@walkeros/cli 4.2.0-next-1781000333052 → 4.3.0-next-1781171238534

package/CHANGELOG.md

@@ -1,6 +1,38 @@
 # @walkeros/cli
 
-## 4.2.0-next-1781000333052
+## 4.3.0-next-1781171238534
+
+### Minor Changes
+
+- 5cbcd23: `walkeros run` reads two new environment variables.
+  `WALKEROS_OBSERVE_LEVEL` sets the runtime's baseline telemetry level (`off`,
+  `standard`, or `trace`). `WALKEROS_CONFIG_FROZEN` (`1` or `true`) serves the
+  bundle as an immutable snapshot: secrets are still injected at boot, but
+  config hot-swap and heartbeat are disabled.
+
+### Patch Changes
+
+- b03bfce: `walkeros deploy` now waits long enough to cover a full server deploy
+  by default, so a slow but healthy deploy is no longer aborted early and
+  reported as a failure. Each run sends a fresh idempotency key, so retrying
+  after a failure starts a new deploy instead of replaying the previous result.
+  Failures print a stable, machine-readable error code (with a `Retry-After`
+  hint on rate limits), and `deploy create` no longer prints an empty token
+  placeholder.
+- 5cbcd23: All four simulate functions (`simulateSource`, `simulateTransformer`,
+  `simulateCollector`, `simulateDestination`) accept a new `data` option to run
+  an existing bundle with updated configuration values, without rebundling. The
+  new `buildDataPayload`, `classifyStepProperties`, and `containsCodeMarkers`
+  exports build and inspect that payload. Destination simulation results now
+  include `mappingKey`, the entity-action key of the matched mapping rule.
+- Updated dependencies [5cbcd23]
+  - @walkeros/core@4.3.0-next-1781171238534
+  - @walkeros/collector@4.3.0-next-1781171238534
+  - @walkeros/server-core@4.3.0-next-1781171238534
+  - @walkeros/server-destination-api@4.3.0-next-1781171238534
+  - @walkeros/transformer-validate@4.3.0-next-1781171238534
+
+## 4.2.0
 
 ### Minor Changes
 
@@ -47,7 +79,7 @@
   custom domains, entitlements, LLM settings, chat sessions, MCP tokens,
   runners, and the package catalog. No runtime behavior change; clients gain
   accurate types for these endpoints.
-- 18c9469: Browser flow bundles are now emitted as an IIFE so all internal code
+- 5b1a134: Browser flow bundles are now emitted as an IIFE so all internal code
   stays inside a private scope. Previously the bundled helper functions could
   leak onto the global `window` object and collide with other scripts on the
   page, such as Google Analytics or a consent manager. Server bundles are
@@ -86,7 +118,7 @@
   without a trace poll. When the telemetry options omit `traceUrl`, the bundle
   emits at a fixed level with no polling, suited to short-lived, URL-opted-in
   sessions. Bundles that pass `traceUrl` keep the existing poll behavior.
-- f1c74e8: New `@walkeros/transformer-validate` transformer validates events
+- 23d4b86: New `@walkeros/transformer-validate` transformer validates events
   against JSON Schema contracts. It runs in both web and server flows, supports
   strict and pass modes, and writes the verdict and error list to configurable
   paths so you can gate or observe event quality.
@@ -99,7 +131,7 @@
   examples against the resolved contract.
 
 - Updated dependencies [76d32c1]
-- Updated dependencies [18c9469]
+- Updated dependencies [5b1a134]
 - Updated dependencies [908d6f0]
 - Updated dependencies [654ba38]
 - Updated dependencies [c27d3c1]
@@ -114,14 +146,15 @@
 - Updated dependencies [654ba38]
 - Updated dependencies [6a72a32]
 - Updated dependencies [3eb2467]
-- Updated dependencies [7d8ebf9]
-- Updated dependencies [f1c74e8]
+- Updated dependencies [5b1a134]
+- Updated dependencies [23d4b86]
 - Updated dependencies [18c9469]
-  - @walkeros/core@4.2.0-next-1781000333052
-  - @walkeros/collector@4.2.0-next-1781000333052
-  - @walkeros/server-core@4.2.0-next-1781000333052
-  - @walkeros/server-destination-api@4.2.0-next-1781000333052
-  - @walkeros/transformer-validate@4.2.0-next-1781000333052
+- Updated dependencies [0cad016]
+  - @walkeros/core@4.2.0
+  - @walkeros/collector@4.2.0
+  - @walkeros/server-core@4.2.0
+  - @walkeros/server-destination-api@4.2.0
+  - @walkeros/transformer-validate@4.2.0
 
 ## 4.1.2
 

package/dist/cli.js

@@ -31,25 +31,62 @@ var init_client_context = __esm({
 });
 
 // src/core/api-error.ts
-function throwApiError(error, fallbackMessage) {
-  if (error && typeof error === "object" && "error" in error && typeof error.error === "object") {
-    const inner = error.error;
-    const message = inner.message || fallbackMessage;
-    const code = inner.code;
-    const details = inner.details?.errors;
-    const options = { code, details };
-    if (code === "CLIENT_OUTDATED") {
-      options.minVersion = inner.minVersion;
-      options.clientVersion = inner.clientVersion;
-      options.client = inner.client;
-      options.upgrade = inner.upgrade;
-      options.docs = inner.docs;
-    }
-    throw new ApiError(message, options);
+function extractApiErrorOptions(error, fallbackMessage) {
+  if (!error || typeof error !== "object" || !("error" in error) || typeof error.error !== "object") {
+    return null;
   }
+  const inner = error.error;
+  const message = inner.message || fallbackMessage;
+  const code = inner.code;
+  const details = inner.details?.errors;
+  const options = { code, details };
+  if (code === "CLIENT_OUTDATED") {
+    options.minVersion = inner.minVersion;
+    options.clientVersion = inner.clientVersion;
+    options.client = inner.client;
+    options.upgrade = inner.upgrade;
+    options.docs = inner.docs;
+  }
+  return { message, options };
+}
+function throwApiError(error, fallbackMessage) {
+  const extracted = extractApiErrorOptions(error, fallbackMessage);
+  if (extracted) throw new ApiError(extracted.message, extracted.options);
   throw new ApiError(fallbackMessage);
 }
+function parseRetryAfter(value) {
+  if (!value) return void 0;
+  const trimmed = value.trim();
+  if (/^\d+$/.test(trimmed)) return parseInt(trimmed, 10);
+  const when = Date.parse(trimmed);
+  if (Number.isNaN(when)) return void 0;
+  return Math.max(0, Math.round((when - Date.now()) / 1e3));
+}
+function throwApiResponseError(response, body, fallbackMessage) {
+  const status = response.status;
+  const retryAfterSeconds = parseRetryAfter(
+    response.headers.get("retry-after")
+  );
+  const retryable = status === 429 || status === 503 && retryAfterSeconds !== void 0;
+  const extracted = extractApiErrorOptions(body, fallbackMessage);
+  const message = extracted?.message ?? fallbackMessage;
+  const options = {
+    ...extracted?.options ?? {},
+    status,
+    retryable,
+    retryAfterSeconds
+  };
+  throw new ApiError(message, options);
+}
+function machineReadableErrorLine(err) {
+  const code = err instanceof ApiError ? err.code ?? "UNKNOWN" : "UNKNOWN";
+  const retryable = err instanceof ApiError ? err.retryable === true : false;
+  const retryAfter = err instanceof ApiError && err.retryAfterSeconds !== void 0 ? ` retryAfter=${err.retryAfterSeconds}` : "";
+  const message = err instanceof Error ? err.message : String(err);
+  return `error: code=${code} retryable=${retryable}${retryAfter} message=${message}`;
+}
 function handleCliError(err) {
+  console.error(machineReadableErrorLine(err));
   if (err instanceof ApiError && err.code === "CLIENT_OUTDATED") {
     console.error(`
 ${err.message}
@@ -59,17 +96,25 @@ ${err.message}
 `);
     process.exit(2);
   }
-  const message = err instanceof Error ? err.message : String(err);
-  console.error(message);
+  if (err instanceof ApiError && err.retryable) {
+    const hint = err.retryAfterSeconds !== void 0 ? ` Retry after ${err.retryAfterSeconds}s.` : " This is temporary, retry shortly.";
+    console.error(`${err.message}${hint}`);
+    process.exit(EXIT_RETRYABLE);
+  }
+  console.error(err instanceof Error ? err.message : String(err));
   process.exit(1);
 }
-var ApiError;
+var EXIT_RETRYABLE, ApiError;
 var init_api_error = __esm({
   "src/core/api-error.ts"() {
     "use strict";
+    EXIT_RETRYABLE = 75;
     ApiError = class extends Error {
       code;
       details;
+      status;
+      retryable;
+      retryAfterSeconds;
       // Populated only for CLIENT_OUTDATED responses (HTTP 426).
       minVersion;
       clientVersion;
@@ -81,6 +126,9 @@ var init_api_error = __esm({
         this.name = "ApiError";
         this.code = options?.code;
         this.details = options?.details;
+        this.status = options?.status;
+        this.retryable = options?.retryable;
+        this.retryAfterSeconds = options?.retryAfterSeconds;
         this.minVersion = options?.minVersion;
         this.clientVersion = options?.clientVersion;
         this.client = options?.client;
@@ -2770,9 +2818,8 @@ function validateReference(type, name, ref) {
     return;
   }
   const hasPackage = !!ref.package;
-  const hasInlineCode = isInlineCode(ref.code);
   const hasCode = hasCodeReference(ref.code);
-  if (hasPackage && hasInlineCode) {
+  if (hasPackage && hasCode) {
     throw new Error(
       `${type} "${name}": Cannot specify both package and code. Use one or the other.`
     );
@@ -2812,13 +2859,13 @@ function validateStoreReferences(flowSettings, storeIds) {
       collectRefs(component, `${section}.${id}`);
     }
   }
-  for (const { ref, location: location2 } of refs) {
-    if (!storeIds.has(ref)) {
-      const available = storeIds.size > 0 ? `Available stores: ${Array.from(storeIds).join(", ")}` : "No stores defined";
-      throw new Error(
-        `Store reference "$store.${ref}" in ${location2} \u2014 store "${ref}" not found. ${available}`
-      );
-    }
+  const missing = refs.filter(({ ref }) => !storeIds.has(ref));
+  if (missing.length > 0) {
+    const available = storeIds.size > 0 ? `Available stores: ${Array.from(storeIds).join(", ")}` : "No stores defined";
+    const details = missing.map(
+      ({ ref, location: location2 }) => `"$store.${ref}" in ${location2} (store "${ref}" not found)`
+    ).join("; ");
+    throw new Error(`Invalid store references: ${details}. ${available}`);
   }
 }
 var VALID_JS_IDENTIFIER;
@@ -4571,7 +4618,7 @@ ${destinationsEntries.join(",\n")}
   stores${collectorStr}
 }`;
   const dataPayload = JSON.stringify(dataPayloadObj, null, 2);
-  return { storesDeclaration, codeConfigObject, dataPayload };
+  return { storesDeclaration, codeConfigObject, dataPayloadObj, dataPayload };
 }
 function generateSplitWireConfigModule(storesDeclaration, codeConfigObject, userCode) {
   const codeSection = userCode ? `
@@ -6699,7 +6746,7 @@ async function wt(e4, t4, o4) {
   }
 }
 function vt(e4, t4) {
-  return { timing: Math.round((Date.now() - e4.timing) / 10) / 100, source: { type: "collector", schema: "4", version: "4.2.0-next-1781000333052" }, ...t4 };
+  return { timing: Math.round((Date.now() - e4.timing) / 10) / 100, source: { type: "collector", schema: "4", version: "4.3.0-next-1781171238534" }, ...t4 };
 }
 function bt(e4, t4) {
   if (!t4.name) throw new Error("Event name is required");
@@ -7754,7 +7801,7 @@ function toError(error) {
   return error instanceof Error ? error : new Error(getErrorMessage(error));
 }
 function buildSimulationResult(args) {
-  const { step, name, startTime, captured, usage, error } = args;
+  const { step, name, startTime, captured, usage, mappingKey, error } = args;
   const events = (captured ?? []).filter(hasEvent).map((entry) => entry.event);
   const calls = usage ? Object.values(usage).flat().map((call) => ({ fn: call.fn, args: call.args, ts: call.ts })) : [];
   return {
@@ -7763,6 +7810,7 @@ function buildSimulationResult(args) {
     events,
     calls,
     duration: Date.now() - startTime,
+    ...mappingKey !== void 0 ? { mappingKey } : {},
     ...error !== void 0 ? { error: toError(error) } : {}
   };
 }
@@ -8356,7 +8404,9 @@ async function simulateSource(configOrPath, input, options) {
             `Source package "${sourceConfig.package}" has no createTrigger in /dev export`
           );
         }
-        const flowConfig = module.wireConfig(module.__configData ?? void 0);
+        const flowConfig = module.wireConfig(
+          options.data ?? module.__configData ?? void 0
+        );
         applyOverrides(flowConfig, prepared.overrides);
         const captured = [];
         flowConfig.hooks = {
@@ -8461,7 +8511,9 @@ async function simulateTransformer(configOrPath, event, options) {
         networkCalls
       },
       async (module) => {
-        const flowConfig = module.wireConfig(module.__configData ?? void 0);
+        const flowConfig = module.wireConfig(
+          options.data ?? module.__configData ?? void 0
+        );
         applyOverrides(flowConfig, prepared.overrides);
         if (flowConfig.sources) flowConfig.sources = {};
         if (flowConfig.destinations) flowConfig.destinations = {};
@@ -8627,7 +8679,9 @@ async function simulateCollector(configOrPath, event, options) {
         networkCalls
       },
       async (module) => {
-        const flowConfig = module.wireConfig(module.__configData ?? void 0);
+        const flowConfig = module.wireConfig(
+          options.data ?? module.__configData ?? void 0
+        );
         applyOverrides(flowConfig, prepared.overrides);
         if (flowConfig.sources) flowConfig.sources = {};
         if (flowConfig.destinations) flowConfig.destinations = {};
@@ -8730,7 +8784,9 @@ async function simulateDestination(configOrPath, event, options) {
         networkCalls
       },
       async (module) => {
-        const flowConfig = module.wireConfig(module.__configData ?? void 0);
+        const flowConfig = module.wireConfig(
+          options.data ?? module.__configData ?? void 0
+        );
         applyOverrides(flowConfig, prepared.overrides);
         const destPkg = (prepared.flowSettings.destinations ?? {})[options.destinationId];
         let trackedCalls = [];
@@ -8766,6 +8822,16 @@ async function simulateDestination(configOrPath, event, options) {
           );
         }
         logger.info(`Simulating destination: ${options.destinationId}`);
+        let mappingKey;
+        const targetStepId = o("destination", options.destinationId);
+        const captureMappingKey = (state) => {
+          if (state.stepId === targetStepId && state.mappingKey) {
+            mappingKey = state.mappingKey;
+          }
+        };
+        if (collector.observers instanceof Set) {
+          collector.observers.add(captureMappingKey);
+        }
         await collector.push(event, {
           include: [options.destinationId]
         });
@@ -8774,7 +8840,8 @@ async function simulateDestination(configOrPath, event, options) {
           step: "destination",
           name: options.destinationId,
           startTime,
-          usage: trackedCalls.length ? { [options.destinationId]: trackedCalls } : void 0
+          usage: trackedCalls.length ? { [options.destinationId]: trackedCalls } : void 0,
+          mappingKey
         });
       },
       (error) => buildSimulationResult({
@@ -9499,13 +9566,21 @@ init_cache();
 async function runPipeline(options) {
   const { bundlePath, port, logger, loggerConfig, api } = options;
   let configVersion;
+  const configFrozen = readConfigFrozen();
   if (api) {
     await injectSecrets(api, logger);
   }
   logger.info(`walkeros/flow v${VERSION}`);
   logger.info(`Instance: ${getInstanceId()}`);
+  if (configFrozen) {
+    logger.info("Config frozen: hot-swap and heartbeat disabled");
+  }
   const healthServer = await createHealthServer(port, logger);
-  const telemetryObservers = buildTelemetryObservers(api?.flowId ?? "flow");
+  const observeLevel = readObserveLevel(logger);
+  const telemetryObservers = buildTelemetryObservers(
+    api?.flowId ?? "flow",
+    observeLevel
+  );
   const runtimeConfig = { port };
   let handle;
   try {
@@ -9534,20 +9609,24 @@ async function runPipeline(options) {
   const ingestToken = process.env.WALKEROS_INGEST_TOKEN;
   const deploymentId = process.env.WALKEROS_DEPLOYMENT_ID;
   if (observerBase && ingestToken && deploymentId) {
-    tracePoller = createTracePoller(
-      {
-        url: `${observerBase}/trace/${deploymentId}`,
-        token: ingestToken,
-        intervalMs: 15e3
-      },
-      logger
-    );
-    tracePoller.start();
-    logger.info("Trace poller: active (every 15s)");
+    if (observeLevel === "trace") {
+      logger.info("Trace poller: skipped (observe level is trace)");
+    } else {
+      tracePoller = createTracePoller(
+        {
+          url: `${observerBase}/trace/${deploymentId}`,
+          token: ingestToken,
+          intervalMs: 15e3
+        },
+        logger
+      );
+      tracePoller.start();
+      logger.info("Trace poller: active (every 15s)");
+    }
   }
   let currentBundleCleanup;
   let currentConfigPath;
-  if (api) {
+  if (api && !configFrozen) {
     heartbeat = createHeartbeat(
       {
         appUrl: api.appUrl,
@@ -9664,17 +9743,39 @@ async function runPipeline(options) {
   await new Promise(() => {
   });
 }
-function buildTelemetryObservers(flowId) {
+var OBSERVE_LEVELS = [
+  "off",
+  "standard",
+  "trace"
+];
+function readConfigFrozen() {
+  const raw = process.env.WALKEROS_CONFIG_FROZEN;
+  return raw === "1" || raw === "true";
+}
+function readObserveLevel(logger) {
+  const raw = process.env.WALKEROS_OBSERVE_LEVEL;
+  if (raw === void 0 || raw === "") return void 0;
+  const level = OBSERVE_LEVELS.find((candidate) => candidate === raw);
+  if (!level) {
+    logger.warn(
+      `Ignoring invalid WALKEROS_OBSERVE_LEVEL "${raw}" (expected off, standard, or trace)`
+    );
+    return void 0;
+  }
+  return level;
+}
+function buildTelemetryObservers(flowId, observeLevel) {
   const base = process.env.WALKEROS_OBSERVER_URL;
   const token = process.env.WALKEROS_INGEST_TOKEN;
   const deploymentId = process.env.WALKEROS_DEPLOYMENT_ID;
   if (!base || !token || !deploymentId) return void 0;
   const url = `${base}/ingest/${deploymentId}`;
   const emit = ht({ url, token });
+  const observe = observeLevel !== void 0 ? { level: observeLevel } : void 0;
   return [
     ft(
       emit,
-      () => pt({ flowId, traceUntil: mt() })
+      () => pt({ flowId, observe, traceUntil: mt() })
     )
   ];
 }
@@ -11402,7 +11503,8 @@ function n4(e4) {
   return i3.set(r5, o4), o4;
 }
 function s5(e4) {
-  return "object" == typeof e4 && null !== e4 && "events" in e4 && "object" == typeof e4.events;
+  if ("object" != typeof e4 || null === e4) return false;
+  return "events" in e4 && "object" == typeof e4.events && null !== e4.events || "schema" in e4;
 }
 function o3(e4, t4, r5) {
   return e4[t4]?.[r5] ?? e4[t4]?.["*"] ?? e4["*"]?.[r5] ?? e4["*"]?.["*"];
@@ -11940,7 +12042,7 @@ function validateMapping(input) {
 // src/commands/validate/validators/entry.ts
 init_dist();
 import Ajv from "ajv";
-var CLIENT_HEADER = "walkeros-cli/4.2.0-next-1781000333052";
+var CLIENT_HEADER = "walkeros-cli/4.3.0-next-1781171238534";
 var SECTIONS = ["destinations", "sources", "transformers"];
 function resolveEntry(path19, flowConfig) {
   const flows = flowConfig.flows;
@@ -12575,6 +12677,7 @@ init_sse();
 init_cli_logger();
 init_output();
 init_flows();
+import { randomUUID as randomUUID2 } from "crypto";
 async function resolveSettingsId(options) {
   const flow = await getFlow({
     flowId: options.flowId,
@@ -12600,8 +12703,9 @@ async function getAvailableFlowNames(options) {
   const settings = flow.settings;
   return settings?.map((c2) => c2.name) ?? [];
 }
+var DEFAULT_DEPLOY_WAIT_MS = 12 * 60 * 1e3;
 async function streamDeploymentStatus(projectId, deploymentId, options) {
-  const timeoutMs = options.timeout ?? 12e4;
+  const timeoutMs = options.timeout ?? DEFAULT_DEPLOY_WAIT_MS;
   const response = await apiFetch(
     `/api/projects/${projectId}/deployments/${deploymentId}/stream`,
     {
@@ -12660,7 +12764,10 @@ async function deploy(options) {
   }
   const { data, error } = await client.POST(
     "/api/projects/{projectId}/flows/{flowId}/deploy",
-    { params: { path: { projectId, flowId: options.flowId } } }
+    {
+      params: { path: { projectId, flowId: options.flowId } },
+      headers: { "Idempotency-Key": randomUUID2() }
+    }
   );
   if (error) {
     try {
@@ -12690,13 +12797,38 @@ Available: ${names.join(", ")}`,
 }
 async function deploySettings(options) {
   const { flowId, projectId, settingsId } = options;
-  const response = await apiFetch(
+  const triggerDeploy = () => apiFetch(
     `/api/projects/${projectId}/flows/${flowId}/settings/${settingsId}/deploy`,
-    { method: "POST" }
+    { method: "POST", headers: { "Idempotency-Key": randomUUID2() } }
   );
+  let response = await triggerDeploy();
+  if (!response.ok && options.wait) {
+    let retryBody = {};
+    try {
+      retryBody = await response.clone().json();
+    } catch {
+      retryBody = {};
+    }
+    try {
+      throwApiResponseError(
+        response,
+        retryBody,
+        `Deploy failed (${response.status})`
+      );
+    } catch (e4) {
+      if (e4 instanceof ApiError && e4.retryable) {
+        const waitSeconds = Math.min(e4.retryAfterSeconds ?? 5, 60);
+        options.onStatus?.("rate_limited", `retrying in ${waitSeconds}s`);
+        await new Promise((resolve4) => setTimeout(resolve4, waitSeconds * 1e3));
+        response = await triggerDeploy();
+      } else {
+        throw e4;
+      }
+    }
+  }
   if (!response.ok) {
     const body = await response.json().catch(() => ({}));
-    throwApiError(body, `Deploy failed (${response.status})`);
+    throwApiResponseError(response, body, `Deploy failed (${response.status})`);
   }
   const data = await response.json();
   if (!options.wait) return data;
@@ -12708,16 +12840,20 @@ async function deploySettings(options) {
   return { ...data, ...result };
 }
 var statusLabels = {
-  bundling: "Building bundle...",
-  "bundling:building": "Building bundle...",
-  "bundling:publishing": "Publishing to web...",
-  deploying: "Deploying container...",
+  "deploying:building": "Building bundle...",
+  "deploying:publishing": "Publishing to web...",
   "deploying:provisioning": "Provisioning container...",
   "deploying:starting": "Starting container...",
+  deploying: "Deploying...",
   active: "Container is live",
   published: "Published",
+  stopped: "Stopped",
   failed: "Deployment failed"
 };
+function renderStatusLabel(status, substatus) {
+  const key = substatus ? `${status}:${substatus}` : status;
+  return statusLabels[key] || statusLabels[status] || `Status: ${status}`;
+}
 async function deployCommand(flowId, options) {
   const log = createCLILogger(options);
   const timeoutMs = options.timeout ? parseInt(options.timeout, 10) * 1e3 : void 0;
@@ -12729,10 +12865,7 @@ async function deployCommand(flowId, options) {
       wait: options.wait !== false,
       timeout: timeoutMs,
       onStatus: options.json ? void 0 : (status, substatus) => {
-        const key = substatus ? `${status}:${substatus}` : status;
-        log.info(
-          statusLabels[key] || statusLabels[status] || `Status: ${status}`
-        );
+        log.info(renderStatusLabel(status, substatus));
       }
     });
     if (options.json) {
@@ -12747,7 +12880,7 @@ async function deployCommand(flowId, options) {
     } else if (r5.status === "failed") {
       log.error(`Failed: ${r5.errorMessage || "Unknown error"}`);
       process.exit(1);
-    } else if (r5.status === "bundling") {
+    } else if (r5.status === "deploying") {
       log.info(`Deployment started: ${r5.deploymentId} (${r5.type})`);
     } else {
       log.info(`Status: ${r5.status}`);
@@ -12902,20 +13035,16 @@ async function createDeployCommand(config, options) {
     log.info(`Deployment created: ${result.id}`);
     log.info(`  Slug:  ${result.slug}`);
     log.info(`  Type:  ${result.type}`);
-    if (result.deployToken) {
-      log.info(`  Token: ${result.deployToken}`);
-      log.warn("  Save this token \u2014 it will not be shown again.");
-    }
     log.info("");
     log.info("Run locally:");
     log.info(
       `  walkeros run ${isRemoteFlow ? "flow.json" : config} --deploy ${result.id}`
     );
     log.info("");
-    log.info("Docker:");
-    log.info(
-      `  docker run -e WALKEROS_DEPLOY_TOKEN=${result.deployToken ?? "<token>"} \\`
-    );
+    log.info("Create a deploy token for this flow in the app");
+    log.info("(Settings, Self-hosted deploy token) and set it as");
+    log.info("WALKEROS_DEPLOY_TOKEN, then run with Docker:");
+    log.info("  docker run -e WALKEROS_DEPLOY_TOKEN \\");
     log.info("             -e WALKEROS_APP_URL=https://app.walkeros.io \\");
     log.info("             walkeros/flow:latest");
   } catch (err) {
@@ -13231,7 +13360,7 @@ deployCmd.command("create [config]").description(
 });
 deployCmd.command("start <flowId>").description("Deploy a flow to walkerOS cloud (auto-detects web or server)").option("--project <id>", "project ID (defaults to WALKEROS_PROJECT_ID)").option("-f, --flow <name>", "flow name for multi-config flows").option("--no-wait", "do not wait for deployment to complete").option(
   "--timeout <seconds>",
-  "timeout for deployment polling (default: 120)"
+  "timeout in seconds for deployment polling (default: 720, the 12-minute server deploy budget)"
 ).option("-o, --output <path>", "output file path").option("--json", "output as JSON").option("-v, --verbose", "verbose output").option("-s, --silent", "suppress output").action(async (flowId, options) => {
   await deployCommand(flowId, options);
 });