowStructure } from "@walkeros/core/dev";
+import {
+  checkStepKeys,
+  schemas as schemas3,
+  validateFlowStructure as validateFlowStructure2
+} from "@walkeros/core/dev";
 import {
   validateEventAgainstContract
 } from "@walkeros/transformer-validate";
@@ -675,14 +636,12 @@ function resolutionCode(error) {
 }
 
 // src/commands/validate/validators/settings.ts
-import * as fs8 from "fs";
-import * as path2 from "path";
 import Ajv from "ajv";
 import {
+  createLogger,
   ENV_MARKER_PREFIX,
-  fetchPackage,
   getErrorMessage as getErrorMessage3,
-  isObject as isObject4,
+  isObject as isObject5,
   REF_CODE_PREFIX,
   REF_STORE,
   SECRET_MARKER_PREFIX
@@ -728,15 +687,191 @@ function resolveExportName(flow, kind, id) {
 
 // src/core/step-packages.ts
 import { packageNameToVariable } from "@walkeros/core";
+function getFlowSection(flow, section) {
+  switch (section) {
+    case "sources":
+      return flow.sources;
+    case "destinations":
+      return flow.destinations;
+    case "transformers":
+      return flow.transformers;
+    case "stores":
+      return flow.stores;
+  }
+}
+function isLocalPath(spec) {
+  return spec.startsWith(".") || spec.startsWith("/");
+}
 function parsePackageSpec(spec) {
   const at = spec.lastIndexOf("@");
   if (at <= 0) return { name: spec };
   const version = spec.slice(at + 1);
   return version ? { name: spec.slice(0, at), version } : { name: spec.slice(0, at) };
 }
+function detectStepPackages(flowSettings, section) {
+  const packages = /* @__PURE__ */ new Set();
+  const steps = getFlowSection(flowSettings, section);
+  if (steps) {
+    for (const [, stepConfig] of Object.entries(steps)) {
+      if (typeof stepConfig !== "object" || stepConfig === null) continue;
+      if (typeof stepConfig.package === "string") {
+        packages.add(stepConfig.package);
+      }
+    }
+  }
+  return packages;
+}
+function collectAllStepPackages(flowSettings) {
+  const allPackages = /* @__PURE__ */ new Set();
+  const sections = [
+    "sources",
+    "destinations",
+    "transformers",
+    "stores"
+  ];
+  for (const section of sections) {
+    for (const pkg of detectStepPackages(flowSettings, section)) {
+      allPackages.add(pkg);
+    }
+  }
+  return allPackages;
+}
+function applyStepPackages(flowSettings, packages, logger) {
+  const stepPackages = collectAllStepPackages(flowSettings);
+  const originalPins = /* @__PURE__ */ new Map();
+  const inlineSeen = /* @__PURE__ */ new Map();
+  const rewriteSteps = (from, to) => {
+    for (const section of [
+      "sources",
+      "destinations",
+      "transformers",
+      "stores"
+    ]) {
+      const steps = getFlowSection(flowSettings, section);
+      if (!steps) continue;
+      for (const step of Object.values(steps)) {
+        if (step.package === from) {
+          step.package = to;
+        }
+      }
+    }
+  };
+  for (const pkg of stepPackages) {
+    if (isLocalPath(pkg)) {
+      const varName = packageNameToVariable(pkg);
+      if (!packages[varName]) {
+        packages[varName] = {
+          path: pkg
+        };
+      }
+      rewriteSteps(pkg, varName);
+      continue;
+    }
+    const { name, version } = parsePackageSpec(pkg);
+    if (!originalPins.has(name)) {
+      const entry = packages[name];
+      originalPins.set(
+        name,
+        entry?.version !== void 0 || entry?.path !== void 0
+      );
+    }
+    const hasBundlePin = originalPins.get(name) === true;
+    if (name !== pkg) {
+      rewriteSteps(pkg, name);
+    }
+    if (version && !hasBundlePin) {
+      const seen = inlineSeen.get(name);
+      if (seen !== void 0 && seen !== version) {
+        throw new Error(
+          `Conflicting inline versions for ${name}: "${seen}" and "${version}" are declared by different steps. Pin one version in config.bundle.packages.`
+        );
+      }
+      inlineSeen.set(name, version);
+    }
+    const existing = packages[name];
+    if (!existing) {
+      packages[name] = version ? { version } : {};
+    } else if (version && !existing.path) {
+      if (!existing.version) {
+        existing.version = version;
+      } else if (existing.version !== version) {
+        logger.warn(
+          `Package ${name}: config.bundle.packages pins ${existing.version}; a step declares ${version} inline. Using the bundle pin.`
+        );
+      }
+    }
+  }
+}
+var KIND_TO_SECTION = {
+  source: "sources",
+  transformer: "transformers",
+  destination: "destinations",
+  store: "stores"
+};
+function resolveStepPackage(flow, kind, id, logger) {
+  const normalizedFlow = structuredClone(flow);
+  const packages = structuredClone(
+    normalizedFlow.config?.bundle?.packages ?? {}
+  );
+  applyStepPackages(normalizedFlow, packages, logger);
+  const bucket = getFlowSection(normalizedFlow, KIND_TO_SECTION[kind]);
+  const step = bucket?.[id];
+  if (!step) {
+    const available = Object.keys(bucket ?? {}).join(", ") || "(none)";
+    throw new Error(
+      `${kind} "${id}" not found in flow. Available: ${available}`
+    );
+  }
+  if (typeof step.package !== "string") {
+    throw new Error(
+      `${kind}.${id} has no "package" (inline code cannot be set up).`
+    );
+  }
+  const declared = getFlowSection(flow, KIND_TO_SECTION[kind])?.[id]?.package;
+  return {
+    packageName: step.package,
+    label: declared !== void 0 && isLocalPath(declared) ? declared : step.package,
+    spec: packages[step.package] ?? {},
+    overrides: normalizedFlow.config?.bundle?.overrides ?? {},
+    normalizedFlow
+  };
+}
+
+// src/core/package-info.ts
+import * as fs8 from "fs";
+import * as path2 from "path";
+import { fetchPackage, isObject as isObject4, parseWalkerOSJson } from "@walkeros/core";
+function readJson(file) {
+  return JSON.parse(fs8.readFileSync(file, "utf-8"));
+}
+async function readStepPackageInfo(resolved, options) {
+  const { packageName, spec } = resolved;
+  if (spec.path === void 0)
+    return fetchPackage(packageName, {
+      ...spec.version ? { version: spec.version } : {},
+      client: options.client
+    });
+  if (options.configDir === void 0)
+    throw new Error(
+      "it is a local path package and the input is not a file, so there is no directory to read it from"
+    );
+  const root = path2.isAbsolute(spec.path) ? spec.path : path2.resolve(options.configDir, spec.path);
+  const file = [
+    path2.join(root, "dist", "walkerOS.json"),
+    path2.join(root, "walkerOS.json")
+  ].find((candidate) => fs8.existsSync(candidate));
+  if (!file) throw new Error(`no walkerOS.json under ${root}`);
+  const meta = readJson(file);
+  if (!isObject4(meta)) throw new Error(`${file} is not a JSON object`);
+  const pkgFile = path2.join(root, "package.json");
+  const pkg = fs8.existsSync(pkgFile) ? readJson(pkgFile) : void 0;
+  const version = isObject4(pkg) && typeof pkg.version === "string" ? pkg.version : void 0;
+  return { ...parseWalkerOSJson(meta), ...version ? { version } : {} };
+}
 
 // src/commands/validate/validators/settings.ts
-var CLIENT_HEADER = "walkeros-cli/4.8.1";
+var CLIENT_HEADER = "walkeros-cli/4.8.3-next-1793115089237";
+var LOGGER = createLogger();
 function createSettingsContext(configDir) {
   return { configDir, cache: /* @__PURE__ */ new Map(), compiled: /* @__PURE__ */ new Map() };
 }
@@ -747,7 +882,7 @@ function selectSettingsSchema(pkg, packageLabel, exportName) {
       pkg.exportSchemas,
       exportName
     ) ? pkg.exportSchemas[exportName] : void 0;
-    if (!isObject4(entry))
+    if (!isObject5(entry))
       return {
         ok: false,
         reason: `${packageLabel} has no export "${exportName}"`
@@ -775,7 +910,7 @@ function valueAt(root, segments) {
   let current = root;
   for (const segment of segments) {
     if (Array.isArray(current)) current = current[Number(segment)];
-    else if (isObject4(current)) current = current[segment];
+    else if (isObject5(current)) current = current[segment];
     else return void 0;
   }
   return current;
@@ -790,7 +925,7 @@ function prepareSettings(settings) {
   const walk = (value, segments) => {
     if (Array.isArray(value))
       return value.map((item, index) => walk(item, [...segments, `${index}`]));
-    if (isObject4(value))
+    if (isObject5(value))
       return Object.fromEntries(
         Object.entries(value).map(([key, item]) => [
           key,
@@ -834,62 +969,9 @@ function prepareSettings(settings) {
 function isUnder(segments, prefix) {
   return prefix.every((segment, index) => segments[index] === segment);
 }
-function bundlePin(rawFlow, name) {
-  const config = isObject4(rawFlow) ? rawFlow.config : void 0;
-  const bundle = isObject4(config) ? config.bundle : void 0;
-  const packages = isObject4(bundle) ? bundle.packages : void 0;
-  const pin = isObject4(packages) ? packages[name] : void 0;
-  if (!isObject4(pin)) return {};
-  return {
-    ...typeof pin.version === "string" ? { version: pin.version } : {},
-    ...typeof pin.path === "string" ? { path: pin.path } : {}
-  };
-}
-function packageSource(spec, rawFlow) {
-  if (spec.startsWith(".") || spec.startsWith("/"))
-    return { name: spec, localPath: spec };
-  const { name, version } = parsePackageSpec(spec);
-  const pin = bundlePin(rawFlow, name);
-  if (pin.path) return { name, localPath: pin.path };
-  const pinned = pin.version ?? version;
-  return pinned ? { name, version: pinned } : { name };
-}
-function readJson(file) {
-  return JSON.parse(fs8.readFileSync(file, "utf-8"));
-}
-function readLocalSchema(source, configDir) {
-  const localPath = source.localPath ?? "";
-  const root = path2.isAbsolute(localPath) ? localPath : path2.resolve(configDir, localPath);
-  const file = [
-    path2.join(root, "dist", "walkerOS.json"),
-    path2.join(root, "walkerOS.json")
-  ].find((candidate) => fs8.existsSync(candidate));
-  if (!file) throw new Error(`no walkerOS.json under ${root}`);
-  const meta = readJson(file);
-  const pkgFile = path2.join(root, "package.json");
-  const pkg = fs8.existsSync(pkgFile) ? readJson(pkgFile) : void 0;
-  const schemas5 = isObject4(meta) ? meta.schemas : void 0;
-  const exportSchemas = isObject4(meta) ? meta.exportSchemas : void 0;
-  const declared = isObject4(meta) && isObject4(meta.$meta) ? meta.$meta.exports : void 0;
-  const version = isObject4(pkg) && typeof pkg.version === "string" ? pkg.version : void 0;
-  return {
-    ...version ? { version } : {},
-    settings: isObject4(schemas5) ? schemas5.settings : void 0,
-    ...isObject4(exportSchemas) ? { exportSchemas } : {},
-    ...isObject4(declared) ? { exports: Object.keys(declared) } : {}
-  };
-}
-async function loadSchema(source, context) {
-  if (source.localPath !== void 0) {
-    const configDir = context.configDir;
-    if (configDir === void 0)
-      throw new Error(
-        "it is a local path package and the input is not a file, so there is no directory to read it from"
-      );
-    return readLocalSchema(source, configDir);
-  }
-  const info = await fetchPackage(source.name, {
-    ...source.version ? { version: source.version } : {},
+async function loadSchema(resolved, context) {
+  const info = await readStepPackageInfo(resolved, {
+    configDir: context.configDir,
     client: CLIENT_HEADER
   });
   return {
@@ -900,7 +982,7 @@ async function loadSchema(source, context) {
   };
 }
 function compileSettings(settings) {
-  if (!isObject4(settings)) return void 0;
+  if (!isObject5(settings)) return void 0;
   const ajv = new Ajv({ allErrors: true, validateFormats: false });
   try {
     return { ok: true, validate: ajv.compile(settings) };
@@ -908,26 +990,26 @@ function compileSettings(settings) {
     return { ok: false, message: getErrorMessage3(error) };
   }
 }
-function sourceKey(source) {
-  return source.localPath ? `path:${source.localPath}` : `${source.name}@${source.version ?? "latest"}`;
+function sourceKey({ packageName, spec }) {
+  return spec.path !== void 0 ? `path:${spec.path}` : `${packageName}@${spec.version ?? "latest"}`;
 }
-function cachedSchema(source, context) {
-  const key = sourceKey(source);
+function cachedSchema(resolved, context) {
+  const key = sourceKey(resolved);
   let pending = context.cache.get(key);
   if (!pending) {
-    pending = loadSchema(source, context);
+    pending = loadSchema(resolved, context);
     context.cache.set(key, pending);
   }
   return pending;
 }
-function cachedCompile(source, exportName, settings, context) {
-  const key = `${sourceKey(source)}#${exportName ?? ""}`;
+function cachedCompile(resolved, exportName, settings, context) {
+  const key = `${sourceKey(resolved)}#${exportName ?? ""}`;
   if (context.compiled.has(key)) return context.compiled.get(key);
   const compiled = compileSettings(settings);
   context.compiled.set(key, compiled);
   return compiled;
 }
-async function checkStepSettings(target, resolvedFlow, rawFlow, check, context) {
+async function checkStepSettings(target, resolvedFlow, check, context) {
   const at = `flows.${target.flow}.${target.section}.${target.key}`;
   const outcome = { findings: [], skipped: [], deferred: [] };
   const spec = typeof target.entry.package === "string" ? target.entry.package : "";
@@ -940,33 +1022,51 @@ async function checkStepSettings(target, resolvedFlow, rawFlow, check, context)
     });
     return outcome;
   }
-  const source = packageSource(spec, rawFlow);
+  let resolved;
+  try {
+    resolved = resolveStepPackage(
+      resolvedFlow,
+      SECTION_KIND[target.section],
+      target.key,
+      LOGGER
+    );
+  } catch (error) {
+    outcome.skipped.push({
+      path: at,
+      check,
+      reason: `Schema for ${spec} could not be loaded: ${getErrorMessage3(error)}`,
+      code: "SCHEMA_UNAVAILABLE"
+    });
+    return outcome;
+  }
+  const { label } = resolved;
+  const pinned = resolved.spec.path === void 0 ? resolved.spec.version : void 0;
   let schema;
   try {
-    schema = await cachedSchema(source, context);
+    schema = await cachedSchema(resolved, context);
   } catch (error) {
     outcome.skipped.push({
       path: at,
       check,
-      reason: `Schema for ${source.name}${source.version ? `@${source.version}` : ""} could not be loaded: ${getErrorMessage3(error)}`,
+      reason: `Schema for ${label}${pinned ? `@${pinned}` : ""} could not be loaded: ${getErrorMessage3(error)}`,
       code: "SCHEMA_UNAVAILABLE"
     });
     return outcome;
   }
   outcome.checked = {
     path: at,
-    package: source.name,
+    package: label,
     ...schema.version ? { version: schema.version } : {}
   };
   const { exportName } = resolveExportName(
-    resolvedFlow,
+    resolved.normalizedFlow,
     SECTION_KIND[target.section],
     target.key
   );
-  const version = schema.version ?? source.version;
+  const version = schema.version ?? pinned;
   const selection = selectSettingsSchema(
     schema,
-    version ? `${source.name}@${version}` : source.name,
+    version ? `${label}@${version}` : label,
     exportName
   );
   if (!selection.ok) {
@@ -979,7 +1079,7 @@ async function checkStepSettings(target, resolvedFlow, rawFlow, check, context)
     return outcome;
   }
   const compiled = cachedCompile(
-    source,
+    resolved,
     exportName,
     selection.settings,
     context
@@ -988,7 +1088,7 @@ async function checkStepSettings(target, resolvedFlow, rawFlow, check, context)
     outcome.skipped.push({
       path: at,
       check,
-      reason: `Package ${source.name} has no settings schema`,
+      reason: `Package ${label} has no settings schema`,
       code: "NO_SETTINGS_SCHEMA"
     });
     return outcome;
@@ -997,14 +1097,14 @@ async function checkStepSettings(target, resolvedFlow, rawFlow, check, context)
     outcome.skipped.push({
       path: at,
       check,
-      reason: `The settings schema of ${source.name} cannot be compiled: ${compiled.message}`,
+      reason: `The settings schema of ${label} cannot be compiled: ${compiled.message}`,
       code: "SCHEMA_UNAVAILABLE"
     });
     return outcome;
   }
   const validate2 = compiled.validate;
   const step = stepOf(resolvedFlow, target.section, target.key);
-  const config = isObject4(step?.config) ? step.config : {};
+  const config = isObject5(step?.config) ? step.config : {};
   const prepared = prepareSettings(config.settings ?? {});
   const base = `${at}.config.settings`;
   for (const { segments, reference } of prepared.deferred) {
@@ -1051,7 +1151,9 @@ var { validateFlowConfig: validateFlowConfig2 } = schemas3;
 var DEPRECATED_PACKAGES = {
   "@walkeros/store-memory": "has been removed. Use the built-in cache by omitting cache.store, or remove the store declaration if it was only used as a cache target."
 };
-var OPEN_STEP_KINDS = [
+var STEP_KINDS = [
+  ["sources", "Source"],
+  ["transformers", "Transformer"],
   ["destinations", "Destination"],
   ["stores", "Store"]
 ];
@@ -1083,24 +1185,22 @@ async function validateFlowWithPackages(input, options = {}) {
       continue;
     }
     for (const section of ENTRY_SECTIONS) {
-      const steps = isObject5(rawFlow[section]) ? rawFlow[section] : {};
+      const steps = isObject6(rawFlow[section]) ? rawFlow[section] : {};
       for (const [key, entry] of Object.entries(steps)) {
-        if (!isObject5(entry) || entry.package === void 0) continue;
+        if (!isObject6(entry) || entry.package === void 0) continue;
         const target = { flow: name, section, key, entry };
         pending.push(
-          checkStepSettings(
-            target,
-            flow,
-            rawFlow,
-            "flow:package-settings",
-            context
-          )
+          checkStepSettings(target, flow, "flow:package-settings", context)
         );
       }
     }
   }
   for (const outcome of await Promise.all(pending)) {
-    result.warnings.push(...outcome.findings);
+    for (const finding of outcome.findings) {
+      if (finding.keyword === "additionalProperties")
+        result.errors.push(finding);
+      else result.warnings.push(finding);
+    }
     run.skipped.push(...outcome.skipped);
     deferred.push(...outcome.deferred);
     if (outcome.checked) packages.push(outcome.checked);
@@ -1108,6 +1208,7 @@ async function validateFlowWithPackages(input, options = {}) {
   result.details.scope = describeScope(scope, run.checks);
   result.details.deferred = [...result.details.deferred ?? [], ...deferred];
   if (packages.length > 0) result.details.packages = packages;
+  result.valid = result.errors.length === 0;
   return result;
 }
 function runFlowChecks(input, options) {
@@ -1144,9 +1245,9 @@ function runFlowChecks(input, options) {
     };
   }
   errors.push(...scope.errors);
-  const config = isObject5(input) ? input : {};
+  const config = isObject6(input) ? input : {};
   const flowsValue = config.flows;
-  const flows = isObject5(flowsValue) ? flowsValue : void 0;
+  const flows = isObject6(flowsValue) ? flowsValue : void 0;
   const allFlows = scope.allFlows;
   const inScope = (path4) => {
     const flow = flowOfPath(path4, allFlows);
@@ -1166,8 +1267,13 @@ function runFlowChecks(input, options) {
   for (const issue of coreResult.errors) {
     const path4 = issue.path || "root";
     if (!inScope(path4)) continue;
-    if (path4 === "contract" && contractErrors > 0) continue;
-    errors.push({ path: path4, message: issue.message, code: "SCHEMA_VALIDATION" });
+    if ((path4 === "contract" || path4.startsWith("contract.")) && contractErrors > 0)
+      continue;
+    errors.push({
+      path: path4,
+      message: issue.message,
+      code: issue.code ?? "SCHEMA_VALIDATION"
+    });
   }
   for (const issue of coreResult.warnings) {
     const path4 = issue.path || "root";
@@ -1184,13 +1290,13 @@ function runFlowChecks(input, options) {
   checks.push("flow:steps");
   for (const flowName of scope.flows) {
     const flowValue = flows?.[flowName];
-    if (!isObject5(flowValue)) continue;
+    if (!isObject6(flowValue)) continue;
     const transformersValue = flowValue.transformers;
-    if (isObject5(transformersValue)) {
+    if (isObject6(transformersValue)) {
       for (const [name, transformerValue] of Object.entries(
         transformersValue
       )) {
-        if (!isObject5(transformerValue)) continue;
+        if (!isObject6(transformerValue)) continue;
         const result2 = validateStepEntry(transformerValue, "Transformer");
         if (!result2.ok) {
           errors.push({
@@ -1201,20 +1307,13 @@ function runFlowChecks(input, options) {
         }
       }
     }
-    for (const [section, kind] of OPEN_STEP_KINDS) {
+    for (const [section, kind] of STEP_KINDS) {
       const steps = flowValue[section];
-      if (!isObject5(steps)) continue;
+      if (!isObject6(steps)) continue;
       for (const [name, step] of Object.entries(steps)) {
-        if (!isObject5(step)) continue;
+        if (!isObject6(step)) continue;
         const at = `flows.${flowName}.${section}.${name}`;
-        for (const key of unknownStepKeys(step, kind)) {
-          warnings.push({
-            path: `${at}.${key}`,
-            message: `Unknown key "${key}" on ${kind} is ignored by the runtime`,
-            suggestion: "Remove the key, or move it to where it belongs.",
-            code: "UNKNOWN_KEY"
-          });
-        }
+        errors.push(...checkStepKeys(step, kind, at));
         const pkg = step.package;
         if (typeof pkg === "string" && pkg in DEPRECATED_PACKAGES) {
           warnings.push({
@@ -1225,6 +1324,7 @@ function runFlowChecks(input, options) {
         }
       }
     }
+    checkWebLoggerFormat(flowName, flowValue, errors);
   }
   if (flows) {
     details.flowNames = allFlows;
@@ -1234,15 +1334,15 @@ function runFlowChecks(input, options) {
   let totalPackageCount = 0;
   for (const flowName of scope.flows) {
     const flowValue = flows?.[flowName];
-    if (!isObject5(flowValue)) continue;
+    if (!isObject6(flowValue)) continue;
     const flowConfig = flowValue.config;
-    if (!isObject5(flowConfig)) continue;
+    if (!isObject6(flowConfig)) continue;
     const bundle = flowConfig.bundle;
-    if (!isObject5(bundle)) continue;
+    if (!isObject6(bundle)) continue;
     const packages = bundle.packages;
-    if (!isObject5(packages)) continue;
+    if (!isObject6(packages)) continue;
     for (const [pkgName, pkgConfigValue] of Object.entries(packages)) {
-      if (!isObject5(pkgConfigValue)) continue;
+      if (!isObject6(pkgConfigValue)) continue;
       if (!pkgConfigValue.version && !pkgConfigValue.path) {
         warnings.push({
           path: `flows.${flowName}.config.bundle.packages.${pkgName}`,
@@ -1288,7 +1388,7 @@ function runFlowChecks(input, options) {
     }
   };
   perFlow(["flow:structure"], (name, flow, file) => {
-    const structure = validateFlowStructure({
+    const structure = validateFlowStructure2({
       ...file,
       flows: { [name]: flow }
     });
@@ -1330,13 +1430,13 @@ function runFlowChecks(input, options) {
           warnings,
           options.strict === true,
           skipped,
-          isObject5(resolvedConfig) && isObject5(resolvedConfig.settings) ? resolvedConfig.settings : void 0
+          isObject6(resolvedConfig) && isObject6(resolvedConfig.settings) ? resolvedConfig.settings : void 0
         );
       }
       for (const [destName, dest] of Object.entries(flow.destinations || {})) {
-        if (!isObject5(dest.config)) continue;
+        if (!isObject6(dest.config)) continue;
         const mapping = dest.config.mapping;
-        if (!isObject5(mapping)) continue;
+        if (!isObject6(mapping)) continue;
         for (const key of Object.keys(mapping)) {
           if (key.includes(".") && !key.includes(" ")) {
             const parts = key.split(".");
@@ -1396,16 +1496,31 @@ function checkResolvedWindowCollector(name, raw, flow, errors, deferred) {
     code: "SCHEMA_VALIDATION"
   });
 }
-function unknownStepKeys(step, kind) {
-  const unknown = [];
-  const rest = { ...step };
-  for (; ; ) {
-    const verdict = validateStepEntry(rest, kind);
-    if (verdict.code !== "UNKNOWN_KEY" || verdict.key === void 0) break;
-    unknown.push(verdict.key);
-    Reflect.deleteProperty(rest, verdict.key);
+function checkWebLoggerFormat(flowName, flow, errors) {
+  if (!isObject6(flow.config) || flow.config.platform !== "web") return;
+  const at = `flows.${flowName}`;
+  const loggers = [];
+  if (isObject6(flow.collector))
+    loggers.push([`${at}.collector.logger`, flow.collector.logger]);
+  for (const [section] of STEP_KINDS) {
+    const steps = flow[section];
+    if (!isObject6(steps)) continue;
+    for (const [name, step] of Object.entries(steps)) {
+      if (isObject6(step) && isObject6(step.config))
+        loggers.push([
+          `${at}.${section}.${name}.config.logger`,
+          step.config.logger
+        ]);
+    }
+  }
+  for (const [path4, logger] of loggers) {
+    if (!isObject6(logger) || logger.format === void 0) continue;
+    errors.push({
+      path: `${path4}.format`,
+      message: "logger.format applies to server flows only: a web flow logs to the browser console, which has no output format. Remove it.",
+      code: "WEB_LOGGER_FORMAT"
+    });
   }
-  return unknown;
 }
 function routeTargets(spec) {
   if (spec === void 0) return [];
@@ -1504,21 +1619,21 @@ function isStepOut(value) {
   return Array.isArray(value) && value.every((entry) => Array.isArray(entry) && typeof entry[0] === "string");
 }
 function returnedEvents(value) {
-  if (isObject5(value)) return [isObject5(value.event) ? value.event : value];
+  if (isObject6(value)) return [isObject6(value.event) ? value.event : value];
   if (Array.isArray(value)) return value.flatMap(returnedEvents);
   return [];
 }
 function outEvents(out) {
   if (isStepOut(out)) {
     return out.flatMap(([head, first]) => {
-      if (head === "elb") return isObject5(first) ? [first] : [];
+      if (head === "elb") return isObject6(first) ? [first] : [];
       if (head === "return") return returnedEvents(first);
       return [];
     });
   }
   if (Array.isArray(out) || typeof out === "string")
     return out.length > 0 ? [out] : [];
-  return isObject5(out) && Object.keys(out).length > 0 ? [out] : [];
+  return isObject6(out) && Object.keys(out).length > 0 ? [out] : [];
 }
 function hasComparableOut(out) {
   return outEvents(out).length > 0;
@@ -1560,7 +1675,7 @@ function routeAt(spec, path4) {
   for (const key of path4) {
     if (typeof key === "number")
       current = Array.isArray(current) ? current[key] : void 0;
-    else current = isObject5(current) ? current[key] : void 0;
+    else current = isObject6(current) ? current[key] : void 0;
   }
   return current;
 }
@@ -1585,7 +1700,7 @@ function lintRoute(spec, position, known, errors, warnings) {
     if (node.stop && !node.match && node.kind !== "many") {
       const self = routeAt(spec, node.path);
       const list = routeAt(spec, node.path.slice(0, -1));
-      if (isObject5(self) && self.stop === true && typeof last === "number" && Array.isArray(list) && last < list.length - 1 && once(`stop:${where(node.path)}`)) {
+      if (isObject6(self) && self.stop === true && typeof last === "number" && Array.isArray(list) && last < list.length - 1 && once(`stop:${where(node.path)}`)) {
         const at = where(node.path);
         warnings.push({
           path: at,
@@ -1633,6 +1748,12 @@ function lintRoute(spec, position, known, errors, warnings) {
     }
   }
 }
+function hasRuntimeValue(value) {
+  if (typeof value === "string")
+    return value.includes(ENV_MARKER_PREFIX2) || value.startsWith(SECRET_MARKER_PREFIX2) || /\$(?:env|secret)\./.test(value);
+  if (Array.isArray(value)) return value.some(hasRuntimeValue);
+  return isObject6(value) && Object.values(value).some(hasRuntimeValue);
+}
 var VALIDATE_PACKAGE = "@walkeros/transformer-validate";
 function isValidateStep(step) {
   return step.package === VALIDATE_PACKAGE;
@@ -1651,7 +1772,7 @@ function resolveStepContracts(entries, contract) {
   }
   const sources = [];
   for (const [index, entry] of entries.entries()) {
-    if (isObject5(entry)) {
+    if (isObject6(entry)) {
       sources.push(entry);
       continue;
     }
@@ -1669,7 +1790,7 @@ function resolveStepContracts(entries, contract) {
         message: `contract "${match[1]}" is not defined in the root contract (defined: ${Object.keys(resolved).join(", ") || "none"})`
       };
     const rule = match[2] ? getByPath(resolved[match[1]], match[2]) : resolved[match[1]];
-    if (!isObject5(rule))
+    if (!isObject6(rule))
       return {
         ok: false,
         index,
@@ -1680,7 +1801,7 @@ function resolveStepContracts(entries, contract) {
   return { ok: true, sources };
 }
 function checkValidateStepExamples(stepPath, step, contract, errors, warnings, strict, skipped, resolvedSettings) {
-  const settings = resolvedSettings ?? (isObject5(step.config) && isObject5(step.config.settings) ? step.config.settings : {});
+  const settings = resolvedSettings ?? (isObject6(step.config) && isObject6(step.config.settings) ? step.config.settings : {});
   const contractPath = `${stepPath}.config.settings.contract`;
   if (settings.contract !== void 0 && !Array.isArray(settings.contract)) {
     if (step.examples)
@@ -1703,12 +1824,21 @@ function checkValidateStepExamples(stepPath, step, contract, errors, warnings, s
   }
   if (!step.examples) return;
   const contracts = resolution.sources;
+  if (contracts.some(hasRuntimeValue)) {
+    skipped?.push({
+      path: stepPath,
+      check: "flow:contract-examples",
+      reason: "the contract uses a $env or $secret value, known only when the bundle builds or runs, so the examples cannot be judged statically",
+      code: "CONTRACT_NOT_STATIC"
+    });
+    return;
+  }
   const mode = settings.mode === "strict" ? "strict" : "pass";
   const format = settings.format === true;
-  const output = isObject5(settings.output) ? settings.output : {};
+  const output = isObject6(settings.output) ? settings.output : {};
   const isValidPath = typeof output.isValid === "string" ? output.isValid : "source.valid";
   for (const [exName, example] of Object.entries(step.examples)) {
-    if (example.command || !isObject5(example.in)) continue;
+    if (example.command || !isObject6(example.in)) continue;
     if (example.out === void 0) continue;
     const event = example.in;
     const verdict = validateEventAgainstContract(event, void 0, {
@@ -1746,14 +1876,14 @@ function checkValidateStepExamples(stepPath, step, contract, errors, warnings, s
 }
 
 // src/commands/validate/validators/mapping.ts
-import { isObject as isObject6 } from "@walkeros/core";
+import { isObject as isObject7 } from "@walkeros/core";
 import { schemas as schemas4 } from "@walkeros/core/dev";
 var { RuleSchema } = schemas4.MappingSchemas;
 function isRule(value) {
-  return isObject6(value) && RuleSchema.safeParse(value).success;
+  return isObject7(value) && RuleSchema.safeParse(value).success;
 }
 function isNestedActions(key, value) {
-  if (key.includes(" ") || !isObject6(value)) return false;
+  if (key.includes(" ") || !isObject7(value)) return false;
   const rules = Object.values(value);
   return rules.length > 0 && rules.every(
     (rule) => Array.isArray(rule) ? rule.length > 0 && rule.every(isRule) : isRule(rule)
@@ -1763,7 +1893,7 @@ function validateMapping(input) {
   const errors = [];
   const warnings = [];
   const details = {};
-  if (!isObject6(input)) {
+  if (!isObject7(input)) {
     errors.push({
       path: "root",
       message: "Mapping must be an object with event patterns as keys",
@@ -1852,7 +1982,6 @@ async function validateEntry(path4, flowConfig, options = {}) {
     const outcome = await checkStepSettings(
       target,
       resolution.flow,
-      file?.flows[target.flow],
       "entry:settings",
       context
     );
@@ -1909,6 +2038,7 @@ var VALIDATE_CODES = [
   "CONTRACT_VIOLATION",
   "MAPPING_DOT_KEY",
   "FLOW_REF_WARNING",
+  "WEB_LOGGER_FORMAT",
   "FLOW_CYCLE",
   "VAR_CYCLE",
   // Structure (the bundler's own preflight, validateFlowStructure)
@@ -1917,7 +2047,11 @@ var VALIDATE_CODES = [
   "STORE_REFERENCE_NOT_FOUND",
   "STATE_STORE_UNKNOWN",
   "STATE_STORE_FILE",
-  "TRANSFORMER_MAPPING_NO_OP",
+  "MAPPING_NO_OP",
+  "MAPPING_VALUE_NO_OPERATOR",
+  "MAPPING_VALUE_PRODUCERS",
+  "BATCH_WITHOUT_PUSH_BATCH",
+  "MALFORMED_REFERENCE",
   // Resolution (getFlowSettings, as the bundler resolves the flow)
   "UNRESOLVED_REFERENCE",
   "MISSING_ENV",
@@ -1934,7 +2068,6 @@ var VALIDATE_CODES = [
   "INVALID_TAGGING",
   "INVALID_SCHEMA",
   "INVALID_EXTENDS",
-  "INVALID_SECTION",
   "INVALID_EVENTS",
   "CIRCULAR_EXTENDS",
   "INVALID_ENTITY_KEY",
@@ -1988,7 +2121,7 @@ function inapplicableOptions(type, options) {
 }
 function validateContractInput(input) {
   if (!isFlowJson(input)) return validateContract(input);
-  const contract = isObject7(input) ? input.contract : void 0;
+  const contract = isObject8(input) ? input.contract : void 0;
   if (contract === void 0) {
     return {
       valid: false,