@walkeros/cli 4.9.0 → 4.10.0-next-1794522704623

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
package/dist/index.d.ts CHANGED
@@ -1,4 +1,4 @@
1
- import { Flow, StepType, PreviewKey, Elb, Simulation, Ingest, WalkerOS, ObserveWeb, MoinTarget } from '@walkeros/core';
1
+ import { Flow, StepType, PreviewKey, Collector, Elb, Simulation, Ingest, WalkerOS, MoinTarget } from '@walkeros/core';
2
2
  export { Flow } from '@walkeros/core';
3
3
  import { BuildOptions as BuildOptions$1 } from 'esbuild';
4
4
  import { z, ValidateResult as ValidateResult$1, ValidationError as ValidationError$1, ValidationWarning as ValidationWarning$1, ValidationType } from '@walkeros/core/dev';
@@ -44,6 +44,112 @@ interface ResolvedExportName {
44
44
  */
45
45
  declare function resolveExportName(flow: Flow, kind: ComponentKind, id: string): ResolvedExportName;
46
46
 
47
+ /**
48
+ * The recorded package tree: every package one build installed, exactly.
49
+ *
50
+ * A lockfile in all but name. Each entry is keyed by its install path (the
51
+ * two layouts the bundler makes: `node_modules/<name>` and
52
+ * `node_modules/<consumer>/node_modules/<name>`) and names the registry
53
+ * package it holds (`name`, which differs from the path for an `npm:` alias),
54
+ * its exact version, the tarball URL and the sha512 of the tarball's bytes.
55
+ * `dependencies` lists the edges the bundler followed from that package:
56
+ * its dependencies and its required peers, as declared.
57
+ *
58
+ * A build orchestrator records the tree a build reports and hands it back to
59
+ * every later build of the same release, which then installs exactly it and
60
+ * resolves nothing. This module is the one definition of the tree's shape,
61
+ * its canonical form and digest, and the check every reader runs before it
62
+ * trusts a tree. It imports no network code.
63
+ */
64
+
65
+ /** Current tree format version. */
66
+ declare const PACKAGE_TREE_VERSION = 1;
67
+ /** A tree with more entries than this is refused. */
68
+ declare const PACKAGE_TREE_MAX_ENTRIES = 5000;
69
+ declare const PackageTreeEntrySchema: z.ZodObject<{
70
+ name: z.ZodString;
71
+ version: z.ZodString;
72
+ resolved: z.ZodString;
73
+ integrity: z.ZodString;
74
+ dependencies: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
75
+ }, z.core.$strict>;
76
+ declare const PackageTreeSchema: z.ZodObject<{
77
+ version: z.ZodLiteral<1>;
78
+ registry: z.ZodString;
79
+ before: z.ZodNullable<z.ZodString>;
80
+ packages: z.ZodRecord<z.ZodString, z.ZodObject<{
81
+ name: z.ZodString;
82
+ version: z.ZodString;
83
+ resolved: z.ZodString;
84
+ integrity: z.ZodString;
85
+ dependencies: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
86
+ }, z.core.$strict>>;
87
+ }, z.core.$strict>;
88
+ type PackageTree = z.infer<typeof PackageTreeSchema>;
89
+ type PackageTreeEntry = z.infer<typeof PackageTreeEntrySchema>;
90
+ /**
91
+ * How a build installs its packages. Absent: resolved fresh, the zero-setup
92
+ * default. `tree`: exactly a recorded tree. `resolve`: resolved under a
93
+ * release-age cutoff, the installed tree handed to `onTree`.
94
+ */
95
+ type PackageInstall = {
96
+ tree: PackageTree;
97
+ } | {
98
+ resolve: {
99
+ before: Date;
100
+ exempt: readonly string[];
101
+ };
102
+ onTree: (tree: PackageTree) => void;
103
+ };
104
+ /** A tree that fails the check: its shape, its registry or its graph. */
105
+ declare class PackageTreeError extends Error {
106
+ readonly problems: readonly string[];
107
+ readonly code = "PACKAGE_TREE_INVALID";
108
+ constructor(problems: readonly string[]);
109
+ }
110
+ /** Recursively key-sorted JSON, the one serialization the digest hashes. */
111
+ declare function canonicalPackageTree(tree: PackageTree): string;
112
+ /** sha256 hex of the canonical form. */
113
+ declare function packageTreeDigest(tree: PackageTree): string;
114
+ /**
115
+ * Whether an edge skips the release-age cutoff. Decided on registry names,
116
+ * never on an install path or an alias key: the edge's target is under an
117
+ * exempt prefix, or the edge is an exact version declared by a parent whose
118
+ * own registry name is under one. A package exempt only by such a pin passes
119
+ * nothing on: its registry name is not under the prefix.
120
+ */
121
+ declare function edgeIsExempt(edge: {
122
+ name: string;
123
+ spec: string;
124
+ parentName?: string;
125
+ }, exempt: readonly string[]): boolean;
126
+ interface PackageTreeCheckOptions {
127
+ /** The registry this build installs from (the tree must name it). */
128
+ registry: string;
129
+ /** Registries for scopes (`@scope` to URL); others use `registry`. */
130
+ scopeRegistries?: Record<string, string>;
131
+ /**
132
+ * Packages the build installs directly, name to spec: each must sit at
133
+ * `node_modules/<name>` with a version the spec names.
134
+ */
135
+ declared?: Record<string, string>;
136
+ /**
137
+ * Name prefixes a cooldown exempts. An alias whose install name and
138
+ * registry name fall on different sides of one is refused.
139
+ */
140
+ exempt?: readonly string[];
141
+ }
142
+ /**
143
+ * Every reason a value is not a tree this build may install; empty when it
144
+ * is one. Checked without any network: the shape, the registry, every entry's
145
+ * tarball URL, sha512 integrity and exact version, the two layouts, aliases
146
+ * that do not cross an exempt prefix, the declared roots and that every edge
147
+ * has a target.
148
+ */
149
+ declare function packageTreeProblems(value: unknown, options: PackageTreeCheckOptions): string[];
150
+ /** `packageTreeProblems`, throwing `PackageTreeError`; returns the tree. */
151
+ declare function assertPackageTree(value: unknown, options: PackageTreeCheckOptions): PackageTree;
152
+
47
153
  /**
48
154
  * CLI Build Configuration
49
155
  *
@@ -107,6 +213,13 @@ interface BuildOptions extends CLIBuildOptions {
107
213
  * Only substitutes transitive specs; direct package specs always win.
108
214
  */
109
215
  overrides?: Record<string, string>;
216
+ /**
217
+ * How packages are installed, set by a manifest build only. Absent, they
218
+ * are resolved fresh (the zero-setup default). `tree` installs exactly a
219
+ * recorded tree; `resolve` resolves under a release-age cutoff and hands
220
+ * the installed tree to `onTree`.
221
+ */
222
+ packageInstall?: PackageInstall;
110
223
  /**
111
224
  * Extra paths or globs the bundler must include in the trace output.
112
225
  * Sourced from `flow.<name>.config.bundle.traceInclude`. Resolved against
@@ -286,6 +399,13 @@ interface WrapEntryPreview {
286
399
  /** Bare CDN hostname. */
287
400
  previewOrigin: string;
288
401
  }
402
+ /**
403
+ * Observe reporting baked into a preview build: the preview part only. A
404
+ * browser build is public, so it never carries a usage token.
405
+ */
406
+ interface WrapEntryObserve {
407
+ preview: NonNullable<Collector.Observe['preview']>;
408
+ }
289
409
 
290
410
  /**
291
411
  * Named bundle targets with frozen presets.
@@ -381,8 +501,27 @@ declare function bundle(configOrPath: unknown, options?: {
381
501
  */
382
502
  type Platform = 'web' | 'server';
383
503
 
384
- /** The one credential the CLI sends: WALKEROS_TOKEN, a token from Account > Automation tokens. */
504
+ /** WALKEROS_TOKEN, a token from Account > Automation tokens. Env only; `resolveCredential` adds `walkeros login`. */
385
505
  declare function resolveAccessToken(): string | null;
506
+ /** The credential a command sends, and where it comes from. */
507
+ type Credential = {
508
+ source: 'env';
509
+ token: string;
510
+ } | {
511
+ source: 'login';
512
+ token: string;
513
+ issuer: string;
514
+ };
515
+ /**
516
+ * The credential to send to the app: WALKEROS_TOKEN first, then the
517
+ * `walkeros login` stored for the app URL's origin, renewed when it is about
518
+ * to expire. Null when there is neither.
519
+ *
520
+ * A stored login is never sent to another origin: with the app URL pointing
521
+ * elsewhere this throws, naming where the person is signed in. Throws
522
+ * `SignInError` when the login ended or could not be renewed.
523
+ */
524
+ declare function resolveCredential(appUrl?: string): Promise<Credential | null>;
386
525
 
387
526
  /** A network call a web run (push or simulate) recorded instead of sending (fetch, sendBeacon, XHR) */
388
527
  interface NetworkCall {
@@ -915,22 +1054,12 @@ interface WrapSkeletonOptions {
915
1054
  */
916
1055
  preview?: WrapEntryPreview;
917
1056
  /**
918
- * Browser-only: preview-ARTIFACT grant injection. The preview-artifact wrap
919
- * sets this to the server-bound destination keys that should receive the
920
- * `X-Walkeros-Preview` header read from `localStorage['elbPreviewSession']` at boot.
921
- * Mutually exclusive with `preview` (a host activates, an artifact injects);
922
- * passing both throws.
923
- */
924
- previewGrantTargets?: string[];
925
- /**
926
- * Browser-only: STATIC observe connect config baked onto the startFlow
927
- * config. PUBLIC values only (`url` + `binding`, plus optional
928
- * `flowId`/`level`/`sample` scoping); the runtime connect module reads the
929
- * per-session credential out-of-band at boot via the `elbObserve` slot.
930
- * This is the preview-artifact observation wiring: it bakes no ingest
931
- * token into the emitted bytes.
1057
+ * Browser-only: Observe preview reporting, the preview route and its token.
1058
+ * Present, it replaces the flow's own `collector.observe` and turns the
1059
+ * reporter on; absent, the build carries no reporter. A node wrap refuses
1060
+ * it: a server flow reads `collector.observe` from its own config.
932
1061
  */
933
- observe?: ObserveWeb;
1062
+ observe?: WrapEntryObserve;
934
1063
  /**
935
1064
  * Browser-only: the Tag Mode loader target, internal deploy data the stage
936
1065
  * app passes like the preview keyring. Absent, the loader trusts the
@@ -975,6 +1104,13 @@ declare function wrapSkeleton(options: WrapSkeletonOptions): Promise<void>;
975
1104
  * Local paths: a manifest build refuses every config-chosen filesystem input
976
1105
  * (local step packages, `bundle.packages.<name>.path`, `bundle.traceInclude`,
977
1106
  * `include`) with `LOCAL_PATH_NOT_ALLOWED`, before anything is fetched.
1107
+ *
1108
+ * Packages: without `packages` every bundle artifact resolves its packages
1109
+ * fresh. `{ tree }` installs exactly that recorded tree for every bundle
1110
+ * artifact and resolves nothing. `{ resolve }` resolves once, taking only
1111
+ * versions published at or before `before` for every spec but the exempt ones,
1112
+ * and installs that tree for every later artifact. Either way the result
1113
+ * carries the installed tree and its digest.
978
1114
  */
979
1115
 
980
1116
  /** Current manifest format version. */
@@ -985,10 +1121,10 @@ declare const BuildBundleArtifactSchema: z.ZodObject<{
985
1121
  contentType: z.ZodOptional<z.ZodString>;
986
1122
  headers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
987
1123
  target: z.ZodEnum<{
1124
+ runner: "runner";
988
1125
  push: "push";
989
1126
  cdn: "cdn";
990
1127
  "cdn-skeleton": "cdn-skeleton";
991
- runner: "runner";
992
1128
  simulate: "simulate";
993
1129
  }>;
994
1130
  }, z.core.$strict>;
@@ -1007,22 +1143,16 @@ declare const BuildWrapOptionsSchema: z.ZodObject<{
1007
1143
  demoAllowlist: z.ZodOptional<z.ZodArray<z.ZodString>>;
1008
1144
  previewOrigin: z.ZodString;
1009
1145
  }, z.core.$strict>>;
1010
- previewGrantTargets: z.ZodOptional<z.ZodArray<z.ZodString>>;
1011
- observe: z.ZodOptional<z.ZodObject<{
1012
- url: z.ZodString;
1013
- binding: z.ZodString;
1014
- flowId: z.ZodOptional<z.ZodString>;
1015
- level: z.ZodOptional<z.ZodEnum<{
1016
- standard: "standard";
1017
- trace: "trace";
1018
- off: "off";
1019
- }>>;
1020
- sample: z.ZodOptional<z.ZodNumber>;
1021
- }, z.core.$strict>>;
1022
1146
  moin: z.ZodOptional<z.ZodObject<{
1023
1147
  app: z.ZodString;
1024
1148
  base: z.ZodString;
1025
1149
  }, z.core.$strict>>;
1150
+ observe: z.ZodOptional<z.ZodObject<{
1151
+ preview: z.ZodObject<{
1152
+ url: z.ZodURL;
1153
+ token: z.ZodString;
1154
+ }, z.core.$strict>;
1155
+ }, z.core.$strict>>;
1026
1156
  minify: z.ZodOptional<z.ZodBoolean>;
1027
1157
  minifyOptions: z.ZodOptional<z.ZodObject<{
1028
1158
  identifiers: z.ZodOptional<z.ZodBoolean>;
@@ -1030,8 +1160,8 @@ declare const BuildWrapOptionsSchema: z.ZodObject<{
1030
1160
  whitespace: z.ZodOptional<z.ZodBoolean>;
1031
1161
  keepNames: z.ZodOptional<z.ZodBoolean>;
1032
1162
  legalComments: z.ZodOptional<z.ZodEnum<{
1033
- external: "external";
1034
1163
  none: "none";
1164
+ external: "external";
1035
1165
  inline: "inline";
1036
1166
  eof: "eof";
1037
1167
  linked: "linked";
@@ -1069,22 +1199,16 @@ declare const BuildWrapArtifactSchema: z.ZodObject<{
1069
1199
  demoAllowlist: z.ZodOptional<z.ZodArray<z.ZodString>>;
1070
1200
  previewOrigin: z.ZodString;
1071
1201
  }, z.core.$strict>>;
1072
- previewGrantTargets: z.ZodOptional<z.ZodArray<z.ZodString>>;
1073
- observe: z.ZodOptional<z.ZodObject<{
1074
- url: z.ZodString;
1075
- binding: z.ZodString;
1076
- flowId: z.ZodOptional<z.ZodString>;
1077
- level: z.ZodOptional<z.ZodEnum<{
1078
- standard: "standard";
1079
- trace: "trace";
1080
- off: "off";
1081
- }>>;
1082
- sample: z.ZodOptional<z.ZodNumber>;
1083
- }, z.core.$strict>>;
1084
1202
  moin: z.ZodOptional<z.ZodObject<{
1085
1203
  app: z.ZodString;
1086
1204
  base: z.ZodString;
1087
1205
  }, z.core.$strict>>;
1206
+ observe: z.ZodOptional<z.ZodObject<{
1207
+ preview: z.ZodObject<{
1208
+ url: z.ZodURL;
1209
+ token: z.ZodString;
1210
+ }, z.core.$strict>;
1211
+ }, z.core.$strict>>;
1088
1212
  minify: z.ZodOptional<z.ZodBoolean>;
1089
1213
  minifyOptions: z.ZodOptional<z.ZodObject<{
1090
1214
  identifiers: z.ZodOptional<z.ZodBoolean>;
@@ -1092,8 +1216,8 @@ declare const BuildWrapArtifactSchema: z.ZodObject<{
1092
1216
  whitespace: z.ZodOptional<z.ZodBoolean>;
1093
1217
  keepNames: z.ZodOptional<z.ZodBoolean>;
1094
1218
  legalComments: z.ZodOptional<z.ZodEnum<{
1095
- external: "external";
1096
1219
  none: "none";
1220
+ external: "external";
1097
1221
  inline: "inline";
1098
1222
  eof: "eof";
1099
1223
  linked: "linked";
@@ -1108,10 +1232,10 @@ declare const BuildArtifactSchema: z.ZodUnion<readonly [z.ZodObject<{
1108
1232
  contentType: z.ZodOptional<z.ZodString>;
1109
1233
  headers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
1110
1234
  target: z.ZodEnum<{
1235
+ runner: "runner";
1111
1236
  push: "push";
1112
1237
  cdn: "cdn";
1113
1238
  "cdn-skeleton": "cdn-skeleton";
1114
- runner: "runner";
1115
1239
  simulate: "simulate";
1116
1240
  }>;
1117
1241
  }, z.core.$strict>, z.ZodObject<{
@@ -1144,22 +1268,16 @@ declare const BuildArtifactSchema: z.ZodUnion<readonly [z.ZodObject<{
1144
1268
  demoAllowlist: z.ZodOptional<z.ZodArray<z.ZodString>>;
1145
1269
  previewOrigin: z.ZodString;
1146
1270
  }, z.core.$strict>>;
1147
- previewGrantTargets: z.ZodOptional<z.ZodArray<z.ZodString>>;
1148
- observe: z.ZodOptional<z.ZodObject<{
1149
- url: z.ZodString;
1150
- binding: z.ZodString;
1151
- flowId: z.ZodOptional<z.ZodString>;
1152
- level: z.ZodOptional<z.ZodEnum<{
1153
- standard: "standard";
1154
- trace: "trace";
1155
- off: "off";
1156
- }>>;
1157
- sample: z.ZodOptional<z.ZodNumber>;
1158
- }, z.core.$strict>>;
1159
1271
  moin: z.ZodOptional<z.ZodObject<{
1160
1272
  app: z.ZodString;
1161
1273
  base: z.ZodString;
1162
1274
  }, z.core.$strict>>;
1275
+ observe: z.ZodOptional<z.ZodObject<{
1276
+ preview: z.ZodObject<{
1277
+ url: z.ZodURL;
1278
+ token: z.ZodString;
1279
+ }, z.core.$strict>;
1280
+ }, z.core.$strict>>;
1163
1281
  minify: z.ZodOptional<z.ZodBoolean>;
1164
1282
  minifyOptions: z.ZodOptional<z.ZodObject<{
1165
1283
  identifiers: z.ZodOptional<z.ZodBoolean>;
@@ -1167,8 +1285,8 @@ declare const BuildArtifactSchema: z.ZodUnion<readonly [z.ZodObject<{
1167
1285
  whitespace: z.ZodOptional<z.ZodBoolean>;
1168
1286
  keepNames: z.ZodOptional<z.ZodBoolean>;
1169
1287
  legalComments: z.ZodOptional<z.ZodEnum<{
1170
- external: "external";
1171
1288
  none: "none";
1289
+ external: "external";
1172
1290
  inline: "inline";
1173
1291
  eof: "eof";
1174
1292
  linked: "linked";
@@ -1177,6 +1295,25 @@ declare const BuildArtifactSchema: z.ZodUnion<readonly [z.ZodObject<{
1177
1295
  target: z.ZodOptional<z.ZodString>;
1178
1296
  }, z.core.$strict>>;
1179
1297
  }, z.core.$strict>]>;
1298
+ declare const BuildPackagesSchema: z.ZodUnion<readonly [z.ZodObject<{
1299
+ tree: z.ZodObject<{
1300
+ version: z.ZodLiteral<1>;
1301
+ registry: z.ZodString;
1302
+ before: z.ZodNullable<z.ZodString>;
1303
+ packages: z.ZodRecord<z.ZodString, z.ZodObject<{
1304
+ name: z.ZodString;
1305
+ version: z.ZodString;
1306
+ resolved: z.ZodString;
1307
+ integrity: z.ZodString;
1308
+ dependencies: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
1309
+ }, z.core.$strict>>;
1310
+ }, z.core.$strict>;
1311
+ }, z.core.$strict>, z.ZodObject<{
1312
+ resolve: z.ZodObject<{
1313
+ before: z.ZodISODateTime;
1314
+ exempt: z.ZodArray<z.ZodString>;
1315
+ }, z.core.$strict>;
1316
+ }, z.core.$strict>]>;
1180
1317
  declare const BuildManifestSchema: z.ZodObject<{
1181
1318
  version: z.ZodLiteral<1>;
1182
1319
  toolchain: z.ZodString;
@@ -1189,10 +1326,10 @@ declare const BuildManifestSchema: z.ZodObject<{
1189
1326
  contentType: z.ZodOptional<z.ZodString>;
1190
1327
  headers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
1191
1328
  target: z.ZodEnum<{
1329
+ runner: "runner";
1192
1330
  push: "push";
1193
1331
  cdn: "cdn";
1194
1332
  "cdn-skeleton": "cdn-skeleton";
1195
- runner: "runner";
1196
1333
  simulate: "simulate";
1197
1334
  }>;
1198
1335
  }, z.core.$strict>, z.ZodObject<{
@@ -1225,22 +1362,16 @@ declare const BuildManifestSchema: z.ZodObject<{
1225
1362
  demoAllowlist: z.ZodOptional<z.ZodArray<z.ZodString>>;
1226
1363
  previewOrigin: z.ZodString;
1227
1364
  }, z.core.$strict>>;
1228
- previewGrantTargets: z.ZodOptional<z.ZodArray<z.ZodString>>;
1229
- observe: z.ZodOptional<z.ZodObject<{
1230
- url: z.ZodString;
1231
- binding: z.ZodString;
1232
- flowId: z.ZodOptional<z.ZodString>;
1233
- level: z.ZodOptional<z.ZodEnum<{
1234
- standard: "standard";
1235
- trace: "trace";
1236
- off: "off";
1237
- }>>;
1238
- sample: z.ZodOptional<z.ZodNumber>;
1239
- }, z.core.$strict>>;
1240
1365
  moin: z.ZodOptional<z.ZodObject<{
1241
1366
  app: z.ZodString;
1242
1367
  base: z.ZodString;
1243
1368
  }, z.core.$strict>>;
1369
+ observe: z.ZodOptional<z.ZodObject<{
1370
+ preview: z.ZodObject<{
1371
+ url: z.ZodURL;
1372
+ token: z.ZodString;
1373
+ }, z.core.$strict>;
1374
+ }, z.core.$strict>>;
1244
1375
  minify: z.ZodOptional<z.ZodBoolean>;
1245
1376
  minifyOptions: z.ZodOptional<z.ZodObject<{
1246
1377
  identifiers: z.ZodOptional<z.ZodBoolean>;
@@ -1248,8 +1379,8 @@ declare const BuildManifestSchema: z.ZodObject<{
1248
1379
  whitespace: z.ZodOptional<z.ZodBoolean>;
1249
1380
  keepNames: z.ZodOptional<z.ZodBoolean>;
1250
1381
  legalComments: z.ZodOptional<z.ZodEnum<{
1251
- external: "external";
1252
1382
  none: "none";
1383
+ external: "external";
1253
1384
  inline: "inline";
1254
1385
  eof: "eof";
1255
1386
  linked: "linked";
@@ -1259,15 +1390,35 @@ declare const BuildManifestSchema: z.ZodObject<{
1259
1390
  }, z.core.$strict>>;
1260
1391
  }, z.core.$strict>]>>;
1261
1392
  resultPutUrl: z.ZodURL;
1393
+ packages: z.ZodOptional<z.ZodUnion<readonly [z.ZodObject<{
1394
+ tree: z.ZodObject<{
1395
+ version: z.ZodLiteral<1>;
1396
+ registry: z.ZodString;
1397
+ before: z.ZodNullable<z.ZodString>;
1398
+ packages: z.ZodRecord<z.ZodString, z.ZodObject<{
1399
+ name: z.ZodString;
1400
+ version: z.ZodString;
1401
+ resolved: z.ZodString;
1402
+ integrity: z.ZodString;
1403
+ dependencies: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
1404
+ }, z.core.$strict>>;
1405
+ }, z.core.$strict>;
1406
+ }, z.core.$strict>, z.ZodObject<{
1407
+ resolve: z.ZodObject<{
1408
+ before: z.ZodISODateTime;
1409
+ exempt: z.ZodArray<z.ZodString>;
1410
+ }, z.core.$strict>;
1411
+ }, z.core.$strict>]>>;
1262
1412
  }, z.core.$loose>;
1263
1413
  type BuildManifest = z.infer<typeof BuildManifestSchema>;
1414
+ type BuildPackages = z.infer<typeof BuildPackagesSchema>;
1264
1415
  type BuildArtifact = z.infer<typeof BuildArtifactSchema>;
1265
1416
  type BuildWrapOptions = z.infer<typeof BuildWrapOptionsSchema>;
1266
1417
  /**
1267
1418
  * Error codes a result can carry. User-config codes first, then build and
1268
1419
  * infrastructure codes.
1269
1420
  */
1270
- declare const BUILD_ERROR_CODES: readonly ["INVALID_MANIFEST", "TOOLCHAIN_MISMATCH", "INVALID_CONFIG", "MISSING_BUILD_ENV", "WEB_SECRET_REF", "UNSUPPORTED_PACKAGE_SPEC", "LOCAL_PATH_NOT_ALLOWED", "BUILD_FAILED", "UPLOAD_FAILED"];
1421
+ declare const BUILD_ERROR_CODES: readonly ["INVALID_MANIFEST", "TOOLCHAIN_MISMATCH", "INVALID_CONFIG", "MISSING_BUILD_ENV", "WEB_SECRET_REF", "UNSUPPORTED_PACKAGE_SPEC", "LOCAL_PATH_NOT_ALLOWED", "BUILD_FAILED", "PACKAGE_UNAVAILABLE", "PACKAGE_TREE_INVALID", "UPLOAD_FAILED"];
1271
1422
  type BuildErrorCode = (typeof BUILD_ERROR_CODES)[number];
1272
1423
  declare const BuildResultSchema: z.ZodObject<{
1273
1424
  ok: z.ZodBoolean;
@@ -1278,8 +1429,25 @@ declare const BuildResultSchema: z.ZodObject<{
1278
1429
  bytes: z.ZodNumber;
1279
1430
  sha256: z.ZodString;
1280
1431
  }, z.core.$strip>>;
1432
+ packages: z.ZodOptional<z.ZodObject<{
1433
+ digest: z.ZodString;
1434
+ tree: z.ZodObject<{
1435
+ version: z.ZodLiteral<1>;
1436
+ registry: z.ZodString;
1437
+ before: z.ZodNullable<z.ZodString>;
1438
+ packages: z.ZodRecord<z.ZodString, z.ZodObject<{
1439
+ name: z.ZodString;
1440
+ version: z.ZodString;
1441
+ resolved: z.ZodString;
1442
+ integrity: z.ZodString;
1443
+ dependencies: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
1444
+ }, z.core.$strict>>;
1445
+ }, z.core.$strict>;
1446
+ }, z.core.$strip>>;
1281
1447
  error: z.ZodOptional<z.ZodObject<{
1282
1448
  code: z.ZodEnum<{
1449
+ PACKAGE_TREE_INVALID: "PACKAGE_TREE_INVALID";
1450
+ PACKAGE_UNAVAILABLE: "PACKAGE_UNAVAILABLE";
1283
1451
  WEB_SECRET_REF: "WEB_SECRET_REF";
1284
1452
  INVALID_MANIFEST: "INVALID_MANIFEST";
1285
1453
  TOOLCHAIN_MISMATCH: "TOOLCHAIN_MISMATCH";
@@ -1327,6 +1495,10 @@ interface FetchRetryOptions {
1327
1495
  *
1328
1496
  * Messages are written for the orchestrator to show a user, so they never
1329
1497
  * carry a URL query string (presigned credentials live there).
1498
+ *
1499
+ * With `packages`, every bundle artifact of the manifest installs one tree:
1500
+ * the recorded one (`tree`), or the one the first bundle artifact resolves
1501
+ * under the cutoff (`resolve`). The result then reports that tree.
1330
1502
  */
1331
1503
 
1332
1504
  /** Env var a bare `--manifest` reads its source from. */
@@ -1426,22 +1598,27 @@ declare function appErrorMessage(body: unknown): string | undefined;
1426
1598
  declare function appFetch(path: string, init?: AppFetchInit): Promise<Response>;
1427
1599
 
1428
1600
  /**
1429
- * The app operations the CLI itself calls: identity, health, telemetry and
1430
- * the public API document. The app keeps every one in its public API set, so
1431
- * its change rule protects them. The only file in the CLI that names an app
1432
- * path; `walkeros api` takes its path from the person.
1601
+ * The app operations the CLI itself calls: identity, health, telemetry, the
1602
+ * public API document, and the two documents `walkeros login` discovers the
1603
+ * rest of a sign-in from (the authorization server metadata, RFC 8414, and
1604
+ * the CLI's own client document, whose URL is its client id). The app keeps
1605
+ * every one in its public API set, so its change rule protects them. The only
1606
+ * file in the CLI that names an app path; `walkeros api` takes its path from
1607
+ * the person.
1433
1608
  */
1434
1609
  declare const APP_PATHS: {
1435
1610
  readonly whoami: "/api/auth/whoami";
1436
1611
  readonly health: "/api/health";
1437
1612
  readonly telemetry: "/api/telemetry";
1438
1613
  readonly openapi: "/api/openapi.json";
1614
+ readonly authorizationServer: "/.well-known/oauth-authorization-server";
1615
+ readonly cliClient: "/oauth/walkeros-cli";
1439
1616
  };
1440
1617
 
1441
1618
  /**
1442
- * The CLI's own settings. It holds no credential: the CLI authenticates with
1443
- * WALKEROS_TOKEN only, and sign-in fields an older CLI left in the file are
1444
- * never read.
1619
+ * The CLI's own settings. It holds no credential: a `walkeros login` lives in
1620
+ * `credentials.json` beside it (`lib/credentials.ts`), and sign-in fields an
1621
+ * older CLI left in this file are never read.
1445
1622
  */
1446
1623
  interface WalkerOSConfig {
1447
1624
  appUrl?: string;
@@ -1728,4 +1905,4 @@ declare module '@walkeros/core' {
1728
1905
  }
1729
1906
  }
1730
1907
 
1731
- export { APP_PATHS, ApiError, type ApiErrorDetail, type AppFetchInit, BUILD_ERROR_CODES, BUILD_MANIFEST_ENV, BUILD_MANIFEST_VERSION, type BuildArtifact, BuildArtifactSchema, BuildBundleArtifactSchema, type BuildErrorCode, type BuildManifest, BuildManifestSchema, type BuildOptions, type BuildResult, BuildResultSchema, BuildWrapArtifactSchema, type BuildWrapOptions, BuildWrapOptionsSchema, type BundleStats, type CLIBuildOptions, type ClientContext, type ClientType, type GlobalOptions, type MinifyOptions, type PrepareInput, type PreparedFlow, type PushResult, type RunBuildManifestResult, type SimulateCollectorOptions, type SimulateDataOptions, type SimulateDestinationOptions, type SimulateSourceOptions, type SimulateTransformerOptions, VALIDATE_CODES, VERSION, type ValidateCheck, type ValidateCode, type ValidateDeferred, type ValidateResult, type ValidateScope, type ValidateSkip, type ValidationError, type ValidationWarning, type WalkerOSConfig, type WrapSkeletonOptions, appErrorMessage, appFetch, buildDataPayload, bundle, bundleCommand, classifyStepProperties, clientContextHeaders, collectKnownSecrets, containsCodeMarkers, formatPushResult, getClientContext, loadConfig, loadJsonConfig, push, pushCommand, readConfig, resetClientContext, resolveAccessToken, resolveAppUrl, resolveExportName, resolveManifestSource, runBuildManifest, selectDevExamples, setClientContext, simulateCollector, simulateDestination, simulateSource, simulateTransformer, index as telemetry, telemetryDisableCommand, telemetryEnableCommand, telemetryStatusCommand, validate, validateCommand, whoami, whoamiCommand, wrapSkeleton, writeConfig };
1908
+ export { APP_PATHS, ApiError, type ApiErrorDetail, type AppFetchInit, BUILD_ERROR_CODES, BUILD_MANIFEST_ENV, BUILD_MANIFEST_VERSION, type BuildArtifact, BuildArtifactSchema, BuildBundleArtifactSchema, type BuildErrorCode, type BuildManifest, BuildManifestSchema, type BuildOptions, type BuildPackages, BuildPackagesSchema, type BuildResult, BuildResultSchema, BuildWrapArtifactSchema, type BuildWrapOptions, BuildWrapOptionsSchema, type BundleStats, type CLIBuildOptions, type ClientContext, type ClientType, type Credential, type GlobalOptions, type MinifyOptions, PACKAGE_TREE_MAX_ENTRIES, PACKAGE_TREE_VERSION, type PackageTree, type PackageTreeCheckOptions, type PackageTreeEntry, PackageTreeError, PackageTreeSchema, type PrepareInput, type PreparedFlow, type PushResult, type RunBuildManifestResult, type SimulateCollectorOptions, type SimulateDataOptions, type SimulateDestinationOptions, type SimulateSourceOptions, type SimulateTransformerOptions, VALIDATE_CODES, VERSION, type ValidateCheck, type ValidateCode, type ValidateDeferred, type ValidateResult, type ValidateScope, type ValidateSkip, type ValidationError, type ValidationWarning, type WalkerOSConfig, type WrapSkeletonOptions, appErrorMessage, appFetch, assertPackageTree, buildDataPayload, bundle, bundleCommand, canonicalPackageTree, classifyStepProperties, clientContextHeaders, collectKnownSecrets, containsCodeMarkers, edgeIsExempt, formatPushResult, getClientContext, loadConfig, loadJsonConfig, packageTreeDigest, packageTreeProblems, push, pushCommand, readConfig, resetClientContext, resolveAccessToken, resolveAppUrl, resolveCredential, resolveExportName, resolveManifestSource, runBuildManifest, selectDevExamples, setClientContext, simulateCollector, simulateDestination, simulateSource, simulateTransformer, index as telemetry, telemetryDisableCommand, telemetryEnableCommand, telemetryStatusCommand, validate, validateCommand, whoami, whoamiCommand, wrapSkeleton, writeConfig };