@walkeros/cli 4.9.0 → 4.10.0-next-1794522704623

package/dist/index.js

@@ -241,6 +241,52 @@ async function resolveLocalPackage(packageName, localPath, configDir, logger) {
     `Local package path not found: ${localPath} (resolved to ${absolutePath})`
   );
 }
+var ROOT_COPY_EXCLUDED = [".turbo", ".git"];
+function excludedFromCopy(root, file) {
+  const relative2 = path4.relative(root, file);
+  if (relative2 === "") return false;
+  const parts = relative2.split(path4.sep);
+  if (ROOT_COPY_EXCLUDED.includes(parts[0])) return true;
+  if (parts.includes("node_modules")) return true;
+  const name = parts[parts.length - 1];
+  return name === ".env" || name.startsWith(".env.");
+}
+async function copyPackageRoot(source, target) {
+  await fs3.copy(source, target, {
+    dereference: true,
+    filter: (file) => !excludedFromCopy(source, file)
+  });
+}
+function stringLeaves(value, into = []) {
+  if (typeof value === "string") into.push(value);
+  else if (value && typeof value === "object")
+    for (const inner of Object.values(value)) stringLeaves(inner, into);
+  return into;
+}
+var TYPE_CONDITIONS = ["types", "typings"];
+function codeExports(value, into = []) {
+  if (typeof value === "string") {
+    if (!/\.d\.[cm]?ts$/.test(value) && !value.endsWith(".json"))
+      into.push(value);
+  } else if (value && typeof value === "object") {
+    for (const [key, inner] of Object.entries(value))
+      if (!TYPE_CONDITIONS.includes(key)) codeExports(inner, into);
+  }
+  return into;
+}
+function entriesOutsideDist(manifest) {
+  if (!manifest || typeof manifest !== "object") return false;
+  const fields = [
+    ...["main", "module", "bin"].flatMap(
+      (field) => stringLeaves(Reflect.get(manifest, field))
+    ),
+    ...codeExports(Reflect.get(manifest, "exports"))
+  ];
+  return fields.some((entry) => {
+    const relative2 = path4.posix.normalize(entry.replace(/^\.\//, ""));
+    return relative2 !== "package.json" && relative2 !== "dist" && !relative2.startsWith("dist/");
+  });
+}
 async function copyLocalPackage(localPkg, targetDir, logger) {
   const packageDir = path4.join(targetDir, "node_modules", localPkg.name);
   if (localPkg.type === "file") {
@@ -258,15 +304,7 @@ async function copyLocalPackage(localPkg, targetDir, logger) {
   }
   if (localPkg.type === "directory") {
     await fs3.ensureDir(path4.dirname(packageDir));
-    const entries = await fs3.readdir(localPkg.absolutePath);
-    for (const entry of entries) {
-      if (!["node_modules", ".turbo", ".git"].includes(entry)) {
-        await fs3.copy(
-          path4.join(localPkg.absolutePath, entry),
-          path4.join(packageDir, entry)
-        );
-      }
-    }
+    await copyPackageRoot(localPkg.absolutePath, packageDir);
     await fs3.writeJson(path4.join(packageDir, "package.json"), {
       name: localPkg.name,
       main: "./index.ts"
@@ -281,18 +319,11 @@ async function copyLocalPackage(localPkg, targetDir, logger) {
     path4.join(localPkg.absolutePath, "package.json"),
     path4.join(packageDir, "package.json")
   );
-  if (localPkg.hasDistFolder) {
+  const manifest = await fs3.readJson(path4.join(localPkg.absolutePath, "package.json")).catch(() => void 0);
+  if (localPkg.hasDistFolder && !entriesOutsideDist(manifest)) {
     await fs3.copy(localPkg.distPath, path4.join(packageDir, "dist"));
   } else {
-    const entries = await fs3.readdir(localPkg.absolutePath);
-    for (const entry of entries) {
-      if (!["node_modules", ".turbo", ".git"].includes(entry)) {
-        await fs3.copy(
-          path4.join(localPkg.absolutePath, entry),
-          path4.join(packageDir, entry)
-        );
-      }
-    }
+    await copyPackageRoot(localPkg.absolutePath, packageDir);
   }
   logger.info(`\u{1F4E6} Using local: ${localPkg.name} from ${localPkg.absolutePath}`);
   return packageDir;
@@ -350,11 +381,523 @@ async function readStdinToTempFile(label) {
   return tmpPath;
 }
 
+// src/lib/credentials.ts
+import {
+  closeSync as closeSync2,
+  openSync as openSync2,
+  readFileSync as readFileSync2,
+  readdirSync,
+  statSync as statSync2,
+  unlinkSync as unlinkSync2,
+  writeSync as writeSync2
+} from "fs";
+import { randomBytes as randomBytes2 } from "crypto";
+import { join as join2 } from "path";
+import { z } from "zod";
+
+// src/lib/config-file.ts
+import {
+  readFileSync,
+  mkdirSync,
+  unlinkSync,
+  renameSync,
+  openSync,
+  writeSync,
+  fsyncSync,
+  closeSync,
+  statSync
+} from "fs";
+import { randomBytes } from "crypto";
+import { join } from "path";
+import { homedir } from "os";
+function getConfigDir() {
+  const xdgConfig = process.env.XDG_CONFIG_HOME;
+  const base = xdgConfig || join(homedir(), ".config");
+  return join(base, "walkeros");
+}
+function getConfigPath() {
+  return join(getConfigDir(), "config.json");
+}
+function readConfig() {
+  const configPath = getConfigPath();
+  try {
+    const content = readFileSync(configPath, "utf-8");
+    return JSON.parse(content);
+  } catch {
+    return null;
+  }
+}
+function ensureConfigDir() {
+  const dir = getConfigDir();
+  mkdirSync(dir, { recursive: true, mode: 448 });
+  return dir;
+}
+function writePrivateFile(path23, content) {
+  const tempPath = `${path23}.${process.pid}.${randomBytes(6).toString("hex")}.tmp`;
+  try {
+    const fd = openSync(tempPath, "wx", 384);
+    try {
+      writeSync(fd, content);
+      fsyncSync(fd);
+    } finally {
+      closeSync(fd);
+    }
+    renameSync(tempPath, path23);
+  } catch (error) {
+    try {
+      unlinkSync(tempPath);
+    } catch {
+    }
+    throw error;
+  }
+}
+function replaceConfigFile(config) {
+  ensureConfigDir();
+  writePrivateFile(getConfigPath(), JSON.stringify(config, null, 2));
+}
+function writeConfig(config) {
+  replaceConfigFile({ ...readConfig() ?? {}, ...config });
+}
+function writeTelemetryOnlyConfig(partial) {
+  writeConfig(partial);
+}
+function resolveAppUrl() {
+  const envUrl = process.env.WALKEROS_APP_URL;
+  if (envUrl) return envUrl;
+  const config = readConfig();
+  if (config?.appUrl) return config.appUrl;
+  return "https://app.walkeros.io";
+}
+
+// src/lib/credentials.ts
+var LoginSchema = z.object({
+  issuer: z.string(),
+  client_id: z.string(),
+  token_endpoint: z.string(),
+  revocation_endpoint: z.string(),
+  access_token: z.string(),
+  /** Epoch milliseconds. */
+  expires_at: z.number(),
+  refresh_token: z.string().optional(),
+  scope: z.string().optional()
+});
+var CredentialsSchema = z.record(z.string(), z.unknown());
+function getCredentialsPath() {
+  return join2(getConfigDir(), "credentials.json");
+}
+function getLockPath() {
+  return join2(getConfigDir(), "credentials.lock");
+}
+function readCredentials() {
+  let raw;
+  try {
+    raw = JSON.parse(readFileSync2(getCredentialsPath(), "utf-8"));
+  } catch {
+    return {};
+  }
+  const parsed = CredentialsSchema.safeParse(raw);
+  if (!parsed.success) return {};
+  const logins = {};
+  for (const [issuer, value] of Object.entries(parsed.data)) {
+    const login = LoginSchema.safeParse(value);
+    if (login.success && login.data.issuer === issuer)
+      logins[issuer] = login.data;
+  }
+  return logins;
+}
+function writeCredentials(logins) {
+  ensureConfigDir();
+  writePrivateFile(getCredentialsPath(), JSON.stringify(logins, null, 2));
+}
+function originOf(url) {
+  try {
+    return new URL(url).origin;
+  } catch {
+    return null;
+  }
+}
+function loginForAppUrl(logins, appUrl) {
+  const origin = originOf(appUrl);
+  if (origin === null) return void 0;
+  const exact = logins[appUrl.replace(/\/+$/, "")];
+  if (exact) return exact;
+  return Object.values(logins).find(
+    (login) => originOf(login.issuer) === origin
+  );
+}
+var CredentialsBusyError = class extends Error {
+};
+var LOCK_TIMING = {
+  waitMs: 15e3,
+  staleMs: 3e4,
+  pollMs: 100
+};
+var sleep = (ms) => new Promise((resolve5) => setTimeout(resolve5, ms));
+function isErrnoCode(error, code) {
+  return typeof error === "object" && error !== null && "code" in error && error.code === code;
+}
+function tryCreateLock(path23, mark) {
+  let fd;
+  try {
+    fd = openSync2(path23, "wx", 384);
+  } catch (error) {
+    if (isErrnoCode(error, "EEXIST")) return false;
+    throw error;
+  }
+  try {
+    writeSync2(fd, mark);
+  } finally {
+    closeSync2(fd);
+  }
+  return true;
+}
+function readLock(path23) {
+  try {
+    const ageMs = Date.now() - statSync2(path23).mtimeMs;
+    return { mark: readFileSync2(path23, "utf-8"), ageMs };
+  } catch {
+    return null;
+  }
+}
+async function withCredentialsLock(fn, timing = LOCK_TIMING) {
+  const dir = ensureConfigDir();
+  const path23 = getLockPath();
+  const mark = `${process.pid} ${(/* @__PURE__ */ new Date()).toISOString()} ${randomBytes2(8).toString("hex")}`;
+  const deadline = Date.now() + timing.waitMs;
+  for (; ; ) {
+    if (tryCreateLock(path23, mark)) break;
+    const held = readLock(path23);
+    if (held && held.ageMs > timing.staleMs) {
+      const again = readLock(path23);
+      if (again && again.mark === held.mark) {
+        try {
+          unlinkSync2(path23);
+        } catch {
+        }
+      }
+      continue;
+    }
+    if (Date.now() >= deadline)
+      throw new CredentialsBusyError(
+        `another walkeros command is updating the sign-in in ${dir}: try again`
+      );
+    await sleep(timing.pollMs);
+  }
+  try {
+    return await fn();
+  } finally {
+    const held = readLock(path23);
+    if (held && held.mark === mark) {
+      try {
+        unlinkSync2(path23);
+      } catch {
+      }
+    }
+  }
+}
+var PENDING_TTL_MS = 15 * 60 * 1e3;
+var STATE_SHAPE = /^[A-Za-z0-9_-]{1,128}$/;
+var PendingSchema = z.object({
+  code_verifier: z.string(),
+  state: z.string().regex(STATE_SHAPE),
+  redirect_uri: z.string(),
+  issuer: z.string(),
+  client_id: z.string(),
+  token_endpoint: z.string(),
+  /** Epoch milliseconds. */
+  created_at: z.number()
+});
+
+// src/core/oauth-login.ts
+import { z as z3 } from "zod";
+
+// src/core/app-fetch.ts
+import { z as z2 } from "zod";
+
+// src/lib/secure-url.ts
+function isLoopback(hostname) {
+  return hostname === "localhost" || hostname === "127.0.0.1" || hostname === "[::1]";
+}
+function requireSecureUrl(url) {
+  let parsed;
+  try {
+    parsed = new URL(url);
+  } catch {
+    return url;
+  }
+  if (parsed.protocol !== "http:" || isLoopback(parsed.hostname)) return url;
+  throw new Error(
+    `Refusing to send walkerOS credentials over plain http to ${url}. Use https, or localhost / 127.0.0.1 / [::1] for local development.`
+  );
+}
+function isSecureSignInUrl(url) {
+  let parsed;
+  try {
+    parsed = new URL(url);
+  } catch {
+    return false;
+  }
+  if (parsed.protocol === "https:") return true;
+  return parsed.protocol === "http:" && isLoopback(parsed.hostname);
+}
+
+// src/core/client-context.ts
+var context;
+function setClientContext(input) {
+  const envType = process.env.WALKEROS_CLIENT_TYPE;
+  const type = envType ?? input.type ?? "cli";
+  context = { type, version: input.version };
+}
+function getClientContext() {
+  return context;
+}
+function resetClientContext() {
+  context = void 0;
+}
+function clientContextHeaders() {
+  if (!context) return {};
+  return {
+    "User-Agent": `walkeros-${context.type}/${context.version}`,
+    "X-WalkerOS-Client": context.type,
+    "X-WalkerOS-Client-Version": context.version
+  };
+}
+
+// src/core/app-fetch.ts
+var AppErrorSchema = z2.object({
+  error: z2.object({ message: z2.string().min(1) })
+});
+function appErrorMessage(body) {
+  const parsed = AppErrorSchema.safeParse(body);
+  return parsed.success ? parsed.data.error.message : void 0;
+}
+async function appFetch(path23, init = {}) {
+  const url = `${(init.baseUrl ?? resolveAppUrl()).replace(/\/+$/, "")}${path23}`;
+  const headers = new Headers(clientContextHeaders());
+  for (const [name, value] of Object.entries(init.headers ?? {}))
+    headers.set(name, value);
+  if (init.token && !headers.has("Authorization"))
+    headers.set("Authorization", `Bearer ${init.token}`);
+  if (headers.has("Authorization")) requireSecureUrl(url);
+  const request = { headers };
+  if (init.method && init.method !== "GET") request.method = init.method;
+  if (init.body !== void 0) request.body = init.body;
+  if (init.signal) request.signal = init.signal;
+  if (init.redirect) request.redirect = init.redirect;
+  return (init.fetch ?? fetch)(url, request);
+}
+
+// src/core/app-paths.ts
+var APP_PATHS = {
+  whoami: "/api/auth/whoami",
+  health: "/api/health",
+  telemetry: "/api/telemetry",
+  openapi: "/api/openapi.json",
+  authorizationServer: "/.well-known/oauth-authorization-server",
+  cliClient: "/oauth/walkeros-cli"
+};
+
+// src/core/oauth-login.ts
+var REQUEST_TIMEOUT_MS = 1e4;
+var FRESH_FOR_MS = 6e4;
+var LoginError = class extends Error {
+};
+var MetadataSchema = z3.object({
+  issuer: z3.string(),
+  authorization_endpoint: z3.string(),
+  token_endpoint: z3.string(),
+  revocation_endpoint: z3.string(),
+  code_challenge_methods_supported: z3.array(z3.string()).optional()
+});
+var ClientDocumentSchema = z3.object({
+  client_id: z3.string(),
+  redirect_uris: z3.array(z3.string())
+});
+var TokenSetSchema = z3.object({
+  access_token: z3.string().min(1),
+  token_type: z3.string().refine((type) => type.toLowerCase() === "bearer"),
+  expires_in: z3.number(),
+  refresh_token: z3.string().min(1).optional(),
+  scope: z3.string().optional()
+});
+var OAuthErrorSchema = z3.object({ error: z3.string() });
+async function postForm(url, form, expectTokens) {
+  if (!isSecureSignInUrl(url))
+    throw new LoginError(
+      `refusing to send a walkerOS sign-in to ${url}: it is neither https nor http on this machine: run walkeros login`
+    );
+  let response;
+  try {
+    response = await fetch(url, {
+      method: "POST",
+      headers: {
+        ...clientContextHeaders(),
+        "Content-Type": "application/x-www-form-urlencoded",
+        Accept: "application/json"
+      },
+      body: new URLSearchParams(form).toString(),
+      redirect: "error",
+      signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS)
+    });
+  } catch (error2) {
+    return {
+      kind: "unreachable",
+      reason: fetchFailureReason(error2, REQUEST_TIMEOUT_MS)
+    };
+  }
+  let body;
+  try {
+    body = await response.json();
+  } catch {
+    body = void 0;
+  }
+  if (response.ok) {
+    if (!expectTokens) return { kind: "ok" };
+    const tokens = TokenSetSchema.safeParse(body);
+    return tokens.success ? { kind: "ok", tokens: tokens.data } : { kind: "failed", status: response.status };
+  }
+  const error = OAuthErrorSchema.safeParse(body);
+  return error.success ? { kind: "refused", status: response.status, error: error.data.error } : { kind: "failed", status: response.status };
+}
+function answerText(answer) {
+  switch (answer.kind) {
+    case "ok":
+      return "HTTP 200";
+    case "refused":
+      return `HTTP ${answer.status} ${answer.error}`;
+    case "failed":
+      return `HTTP ${answer.status}`;
+    case "unreachable":
+      return answer.reason;
+  }
+}
+function isFresh(login, now = Date.now()) {
+  return login.expires_at - now > FRESH_FOR_MS;
+}
+function loginOf(endpoints, tokens, now = Date.now()) {
+  return {
+    issuer: endpoints.issuer,
+    client_id: endpoints.clientId,
+    token_endpoint: endpoints.tokenEndpoint,
+    revocation_endpoint: endpoints.revocationEndpoint,
+    access_token: tokens.access_token,
+    expires_at: now + tokens.expires_in * 1e3,
+    ...tokens.refresh_token === void 0 ? {} : { refresh_token: tokens.refresh_token },
+    ...tokens.scope === void 0 ? {} : { scope: tokens.scope }
+  };
+}
+var SignInError = class extends Error {
+  constructor(message, reason) {
+    super(message);
+    this.reason = reason;
+  }
+  reason;
+};
+function without(logins, issuer) {
+  return Object.fromEntries(
+    Object.entries(logins).filter(([key]) => key !== issuer)
+  );
+}
+function endedError(issuer) {
+  return new SignInError(
+    `your sign-in to ${issuer} ended: run walkeros login`,
+    "ended"
+  );
+}
+async function refreshStoredLogin(issuer, options = {}) {
+  try {
+    return await withCredentialsLock(async () => {
+      const logins = readCredentials();
+      const login = logins[issuer];
+      if (login === void 0) throw endedError(issuer);
+      if (login.access_token !== options.rejected && isFresh(login))
+        return login;
+      const remove = () => writeCredentials(without(logins, issuer));
+      if (login.refresh_token === void 0) {
+        remove();
+        throw endedError(issuer);
+      }
+      const answer = await postForm(
+        login.token_endpoint,
+        {
+          grant_type: "refresh_token",
+          client_id: login.client_id,
+          refresh_token: login.refresh_token
+        },
+        true
+      );
+      if (answer.kind === "ok" && answer.tokens) {
+        const tokens = answer.tokens;
+        const refreshed = loginOf(
+          {
+            issuer: login.issuer,
+            clientId: login.client_id,
+            tokenEndpoint: login.token_endpoint,
+            revocationEndpoint: login.revocation_endpoint
+          },
+          {
+            ...tokens,
+            refresh_token: tokens.refresh_token ?? login.refresh_token,
+            scope: tokens.scope ?? login.scope
+          }
+        );
+        writeCredentials({ ...logins, [issuer]: refreshed });
+        return refreshed;
+      }
+      if (answer.kind === "refused" && (answer.error === "invalid_grant" || answer.error === "invalid_client")) {
+        remove();
+        throw endedError(issuer);
+      }
+      if (answer.kind === "unreachable")
+        throw new SignInError(
+          `could not reach ${issuer} to renew the sign-in: ${answer.reason}: try again`,
+          "unreachable"
+        );
+      throw new SignInError(
+        `${issuer} did not renew the sign-in (${answerText(answer)}): try again, or run walkeros login`,
+        "unreachable"
+      );
+    }, options.timing);
+  } catch (error) {
+    if (error instanceof SignInError) throw error;
+    if (error instanceof LoginError)
+      throw new SignInError(error.message, "ended");
+    if (error instanceof CredentialsBusyError)
+      throw new SignInError(error.message, "busy");
+    throw error;
+  }
+}
+
 // src/core/auth.ts
 function resolveAccessToken() {
   const token = process.env.WALKEROS_TOKEN;
   return token ? token : null;
 }
+async function resolveCredential(appUrl = resolveAppUrl()) {
+  const env = resolveAccessToken();
+  if (env !== null) return { source: "env", token: env };
+  const logins = readCredentials();
+  const login = loginForAppUrl(logins, appUrl);
+  if (login === void 0) {
+    const issuers = Object.keys(logins);
+    if (issuers.length === 0) return null;
+    throw new SignInError(
+      `signed in to ${issuers.join(", ")}, not ${appUrl.replace(/\/+$/, "")}: run walkeros login`,
+      "elsewhere"
+    );
+  }
+  const usable = isFresh(login) ? login : await refreshStoredLogin(login.issuer);
+  return { source: "login", token: usable.access_token, issuer: usable.issuer };
+}
+async function sendWithCredential(credential, send) {
+  const response = await send(credential.token);
+  if (response.status !== 401 || credential.source !== "login") return response;
+  await response.body?.cancel();
+  const renewed = await refreshStoredLogin(credential.issuer, {
+    rejected: credential.token
+  });
+  return send(renewed.access_token);
+}
 
 // src/core/event-validation.ts
 import { schemas } from "@walkeros/core/dev";
@@ -1001,12 +1544,13 @@ function resolveStepPackage(flow, kind, id, logger) {
 }
 
 // src/core/package-manager.ts
+import { createHash as createHash3 } from "crypto";
 import pacote from "pacote";
 import path10 from "path";
 import fs10 from "fs-extra";
 import { readFile } from "fs/promises";
 import os from "os";
-import semver2 from "semver";
+import semver3 from "semver";
 
 // src/core/cache-utils.ts
 import { getHashServer } from "@walkeros/server-core";
@@ -1202,6 +1746,246 @@ function assertTransitiveRegistrySpec(check) {
   );
 }
 
+// src/core/package-tree.ts
+import { createHash as createHash2 } from "crypto";
+import npa2 from "npm-package-arg";
+import semver2 from "semver";
+import { z as z4 } from "@walkeros/core/dev";
+var PACKAGE_TREE_VERSION = 1;
+var PACKAGE_TREE_MAX_ENTRIES = 5e3;
+var SHA512_INTEGRITY = /^sha512-[A-Za-z0-9+/]{86}==$/;
+var PackageTreeEntrySchema = z4.object({
+  name: z4.string().min(1).describe("Registry name of the package"),
+  version: z4.string().min(1).describe("Exact version"),
+  resolved: z4.string().min(1).describe("Tarball URL on the registry"),
+  integrity: z4.string().min(1).describe("sha512 of the tarball bytes"),
+  dependencies: z4.record(z4.string().min(1), z4.string()).optional().describe("Edges followed: dependencies and required peers")
+}).strict();
+var PackageTreeSchema = z4.object({
+  version: z4.literal(PACKAGE_TREE_VERSION),
+  registry: z4.string().min(1).describe("Registry every entry comes from"),
+  before: z4.string().nullable().describe("Release-age cutoff the tree was resolved under"),
+  packages: z4.record(z4.string().min(1), PackageTreeEntrySchema).describe("Entries by install path")
+}).strict().meta({ id: "PackageTree", title: "Recorded package tree" });
+var PackageTreeError = class extends Error {
+  constructor(problems) {
+    super(`Package tree refused: ${problems.join("; ")}`);
+    this.problems = problems;
+    this.name = "PackageTreeError";
+  }
+  problems;
+  code = "PACKAGE_TREE_INVALID";
+};
+function canonicalPackageTree(tree) {
+  return JSON.stringify(sortKeys(tree));
+}
+function sortKeys(value) {
+  if (Array.isArray(value)) return value.map(sortKeys);
+  if (typeof value === "object" && value !== null) {
+    const sorted = {};
+    for (const key of Object.keys(value).sort()) {
+      sorted[key] = sortKeys(Reflect.get(value, key));
+    }
+    return sorted;
+  }
+  return value;
+}
+function packageTreeDigest(tree) {
+  return createHash2("sha256").update(canonicalPackageTree(tree)).digest("hex");
+}
+function normalizeRegistry(registry) {
+  try {
+    const url = new URL(registry);
+    if (!url.pathname.endsWith("/")) url.pathname = `${url.pathname}/`;
+    return url;
+  } catch {
+    return null;
+  }
+}
+function isPackageName(name) {
+  try {
+    const parsed = npa2(`${name}@0.0.0`);
+    return parsed.name === name && parsed.type === "version";
+  } catch {
+    return false;
+  }
+}
+function scopeOf(name) {
+  return name.startsWith("@") ? name.slice(0, name.indexOf("/")) : "";
+}
+function isExemptName(name, exempt) {
+  return exempt.some((prefix) => name.startsWith(prefix));
+}
+function aliasCrossesExemption(installName, realName, exempt) {
+  return isExemptName(installName, exempt) !== isExemptName(realName, exempt);
+}
+function edgeTargetName(depName, spec) {
+  try {
+    const parsed = npa2.resolve(depName, spec);
+    if (parsed.type === "alias") return parsed.subSpec.name ?? null;
+    return parsed.name ?? null;
+  } catch {
+    return null;
+  }
+}
+function isExactSpec(depName, spec) {
+  try {
+    const parsed = npa2.resolve(depName, spec);
+    if (parsed.type === "alias") return parsed.subSpec.type === "version";
+    return parsed.type === "version";
+  } catch {
+    return false;
+  }
+}
+function edgeIsExempt(edge, exempt) {
+  const target = edgeTargetName(edge.name, edge.spec);
+  if (target === null) return false;
+  if (isExemptName(target, exempt)) return true;
+  return edge.parentName !== void 0 && isExemptName(edge.parentName, exempt) && isExactSpec(edge.name, edge.spec);
+}
+function tarballPath(registryPath, name, version) {
+  const base = name.startsWith("@") ? name.slice(name.indexOf("/") + 1) : name;
+  return `${registryPath}${name}/-/${base}-${version}.tgz`;
+}
+var LAYOUT = /^node_modules\/((?:@[^/]+\/)?[^/@][^/]*)(?:\/node_modules\/((?:@[^/]+\/)?[^/@][^/]*))?$/;
+function parseInstallPath(path23) {
+  const match = LAYOUT.exec(path23);
+  if (!match) return null;
+  const [, first, second] = match;
+  if (!isPackageName(first)) return null;
+  if (second === void 0) return { name: first };
+  if (!isPackageName(second)) return null;
+  return { name: second, consumer: first };
+}
+function lookupPaths(path23, dep) {
+  const at = parseInstallPath(path23);
+  if (!at) return [];
+  return at.consumer === void 0 ? [`node_modules/${at.name}/node_modules/${dep}`, `node_modules/${dep}`] : [
+    `node_modules/${at.consumer}/node_modules/${dep}`,
+    `node_modules/${dep}`
+  ];
+}
+function packageTreeProblems(value, options) {
+  const parsed = PackageTreeSchema.safeParse(value);
+  if (!parsed.success) {
+    return parsed.error.issues.map(
+      (issue) => `${issue.path.join(".") || "(root)"}: ${issue.message}`
+    );
+  }
+  const tree = parsed.data;
+  const problems = [];
+  const exempt = options.exempt ?? [];
+  const registry = normalizeRegistry(options.registry);
+  const treeRegistry = normalizeRegistry(tree.registry);
+  if (!registry)
+    return [`the build registry is not a URL: ${options.registry}`];
+  if (!treeRegistry || treeRegistry.href !== registry.href) {
+    problems.push(`registry ${tree.registry} is not ${registry.href}`);
+  }
+  const paths = Object.keys(tree.packages);
+  if (paths.length > PACKAGE_TREE_MAX_ENTRIES) {
+    return [
+      `${paths.length} entries, more than ${PACKAGE_TREE_MAX_ENTRIES}`,
+      ...problems
+    ];
+  }
+  for (const [path23, entry] of Object.entries(tree.packages)) {
+    const at = parseInstallPath(path23);
+    if (!at) {
+      problems.push(
+        `${path23}: not node_modules/<name> or node_modules/<name>/node_modules/<name>`
+      );
+      continue;
+    }
+    if (!isPackageName(entry.name)) {
+      problems.push(`${path23}: name ${entry.name} is not a package name`);
+      continue;
+    }
+    if (aliasCrossesExemption(at.name, entry.name, exempt)) {
+      problems.push(
+        `${path23}: an alias of ${entry.name} crosses an exempt prefix`
+      );
+    }
+    if (semver2.valid(entry.version) !== entry.version) {
+      problems.push(`${path23}: version ${entry.version} is not exact`);
+    }
+    if (!SHA512_INTEGRITY.test(entry.integrity)) {
+      problems.push(`${path23}: integrity is not one sha512 value`);
+    }
+    const scoped = options.scopeRegistries?.[scopeOf(entry.name)];
+    const from = scoped ? normalizeRegistry(scoped) : registry;
+    if (!tarballOn(entry.resolved, from, entry.name, entry.version)) {
+      problems.push(
+        `${path23}: resolved ${entry.resolved} is not the ${entry.name}@${entry.version} tarball on ${from?.origin ?? "the registry"}`
+      );
+    }
+    for (const [dep, spec] of Object.entries(entry.dependencies ?? {})) {
+      const target = edgeTargetName(dep, spec);
+      if (target === null) {
+        problems.push(`${path23}: dependency ${dep}@${spec} is no registry spec`);
+        continue;
+      }
+      if (aliasCrossesExemption(dep, target, exempt)) {
+        problems.push(
+          `${path23}: dependency ${dep}@${spec} crosses an exempt prefix`
+        );
+        continue;
+      }
+      const found = lookupPaths(path23, dep).find((p) => tree.packages[p]);
+      if (!found || tree.packages[found].name !== target) {
+        problems.push(
+          `${path23}: dependency ${dep}@${spec} has no ${target} in the tree`
+        );
+      }
+    }
+  }
+  for (const [name, spec] of Object.entries(options.declared ?? {})) {
+    const root = tree.packages[`node_modules/${name}`];
+    if (!root || root.name !== name) {
+      problems.push(`declared ${name}@${spec} is not at node_modules/${name}`);
+    } else if (!versionNamedBy(root.version, spec)) {
+      problems.push(`declared ${name}@${spec} is ${root.version} in the tree`);
+    }
+  }
+  return problems;
+}
+function assertPackageTree(value, options) {
+  const problems = packageTreeProblems(value, options);
+  if (problems.length > 0) throw new PackageTreeError(problems);
+  return PackageTreeSchema.parse(value);
+}
+function tarballOn(resolved, registry, name, version) {
+  if (!registry) return false;
+  let url;
+  try {
+    url = new URL(resolved);
+  } catch {
+    return false;
+  }
+  return url.origin === registry.origin && url.protocol === registry.protocol && url.username === "" && url.password === "" && url.search === "" && url.hash === "" && url.pathname === tarballPath(registry.pathname, name, version);
+}
+function versionNamedBy(version, spec) {
+  if (semver2.valid(spec) !== null) return semver2.eq(spec, version);
+  if (semver2.validRange(spec) !== null) {
+    return semver2.satisfies(version, spec, { includePrerelease: true });
+  }
+  return true;
+}
+function treeVersionLines(tree) {
+  return Object.entries(tree.packages).flatMap(([path23, entry]) => {
+    const at = parseInstallPath(path23);
+    return at && at.consumer === void 0 ? [`${at.name}@${entry.version}`] : [];
+  }).sort((a, b) => a.localeCompare(b));
+}
+function followedEdges(manifest) {
+  const edges = { ...manifest.dependencies ?? {} };
+  for (const [name, spec] of Object.entries(manifest.peerDependencies ?? {})) {
+    if (manifest.peerDependenciesMeta?.[name]?.optional === true) continue;
+    if (!(name in edges)) edges[name] = spec;
+  }
+  return edges;
+}
+
 // src/core/package-manager.ts
 var IGNORE_SCRIPTS = { ignoreScripts: true };
 var PACOTE_OPTS = {
@@ -1210,6 +1994,32 @@ var PACOTE_OPTS = {
   where: void 0,
   ...IGNORE_SCRIPTS
 };
+var UNAVAILABLE_CODES = /* @__PURE__ */ new Set([
+  "E404",
+  "E410",
+  "ETARGET",
+  "EINTEGRITY"
+]);
+var PackageUnavailableError = class extends Error {
+  constructor(installPath, entry, reason) {
+    super(
+      `Recorded package ${entry.name}@${entry.version} (${installPath}) could not be installed: ${reason}`
+    );
+    this.installPath = installPath;
+    this.name = "PackageUnavailableError";
+  }
+  installPath;
+  code = "PACKAGE_UNAVAILABLE";
+};
+function scopeRegistriesOf(npmConfig) {
+  const scoped = {};
+  for (const [key, value] of Object.entries(npmConfig)) {
+    if (key.startsWith("@") && key.endsWith(":registry") && typeof value === "string") {
+      scoped[key.slice(0, -":registry".length)] = value;
+    }
+  }
+  return scoped;
+}
 async function loadNpmConfigForPacote(projectDir = process.cwd(), homeDir = os.homedir()) {
   const merged = {};
   const sources = [
@@ -1334,6 +2144,13 @@ function extractWithResilience(spec, dest, opts, _logger, retryOptions) {
     retryOptions
   );
 }
+function tarballWithResilience(spec, opts, retryOptions) {
+  return withPacoteRetry(
+    (signal) => pacote.tarball(spec, withSignal(opts, signal)),
+    `download ${spec}`,
+    retryOptions
+  );
+}
 function manifestWithResilience(spec, opts, _logger, retryOptions) {
   return withPacoteRetry(
     (signal) => pacote.manifest(spec, withSignal(opts, signal)),
@@ -1353,9 +2170,10 @@ function getNestedPackageDirectory(baseDir, consumerName, nestedPackageName) {
     nestedPackageName
   );
 }
-async function collectAllSpecs(packages, logger, configDir, overrides = {}, npmConfig = PACOTE_OPTS) {
+async function collectAllSpecs(packages, logger, configDir, overrides = {}, npmConfig = PACOTE_OPTS, cooldown) {
   const allSpecs = /* @__PURE__ */ new Map();
   const visited = /* @__PURE__ */ new Set();
+  const exemptEdge = (name, spec, parentName) => cooldown !== void 0 && edgeIsExempt({ name, spec, parentName }, cooldown.exempt);
   const directLocalNames = new Set(
     packages.filter((p) => p.path).map((p) => p.name)
   );
@@ -1366,7 +2184,7 @@ async function collectAllSpecs(packages, logger, configDir, overrides = {}, npmC
       );
     }
   }
-  const substituteDep = (depName, depSpec, source, from, optional) => {
+  const substituteDep = (depName, depSpec, source, from, optional, parentName) => {
     const overrideSpec = overrides[depName];
     if (overrideSpec) {
       return {
@@ -1374,10 +2192,18 @@ async function collectAllSpecs(packages, logger, configDir, overrides = {}, npmC
         spec: overrideSpec,
         source: "override",
         from: `override (was ${depSpec} from ${from})`,
-        optional
+        optional,
+        exempt: exemptEdge(depName, overrideSpec)
       };
     }
-    return { name: depName, spec: depSpec, source, from, optional };
+    return {
+      name: depName,
+      spec: depSpec,
+      source,
+      from,
+      optional,
+      exempt: exemptEdge(depName, depSpec, parentName)
+    };
   };
   assertRegistrySpecs([
     ...packages.filter((pkg) => !pkg.path).map((pkg) => ({ name: pkg.name, spec: pkg.version, from: "flow.json" })),
@@ -1395,7 +2221,8 @@ async function collectAllSpecs(packages, logger, configDir, overrides = {}, npmC
     source: "direct",
     from: "flow.json",
     optional: false,
-    localPath: pkg.path
+    localPath: pkg.path,
+    exempt: exemptEdge(pkg.name, pkg.version)
   }));
   while (queue.length > 0) {
     const item = queue.shift();
@@ -1411,6 +2238,7 @@ async function collectAllSpecs(packages, logger, configDir, overrides = {}, npmC
       }
       assertTransitiveRegistrySpec(item);
     }
+    if (cooldown && !item.localPath) assertAliasKeepsSide(item, cooldown);
     if (!allSpecs.has(item.name)) allSpecs.set(item.name, []);
     const existing = allSpecs.get(item.name);
     if (!existing.some((s) => s.spec === item.spec && s.from === item.from)) {
@@ -1419,7 +2247,8 @@ async function collectAllSpecs(packages, logger, configDir, overrides = {}, npmC
         source: item.source,
         from: item.from,
         optional: item.optional,
-        localPath: item.localPath
+        localPath: item.localPath,
+        ...cooldown ? { exempt: item.exempt } : {}
       });
     }
     const visitKey = `${item.name}@${item.spec}`;
@@ -1468,10 +2297,16 @@ async function collectAllSpecs(packages, logger, configDir, overrides = {}, npmC
     try {
       manifest = await manifestWithResilience(
         `${item.name}@${item.spec}`,
-        npmConfig,
+        cooldownOptions(npmConfig, cooldown, item.exempt),
         logger
       );
+      if (cooldown && !item.exempt) {
+        assertPublishedBefore(manifest, cooldown, item.from);
+      }
     } catch (error) {
+      if (cooldown) {
+        throw cooldownFailure(item.name, item.spec, item.from, cooldown, error);
+      }
       logger.warn(
         `Failed to fetch manifest for ${item.name}@${item.spec} after retries; its dependencies may be unresolved: ${error instanceof Error ? error.message : String(error)}`
       );
@@ -1481,7 +2316,14 @@ async function collectAllSpecs(packages, logger, configDir, overrides = {}, npmC
     for (const [depName, depSpec] of Object.entries(deps)) {
       if (typeof depSpec === "string") {
         queue.push(
-          substituteDep(depName, depSpec, "dependency", item.name, false)
+          substituteDep(
+            depName,
+            depSpec,
+            "dependency",
+            item.name,
+            false,
+            manifest.name
+          )
         );
       }
     }
@@ -1496,13 +2338,46 @@ async function collectAllSpecs(packages, logger, configDir, overrides = {}, npmC
             depSpec,
             "peerDependency",
             item.name,
-            isOptional
+            isOptional,
+            manifest.name
           )
         );
       }
     }
   }
-  return allSpecs;
+  return allSpecs;
+}
+function cooldownOptions(npmConfig, cooldown, exempt) {
+  return cooldown && !exempt ? { ...npmConfig, before: cooldown.before } : npmConfig;
+}
+function assertPublishedBefore(manifest, cooldown, from) {
+  const time = Reflect.get(manifest, "_time");
+  const label = `${manifest.name}@${manifest.version} (from ${from})`;
+  if (typeof time !== "string" || Number.isNaN(Date.parse(time))) {
+    throw new Error(`${label} has no publish time in the registry`);
+  }
+  if (Date.parse(time) > cooldown.before.getTime()) {
+    throw new Error(
+      `${label} was published ${time}, after ${cooldown.before.toISOString()}`
+    );
+  }
+}
+function cooldownFailure(name, spec, from, cooldown, error) {
+  if (readErrorCode(error) === "ETARGET") {
+    return new Error(
+      `No version of ${name}@${spec} (from ${from}) was published at or before ${cooldown.before.toISOString()}`
+    );
+  }
+  if (error instanceof Error) return error;
+  return new Error(String(error));
+}
+function assertAliasKeepsSide(item, cooldown) {
+  const target = edgeTargetName(item.name, item.spec);
+  if (target !== null && aliasCrossesExemption(item.name, target, cooldown.exempt)) {
+    throw new PackageTreeError([
+      `${item.name}@${item.spec} (from ${item.from}) aliases across an exempt prefix`
+    ]);
+  }
 }
 var SOURCE_PRIORITY = {
   direct: 0,
@@ -1510,21 +2385,26 @@ var SOURCE_PRIORITY = {
   dependency: 2,
   peerDependency: 3
 };
-async function resolveVersionConflicts(allSpecs, logger, npmConfig = {}) {
+async function resolveVersionConflicts(allSpecs, logger, npmConfig = {}, cooldown) {
   const topLevel = /* @__PURE__ */ new Map();
   const nested = [];
   for (const [name, specs] of allSpecs) {
     let nestLoser2 = function(spec, alreadyNested2) {
       if (spec.localPath) return;
       if (alreadyNested2.has(spec.spec)) return;
-      if (semver2.valid(spec.spec) === null && semver2.validRange(spec.spec) === null) {
+      if (semver3.valid(spec.spec) === null && semver3.validRange(spec.spec) === null) {
         logger.debug(
           `Skipping non-semver loser spec for ${name}: ${spec.spec} from ${spec.from}`
         );
         return;
       }
       const consumers = activeSpecs.filter((s) => s.spec === spec.spec).map((s) => s.from);
-      nested.push({ name, version: spec.spec, consumers });
+      nested.push({
+        name,
+        version: spec.spec,
+        consumers,
+        ...cooldown ? { exempt: specExempt(spec.spec) } : {}
+      });
       alreadyNested2.add(spec.spec);
     };
     var nestLoser = nestLoser2;
@@ -1537,6 +2417,7 @@ async function resolveVersionConflicts(allSpecs, logger, npmConfig = {}) {
       });
       continue;
     }
+    const specExempt = (spec) => cooldown !== void 0 && specs.filter((s) => s.spec === spec).every((s) => s.exempt === true);
     const nonPeerSpecs = specs.filter((s) => s.source !== "peerDependency");
     const peerSpecs = specs.filter((s) => s.source === "peerDependency");
     let activeSpecs;
@@ -1554,7 +2435,7 @@ async function resolveVersionConflicts(allSpecs, logger, npmConfig = {}) {
       (a, b) => SOURCE_PRIORITY[a.source] - SOURCE_PRIORITY[b.source]
     );
     const directSpecs = activeSpecs.filter((s) => s.source === "direct");
-    const directExact = directSpecs.find((s) => semver2.valid(s.spec) !== null);
+    const directExact = directSpecs.find((s) => semver3.valid(s.spec) !== null);
     let chosenVersion;
     const alreadyNested = /* @__PURE__ */ new Set();
     if (directExact) {
@@ -1562,15 +2443,20 @@ async function resolveVersionConflicts(allSpecs, logger, npmConfig = {}) {
     } else if (directSpecs.length > 0) {
       chosenVersion = directSpecs[0].spec;
     } else {
-      const exactVersions = activeSpecs.filter((s) => semver2.valid(s.spec) !== null).map((s) => s.spec);
+      const exactVersions = activeSpecs.filter((s) => semver3.valid(s.spec) !== null).map((s) => s.spec);
       const uniqueExact = [...new Set(exactVersions)];
       if (uniqueExact.length > 1) {
-        const sorted = [...uniqueExact].sort(semver2.rcompare);
+        const sorted = [...uniqueExact].sort(semver3.rcompare);
         chosenVersion = sorted[0];
         for (let i = 1; i < sorted.length; i++) {
           const loserVersion = sorted[i];
           const consumers = activeSpecs.filter((s) => s.spec === loserVersion).map((s) => s.from);
-          nested.push({ name, version: loserVersion, consumers });
+          nested.push({
+            name,
+            version: loserVersion,
+            consumers,
+            ...cooldown ? { exempt: specExempt(loserVersion) } : {}
+          });
           alreadyNested.add(loserVersion);
         }
       } else if (uniqueExact.length === 1) {
@@ -1580,17 +2466,25 @@ async function resolveVersionConflicts(allSpecs, logger, npmConfig = {}) {
       }
     }
     let concreteVersion;
-    if (semver2.valid(chosenVersion)) {
+    if (semver3.valid(chosenVersion)) {
       concreteVersion = chosenVersion;
     } else {
+      const askedBy = specs.filter((s) => s.spec === chosenVersion).map((s) => s.from).join(", ");
       try {
+        const exempt = specExempt(chosenVersion);
         const manifest = await manifestWithResilience(
           `${name}@${chosenVersion}`,
-          npmConfig,
+          cooldownOptions(npmConfig, cooldown, exempt),
           logger
         );
+        if (cooldown && !exempt) {
+          assertPublishedBefore(manifest, cooldown, askedBy);
+        }
         concreteVersion = manifest.version;
       } catch (err) {
+        if (cooldown) {
+          throw cooldownFailure(name, chosenVersion, askedBy, cooldown, err);
+        }
         if (process.env.BUNDLER_STRICT_RANGES === "0") {
           logger.warn(
             `Could not resolve ${name}@${chosenVersion} for strict validation: ${err instanceof Error ? err.message : String(err)}. Skipping range validation (BUNDLER_STRICT_RANGES=0).`
@@ -1606,7 +2500,7 @@ async function resolveVersionConflicts(allSpecs, logger, npmConfig = {}) {
     for (const spec of specs) {
       if (spec.localPath) continue;
       if (spec.spec === chosenVersion) continue;
-      const satisfied = semver2.valid(spec.spec) ? spec.spec === concreteVersion : semver2.validRange(spec.spec) ? semver2.satisfies(concreteVersion, spec.spec, {
+      const satisfied = semver3.valid(spec.spec) ? spec.spec === concreteVersion : semver3.validRange(spec.spec) ? semver3.satisfies(concreteVersion, spec.spec, {
         includePrerelease: true
       }) : true;
       if (satisfied) continue;
@@ -1618,7 +2512,11 @@ async function resolveVersionConflicts(allSpecs, logger, npmConfig = {}) {
         nestLoser2(spec, alreadyNested);
       }
     }
-    topLevel.set(name, { name, version: chosenVersion });
+    topLevel.set(name, {
+      name,
+      version: chosenVersion,
+      ...cooldown ? { exempt: specExempt(chosenVersion) } : {}
+    });
   }
   const consolidatedMap = /* @__PURE__ */ new Map();
   for (const entry of nested) {
@@ -1628,13 +2526,16 @@ async function resolveVersionConflicts(allSpecs, logger, npmConfig = {}) {
       for (const c of entry.consumers) {
         if (!existing.consumers.includes(c)) existing.consumers.push(c);
       }
+      if (existing.exempt !== void 0) {
+        existing.exempt = existing.exempt && entry.exempt === true;
+      }
     } else {
       consolidatedMap.set(key, { ...entry, consumers: [...entry.consumers] });
     }
   }
   return { topLevel, nested: [...consolidatedMap.values()] };
 }
-async function downloadPackagesWithResolution(packages, targetDir, logger, useCache = true, configDir, tmpDir, overrides = {}, npmConfig = PACOTE_OPTS) {
+async function downloadPackagesWithResolution(packages, targetDir, logger, useCache = true, configDir, tmpDir, overrides = {}, npmConfig = PACOTE_OPTS, cooldown) {
   return downloadPackagesImpl(
     packages,
     targetDir,
@@ -1643,10 +2544,11 @@ async function downloadPackagesWithResolution(packages, targetDir, logger, useCa
     configDir,
     tmpDir,
     overrides,
-    npmConfig
+    npmConfig,
+    cooldown
   );
 }
-async function downloadPackagesImpl(packages, targetDir, logger, useCache, configDir, tmpDir, overrides, npmConfig) {
+async function downloadPackagesImpl(packages, targetDir, logger, useCache, configDir, tmpDir, overrides, npmConfig, cooldown) {
   const packagePaths = /* @__PURE__ */ new Map();
   const userSpecifiedPackages = new Set(packages.map((p) => p.name));
   validateNoDuplicatePackages(packages);
@@ -1656,11 +2558,30 @@ async function downloadPackagesImpl(packages, targetDir, logger, useCache, confi
     logger,
     configDir,
     overrides,
-    npmConfig
+    npmConfig,
+    cooldown
+  );
+  const resolution = await resolveVersionConflicts(
+    allSpecs,
+    logger,
+    npmConfig,
+    cooldown
   );
-  const resolution = await resolveVersionConflicts(allSpecs, logger, npmConfig);
   const { topLevel, nested } = resolution;
   await fs10.ensureDir(targetDir);
+  if (cooldown) {
+    const tree = await installResolvedTree(
+      packages,
+      resolution,
+      targetDir,
+      logger,
+      { npmConfig, cooldown, tmpDir }
+    );
+    for (const name of topLevel.keys()) {
+      packagePaths.set(name, getPackageDirectory(targetDir, name));
+    }
+    return { packagePaths, resolution, tree };
+  }
   const localPackageMap = /* @__PURE__ */ new Map();
   for (const pkg of packages) {
     if (pkg.path) localPackageMap.set(pkg.name, pkg.path);
@@ -1721,7 +2642,7 @@ async function downloadPackagesImpl(packages, targetDir, logger, useCache, confi
   }
   for (const nestedPkg of nested) {
     let resolvedSpec = `${nestedPkg.name}@${nestedPkg.version}`;
-    if (!semver2.valid(nestedPkg.version)) {
+    if (!semver3.valid(nestedPkg.version)) {
       try {
         const manifest = await manifestWithResilience(
           resolvedSpec,
@@ -1760,6 +2681,169 @@ async function downloadPackagesImpl(packages, targetDir, logger, useCache, confi
   }
   return { packagePaths, resolution };
 }
+function npmCacheDir(tmpDir) {
+  return process.env.NPM_CACHE_DIR || getTmpPath(tmpDir, "cache", "npm");
+}
+function sha512Of(integrity) {
+  return integrity?.split(/\s+/).find((value) => value.startsWith("sha512-")) ?? null;
+}
+async function readInstalledManifest(dir) {
+  const manifest = await fs10.readJson(
+    path10.join(dir, "package.json")
+  );
+  return manifest;
+}
+async function installResolvedTree(packages, resolution, targetDir, logger, context2) {
+  const { npmConfig, cooldown, tmpDir } = context2;
+  const cacheDir = npmCacheDir(tmpDir);
+  const entries = {};
+  const install = async (installName, spec, exempt, installPath) => {
+    let picked;
+    try {
+      picked = await manifestWithResilience(
+        `${installName}@${spec}`,
+        cooldownOptions(npmConfig, cooldown, exempt),
+        logger
+      );
+      if (!exempt) assertPublishedBefore(picked, cooldown, installPath);
+    } catch (error) {
+      throw cooldownFailure(installName, spec, installPath, cooldown, error);
+    }
+    if (aliasCrossesExemption(installName, picked.name, cooldown.exempt)) {
+      throw new PackageTreeError([
+        `${installPath}: ${installName} holds ${picked.name}, across an exempt prefix`
+      ]);
+    }
+    const resolved = picked._resolved;
+    const registryIntegrity = picked._integrity || void 0;
+    const dir = path10.join(targetDir, installPath);
+    await fs10.ensureDir(path10.dirname(dir));
+    const result = await extractWithResilience(
+      resolved,
+      dir,
+      {
+        ...npmConfig,
+        cache: cacheDir,
+        ...registryIntegrity ? { integrity: registryIntegrity } : {}
+      },
+      logger
+    );
+    let integrity = sha512Of(result.integrity) ?? sha512Of(registryIntegrity);
+    if (integrity === null) {
+      const bytes = await tarballWithResilience(resolved, {
+        ...npmConfig,
+        cache: cacheDir,
+        ...registryIntegrity ? { integrity: registryIntegrity } : {}
+      });
+      integrity = `sha512-${createHash3("sha512").update(bytes).digest("base64")}`;
+    }
+    const edges = followedEdges(await readInstalledManifest(dir));
+    entries[installPath] = {
+      name: picked.name,
+      version: picked.version,
+      resolved,
+      integrity,
+      ...Object.keys(edges).length > 0 ? { dependencies: edges } : {}
+    };
+    logger.debug(
+      `Installed ${picked.name}@${picked.version} at ${installPath}`
+    );
+  };
+  for (const [name, pkg] of resolution.topLevel) {
+    if (pkg.localPath) {
+      throw new PackageTreeError([
+        `${name}: a local package cannot be part of a recorded tree`
+      ]);
+    }
+    await install(
+      name,
+      pkg.version,
+      pkg.exempt === true,
+      `node_modules/${name}`
+    );
+  }
+  for (const nestedPkg of resolution.nested) {
+    for (const consumer of nestedPkg.consumers) {
+      await install(
+        nestedPkg.name,
+        nestedPkg.version,
+        nestedPkg.exempt === true,
+        `node_modules/${consumer}/node_modules/${nestedPkg.name}`
+      );
+    }
+  }
+  const tree = {
+    version: PACKAGE_TREE_VERSION,
+    registry: npmConfig.registry,
+    before: cooldown.before.toISOString(),
+    packages: entries
+  };
+  return assertPackageTree(tree, {
+    registry: npmConfig.registry,
+    scopeRegistries: scopeRegistriesOf(npmConfig),
+    declared: Object.fromEntries(
+      packages.map((pkg) => [pkg.name, pkg.version])
+    ),
+    exempt: cooldown.exempt
+  });
+}
+async function installPackageTree(tree, targetDir, logger, context2) {
+  const { npmConfig, tmpDir, declared } = context2;
+  const checked = assertPackageTree(tree, {
+    registry: npmConfig.registry,
+    scopeRegistries: scopeRegistriesOf(npmConfig),
+    declared
+  });
+  const cacheDir = npmCacheDir(tmpDir);
+  const ordered = Object.entries(checked.packages).sort(
+    ([a], [b]) => a.split("/").length - b.split("/").length || a.localeCompare(b)
+  );
+  for (const [installPath, entry] of ordered) {
+    const dir = path10.join(targetDir, installPath);
+    await fs10.ensureDir(path10.dirname(dir));
+    try {
+      await extractWithResilience(
+        entry.resolved,
+        dir,
+        { ...npmConfig, cache: cacheDir, integrity: entry.integrity },
+        logger
+      );
+    } catch (error) {
+      const code = readErrorCode(error);
+      if (code === void 0 || !UNAVAILABLE_CODES.has(code)) throw error;
+      const found = Reflect.get(Object(error), "found");
+      const reason = code === "EINTEGRITY" ? `integrity ${entry.integrity} recorded, ${found === void 0 ? "other bytes" : String(found)} received` : "the registry does not serve it";
+      throw new PackageUnavailableError(installPath, entry, reason);
+    }
+  }
+  const problems = [];
+  const packagePaths = /* @__PURE__ */ new Map();
+  for (const [installPath, entry] of ordered) {
+    const dir = path10.join(targetDir, installPath);
+    const installed = await readInstalledManifest(dir);
+    if (installed.name !== entry.name || installed.version !== entry.version) {
+      problems.push(
+        `${installPath}: holds ${installed.name}@${installed.version}, recorded ${entry.name}@${entry.version}`
+      );
+    }
+    for (const [dep, spec] of Object.entries(followedEdges(installed))) {
+      const target = edgeTargetName(dep, spec);
+      const found = lookupPaths(installPath, dep).find(
+        (candidate) => checked.packages[candidate] !== void 0
+      );
+      if (target === null || !found || checked.packages[found].name !== target) {
+        problems.push(
+          `${installPath}: dependency ${dep}@${spec} has no ${target ?? dep} in the tree`
+        );
+      }
+    }
+    const at = parseInstallPath(installPath);
+    if (at && at.consumer === void 0) packagePaths.set(at.name, dir);
+  }
+  if (problems.length > 0) throw new PackageTreeError(problems);
+  logger.debug(`Installed ${ordered.length} packages from the recorded tree`);
+  return packagePaths;
+}
 async function getCachedPackagePath(pkg, tmpDir) {
   const cacheDir = getTmpPath(tmpDir, "cache", "packages");
   const cacheKey = await getPackageCacheKey(pkg.name, pkg.version);
@@ -1852,6 +2936,27 @@ function assertDepsTraced(opts) {
     (dep) => !opts.importedPackages.has(dep) && !isTraced(dep)
   );
 }
+async function missingEntry(packageDir) {
+  let manifest;
+  try {
+    manifest = JSON.parse(
+      await fs11.readFile(path11.join(packageDir, "package.json"), "utf8")
+    );
+  } catch {
+    return void 0;
+  }
+  if (!manifest || typeof manifest !== "object") return void 0;
+  const entries = ["main", "module", "exports"].flatMap((field) => stringLeaves(Reflect.get(manifest, field))).filter((entry) => !entry.includes("*") && !entry.endsWith("package.json"));
+  if (entries.length === 0) return void 0;
+  for (const entry of entries) {
+    try {
+      await fs11.access(path11.join(packageDir, entry));
+      return void 0;
+    } catch {
+    }
+  }
+  return entries[0];
+}
 async function collectImportedPackages(file) {
   let result;
   try {
@@ -1923,7 +3028,7 @@ async function walkFiles(root, dir, visit) {
 // src/commands/bundle/assert-consumer-deps.ts
 import fs12 from "fs-extra";
 import * as path12 from "path";
-import semver3 from "semver";
+import semver4 from "semver";
 async function assertConsumerDepsSatisfied(root, logger) {
   const consumers = await collectInstalledPackages(
     path12.join(root, "node_modules")
@@ -1944,13 +3049,13 @@ async function assertConsumerDepsSatisfied(root, logger) {
         );
         continue;
       }
-      if (semver3.validRange(declaredRange) === null && semver3.valid(declaredRange) === null) {
+      if (semver4.validRange(declaredRange) === null && semver4.valid(declaredRange) === null) {
         logger.debug(
           `assertConsumerDepsSatisfied: skipping non-semver declared range ${depName}@${declaredRange} from ${pkg.name}`
         );
         continue;
       }
-      const satisfied = semver3.valid(declaredRange) ? declaredRange === installed.version : semver3.satisfies(installed.version, declaredRange, {
+      const satisfied = semver4.valid(declaredRange) ? declaredRange === installed.version : semver4.satisfies(installed.version, declaredRange, {
         includePrerelease: true
       });
       if (!satisfied) {
@@ -2030,22 +3135,22 @@ function flowNeeds(flow) {
     ...Object.values(flow.destinations ?? {})
   ];
   return {
-    observe: flow.config?.observe !== void 0 || flow.collector?.observe !== void 0,
+    observe: false,
     stores: Object.keys(flow.stores ?? {}).length > 0,
     state: steps.some(carriesState)
   };
 }
-function buildFlagDefines(needs) {
+function buildFlagDefines(needs, observe) {
   if (!needs) {
     return {
-      __WALKEROS_OBSERVE__: "true",
+      __WALKEROS_OBSERVE__: String(observe),
       __WALKEROS_STORES__: "true",
       __WALKEROS_STATE__: "true",
       __WALKEROS_VALIDATE__: "true"
     };
   }
   return {
-    __WALKEROS_OBSERVE__: String(needs.observe),
+    __WALKEROS_OBSERVE__: String(observe),
     __WALKEROS_STORES__: String(needs.stores),
     __WALKEROS_STATE__: String(needs.state),
     __WALKEROS_VALIDATE__: "false"
@@ -2148,21 +3253,21 @@ async function ensureCodeOnDisk(codeContent, compiledCode, tmpDir, inputs) {
 }
 
 // src/version.ts
-import { readFileSync } from "fs";
+import { readFileSync as readFileSync3 } from "fs";
 import { fileURLToPath } from "url";
-import { dirname as dirname3, join as join3 } from "path";
+import { dirname as dirname3, join as join5 } from "path";
 var versionFilename = fileURLToPath(import.meta.url);
 var versionDirname = dirname3(versionFilename);
 function findPackageJson() {
   const paths = [
-    join3(versionDirname, "../package.json"),
+    join5(versionDirname, "../package.json"),
     // dist/ or src/
-    join3(versionDirname, "../../package.json")
+    join5(versionDirname, "../../package.json")
     // src/core/ (not used, but safe)
   ];
   for (const p of paths) {
     try {
-      return readFileSync(p, "utf-8");
+      return readFileSync3(p, "utf-8");
     } catch {
     }
   }
@@ -2268,6 +3373,46 @@ async function resolvedVersionLines(topLevel, packagePaths) {
   }
   return lines;
 }
+async function installPackages(packagesArray, targetDir, cacheDir, buildOptions, npmConfig, logger) {
+  const install = buildOptions.packageInstall;
+  if (install && "tree" in install) {
+    const packagePaths2 = await installPackageTree(
+      install.tree,
+      targetDir,
+      logger,
+      {
+        npmConfig,
+        tmpDir: cacheDir,
+        declared: Object.fromEntries(
+          packagesArray.map((pkg) => [pkg.name, pkg.version])
+        )
+      }
+    );
+    return { packagePaths: packagePaths2, versionLines: treeVersionLines(install.tree) };
+  }
+  const { packagePaths, resolution, tree } = await downloadPackagesWithResolution(
+    packagesArray,
+    targetDir,
+    logger,
+    // A recorded tree is built from what was extracted, never a cache copy.
+    install ? false : buildOptions.cache,
+    buildOptions.configDir,
+    // For resolving relative local paths
+    cacheDir,
+    buildOptions.overrides,
+    npmConfig,
+    install?.resolve
+  );
+  if (install) {
+    if (!tree) throw new Error("A resolve under a cutoff returned no tree");
+    install.onTree(tree);
+    return { packagePaths, versionLines: treeVersionLines(tree) };
+  }
+  return {
+    packagePaths,
+    versionLines: await resolvedVersionLines(resolution.topLevel, packagePaths)
+  };
+}
 async function bundleCore(flowSettings, buildOptions, logger, showStats = false, provenance) {
   const bundleStartTime = Date.now();
   const CACHE_DIR = buildOptions.tempDir || getTmpPath();
@@ -2296,16 +3441,13 @@ async function bundleCore(flowSettings, buildOptions, logger, showStats = false,
         // Pass local path if defined
       })
     );
-    const { packagePaths, resolution: resolutionResult } = await downloadPackagesWithResolution(
+    const { packagePaths, versionLines } = await installPackages(
       packagesArray,
       TEMP_DIR,
-      logger,
-      buildOptions.cache,
-      buildOptions.configDir,
-      // For resolving relative local paths
       CACHE_DIR,
-      buildOptions.overrides,
-      npmConfig
+      buildOptions,
+      npmConfig,
+      logger
     );
     const warnedBundleFieldPackages = /* @__PURE__ */ new Set();
     for (const [pkgName, pkgPath] of packagePaths.entries()) {
@@ -2344,10 +3486,7 @@ async function bundleCore(flowSettings, buildOptions, logger, showStats = false,
     if (process.env.BUNDLER_STRICT_RANGES !== "0") {
       await assertConsumerDepsSatisfied(TEMP_DIR, logger);
     }
-    const sortedVersions = await resolvedVersionLines(
-      resolutionResult.topLevel,
-      packagePaths
-    );
+    const sortedVersions = versionLines;
     const versionsHash = await getHashServer3(sortedVersions.join("\n"), 12);
     applyCollectorDefaults(flowSettings);
     if (provenance) {
@@ -2497,8 +3636,7 @@ ${dataDeclaration}${needs}`;
       const stage2Entry = (buildOptions.platform || "node") === "browser" ? generateWebEntry(stage1Path, dataPayload, {
         windowCollector: buildOptions.windowCollector,
         windowElb: buildOptions.windowElb,
-        platform: buildOptions.platform,
-        observe: readObserveConnect(flowSettings, logger)
+        platform: buildOptions.platform
       }) : generateServerEntry(stage1Path, dataPayload);
       const stage2EntryPath = path14.join(TEMP_DIR, "stage2.mjs");
       await fs14.writeFile(stage2EntryPath, stage2Entry);
@@ -2525,7 +3663,7 @@ ${dataDeclaration}${needs}`;
         stage2Options.define = {
           "process.env.NODE_ENV": '"production"',
           global: "globalThis",
-          ...buildFlagDefines(flowNeeds(flowSettings))
+          ...buildFlagDefines(flowNeeds(flowSettings), false)
         };
         stage2Options.target = resolveTarget(buildOptions);
       } else {
@@ -2742,8 +3880,11 @@ async function runNftServerPath(outputPath, flowSettings, buildOptions, tempDir,
       importedPackages: await collectImportedPackages(outputPath)
     });
     for (const name of unused) {
+      const entry = await missingEntry(
+        path14.join(tempDir, "node_modules", name)
+      );
       logger.warn(
-        `Package ${name} is declared in bundle.packages but nothing imports it; it is not in the bundle. Remove it from bundle.packages if unused.`
+        entry ? `Package ${name} is declared in bundle.packages, but its installed copy has no ${entry}; it is not in the bundle.` : `Package ${name} is declared in bundle.packages but nothing imports it; it is not in the bundle. Remove it from bundle.packages if unused.`
       );
     }
   }
@@ -3197,66 +4338,12 @@ ${HOST_LOGGER_MERGE}
 
   const result = await startFlow(config);
 
-  // Telemetry observer installation: the host (pipeline.ts) builds the
-  // observer functions via createTelemetryObserver + createBatchedPoster
-  // and forwards them through context. Added to collector.observers so the
-  // runtime self-emission loop drives them.
-  if (context.observers) {
-    for (const observer of context.observers) {
-      result.collector.observers.add(observer);
-    }
-  }
-
-  // The host forwards the level supplier beside the observers; the collector
-  // capture path reads it to decide destination call capture at trace.
-  if (context.observeLevel) result.collector.observeLevel = context.observeLevel;
-
   const httpSource = Object.values(result.collector.sources || {})
     .find(s => 'httpHandler' in s && typeof s.httpHandler === 'function');
 
   return { ...result, httpHandler: httpSource ? httpSource.httpHandler : undefined };
 }`;
 }
-function readObserveConnect(flowSettings, logger) {
-  const observe = flowSettings.config?.observe;
-  if (!observe) return void 0;
-  const { url, binding, level, sample } = observe;
-  if (url === void 0 && binding === void 0) return void 0;
-  const trimmedUrl = typeof url === "string" ? url.trim() : "";
-  const trimmedBinding = typeof binding === "string" ? binding.trim() : "";
-  if (trimmedUrl !== "" && trimmedBinding !== "") {
-    return {
-      url: trimmedUrl,
-      binding: trimmedBinding,
-      // Same JSON-borne prudence as the pair: only known-shaped public
-      // values reach the emitted literal.
-      ...level === "off" || level === "standard" || level === "trace" ? { level } : {},
-      // Sample is a fraction in [0, 1] per the Flow.Observe contract; the
-      // range test also drops NaN and the infinities.
-      ...typeof sample === "number" && sample >= 0 && sample <= 1 ? { sample } : {}
-    };
-  }
-  const missing = [
-    ...trimmedUrl === "" ? ["url"] : [],
-    ...trimmedBinding === "" ? ["binding"] : []
-  ].join(" and ");
-  logger?.warn(
-    `config.observe has no effect: missing or empty ${missing}. Observe connect wiring was skipped; set both config.observe.url and config.observe.binding to non-empty public values.`
-  );
-  return void 0;
-}
-var OBSERVE_SLOT_IMPORT = "import { pageObserveSlot } from '@walkeros/web-core';\n";
-function emitObserveAssignment(observe) {
-  const literal = {
-    url: observe.url,
-    binding: observe.binding,
-    ...observe.flowId !== void 0 ? { flowId: observe.flowId } : {},
-    ...observe.level !== void 0 ? { level: observe.level } : {},
-    ...observe.sample !== void 0 ? { sample: observe.sample } : {}
-  };
-  return `
-  config.observe = { ...${JSON.stringify(literal)}, slot: pageObserveSlot() };`;
-}
 var MOIN_IMPORT = "import { moin } from '@walkeros/web-core';\n";
 function emitMoinCall(target) {
   if (!target)
@@ -3305,16 +4392,14 @@ function generateWebEntry(stage1Path, dataPayload, options = {}) {
     }
   }` : "";
   const stage1Specifier = toFileImportSpecifier(stage1Path);
-  const observeImport = options.observe ? OBSERVE_SLOT_IMPORT : "";
-  const observeBlock = options.observe ? emitObserveAssignment(options.observe) : "";
   const loaderImport = platform === "browser" ? MOIN_IMPORT : "";
   const loaderCall = platform === "browser" ? emitMoinCall() : "";
-  return `${loaderImport}${observeImport}import { startFlow, wireConfig } from '${stage1Specifier}';
+  return `${loaderImport}import { startFlow, wireConfig } from '${stage1Specifier}';
 
 const __configData = ${dataPayload};
 
 (async () => {${loaderCall}
-  const config = wireConfig(__configData);${envBlock}${observeBlock}
+  const config = wireConfig(__configData);${envBlock}
   const { collector, elb } = await startFlow(config);${assignmentCode}
 })();`;
 }
@@ -3326,39 +4411,10 @@ function generateWrapEntry(stage1Path, options = {}) {
     );
   }
   const assignmentCode = assignments.length > 0 ? "\n" + assignments.join("\n") : "";
-  if (options.preview !== void 0 && options.previewGrantTargets !== void 0) {
-    throw new Error(
-      "generateWrapEntry: `preview` (host activator) and `previewGrantTargets` (preview-artifact injection) are mutually exclusive. A host bundle activates a preview; an artifact injects its grant. Pass at most one."
-    );
-  }
   const preview = options.preview;
   const previewEnabled = !!preview?.enabled;
   const previewImport = previewEnabled ? `import { browserSwapActivator } from '@walkeros/web-core';
 ` : "";
-  const grantTargets = options.previewGrantTargets ?? [];
-  const previewGrantBlock = grantTargets.length > 0 ? `
-  // --- Preview grant injection ---
-  try {
-    const __previewGrant =
-      typeof localStorage !== 'undefined'
-        ? localStorage.getItem('elbPreviewSession')
-        : null;
-    if (__previewGrant && config.destinations) {
-${grantTargets.map((key) => {
-    const ref = `config.destinations[${singleQuoteLiteral(key)}]`;
-    return `      if (${ref}) {
-        const __dest = ${ref};
-        const __cfg = __dest.config || (__dest.config = {});
-        const __settings = __cfg.settings || (__cfg.settings = {});
-        const __headers = __settings.headers || (__settings.headers = {});
-        __headers['X-Walkeros-Preview'] = __previewGrant;
-      }`;
-  }).join("\n")}
-    }
-  } catch (__err) {
-    // localStorage can throw (Safari private mode); boot without the grant.
-  }
-  // --- End preview grant injection ---` : "";
   const previewBlock = previewEnabled && preview ? `
   // --- Preview activation ---
   if (await browserSwapActivator(${JSON.stringify({
@@ -3382,21 +4438,24 @@ ${grantTargets.map((key) => {
       env.document = env.document ?? (typeof document !== 'undefined' ? document : undefined);
     }
   }` : "";
+  const observe = options.observe && {
+    preview: {
+      url: options.observe.preview.url,
+      token: options.observe.preview.token
+    }
+  };
+  const observeBlock = observe ? `
+  config.observe = ${JSON.stringify(observe)};` : "";
   const stage1Specifier = toFileImportSpecifier(stage1Path);
-  const observeImport = options.observe ? OBSERVE_SLOT_IMPORT : "";
-  const observeBlock = options.observe ? emitObserveAssignment(options.observe) : "";
   const loaderImport = platform === "browser" ? MOIN_IMPORT : "";
   const loaderCall = platform === "browser" ? emitMoinCall(options.moin) : "";
-  return `${loaderImport}${previewImport}${observeImport}import { startFlow, wireConfig, __configData } from '${stage1Specifier}';
+  return `${loaderImport}${previewImport}import { startFlow, wireConfig, __configData } from '${stage1Specifier}';
 
 (async () => {${loaderCall}${previewBlock}
-  const config = wireConfig(__configData);${envBlock}${previewGrantBlock}${observeBlock}
+  const config = wireConfig(__configData);${envBlock}${observeBlock}
   const { collector, elb } = await startFlow(config);${assignmentCode}
 })();`;
 }
-function singleQuoteLiteral(value) {
-  return `'${value.replace(/\\/g, "\\\\").replace(/'/g, "\\'")}'`;
-}
 function generateWrapEntryServer(stage1Path) {
   const stage1Specifier = toFileImportSpecifier(stage1Path);
   return `import { startFlow, wireConfig, __configData } from '${stage1Specifier}';
@@ -3416,20 +4475,6 @@ ${HOST_LOGGER_MERGE}
 
   const result = await startFlow(config);
 
-  // Telemetry observer installation: the host (pipeline.ts) builds the
-  // observer functions via createTelemetryObserver + createBatchedPoster
-  // and forwards them through context. Added to collector.observers so the
-  // runtime self-emission loop drives them.
-  if (context.observers) {
-    for (const observer of context.observers) {
-      result.collector.observers.add(observer);
-    }
-  }
-
-  // The host forwards the level supplier beside the observers; the collector
-  // capture path reads it to decide destination call capture at trace.
-  if (context.observeLevel) result.collector.observeLevel = context.observeLevel;
-
   const httpSource = Object.values(result.collector.sources || {})
     .find(s => 'httpHandler' in s && typeof s.httpHandler === 'function');
 
@@ -4077,6 +5122,7 @@ function applyOverrides(config, overrides) {
     }
   }
   config.run = true;
+  delete config.observe;
   if (overrides.transformerMocks) {
     const transformers = config.transformers;
     if (transformers) {
@@ -5311,9 +6357,11 @@ function collectFailedDestinations(collector) {
 }
 function buildFailureSummary(failedIds, collector) {
   const view = collector !== null && typeof collector === "object" ? collector : {};
-  const dests = view.destinations ?? {};
+  const dests = Object.entries(view.destinations ?? {});
   const labels = failedIds.map((id) => {
-    const type = dests[id]?.type;
+    const type = dests.find(
+      ([key, dest]) => (dest.config?.id || key) === id
+    )?.[1].type;
     return type ? `${id} (${type})` : id;
   });
   const noun = failedIds.length === 1 ? "destination" : "destinations";
@@ -6515,7 +7563,7 @@ async function readStepPackageInfo(resolved, options) {
 }
 
 // src/commands/validate/validators/settings.ts
-var CLIENT_HEADER = "walkeros-cli/4.9.0";
+var CLIENT_HEADER = "walkeros-cli/4.10.0-next-1794522704623";
 var LOGGER = createLogger();
 function createSettingsContext(configDir) {
   return { configDir, cache: /* @__PURE__ */ new Map(), compiled: /* @__PURE__ */ new Map() };
@@ -7988,7 +9036,7 @@ function exitCodeOf(result, strict) {
 }
 
 // src/commands/auth/index.ts
-import { z as z3 } from "zod";
+import { z as z6 } from "zod";
 
 // src/core/api-error.ts
 var EXIT_RETRYABLE = 75;
@@ -8017,191 +9065,57 @@ var ApiError = class extends Error {
     this.client = options?.client;
     this.upgrade = options?.upgrade;
     this.docs = options?.docs;
-  }
-};
-function machineReadableErrorLine(err) {
-  const code = err instanceof ApiError ? err.code ?? "UNKNOWN" : "UNKNOWN";
-  const retryable = err instanceof ApiError ? err.retryable === true : false;
-  const retryAfter = err instanceof ApiError && err.retryAfterSeconds !== void 0 ? ` retryAfter=${err.retryAfterSeconds}` : "";
-  const message = err instanceof Error ? err.message : String(err);
-  return `error: code=${code} retryable=${retryable}${retryAfter} message=${message}`;
-}
-function handleCliError(err) {
-  console.error(machineReadableErrorLine(err));
-  if (err instanceof ApiError && err.code === "CLIENT_OUTDATED") {
-    console.error(`
-${err.message}
-`);
-    if (err.upgrade) console.error(`  Upgrade: ${err.upgrade}`);
-    if (err.docs) console.error(`  Docs:    ${err.docs}
-`);
-    process.exit(2);
-  }
-  if (err instanceof ApiError && err.retryable) {
-    const hint = err.retryAfterSeconds !== void 0 ? ` Retry after ${err.retryAfterSeconds}s.` : " This is temporary, retry shortly.";
-    console.error(`${err.message}${hint}`);
-    process.exit(EXIT_RETRYABLE);
-  }
-  console.error(err instanceof Error ? err.message : String(err));
-  process.exit(1);
-}
-
-// src/core/app-fetch.ts
-import { z } from "zod";
-
-// src/lib/config-file.ts
-import {
-  readFileSync as readFileSync3,
-  writeFileSync,
-  mkdirSync,
-  unlinkSync,
-  chmodSync,
-  renameSync
-} from "fs";
-import { randomBytes } from "crypto";
-import { join as join5 } from "path";
-import { homedir } from "os";
-function getConfigDir() {
-  const xdgConfig = process.env.XDG_CONFIG_HOME;
-  const base = xdgConfig || join5(homedir(), ".config");
-  return join5(base, "walkeros");
-}
-function getConfigPath() {
-  return join5(getConfigDir(), "config.json");
-}
-function readConfig() {
-  const configPath = getConfigPath();
-  try {
-    const content = readFileSync3(configPath, "utf-8");
-    return JSON.parse(content);
-  } catch {
-    return null;
-  }
-}
-function replaceConfigFile(config) {
-  const dir = getConfigDir();
-  mkdirSync(dir, { recursive: true, mode: 448 });
-  const configPath = getConfigPath();
-  const tempPath = `${configPath}.${process.pid}.${randomBytes(6).toString("hex")}.tmp`;
-  try {
-    writeFileSync(tempPath, JSON.stringify(config, null, 2), { mode: 384 });
-    chmodSync(tempPath, 384);
-    renameSync(tempPath, configPath);
-  } catch (error) {
-    try {
-      unlinkSync(tempPath);
-    } catch {
-    }
-    throw error;
-  }
-}
-function writeConfig(config) {
-  replaceConfigFile({ ...readConfig() ?? {}, ...config });
-}
-function writeTelemetryOnlyConfig(partial) {
-  writeConfig(partial);
-}
-function resolveAppUrl() {
-  const envUrl = process.env.WALKEROS_APP_URL;
-  if (envUrl) return envUrl;
-  const config = readConfig();
-  if (config?.appUrl) return config.appUrl;
-  return "https://app.walkeros.io";
-}
-
-// src/lib/secure-url.ts
-function isLoopback(hostname) {
-  return hostname === "localhost" || hostname === "127.0.0.1" || hostname === "[::1]";
-}
-function requireSecureUrl(url) {
-  let parsed;
-  try {
-    parsed = new URL(url);
-  } catch {
-    return url;
-  }
-  if (parsed.protocol !== "http:" || isLoopback(parsed.hostname)) return url;
-  throw new Error(
-    `Refusing to send walkerOS credentials over plain http to ${url}. Use https, or localhost / 127.0.0.1 / [::1] for local development.`
-  );
-}
-
-// src/core/client-context.ts
-var context;
-function setClientContext(input) {
-  const envType = process.env.WALKEROS_CLIENT_TYPE;
-  const type = envType ?? input.type ?? "cli";
-  context = { type, version: input.version };
-}
-function getClientContext() {
-  return context;
-}
-function resetClientContext() {
-  context = void 0;
-}
-function clientContextHeaders() {
-  if (!context) return {};
-  return {
-    "User-Agent": `walkeros-${context.type}/${context.version}`,
-    "X-WalkerOS-Client": context.type,
-    "X-WalkerOS-Client-Version": context.version
-  };
-}
-
-// src/core/app-fetch.ts
-var AppErrorSchema = z.object({
-  error: z.object({ message: z.string().min(1) })
-});
-function appErrorMessage(body) {
-  const parsed = AppErrorSchema.safeParse(body);
-  return parsed.success ? parsed.data.error.message : void 0;
+  }
+};
+function machineReadableErrorLine(err) {
+  const code = err instanceof ApiError ? err.code ?? "UNKNOWN" : "UNKNOWN";
+  const retryable = err instanceof ApiError ? err.retryable === true : false;
+  const retryAfter = err instanceof ApiError && err.retryAfterSeconds !== void 0 ? ` retryAfter=${err.retryAfterSeconds}` : "";
+  const message = err instanceof Error ? err.message : String(err);
+  return `error: code=${code} retryable=${retryable}${retryAfter} message=${message}`;
 }
-async function appFetch(path23, init = {}) {
-  const url = `${(init.baseUrl ?? resolveAppUrl()).replace(/\/+$/, "")}${path23}`;
-  const headers = new Headers(clientContextHeaders());
-  for (const [name, value] of Object.entries(init.headers ?? {}))
-    headers.set(name, value);
-  if (init.token && !headers.has("Authorization"))
-    headers.set("Authorization", `Bearer ${init.token}`);
-  if (headers.has("Authorization")) requireSecureUrl(url);
-  const request = { headers };
-  if (init.method && init.method !== "GET") request.method = init.method;
-  if (init.body !== void 0) request.body = init.body;
-  if (init.signal) request.signal = init.signal;
-  if (init.redirect) request.redirect = init.redirect;
-  return (init.fetch ?? fetch)(url, request);
+function handleCliError(err) {
+  console.error(machineReadableErrorLine(err));
+  if (err instanceof ApiError && err.code === "CLIENT_OUTDATED") {
+    console.error(`
+${err.message}
+`);
+    if (err.upgrade) console.error(`  Upgrade: ${err.upgrade}`);
+    if (err.docs) console.error(`  Docs:    ${err.docs}
+`);
+    process.exit(2);
+  }
+  if (err instanceof ApiError && err.retryable) {
+    const hint = err.retryAfterSeconds !== void 0 ? ` Retry after ${err.retryAfterSeconds}s.` : " This is temporary, retry shortly.";
+    console.error(`${err.message}${hint}`);
+    process.exit(EXIT_RETRYABLE);
+  }
+  console.error(err instanceof Error ? err.message : String(err));
+  process.exit(1);
 }
 
-// src/core/app-paths.ts
-var APP_PATHS = {
-  whoami: "/api/auth/whoami",
-  health: "/api/health",
-  telemetry: "/api/telemetry",
-  openapi: "/api/openapi.json"
-};
-
 // src/commands/api/index.ts
 import { once } from "events";
-import { readFile as readFile2 } from "fs/promises";
-import { z as z2 } from "zod";
-var NOT_SIGNED_IN = "no token: set WALKEROS_TOKEN to a token from Account > Automation tokens in the walkerOS app";
+import { readFile as readFile3 } from "fs/promises";
+import { z as z5 } from "zod";
+var NOT_SIGNED_IN = "not signed in: run walkeros login, or set WALKEROS_TOKEN to a token from Account > Automation tokens in the walkerOS app";
 var ERROR_BODY_LIMIT = 64 * 1024;
-var DocumentSchema = z2.object({
-  paths: z2.record(z2.string(), z2.record(z2.string(), z2.unknown())),
-  components: z2.record(z2.string(), z2.record(z2.string(), z2.unknown())).optional()
+var DocumentSchema = z5.object({
+  paths: z5.record(z5.string(), z5.record(z5.string(), z5.unknown())),
+  components: z5.record(z5.string(), z5.record(z5.string(), z5.unknown())).optional()
 });
-var OperationSchema = z2.object({
-  summary: z2.string().optional(),
-  description: z2.string().optional(),
-  parameters: z2.array(z2.unknown()).optional(),
-  requestBody: z2.unknown().optional(),
-  responses: z2.record(z2.string(), z2.unknown()).optional()
+var OperationSchema = z5.object({
+  summary: z5.string().optional(),
+  description: z5.string().optional(),
+  parameters: z5.array(z5.unknown()).optional(),
+  requestBody: z5.unknown().optional(),
+  responses: z5.record(z5.string(), z5.unknown()).optional()
 });
-var OptionsSchema = z2.object({
-  data: z2.string().optional(),
-  header: z2.array(z2.string()).default([]),
-  project: z2.string().optional(),
-  yes: z2.boolean().optional()
+var OptionsSchema = z5.object({
+  data: z5.string().optional(),
+  header: z5.array(z5.string()).default([]),
+  project: z5.string().optional(),
+  yes: z5.boolean().optional()
 });
 
 // src/commands/auth/index.ts
@@ -8212,34 +9126,44 @@ async function readJson2(response) {
     return null;
   }
 }
-async function whoami() {
-  const token = resolveAccessToken();
-  if (!token) throw new Error(NOT_SIGNED_IN);
-  const response = await appFetch(APP_PATHS.whoami, { token });
+async function identify() {
+  const credential = await resolveCredential();
+  if (!credential) throw new Error(NOT_SIGNED_IN);
+  const response = await sendWithCredential(
+    credential,
+    (token) => appFetch(APP_PATHS.whoami, { token })
+  );
   const body = await readJson2(response);
   if (!response.ok)
     throw new Error(appErrorMessage(body) ?? `HTTP ${response.status}`);
-  return body;
+  return { body, credential };
+}
+async function whoami() {
+  return (await identify()).body;
 }
-var IdentitySchema = z3.object({
-  email: z3.string().optional(),
-  userId: z3.string().optional()
+function credentialSourceLine(credential) {
+  return credential.source === "env" ? "Credential: WALKEROS_TOKEN" : `Credential: signed in to ${credential.issuer}`;
+}
+var IdentitySchema = z6.object({
+  email: z6.string().optional(),
+  userId: z6.string().optional()
 });
 async function whoamiCommand(options) {
   const logger = createCLILogger(options);
   try {
-    const result = await whoami();
+    const { body: result, credential } = await identify();
     if (options.json) {
       await writeResult(JSON.stringify(result, null, 2), options);
     } else {
       const identity = IdentitySchema.safeParse(result);
       if (!identity.success) {
         logger.info(JSON.stringify(result));
-        return;
+      } else {
+        const data = identity.data;
+        if (data.email) logger.info(data.email);
+        if (data.userId) logger.info(`User: ${data.userId}`);
       }
-      const data = identity.data;
-      if (data.email) logger.info(data.email);
-      if (data.userId) logger.info(`User: ${data.userId}`);
+      logger.info(credentialSourceLine(credential));
     }
   } catch (error) {
     handleCliError(error);
@@ -8321,6 +9245,188 @@ import * as path21 from "path";
 import { fileURLToPath as fileURLToPath3 } from "url";
 import fs21 from "fs-extra";
 import * as esbuild3 from "esbuild";
+
+// src/schemas/build-manifest.ts
+import { z as z7 } from "@walkeros/core/dev";
+var BUILD_MANIFEST_VERSION = 1;
+var HttpUrlSchema = z7.url({ protocol: /^https?$/ });
+var BuildWrapObserveSchema = z7.object({
+  preview: z7.object({ url: HttpUrlSchema, token: z7.string().min(1) }).strict()
+}).strict();
+var OutputNameSchema = z7.string().regex(/^[A-Za-z0-9][A-Za-z0-9._-]*$/, "Must be a bare file name").describe("Output file name; its extension picks the format (.tar.gz packs)");
+var BUNDLE_TARGET_NAMES = [
+  "cdn",
+  "cdn-skeleton",
+  "runner",
+  "simulate",
+  "push"
+];
+var RESERVED_HEADERS = /* @__PURE__ */ new Set([
+  "content-type",
+  "content-length",
+  "host"
+]);
+var OutputFields = {
+  outputName: OutputNameSchema,
+  putUrl: HttpUrlSchema.describe("Presigned PUT for exactly this output"),
+  contentType: z7.string().min(1).optional().describe("Content-Type sent with the PUT (must match a signed header)"),
+  headers: z7.record(z7.string().min(1), z7.string()).refine(
+    (headers) => Object.keys(headers).every(
+      (name) => !RESERVED_HEADERS.has(name.toLowerCase())
+    ),
+    "Content-Type, Content-Length and Host are set by the CLI"
+  ).optional().describe(
+    "Extra headers sent with the PUT (for headers a presign signs); never logged"
+  )
+};
+var BuildBundleArtifactSchema = z7.object({
+  target: z7.enum(BUNDLE_TARGET_NAMES).describe("Named bundle target"),
+  ...OutputFields
+}).strict();
+var BuildWrapOptionsSchema = z7.object({
+  windowCollector: z7.string().min(1).optional(),
+  windowElb: z7.string().min(1).optional(),
+  preview: z7.object({
+    enabled: z7.boolean(),
+    keyring: z7.array(
+      z7.object({ kid: z7.string(), spki: z7.string() }).strict()
+    ),
+    iss: z7.string(),
+    pb: z7.string().optional(),
+    acceptForeign: z7.boolean().optional(),
+    demoAllowlist: z7.array(z7.string()).optional(),
+    previewOrigin: z7.string()
+  }).strict().optional(),
+  moin: z7.object({ app: z7.string(), base: z7.string() }).strict().optional().describe("Tag Mode loader target; absent, the production app"),
+  observe: BuildWrapObserveSchema.optional().describe(
+    "Browser only: Observe preview reporting, the preview route and its token. It replaces the flow's own collector.observe; a browser build never carries usage"
+  ),
+  minify: z7.boolean().optional(),
+  minifyOptions: z7.object({
+    identifiers: z7.boolean().optional(),
+    syntax: z7.boolean().optional(),
+    whitespace: z7.boolean().optional(),
+    keepNames: z7.boolean().optional(),
+    legalComments: z7.enum(["none", "inline", "eof", "linked", "external"]).optional()
+  }).strict().optional(),
+  target: z7.string().min(1).optional().describe("esbuild target")
+}).strict().describe("Options forwarded to wrapSkeleton");
+var OBSERVE_NOT_ON_NODE = "observe is a browser wrap option";
+var OBSERVE_NOT_WITH_PREVIEW = "observe is refused beside preview, which makes a host build";
+var BuildWrapArtifactSchema = z7.object({
+  target: z7.literal("wrap"),
+  platform: z7.enum(["browser", "node"]),
+  skeleton: z7.union([
+    z7.object({ url: HttpUrlSchema }).strict(),
+    z7.object({ artifact: OutputNameSchema }).strict()
+  ]).describe(
+    "The skeleton to wrap: a GET URL, or the outputName of an earlier bundle artifact in this manifest"
+  ),
+  options: BuildWrapOptionsSchema.optional(),
+  ...OutputFields
+}).strict().refine(
+  (artifact) => artifact.platform === "browser" || artifact.options?.observe === void 0,
+  { path: ["options", "observe"], message: OBSERVE_NOT_ON_NODE }
+).refine(
+  (artifact) => artifact.options?.observe === void 0 || artifact.options.preview === void 0,
+  { path: ["options", "observe"], message: OBSERVE_NOT_WITH_PREVIEW }
+);
+var BuildArtifactSchema = z7.union([
+  BuildBundleArtifactSchema,
+  BuildWrapArtifactSchema
+]);
+var BuildPackagesSchema = z7.union([
+  z7.object({
+    tree: PackageTreeSchema.describe(
+      "Install exactly this tree for every bundle artifact"
+    )
+  }).strict(),
+  z7.object({
+    resolve: z7.object({
+      before: z7.iso.datetime({ offset: true }).describe("Only versions published at or before this time"),
+      exempt: z7.array(z7.string().min(1)).describe(
+        "Name prefixes the cutoff skips, with the exact versions packages under them declare"
+      )
+    }).strict()
+  }).strict()
+]).describe("How bundle artifacts install their packages");
+var BuildManifestSchema = z7.object({
+  version: z7.literal(BUILD_MANIFEST_VERSION),
+  toolchain: z7.string().min(1).describe("Exact @walkeros/cli version; any other version refuses"),
+  flowConfig: z7.record(z7.string(), z7.unknown()).optional().describe("Flow.Json to bundle; required when any bundle artifact is"),
+  flowName: z7.string().min(1).optional(),
+  buildEnv: z7.record(z7.string(), z7.string()).optional().describe(
+    "Base env for web $env, beneath config.bundle.env. Never the CLI process's own env"
+  ),
+  artifacts: z7.array(BuildArtifactSchema).min(1),
+  resultPutUrl: HttpUrlSchema.describe("Presigned PUT for the result JSON"),
+  packages: BuildPackagesSchema.optional()
+}).loose().superRefine((manifest, ctx) => {
+  const seen = /* @__PURE__ */ new Set();
+  const bundled = /* @__PURE__ */ new Set();
+  manifest.artifacts.forEach((artifact, index) => {
+    if (seen.has(artifact.outputName)) {
+      ctx.addIssue({
+        code: "custom",
+        path: ["artifacts", index, "outputName"],
+        message: `Duplicate outputName "${artifact.outputName}"`
+      });
+    }
+    seen.add(artifact.outputName);
+    if (artifact.target !== "wrap") {
+      bundled.add(artifact.outputName);
+      if (!manifest.flowConfig) {
+        ctx.addIssue({
+          code: "custom",
+          path: ["flowConfig"],
+          message: "flowConfig is required for bundle artifacts"
+        });
+      }
+    } else if ("artifact" in artifact.skeleton && !bundled.has(artifact.skeleton.artifact)) {
+      ctx.addIssue({
+        code: "custom",
+        path: ["artifacts", index, "skeleton", "artifact"],
+        message: `No earlier bundle artifact named "${artifact.skeleton.artifact}"`
+      });
+    }
+  });
+}).meta({ id: "BuildManifest", title: "walkeros bundle --manifest input" });
+var BUILD_ERROR_CODES = [
+  "INVALID_MANIFEST",
+  "TOOLCHAIN_MISMATCH",
+  "INVALID_CONFIG",
+  "MISSING_BUILD_ENV",
+  "WEB_SECRET_REF",
+  "UNSUPPORTED_PACKAGE_SPEC",
+  "LOCAL_PATH_NOT_ALLOWED",
+  "BUILD_FAILED",
+  "PACKAGE_UNAVAILABLE",
+  "PACKAGE_TREE_INVALID",
+  "UPLOAD_FAILED"
+];
+var BuildResultSchema = z7.object({
+  ok: z7.boolean(),
+  toolchain: z7.string().describe("The CLI version that ran the build"),
+  artifacts: z7.array(
+    z7.object({
+      target: z7.string(),
+      outputName: z7.string(),
+      bytes: z7.number().int().nonnegative(),
+      sha256: z7.string()
+    })
+  ).describe("Outputs PUT successfully, in manifest order"),
+  packages: z7.object({
+    digest: z7.string().describe("sha256 of the canonical tree"),
+    tree: PackageTreeSchema
+  }).optional().describe("The tree the bundle artifacts installed, when asked for"),
+  error: z7.object({
+    code: z7.enum(BUILD_ERROR_CODES),
+    message: z7.string(),
+    outputName: z7.string().optional().describe("The artifact being built when the error occurred")
+  }).optional()
+}).meta({ id: "BuildResult", title: "walkeros bundle --manifest result" });
+
+// src/commands/bundle/wrap.ts
 function extractDevExternals(skeletonText) {
   const pattern = /import\(\s*['"]([^'"]+\/dev)['"]\s*\)/g;
   const found = /* @__PURE__ */ new Set();
@@ -8343,6 +9449,15 @@ function getNodeResolutionPaths() {
   }
   return candidates;
 }
+function observeProblem(observe, wrap) {
+  if (wrap.platform !== "browser") return OBSERVE_NOT_ON_NODE;
+  if (wrap.preview) return OBSERVE_NOT_WITH_PREVIEW;
+  const parsed = BuildWrapObserveSchema.safeParse(observe);
+  if (parsed.success) return void 0;
+  const issue = parsed.error.issues[0];
+  const at = ["observe", ...(issue?.path ?? []).map(String)].join(".");
+  return `Invalid ${at}: ${issue?.message ?? "not an observe option"}`;
+}
 async function wrapSkeleton(options) {
   const {
     skeletonPath,
@@ -8354,16 +9469,18 @@ async function wrapSkeleton(options) {
     minify = true,
     minifyOptions
   } = options;
-  if (options.preview && options.previewGrantTargets) {
-    throw new Error(
-      "wrapSkeleton: `preview` (host activator) and `previewGrantTargets` (preview-artifact injection) are mutually exclusive. Pass at most one."
-    );
-  }
   if (options.preview && (typeof options.preview.previewOrigin !== "string" || !/^[a-z0-9.-]+$/.test(options.preview.previewOrigin))) {
     throw new Error(
       `Invalid previewOrigin "${options.preview.previewOrigin}". Must be a bare hostname matching /^[a-z0-9.-]+$/.`
     );
   }
+  if (options.observe !== void 0) {
+    const problem = observeProblem(options.observe, {
+      platform,
+      preview: options.preview !== void 0
+    });
+    if (problem) throw new Error(problem);
+  }
   if (!await fs21.pathExists(skeletonPath)) {
     throw new Error(`wrapSkeleton: skeleton not found at ${skeletonPath}`);
   }
@@ -8374,9 +9491,8 @@ async function wrapSkeleton(options) {
     ...windowCollector ? { windowCollector } : {},
     ...windowElb ? { windowElb } : {},
     ...options.preview ? { preview: options.preview } : {},
-    ...options.previewGrantTargets ? { previewGrantTargets: options.previewGrantTargets } : {},
-    platform,
     ...options.observe ? { observe: options.observe } : {},
+    platform,
     ...options.moin ? { moin: options.moin } : {}
   }) : generateWrapEntryServer(absoluteSkeletonPath);
   const entryDir = await tmpRunDir("wrap");
@@ -8411,15 +9527,12 @@ async function wrapSkeleton(options) {
     if (platform === "browser") {
       esbuildOptions.format = "iife";
       esbuildOptions.plugins = [cliPackagesPlugin()];
-      const needs = readNeedsMarker(skeletonText);
       esbuildOptions.define = {
         "process.env.NODE_ENV": '"production"',
         global: "globalThis",
         ...buildFlagDefines(
-          needs && {
-            ...needs,
-            observe: needs.observe || options.observe !== void 0
-          }
+          readNeedsMarker(skeletonText),
+          options.observe !== void 0
         )
       };
       esbuildOptions.external = devExternals;
@@ -8444,158 +9557,6 @@ import path22 from "path";
 import fs22 from "fs-extra";
 import { FlowReferenceError as FlowReferenceError2 } from "@walkeros/core";
 
-// src/schemas/build-manifest.ts
-import { z as z4 } from "@walkeros/core/dev";
-var BUILD_MANIFEST_VERSION = 1;
-var HttpUrlSchema = z4.url({ protocol: /^https?$/ });
-var OutputNameSchema = z4.string().regex(/^[A-Za-z0-9][A-Za-z0-9._-]*$/, "Must be a bare file name").describe("Output file name; its extension picks the format (.tar.gz packs)");
-var BUNDLE_TARGET_NAMES = [
-  "cdn",
-  "cdn-skeleton",
-  "runner",
-  "simulate",
-  "push"
-];
-var RESERVED_HEADERS = /* @__PURE__ */ new Set([
-  "content-type",
-  "content-length",
-  "host"
-]);
-var OutputFields = {
-  outputName: OutputNameSchema,
-  putUrl: HttpUrlSchema.describe("Presigned PUT for exactly this output"),
-  contentType: z4.string().min(1).optional().describe("Content-Type sent with the PUT (must match a signed header)"),
-  headers: z4.record(z4.string().min(1), z4.string()).refine(
-    (headers) => Object.keys(headers).every(
-      (name) => !RESERVED_HEADERS.has(name.toLowerCase())
-    ),
-    "Content-Type, Content-Length and Host are set by the CLI"
-  ).optional().describe(
-    "Extra headers sent with the PUT (for headers a presign signs); never logged"
-  )
-};
-var BuildBundleArtifactSchema = z4.object({
-  target: z4.enum(BUNDLE_TARGET_NAMES).describe("Named bundle target"),
-  ...OutputFields
-}).strict();
-var BuildWrapOptionsSchema = z4.object({
-  windowCollector: z4.string().min(1).optional(),
-  windowElb: z4.string().min(1).optional(),
-  preview: z4.object({
-    enabled: z4.boolean(),
-    keyring: z4.array(
-      z4.object({ kid: z4.string(), spki: z4.string() }).strict()
-    ),
-    iss: z4.string(),
-    pb: z4.string().optional(),
-    acceptForeign: z4.boolean().optional(),
-    demoAllowlist: z4.array(z4.string()).optional(),
-    previewOrigin: z4.string()
-  }).strict().optional(),
-  previewGrantTargets: z4.array(z4.string()).optional(),
-  observe: z4.object({
-    url: z4.string(),
-    binding: z4.string(),
-    flowId: z4.string().optional(),
-    level: z4.enum(["off", "standard", "trace"]).optional(),
-    sample: z4.number().min(0).max(1).optional()
-  }).strict().optional(),
-  moin: z4.object({ app: z4.string(), base: z4.string() }).strict().optional().describe("Tag Mode loader target; absent, the production app"),
-  minify: z4.boolean().optional(),
-  minifyOptions: z4.object({
-    identifiers: z4.boolean().optional(),
-    syntax: z4.boolean().optional(),
-    whitespace: z4.boolean().optional(),
-    keepNames: z4.boolean().optional(),
-    legalComments: z4.enum(["none", "inline", "eof", "linked", "external"]).optional()
-  }).strict().optional(),
-  target: z4.string().min(1).optional().describe("esbuild target")
-}).strict().describe("Options forwarded to wrapSkeleton");
-var BuildWrapArtifactSchema = z4.object({
-  target: z4.literal("wrap"),
-  platform: z4.enum(["browser", "node"]),
-  skeleton: z4.union([
-    z4.object({ url: HttpUrlSchema }).strict(),
-    z4.object({ artifact: OutputNameSchema }).strict()
-  ]).describe(
-    "The skeleton to wrap: a GET URL, or the outputName of an earlier bundle artifact in this manifest"
-  ),
-  options: BuildWrapOptionsSchema.optional(),
-  ...OutputFields
-}).strict();
-var BuildArtifactSchema = z4.union([
-  BuildBundleArtifactSchema,
-  BuildWrapArtifactSchema
-]);
-var BuildManifestSchema = z4.object({
-  version: z4.literal(BUILD_MANIFEST_VERSION),
-  toolchain: z4.string().min(1).describe("Exact @walkeros/cli version; any other version refuses"),
-  flowConfig: z4.record(z4.string(), z4.unknown()).optional().describe("Flow.Json to bundle; required when any bundle artifact is"),
-  flowName: z4.string().min(1).optional(),
-  buildEnv: z4.record(z4.string(), z4.string()).optional().describe(
-    "Base env for web $env, beneath config.bundle.env. Never the CLI process's own env"
-  ),
-  artifacts: z4.array(BuildArtifactSchema).min(1),
-  resultPutUrl: HttpUrlSchema.describe("Presigned PUT for the result JSON")
-}).loose().superRefine((manifest, ctx) => {
-  const seen = /* @__PURE__ */ new Set();
-  const bundled = /* @__PURE__ */ new Set();
-  manifest.artifacts.forEach((artifact, index) => {
-    if (seen.has(artifact.outputName)) {
-      ctx.addIssue({
-        code: "custom",
-        path: ["artifacts", index, "outputName"],
-        message: `Duplicate outputName "${artifact.outputName}"`
-      });
-    }
-    seen.add(artifact.outputName);
-    if (artifact.target !== "wrap") {
-      bundled.add(artifact.outputName);
-      if (!manifest.flowConfig) {
-        ctx.addIssue({
-          code: "custom",
-          path: ["flowConfig"],
-          message: "flowConfig is required for bundle artifacts"
-        });
-      }
-    } else if ("artifact" in artifact.skeleton && !bundled.has(artifact.skeleton.artifact)) {
-      ctx.addIssue({
-        code: "custom",
-        path: ["artifacts", index, "skeleton", "artifact"],
-        message: `No earlier bundle artifact named "${artifact.skeleton.artifact}"`
-      });
-    }
-  });
-}).meta({ id: "BuildManifest", title: "walkeros bundle --manifest input" });
-var BUILD_ERROR_CODES = [
-  "INVALID_MANIFEST",
-  "TOOLCHAIN_MISMATCH",
-  "INVALID_CONFIG",
-  "MISSING_BUILD_ENV",
-  "WEB_SECRET_REF",
-  "UNSUPPORTED_PACKAGE_SPEC",
-  "LOCAL_PATH_NOT_ALLOWED",
-  "BUILD_FAILED",
-  "UPLOAD_FAILED"
-];
-var BuildResultSchema = z4.object({
-  ok: z4.boolean(),
-  toolchain: z4.string().describe("The CLI version that ran the build"),
-  artifacts: z4.array(
-    z4.object({
-      target: z4.string(),
-      outputName: z4.string(),
-      bytes: z4.number().int().nonnegative(),
-      sha256: z4.string()
-    })
-  ).describe("Outputs PUT successfully, in manifest order"),
-  error: z4.object({
-    code: z4.enum(BUILD_ERROR_CODES),
-    message: z4.string(),
-    outputName: z4.string().optional().describe("The artifact being built when the error occurred")
-  }).optional()
-}).meta({ id: "BuildResult", title: "walkeros bundle --manifest result" });
-
 // src/commands/bundle/fetch-retry.ts
 var BACKOFF_MS = [1e3, 3e3];
 function defaultSleep(ms) {
@@ -8625,7 +9586,7 @@ function describeFetchError(failure, timeoutMs) {
   return "fetch failed";
 }
 async function fetchWithRetry(url, init, options) {
-  const { label, timeoutMs, warn, sleep = defaultSleep } = options;
+  const { label, timeoutMs, warn, sleep: sleep2 = defaultSleep } = options;
   const maxAttempts = BACKOFF_MS.length + 1;
   for (let attempt = 1; ; attempt++) {
     let failure;
@@ -8652,7 +9613,7 @@ async function fetchWithRetry(url, init, options) {
     warn?.(
       `${label} attempt ${attempt}/${maxAttempts} failed: ${reason}, retrying in ${delay2 / 1e3}s`
     );
-    await sleep(delay2);
+    await sleep2(delay2);
   }
 }
 
@@ -8710,6 +9671,8 @@ function classify(error, phase) {
   if (error instanceof UnsupportedPackageSpecError) {
     return "UNSUPPORTED_PACKAGE_SPEC";
   }
+  if (error instanceof PackageTreeError) return "PACKAGE_TREE_INVALID";
+  if (error instanceof PackageUnavailableError) return "PACKAGE_UNAVAILABLE";
   return phase === "config" ? "INVALID_CONFIG" : "BUILD_FAILED";
 }
 function isHttpUrl(source) {
@@ -8764,7 +9727,7 @@ async function download(url, dest, retry) {
   }
   await fs22.writeFile(dest, Buffer.from(await response.arrayBuffer()));
 }
-async function buildArtifact(manifest, configPath, artifact, workDir, index, outputs, retry) {
+async function buildArtifact(manifest, configPath, artifact, workDir, index, outputs, retry, packageInstall) {
   const output = path22.join(workDir, "out", artifact.outputName);
   await fs22.ensureDir(path22.dirname(output));
   if (artifact.target === "wrap") {
@@ -8800,7 +9763,11 @@ async function buildArtifact(manifest, configPath, artifact, workDir, index, out
     cache: false,
     // The base env is the manifest's, NEVER this process's own.
     buildEnv: manifest.buildEnv ?? {},
-    buildOverrides: { output, tempDir: scratch }
+    buildOverrides: {
+      output,
+      tempDir: scratch,
+      ...packageInstall ? { packageInstall } : {}
+    }
   });
   return output;
 }
@@ -8858,6 +9825,18 @@ async function runBuildManifest(source, retry = {}) {
       }
     }
     const outputs = /* @__PURE__ */ new Map();
+    let tree = manifest.packages && "tree" in manifest.packages ? manifest.packages.tree : void 0;
+    const resolve5 = manifest.packages && "resolve" in manifest.packages ? manifest.packages.resolve : void 0;
+    const installFor = () => {
+      if (tree) return { tree };
+      if (!resolve5) return void 0;
+      return {
+        resolve: { before: new Date(resolve5.before), exempt: resolve5.exempt },
+        onTree: (installed) => {
+          tree = installed;
+        }
+      };
+    };
     for (const [index, artifact] of manifest.artifacts.entries()) {
       try {
         const output = await buildArtifact(
@@ -8867,7 +9846,8 @@ async function runBuildManifest(source, retry = {}) {
           workDir,
           index,
           outputs,
-          retry
+          retry,
+          artifact.target === "wrap" ? void 0 : installFor()
         );
         outputs.set(artifact.outputName, output);
         const content = await fs22.readFile(output);
@@ -8896,6 +9876,9 @@ async function runBuildManifest(source, retry = {}) {
         };
       }
     }
+    if (manifest.packages && tree) {
+      result.packages = { digest: packageTreeDigest(tree), tree };
+    }
     result.ok = true;
     return { result, reported: await report(manifest.resultPutUrl, result) };
   } finally {
@@ -9129,30 +10112,41 @@ export {
   BuildArtifactSchema,
   BuildBundleArtifactSchema,
   BuildManifestSchema,
+  BuildPackagesSchema,
   BuildResultSchema,
   BuildWrapArtifactSchema,
   BuildWrapOptionsSchema,
+  PACKAGE_TREE_MAX_ENTRIES,
+  PACKAGE_TREE_VERSION,
+  PackageTreeError,
+  PackageTreeSchema,
   VALIDATE_CODES,
   VERSION,
   appErrorMessage,
   appFetch,
+  assertPackageTree,
   buildDataPayload,
   bundle,
   bundleCommand,
+  canonicalPackageTree,
   classifyStepProperties,
   clientContextHeaders,
   collectKnownSecrets,
   containsCodeMarkers,
+  edgeIsExempt,
   formatPushResult,
   getClientContext,
   loadConfig,
   loadJsonConfig,
+  packageTreeDigest,
+  packageTreeProblems,
   push,
   pushCommand,
   readConfig,
   resetClientContext,
   resolveAccessToken,
   resolveAppUrl,
+  resolveCredential,
   resolveExportName,
   resolveManifestSource,
   runBuildManifest,