@walkeros/cli 4.2.0 → 4.2.1-next-1781538735002

package/dist/cli.js

@@ -31,25 +31,62 @@ var init_client_context = __esm({
 });
 
 // src/core/api-error.ts
-function throwApiError(error, fallbackMessage) {
-  if (error && typeof error === "object" && "error" in error && typeof error.error === "object") {
-    const inner = error.error;
-    const message = inner.message || fallbackMessage;
-    const code = inner.code;
-    const details = inner.details?.errors;
-    const options = { code, details };
-    if (code === "CLIENT_OUTDATED") {
-      options.minVersion = inner.minVersion;
-      options.clientVersion = inner.clientVersion;
-      options.client = inner.client;
-      options.upgrade = inner.upgrade;
-      options.docs = inner.docs;
-    }
-    throw new ApiError(message, options);
+function extractApiErrorOptions(error, fallbackMessage) {
+  if (!error || typeof error !== "object" || !("error" in error) || typeof error.error !== "object") {
+    return null;
   }
+  const inner = error.error;
+  const message = inner.message || fallbackMessage;
+  const code = inner.code;
+  const details = inner.details?.errors;
+  const options = { code, details };
+  if (code === "CLIENT_OUTDATED") {
+    options.minVersion = inner.minVersion;
+    options.clientVersion = inner.clientVersion;
+    options.client = inner.client;
+    options.upgrade = inner.upgrade;
+    options.docs = inner.docs;
+  }
+  return { message, options };
+}
+function throwApiError(error, fallbackMessage) {
+  const extracted = extractApiErrorOptions(error, fallbackMessage);
+  if (extracted) throw new ApiError(extracted.message, extracted.options);
   throw new ApiError(fallbackMessage);
 }
+function parseRetryAfter(value) {
+  if (!value) return void 0;
+  const trimmed = value.trim();
+  if (/^\d+$/.test(trimmed)) return parseInt(trimmed, 10);
+  const when = Date.parse(trimmed);
+  if (Number.isNaN(when)) return void 0;
+  return Math.max(0, Math.round((when - Date.now()) / 1e3));
+}
+function throwApiResponseError(response, body, fallbackMessage) {
+  const status = response.status;
+  const retryAfterSeconds = parseRetryAfter(
+    response.headers.get("retry-after")
+  );
+  const retryable = status === 429 || status === 503 && retryAfterSeconds !== void 0;
+  const extracted = extractApiErrorOptions(body, fallbackMessage);
+  const message = extracted?.message ?? fallbackMessage;
+  const options = {
+    ...extracted?.options ?? {},
+    status,
+    retryable,
+    retryAfterSeconds
+  };
+  throw new ApiError(message, options);
+}
+function machineReadableErrorLine(err) {
+  const code = err instanceof ApiError ? err.code ?? "UNKNOWN" : "UNKNOWN";
+  const retryable = err instanceof ApiError ? err.retryable === true : false;
+  const retryAfter = err instanceof ApiError && err.retryAfterSeconds !== void 0 ? ` retryAfter=${err.retryAfterSeconds}` : "";
+  const message = err instanceof Error ? err.message : String(err);
+  return `error: code=${code} retryable=${retryable}${retryAfter} message=${message}`;
+}
 function handleCliError(err) {
+  console.error(machineReadableErrorLine(err));
   if (err instanceof ApiError && err.code === "CLIENT_OUTDATED") {
     console.error(`
 ${err.message}
@@ -59,17 +96,25 @@ ${err.message}
 `);
     process.exit(2);
   }
-  const message = err instanceof Error ? err.message : String(err);
-  console.error(message);
+  if (err instanceof ApiError && err.retryable) {
+    const hint = err.retryAfterSeconds !== void 0 ? ` Retry after ${err.retryAfterSeconds}s.` : " This is temporary, retry shortly.";
+    console.error(`${err.message}${hint}`);
+    process.exit(EXIT_RETRYABLE);
+  }
+  console.error(err instanceof Error ? err.message : String(err));
   process.exit(1);
 }
-var ApiError;
+var EXIT_RETRYABLE, ApiError;
 var init_api_error = __esm({
   "src/core/api-error.ts"() {
     "use strict";
+    EXIT_RETRYABLE = 75;
     ApiError = class extends Error {
       code;
       details;
+      status;
+      retryable;
+      retryAfterSeconds;
       // Populated only for CLIENT_OUTDATED responses (HTTP 426).
       minVersion;
       clientVersion;
@@ -81,6 +126,9 @@ var init_api_error = __esm({
         this.name = "ApiError";
         this.code = options?.code;
         this.details = options?.details;
+        this.status = options?.status;
+        this.retryable = options?.retryable;
+        this.retryAfterSeconds = options?.retryAfterSeconds;
         this.minVersion = options?.minVersion;
         this.clientVersion = options?.clientVersion;
         this.client = options?.client;
@@ -1229,6 +1277,10 @@ function createCLILogger(options = {}) {
     handler: (level, message, _context, scope) => {
       const scopePath = scope.length > 0 ? `[${scope.join(":")}] ` : "";
       const fullMessage = `${scopePath}${message}`;
+      try {
+        options.onLine?.(level, fullMessage);
+      } catch {
+      }
       if (level === l.ERROR) {
         if (!json) console.error(chalk2.red(fullMessage));
         return;
@@ -4570,7 +4622,7 @@ ${destinationsEntries.join(",\n")}
   stores${collectorStr}
 }`;
   const dataPayload = JSON.stringify(dataPayloadObj, null, 2);
-  return { storesDeclaration, codeConfigObject, dataPayload };
+  return { storesDeclaration, codeConfigObject, dataPayloadObj, dataPayload };
 }
 function generateSplitWireConfigModule(storesDeclaration, codeConfigObject, userCode) {
   const codeSection = userCode ? `
@@ -5314,7 +5366,7 @@ var init_contract = __esm({
   "src/core/contract.ts"() {
     "use strict";
     init_config_file();
-    bakedContractVersion = true ? "1.1.0" : PLACEHOLDER;
+    bakedContractVersion = true ? "2.1.0" : PLACEHOLDER;
   }
 });
 
@@ -6387,9 +6439,10 @@ async function nt(e4, t4, n5 = {}, o4) {
     const v4 = n5.ingest ? { ...n5.ingest, _meta: { ...n5.ingest._meta, path: [...n5.ingest._meta.path] } } : E("unknown");
     if (!w4.length && !s7.queueOn?.length) return { id: o5, destination: s7, skipped: true };
     if (!w4.length && s7.queueOn?.length) {
+      if (!je(s7.config.consent, r5)) return { id: o5, destination: s7, skipped: true };
       let t5 = false;
       try {
-        t5 = await ot2(e4, s7, o5);
+        t5 = await ot2(e4, s7, o5, true);
       } catch (t6) {
         e4.status.failed++;
         const n6 = s7.type || "unknown";
@@ -6418,7 +6471,7 @@ async function nt(e4, t4, n5 = {}, o4) {
     if (!b4.length) return { id: o5, destination: s7, queue: w4 };
     let C2, S2, j2 = false;
     try {
-      j2 = await ot2(e4, s7, o5);
+      j2 = await ot2(e4, s7, o5, true);
     } catch (t5) {
       e4.status.failed++;
       const n6 = s7.type || "unknown";
@@ -6484,26 +6537,30 @@ async function nt(e4, t4, n5 = {}, o4) {
   }
   return rt({ event: t4, ...Object.keys(v3).length && { done: v3 }, ...Object.keys(b3).length && { queued: b3 }, ...Object.keys(k3).length && { failed: k3 } });
 }
-async function ot2(e4, t4, n5) {
+async function ot2(e4, t4, n5, o4 = false) {
   if (t4.init && !t4.config.init) {
-    const o4 = t4.type || "unknown", s6 = e4.logger.scope(o4), r5 = { collector: e4, logger: s6, id: n5, config: t4.config, env: ct2(t4.env, t4.config.env) };
-    s6.debug("init");
-    const a4 = Date.now();
-    let i4;
-    yt(e4, D2(e4, { stepId: o("destination", n5), stepType: "destination", phase: "init", eventId: "", now: a4 }));
+    if (!o4 && (function(e5) {
+      const t5 = e5.config.consent;
+      return !!t5 && Object.keys(t5).length > 0;
+    })(t4)) return e4.logger.scope(t4.type || "unknown").debug("init blocked: consent gate not cleared"), false;
+    const s6 = t4.type || "unknown", r5 = e4.logger.scope(s6), a4 = { collector: e4, logger: r5, id: n5, config: t4.config, env: ct2(t4.env, t4.config.env) };
+    r5.debug("init");
+    const i4 = Date.now();
+    let c2;
+    yt(e4, D2(e4, { stepId: o("destination", n5), stepType: "destination", phase: "init", eventId: "", now: i4 }));
     try {
-      i4 = await ct(t4.init, "DestinationInit", e4.hooks, e4.logger)(r5);
+      c2 = await ct(t4.init, "DestinationInit", e4.hooks, e4.logger)(a4);
     } catch (t5) {
       const o5 = Date.now(), s7 = D2(e4, { stepId: o("destination", n5), stepType: "destination", phase: "error", eventId: "", now: o5 });
-      throw s7.durationMs = o5 - a4, s7.error = t5 instanceof Error ? { name: t5.name, message: t5.message } : { message: String(t5) }, yt(e4, s7), t5;
+      throw s7.durationMs = o5 - i4, s7.error = t5 instanceof Error ? { name: t5.name, message: t5.message } : { message: String(t5) }, yt(e4, s7), t5;
     }
-    if (false === i4) return i4;
-    if (t4.config = { ...i4 || t4.config, init: true }, t4.queueOn?.length) {
+    if (false === c2) return c2;
+    if (t4.config = { ...c2 || t4.config, init: true }, t4.queueOn?.length) {
       const o5 = t4.queueOn;
       t4.queueOn = [];
       for (const { type: s7, data: r6 } of o5) He2(e4, t4, n5, s7, r6);
     }
-    s6.debug("init done");
+    r5.debug("init done");
   }
   return true;
 }
@@ -6698,7 +6755,7 @@ async function wt(e4, t4, o4) {
   }
 }
 function vt(e4, t4) {
-  return { timing: Math.round((Date.now() - e4.timing) / 10) / 100, source: { type: "collector", schema: "4", version: "4.2.0" }, ...t4 };
+  return { timing: Math.round((Date.now() - e4.timing) / 10) / 100, source: { type: "collector", schema: "4", version: "4.2.1-next-1781538735002" }, ...t4 };
 }
 function bt(e4, t4) {
   if (!t4.name) throw new Error("Event name is required");
@@ -7451,13 +7508,13 @@ function installTimerInterception(options = {}) {
       setInterval: Reflect.get(target, "setInterval"),
       clearInterval: Reflect.get(target, "clearInterval")
     });
-    const trackedSetTimeout = (callback, delay, ...args) => {
+    const trackedSetTimeout = (callback, delay2, ...args) => {
       if (typeof callback !== "function") return 0;
       const id = nextId++;
       pending.set(id, {
         id,
         callback,
-        delay: delay ?? 0,
+        delay: delay2 ?? 0,
         type: "timeout",
         args,
         cleared: false
@@ -7470,13 +7527,13 @@ function installTimerInterception(options = {}) {
       const entry = pending.get(numId);
       if (entry) entry.cleared = true;
     };
-    const trackedSetInterval = (callback, delay, ...args) => {
+    const trackedSetInterval = (callback, delay2, ...args) => {
       if (typeof callback !== "function") return 0;
       const id = nextId++;
       pending.set(id, {
         id,
         callback,
-        delay: delay ?? 0,
+        delay: delay2 ?? 0,
         type: "interval",
         args,
         cleared: false
@@ -7753,7 +7810,7 @@ function toError(error) {
   return error instanceof Error ? error : new Error(getErrorMessage(error));
 }
 function buildSimulationResult(args) {
-  const { step, name, startTime, captured, usage, error } = args;
+  const { step, name, startTime, captured, usage, mappingKey, error } = args;
   const events = (captured ?? []).filter(hasEvent).map((entry) => entry.event);
   const calls = usage ? Object.values(usage).flat().map((call) => ({ fn: call.fn, args: call.args, ts: call.ts })) : [];
   return {
@@ -7762,6 +7819,7 @@ function buildSimulationResult(args) {
     events,
     calls,
     duration: Date.now() - startTime,
+    ...mappingKey !== void 0 ? { mappingKey } : {},
     ...error !== void 0 ? { error: toError(error) } : {}
   };
 }
@@ -8355,7 +8413,9 @@ async function simulateSource(configOrPath, input, options) {
             `Source package "${sourceConfig.package}" has no createTrigger in /dev export`
           );
         }
-        const flowConfig = module.wireConfig(module.__configData ?? void 0);
+        const flowConfig = module.wireConfig(
+          options.data ?? module.__configData ?? void 0
+        );
         applyOverrides(flowConfig, prepared.overrides);
         const captured = [];
         flowConfig.hooks = {
@@ -8460,7 +8520,9 @@ async function simulateTransformer(configOrPath, event, options) {
         networkCalls
       },
       async (module) => {
-        const flowConfig = module.wireConfig(module.__configData ?? void 0);
+        const flowConfig = module.wireConfig(
+          options.data ?? module.__configData ?? void 0
+        );
         applyOverrides(flowConfig, prepared.overrides);
         if (flowConfig.sources) flowConfig.sources = {};
         if (flowConfig.destinations) flowConfig.destinations = {};
@@ -8626,7 +8688,9 @@ async function simulateCollector(configOrPath, event, options) {
         networkCalls
       },
       async (module) => {
-        const flowConfig = module.wireConfig(module.__configData ?? void 0);
+        const flowConfig = module.wireConfig(
+          options.data ?? module.__configData ?? void 0
+        );
         applyOverrides(flowConfig, prepared.overrides);
         if (flowConfig.sources) flowConfig.sources = {};
         if (flowConfig.destinations) flowConfig.destinations = {};
@@ -8729,7 +8793,9 @@ async function simulateDestination(configOrPath, event, options) {
         networkCalls
       },
       async (module) => {
-        const flowConfig = module.wireConfig(module.__configData ?? void 0);
+        const flowConfig = module.wireConfig(
+          options.data ?? module.__configData ?? void 0
+        );
         applyOverrides(flowConfig, prepared.overrides);
         const destPkg = (prepared.flowSettings.destinations ?? {})[options.destinationId];
         let trackedCalls = [];
@@ -8765,6 +8831,16 @@ async function simulateDestination(configOrPath, event, options) {
           );
         }
         logger.info(`Simulating destination: ${options.destinationId}`);
+        let mappingKey;
+        const targetStepId = o("destination", options.destinationId);
+        const captureMappingKey = (state) => {
+          if (state.stepId === targetStepId && state.mappingKey) {
+            mappingKey = state.mappingKey;
+          }
+        };
+        if (collector.observers instanceof Set) {
+          collector.observers.add(captureMappingKey);
+        }
         await collector.push(event, {
           include: [options.destinationId]
         });
@@ -8773,7 +8849,8 @@ async function simulateDestination(configOrPath, event, options) {
           step: "destination",
           name: options.destinationId,
           startTime,
-          usage: trackedCalls.length ? { [options.destinationId]: trackedCalls } : void 0
+          usage: trackedCalls.length ? { [options.destinationId]: trackedCalls } : void 0,
+          mappingKey
         });
       },
       (error) => buildSimulationResult({
@@ -8796,16 +8873,91 @@ async function simulateDestination(configOrPath, event, options) {
 }
 
 // src/commands/run/index.ts
+init_dist();
 init_cli_logger();
 init_core();
-init_tmp();
-init_config_file();
-init_auth();
 import path18 from "path";
 import { writeFileSync as writeFileSync5 } from "fs";
 import { homedir as homedir2 } from "os";
 import { join as join7 } from "path";
 
+// src/runtime/runner.ts
+import { resolve as resolve3, dirname as dirname4 } from "path";
+
+// src/runtime/load-bundle.ts
+import { resolve as resolve2 } from "path";
+import { pathToFileURL as pathToFileURL2 } from "url";
+async function loadBundle(file, context2, logger) {
+  const absolutePath = resolve2(file);
+  const fileUrl = pathToFileURL2(absolutePath).href;
+  logger?.debug?.(`Importing bundle: ${absolutePath}`);
+  const module = await import(`${fileUrl}?t=${Date.now()}`);
+  if (!module.default || typeof module.default !== "function") {
+    throw new Error(
+      `Invalid bundle: ${file} must export a default factory function`
+    );
+  }
+  logger?.debug?.("Calling factory function...");
+  const result = await module.default(context2 ?? {});
+  if (!result || !result.collector || typeof result.collector.push !== "function") {
+    throw new Error(
+      `Invalid bundle: factory must return { collector } with a push function`
+    );
+  }
+  return {
+    collector: result.collector,
+    ...typeof result.httpHandler === "function" ? { httpHandler: result.httpHandler } : {}
+  };
+}
+
+// src/runtime/runner.ts
+async function loadFlow(file, config, logger, loggerConfig, healthServer, observers) {
+  const absolutePath = resolve3(file);
+  const flowDir = dirname4(absolutePath);
+  process.chdir(flowDir);
+  const flowContext = {
+    ...config,
+    ...loggerConfig ? { logger: loggerConfig } : {},
+    ...healthServer ? { sourceSettings: { port: void 0 } } : {},
+    ...observers ? { observers } : {}
+  };
+  const result = await loadBundle(absolutePath, flowContext, logger);
+  if (healthServer && typeof result.httpHandler === "function") {
+    healthServer.setFlowHandler(result.httpHandler);
+  }
+  return {
+    collector: {
+      command: result.collector.command,
+      status: result.collector.status
+    },
+    file,
+    httpHandler: result.httpHandler
+  };
+}
+async function swapFlow(currentHandle, newFile, config, logger, loggerConfig, healthServer, observers) {
+  logger.info("Shutting down current flow for hot-swap...");
+  if (healthServer) {
+    healthServer.setFlowHandler(null);
+  }
+  try {
+    if (currentHandle.collector.command) {
+      await currentHandle.collector.command("shutdown");
+    }
+  } catch (error) {
+    logger.debug(`Shutdown warning: ${error}`);
+  }
+  const newHandle = await loadFlow(
+    newFile,
+    config,
+    logger,
+    loggerConfig,
+    healthServer,
+    observers
+  );
+  logger.info("Flow swapped successfully");
+  return newHandle;
+}
+
 // src/runtime/resolve-bundle.ts
 init_stdin();
 import {
@@ -8815,11 +8967,127 @@ import {
   rmSync,
   writeFileSync as writeFileSync2
 } from "fs";
-import { dirname as dirname4, join as join5 } from "path";
+import { dirname as dirname5, join as join5 } from "path";
 import { Readable } from "stream";
 import { x as tarExtract } from "tar";
+
+// src/runtime/fetch-retry.ts
+var DEFAULT_PER_ATTEMPT_TIMEOUT_MS = 3e4;
+var DEFAULT_MAX_TOTAL_MS = 6e4;
+var DEFAULT_ATTEMPTS = 3;
+var MIN_ATTEMPT_BUDGET_MS = 1e3;
+var BASE_BACKOFF_MS = [2e3, 5e3];
+var JITTER = 0.2;
+var RETRYABLE_NETWORK_CODES = /* @__PURE__ */ new Set([
+  "ECONNRESET",
+  "ECONNREFUSED",
+  "ETIMEDOUT",
+  "EAI_AGAIN",
+  "ENOTFOUND"
+]);
+function readErrorCode(value) {
+  if (typeof value !== "object" || value === null) return void 0;
+  const code = Reflect.get(value, "code");
+  return typeof code === "string" ? code : void 0;
+}
+function readErrorName(value) {
+  if (typeof value !== "object" || value === null) return void 0;
+  const name = Reflect.get(value, "name");
+  return typeof name === "string" ? name : void 0;
+}
+function isTransientThrow(error) {
+  const name = readErrorName(error);
+  if (name === "TimeoutError" || name === "AbortError") return true;
+  const directCode = readErrorCode(error);
+  if (directCode && RETRYABLE_NETWORK_CODES.has(directCode)) return true;
+  if (typeof error === "object" && error !== null) {
+    const causeCode = readErrorCode(Reflect.get(error, "cause"));
+    if (causeCode && RETRYABLE_NETWORK_CODES.has(causeCode)) return true;
+  }
+  return error instanceof TypeError;
+}
+function isTransientStatus(status) {
+  return status >= 500 || status === 429;
+}
+function readErrorMessage(value) {
+  if (typeof value !== "object" || value === null) return void 0;
+  const message = Reflect.get(value, "message");
+  return typeof message === "string" ? message : void 0;
+}
+function describeReason(reason) {
+  if (reason.kind === "status") return `HTTP ${reason.status}`;
+  const name = readErrorName(reason.error);
+  const message = reason.error instanceof Error ? reason.error.message : String(reason.error);
+  let detail = name ? `${name}: ${message}` : message;
+  if (typeof reason.error === "object" && reason.error !== null) {
+    const cause = Reflect.get(reason.error, "cause");
+    const causeCode = readErrorCode(cause);
+    const causeMessage = readErrorMessage(cause);
+    const causeDetail = causeCode ?? causeMessage;
+    if (causeDetail) detail = `${detail} (${causeDetail})`;
+  }
+  return detail;
+}
+function backoffForAttempt(index) {
+  const base = BASE_BACKOFF_MS[Math.min(index, BASE_BACKOFF_MS.length - 1)] ?? 0;
+  const spread = base * JITTER;
+  return base + (Math.random() * 2 - 1) * spread;
+}
+function delay(ms) {
+  return new Promise((resolve4) => {
+    setTimeout(resolve4, ms);
+  });
+}
+async function fetchWithRetry(url, options = {}) {
+  const attempts = options.attempts ?? DEFAULT_ATTEMPTS;
+  const perAttemptTimeoutMs = options.perAttemptTimeoutMs ?? DEFAULT_PER_ATTEMPT_TIMEOUT_MS;
+  const maxTotalMs = options.maxTotalMs ?? DEFAULT_MAX_TOTAL_MS;
+  const init = options.init;
+  const start = Date.now();
+  let lastReason;
+  let made = 0;
+  for (let attempt = 0; attempt < attempts; attempt++) {
+    const remaining = maxTotalMs - (Date.now() - start);
+    if (remaining <= MIN_ATTEMPT_BUDGET_MS) break;
+    const attemptTimeoutMs = Math.min(perAttemptTimeoutMs, remaining);
+    made = attempt + 1;
+    let reason;
+    try {
+      const controller = new AbortController();
+      const timeoutId = setTimeout(() => controller.abort(), attemptTimeoutMs);
+      let response;
+      try {
+        response = await fetch(url, {
+          ...init,
+          signal: controller.signal
+        });
+      } finally {
+        clearTimeout(timeoutId);
+      }
+      if (!isTransientStatus(response.status)) return response;
+      await response.body?.cancel();
+      reason = { kind: "status", status: response.status };
+    } catch (error) {
+      if (!isTransientThrow(error)) throw error;
+      reason = { kind: "throw", error };
+    }
+    lastReason = reason;
+    const isLastAttempt = attempt === attempts - 1;
+    const budgetSpent = Date.now() - start >= maxTotalMs;
+    if (isLastAttempt || budgetSpent) break;
+    const sleepMs = Math.min(
+      backoffForAttempt(attempt),
+      maxTotalMs - (Date.now() - start)
+    );
+    if (sleepMs <= 0) break;
+    await delay(sleepMs);
+  }
+  const cause = lastReason ? describeReason(lastReason) : "no attempts made";
+  throw new Error(`Fetch failed after ${made} attempts: ${cause}`);
+}
+
+// src/runtime/resolve-bundle.ts
 var ARCHIVE_ENTRY = "flow.mjs";
-var FETCH_TIMEOUT_MS = 3e4;
 function getDefaultWritePath() {
   if (existsSync2("/app/flow")) return "/app/flow/flow.mjs";
   return "/tmp/walkeros-flow.mjs";
@@ -8837,16 +9105,14 @@ function isArchive(value, contentType) {
   return false;
 }
 function writeBundleToDisk(writePath, content) {
-  const dir = dirname4(writePath);
+  const dir = dirname5(writePath);
   if (!existsSync2(dir)) {
     mkdirSync2(dir, { recursive: true });
   }
   writeFileSync2(writePath, content, "utf-8");
 }
 async function fetchOk(url) {
-  const response = await fetch(url, {
-    signal: AbortSignal.timeout(FETCH_TIMEOUT_MS)
-  });
+  const response = await fetchWithRetry(url);
   if (!response.ok) {
     throw new Error(
       `Failed to fetch bundle from ${url}: ${response.status} ${response.statusText}`
@@ -8898,7 +9164,7 @@ async function readBundleFromStdin(writePath) {
 }
 async function resolveBundle(bundleEnv) {
   const writePath = getDefaultWritePath();
-  const archiveDestDir = dirname4(writePath);
+  const archiveDestDir = dirname5(writePath);
   if (!isUrl2(bundleEnv) && existsSync2(bundleEnv)) {
     if (isArchive(bundleEnv)) {
       const path19 = await extractToDir(
@@ -8967,10 +9233,7 @@ async function fetchConfig(options) {
     options.token,
     options.lastEtag ? { "If-None-Match": options.lastEtag } : void 0
   );
-  const response = await fetch(url, {
-    headers,
-    signal: AbortSignal.timeout(3e4)
-  });
+  const response = await fetchWithRetry(url, { init: { headers } });
   if (response.status === 304) {
     return { changed: false };
   }
@@ -8991,271 +9254,126 @@ async function fetchConfig(options) {
   };
 }
 
-// src/commands/run/index.ts
+// src/runtime/index.ts
 init_cache();
 
-// src/commands/run/validators.ts
-init_asset_resolver();
-import { existsSync as existsSync4 } from "fs";
-
-// src/schemas/primitives.ts
-init_dev();
-var PortSchema = n3.number().int("Port must be an integer").min(1, "Port must be at least 1").max(65535, "Port must be at most 65535").describe("HTTP server port number");
-var FilePathSchema = n3.string().min(1, "File path cannot be empty").describe("Path to configuration file");
-
-// src/schemas/run.ts
-init_dev();
-var RunOptionsSchema = n3.object({
-  flow: FilePathSchema,
-  port: PortSchema.default(8080),
-  flowName: n3.string().optional().describe("Specific flow name to run")
-});
-
-// src/schemas/validate.ts
-init_dev();
-var ValidationTypeSchema = n3.enum(["contract", "event", "flow", "mapping"]).describe('Validation type: "event", "flow", "mapping", or "contract"');
-var ValidateOptionsSchema = n3.object({
-  flow: n3.string().optional().describe("Flow name for multi-flow configs"),
-  path: n3.string().optional().describe(
-    'Entry path for package schema validation (e.g., "destinations.snowplow", "sources.browser")'
-  )
-});
-var ValidateInputShape = {
-  type: ValidationTypeSchema,
-  input: n3.string().min(1).describe("JSON string, file path, or URL to validate"),
-  flow: n3.string().optional().describe("Flow name for multi-flow configs"),
-  path: n3.string().optional().describe(
-    'Entry path for package schema validation (e.g., "destinations.snowplow"). When provided, validates the entry against its package JSON Schema instead of using --type.'
-  )
-};
-var ValidateInputSchema = n3.object(ValidateInputShape);
-
-// src/schemas/bundle.ts
-init_dev();
-var BundleOptionsSchema = n3.object({
-  silent: n3.boolean().optional().describe("Suppress all output"),
-  verbose: n3.boolean().optional().describe("Enable verbose logging"),
-  stats: n3.boolean().optional().default(true).describe("Return bundle statistics"),
-  cache: n3.boolean().optional().default(true).describe("Enable package caching"),
-  flowName: n3.string().optional().describe("Flow name for multi-flow configs")
-});
-var BundleInputShape = {
-  configPath: FilePathSchema.describe(
-    "Path to flow configuration file (JSON or JavaScript), URL, or inline JSON string"
-  ),
-  flow: n3.string().optional().describe("Flow name for multi-flow configs"),
-  stats: n3.boolean().optional().default(true).describe("Return bundle statistics"),
-  output: n3.string().optional().describe("Output file path (defaults to config-defined)")
-};
-var BundleInputSchema = n3.object(BundleInputShape);
-
-// src/schemas/simulate.ts
-init_dev();
-var PlatformSchema = n3.enum(["web", "server"]).describe("Platform type for event processing");
-var SimulateOptionsSchema = n3.object({
-  silent: n3.boolean().optional().describe("Suppress all output"),
-  verbose: n3.boolean().optional().describe("Enable verbose logging"),
-  json: n3.boolean().optional().describe("Format output as JSON")
-});
-var SimulateInputShape = {
-  configPath: FilePathSchema.describe(
-    "Path to flow configuration file, URL, or inline JSON string"
-  ),
-  event: n3.string().min(1).optional().describe(
-    "Event as JSON string, file path, or URL. For sources: { content, trigger?, env? }."
-  ),
-  flow: n3.string().optional().describe("Flow name for multi-flow configs"),
-  platform: PlatformSchema.optional().describe("Override platform detection"),
-  step: n3.string().optional().describe(
-    'Step target in type.name format (e.g. "source.browser", "destination.gtag")'
-  )
-};
-var SimulateInputSchema = n3.object(SimulateInputShape);
-
-// src/schemas/push.ts
-init_dev();
-var PushOptionsSchema = n3.object({
-  silent: n3.boolean().optional().describe("Suppress all output"),
-  verbose: n3.boolean().optional().describe("Enable verbose logging"),
-  json: n3.boolean().optional().describe("Format output as JSON")
-});
-var PushInputShape = {
-  configPath: FilePathSchema.describe("Path to flow configuration file"),
-  event: n3.string().min(1).describe("Event as JSON string, file path, or URL"),
-  flow: n3.string().optional().describe("Flow name for multi-flow configs"),
-  platform: PlatformSchema.optional().describe("Override platform detection")
-};
-var PushInputSchema = n3.object(PushInputShape);
+// src/runtime/heartbeat.ts
+import { randomBytes } from "crypto";
+init_http();
 
-// src/commands/run/validators.ts
-function validateFlowFile(filePath) {
-  const absolutePath = resolveAsset(filePath, "bundle");
-  if (!existsSync4(absolutePath)) {
-    throw new Error(
-      `Flow file not found: ${filePath}
-   Resolved path: ${absolutePath}
-   Make sure the file exists and the path is correct`
-    );
-  }
-  return absolutePath;
+// src/runtime/redact.ts
+var MAX_LENGTH = 256;
+var MIN_TOKEN_LEN = 20;
+var ENTROPY_THRESHOLD = 4;
+var FORCE_MASK_PREFIXES = [
+  "sk-",
+  "sk_",
+  "pk_",
+  "ghp_",
+  "gho_",
+  "xoxb-",
+  "xoxp-",
+  "AKIA"
+];
+var RE_URL_CREDS = /(:\/\/[^/:@\s]+:)[^@\s]+(@)/g;
+var RE_JSON_PRIVATE_KEY = /("private_key"\s*:\s*)"[^"]*"/g;
+var RE_PEM_BEGIN = /^\s*-----BEGIN [A-Z ]*PRIVATE KEY-----/i;
+var RE_PEM_END = /-----END[A-Z -]*-----/i;
+var TOKEN_VALUE_CLASS = "[A-Za-z0-9+/._-]";
+var RE_KV_SECRET = new RegExp(
+  `(^|\\s)([A-Za-z_][A-Za-z0-9_.]{0,63}\\s*[=:]\\s*)(${TOKEN_VALUE_CLASS}{12,}={0,2})`,
+  "g"
+);
+var RE_TOKEN_RUN = new RegExp(`${TOKEN_VALUE_CLASS}{${MIN_TOKEN_LEN},}`, "g");
+function escapeRegex(s6) {
+  return s6.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+var PREFIX_ALTERNATION = [...FORCE_MASK_PREFIXES].sort((a4, b3) => b3.length - a4.length).map(escapeRegex).join("|");
+var RE_PREFIXED_TOKEN = new RegExp(
+  `(?:${PREFIX_ALTERNATION})${TOKEN_VALUE_CLASS}*`,
+  "g"
+);
+function shannonEntropy(s6) {
+  if (s6.length === 0) return 0;
+  const counts = /* @__PURE__ */ new Map();
+  for (const ch of s6) counts.set(ch, (counts.get(ch) ?? 0) + 1);
+  let entropy = 0;
+  for (const count of counts.values()) {
+    const p3 = count / s6.length;
+    entropy -= p3 * Math.log2(p3);
+  }
+  return entropy;
+}
+var RE_ALL_HEX = /^[0-9a-fA-F]+$/;
+var RE_ALL_DIGIT = /^[0-9]+$/;
+var RE_BASE64_SPECIAL = /[+/=]/;
+var RE_HAS_DIGIT = /[0-9]/;
+var RE_HAS_LETTER = /[A-Za-z]/;
+function shouldMaskToken(run) {
+  if (RE_ALL_HEX.test(run)) return true;
+  if (RE_ALL_DIGIT.test(run)) return true;
+  if (RE_BASE64_SPECIAL.test(run)) return true;
+  if (RE_HAS_DIGIT.test(run) && RE_HAS_LETTER.test(run)) return true;
+  if (shannonEntropy(run) >= ENTROPY_THRESHOLD) return true;
+  return false;
 }
-function validatePort(port) {
-  const result = PortSchema.safeParse(port);
-  if (!result.success) {
-    throw new Error(
-      `Invalid port: ${port}
-   Port must be an integer between 1 and 65535
-   Example: --port 8080`
-    );
+function removePemBlocks(lines) {
+  const out = [];
+  let inBlock = false;
+  for (const line of lines) {
+    if (!inBlock) {
+      if (RE_PEM_BEGIN.test(line)) {
+        inBlock = true;
+        continue;
+      }
+      out.push(line);
+    } else {
+      if (RE_PEM_END.test(line)) {
+        inBlock = false;
+      }
+    }
   }
-}
-
-// src/commands/run/index.ts
-init_utils3();
-
-// src/commands/run/pipeline.ts
-init_dist();
-init_tmp();
-import { writeFileSync as writeFileSync4 } from "fs";
-import fs17 from "fs-extra";
-
-// src/runtime/health-server.ts
-import http from "http";
-function createHealthServer(port, logger) {
-  return new Promise((resolve4, reject) => {
-    let flowHandler = null;
-    let ready = false;
-    let failureReason = null;
-    const server = http.createServer((req, res) => {
-      if (req.url === "/health" && req.method === "GET") {
-        res.writeHead(200, { "Content-Type": "application/json" });
-        res.end(JSON.stringify({ status: "ok" }));
-        return;
-      }
-      if (req.url === "/ready" && req.method === "GET") {
-        const code = ready ? 200 : 503;
-        const status = ready ? "ready" : failureReason ? "failed" : "not_ready";
-        res.writeHead(code, { "Content-Type": "application/json" });
-        res.end(
-          JSON.stringify(
-            failureReason && !ready ? { status, reason: failureReason } : { status }
-          )
-        );
-        return;
-      }
-      if (flowHandler) {
-        flowHandler(req, res);
-        return;
-      }
-      res.writeHead(503, { "Content-Type": "application/json" });
-      res.end(JSON.stringify({ error: "No flow loaded" }));
-    });
-    server.keepAliveTimeout = 5e3;
-    server.headersTimeout = 1e4;
-    server.listen(port, "0.0.0.0", () => {
-      logger.info(`Health server listening on port ${port}`);
-      resolve4({
-        server,
-        setFlowHandler(handler) {
-          flowHandler = handler;
-        },
-        setReady(value) {
-          ready = value;
-          if (value) failureReason = null;
-        },
-        setFailed(reason) {
-          ready = false;
-          failureReason = reason;
-        },
-        close: () => new Promise((res, rej) => {
-          server.close((err) => err ? rej(err) : res());
-        })
-      });
-    });
-    server.on("error", reject);
-  });
-}
-
-// src/runtime/runner.ts
-import { resolve as resolve3, dirname as dirname5 } from "path";
-
-// src/runtime/load-bundle.ts
-import { resolve as resolve2 } from "path";
-import { pathToFileURL as pathToFileURL2 } from "url";
-async function loadBundle(file, context2, logger) {
-  const absolutePath = resolve2(file);
-  const fileUrl = pathToFileURL2(absolutePath).href;
-  logger?.debug?.(`Importing bundle: ${absolutePath}`);
-  const module = await import(`${fileUrl}?t=${Date.now()}`);
-  if (!module.default || typeof module.default !== "function") {
-    throw new Error(
-      `Invalid bundle: ${file} must export a default factory function`
-    );
-  }
-  logger?.debug?.("Calling factory function...");
-  const result = await module.default(context2 ?? {});
-  if (!result || !result.collector || typeof result.collector.push !== "function") {
-    throw new Error(
-      `Invalid bundle: factory must return { collector } with a push function`
-    );
-  }
-  return {
-    collector: result.collector,
-    ...typeof result.httpHandler === "function" ? { httpHandler: result.httpHandler } : {}
-  };
-}
-
-// src/runtime/runner.ts
-async function loadFlow(file, config, logger, loggerConfig, healthServer, observers) {
-  const absolutePath = resolve3(file);
-  const flowDir = dirname5(absolutePath);
-  process.chdir(flowDir);
-  const flowContext = {
-    ...config,
-    ...loggerConfig ? { logger: loggerConfig } : {},
-    ...healthServer ? { sourceSettings: { port: void 0 } } : {},
-    ...observers ? { observers } : {}
-  };
-  const result = await loadBundle(absolutePath, flowContext, logger);
-  if (healthServer && typeof result.httpHandler === "function") {
-    healthServer.setFlowHandler(result.httpHandler);
-  }
-  return {
-    collector: {
-      command: result.collector.command,
-      status: result.collector.status
-    },
-    file,
-    httpHandler: result.httpHandler
-  };
-}
-async function swapFlow(currentHandle, newFile, config, logger, loggerConfig, healthServer, observers) {
-  logger.info("Shutting down current flow for hot-swap...");
-  if (healthServer) {
-    healthServer.setFlowHandler(null);
-  }
-  try {
-    if (currentHandle.collector.command) {
-      await currentHandle.collector.command("shutdown");
-    }
-  } catch (error) {
-    logger.debug(`Shutdown warning: ${error}`);
-  }
-  const newHandle = await loadFlow(
-    newFile,
-    config,
-    logger,
-    loggerConfig,
-    healthServer,
-    observers
-  );
-  logger.info("Flow swapped successfully");
-  return newHandle;
+  return out;
+}
+function maskLine(line) {
+  let s6 = line;
+  s6 = s6.replace(RE_URL_CREDS, "$1***$2");
+  s6 = s6.replace(RE_KV_SECRET, "$1$2***");
+  s6 = s6.replace(RE_PREFIXED_TOKEN, "***");
+  s6 = s6.replace(
+    RE_TOKEN_RUN,
+    (match) => shouldMaskToken(match) ? "***" : match
+  );
+  return s6;
+}
+function redactLine(line) {
+  const withoutJsonKey = line.replace(RE_JSON_PRIVATE_KEY, '$1"***"');
+  const rawLines = withoutJsonKey.split("\n");
+  const cleanLines = removePemBlocks(rawLines);
+  const maskedLines = cleanLines.map(maskLine);
+  const joined = maskedLines.join("\n");
+  if (joined.length > MAX_LENGTH) {
+    return joined.slice(0, MAX_LENGTH - 1) + "\u2026";
+  }
+  return joined;
+}
+function redactErrors(errors) {
+  return errors.map((e4) => ({
+    message: redactLine(e4.message),
+    count: e4.count,
+    firstSeen: new Date(e4.firstSeen).toISOString(),
+    lastSeen: new Date(e4.lastSeen).toISOString()
+  }));
+}
+function redactLogs(entries) {
+  return entries.map((e4) => ({
+    time: new Date(e4.time).toISOString(),
+    level: e4.level,
+    message: redactLine(e4.message)
+  }));
 }
 
 // src/runtime/heartbeat.ts
-import { randomBytes } from "crypto";
-init_http();
 function computeCounterDelta(current, last) {
   const destinations = {};
   for (const [name, dest] of Object.entries(current.destinations)) {
@@ -9316,6 +9434,8 @@ function createHeartbeat(config, logger) {
         };
         counters = computeCounterDelta(current, lastReported);
       }
+      const errors = config.getErrors ? redactErrors(config.getErrors()) : [];
+      const logs = config.getLogs ? redactLogs(config.getLogs().slice(-50)) : [];
       const response = await fetch(
         `${config.appUrl}/api/projects/${config.projectId}/runners/heartbeat`,
         {
@@ -9332,7 +9452,9 @@ function createHeartbeat(config, logger) {
             configVersion,
             cliVersion: VERSION,
             uptime: Math.floor((Date.now() - startTime) / 1e3),
-            ...counters && { counters }
+            ...counters && { counters },
+            ...errors.length && { recentErrors: errors },
+            ...logs.length && { recentLogs: logs }
           }),
           signal: AbortSignal.timeout(1e4)
         }
@@ -9407,6 +9529,270 @@ function createPoller(config, logger) {
   return { start, stop, pollOnce };
 }
 
+// src/runtime/health-server.ts
+import http from "http";
+function createHealthServer(port, logger) {
+  return new Promise((resolve4, reject) => {
+    let flowHandler = null;
+    let ready = false;
+    let failureReason = null;
+    const server = http.createServer((req, res) => {
+      if (req.url === "/health" && req.method === "GET") {
+        res.writeHead(200, { "Content-Type": "application/json" });
+        res.end(JSON.stringify({ status: "ok" }));
+        return;
+      }
+      if (req.url === "/ready" && req.method === "GET") {
+        const code = ready ? 200 : 503;
+        const status = ready ? "ready" : failureReason ? "failed" : "not_ready";
+        res.writeHead(code, { "Content-Type": "application/json" });
+        res.end(
+          JSON.stringify(
+            failureReason && !ready ? { status, reason: failureReason } : { status }
+          )
+        );
+        return;
+      }
+      if (flowHandler) {
+        flowHandler(req, res);
+        return;
+      }
+      res.writeHead(503, { "Content-Type": "application/json" });
+      res.end(JSON.stringify({ error: "No flow loaded" }));
+    });
+    server.keepAliveTimeout = 5e3;
+    server.headersTimeout = 1e4;
+    server.listen(port, "0.0.0.0", () => {
+      logger.info(`Health server listening on port ${port}`);
+      resolve4({
+        server,
+        setFlowHandler(handler) {
+          flowHandler = handler;
+        },
+        setReady(value) {
+          ready = value;
+          if (value) failureReason = null;
+        },
+        setFailed(reason) {
+          ready = false;
+          failureReason = reason;
+        },
+        close: () => new Promise((res, rej) => {
+          server.close((err) => err ? rej(err) : res());
+        })
+      });
+    });
+    server.on("error", reject);
+  });
+}
+
+// src/runtime/secrets-fetcher.ts
+init_http();
+var SecretsHttpError = class extends Error {
+  constructor(status, statusText) {
+    super(`Failed to fetch secrets: ${status} ${statusText}`);
+    this.status = status;
+    this.name = "SecretsHttpError";
+  }
+  status;
+};
+async function fetchSecrets(options) {
+  const { appUrl, token, projectId, flowId } = options;
+  const url = `${appUrl}/api/projects/${encodeURIComponent(projectId)}/flows/${encodeURIComponent(flowId)}/secrets/values`;
+  const res = await fetchWithRetry(url, {
+    maxTotalMs: 2e4,
+    init: {
+      headers: mergeAuthHeaders(token, { "Content-Type": "application/json" })
+    }
+  });
+  await throwIfRunnerAuthFailure(res);
+  if (!res.ok) {
+    throw new SecretsHttpError(res.status, res.statusText);
+  }
+  const json = await res.json();
+  return json.values;
+}
+
+// src/runtime/log-ring.ts
+var LogRing = class {
+  constructor(max) {
+    this.max = max;
+  }
+  max;
+  entries = [];
+  add(entry) {
+    this.entries.push(entry);
+    if (this.entries.length > this.max) this.entries.shift();
+  }
+  snapshot(limit = this.max) {
+    return this.entries.slice(Math.max(0, this.entries.length - limit));
+  }
+};
+var ErrorRing = class {
+  constructor(maxUnique, now = () => Date.now()) {
+    this.maxUnique = maxUnique;
+    this.now = now;
+  }
+  maxUnique;
+  now;
+  map = /* @__PURE__ */ new Map();
+  add(message) {
+    const ts = this.now();
+    const existing = this.map.get(message);
+    if (existing) {
+      existing.count += 1;
+      existing.lastSeen = ts;
+      return;
+    }
+    if (this.map.size >= this.maxUnique) {
+      let oldestKey;
+      let oldest = Infinity;
+      for (const [k3, v3] of this.map) {
+        if (v3.lastSeen < oldest) {
+          oldest = v3.lastSeen;
+          oldestKey = k3;
+        }
+      }
+      if (oldestKey !== void 0) this.map.delete(oldestKey);
+    }
+    this.map.set(message, { message, count: 1, firstSeen: ts, lastSeen: ts });
+  }
+  snapshot() {
+    return [...this.map.values()].sort((a4, b3) => b3.lastSeen - a4.lastSeen);
+  }
+};
+
+// src/commands/run/index.ts
+init_tmp();
+init_config_file();
+init_auth();
+init_cache();
+
+// src/commands/run/validators.ts
+init_asset_resolver();
+import { existsSync as existsSync4 } from "fs";
+
+// src/schemas/primitives.ts
+init_dev();
+var PortSchema = n3.number().int("Port must be an integer").min(1, "Port must be at least 1").max(65535, "Port must be at most 65535").describe("HTTP server port number");
+var FilePathSchema = n3.string().min(1, "File path cannot be empty").describe("Path to configuration file");
+
+// src/schemas/run.ts
+init_dev();
+var RunOptionsSchema = n3.object({
+  flow: FilePathSchema,
+  port: PortSchema.default(8080),
+  flowName: n3.string().optional().describe("Specific flow name to run")
+});
+
+// src/schemas/validate.ts
+init_dev();
+var ValidationTypeSchema = n3.enum(["contract", "event", "flow", "mapping"]).describe('Validation type: "event", "flow", "mapping", or "contract"');
+var ValidateOptionsSchema = n3.object({
+  flow: n3.string().optional().describe("Flow name for multi-flow configs"),
+  path: n3.string().optional().describe(
+    'Entry path for package schema validation (e.g., "destinations.snowplow", "sources.browser")'
+  )
+});
+var ValidateInputShape = {
+  type: ValidationTypeSchema,
+  input: n3.string().min(1).describe("JSON string, file path, or URL to validate"),
+  flow: n3.string().optional().describe("Flow name for multi-flow configs"),
+  path: n3.string().optional().describe(
+    'Entry path for package schema validation (e.g., "destinations.snowplow"). When provided, validates the entry against its package JSON Schema instead of using --type.'
+  )
+};
+var ValidateInputSchema = n3.object(ValidateInputShape);
+
+// src/schemas/bundle.ts
+init_dev();
+var BundleOptionsSchema = n3.object({
+  silent: n3.boolean().optional().describe("Suppress all output"),
+  verbose: n3.boolean().optional().describe("Enable verbose logging"),
+  stats: n3.boolean().optional().default(true).describe("Return bundle statistics"),
+  cache: n3.boolean().optional().default(true).describe("Enable package caching"),
+  flowName: n3.string().optional().describe("Flow name for multi-flow configs")
+});
+var BundleInputShape = {
+  configPath: FilePathSchema.describe(
+    "Path to flow configuration file (JSON or JavaScript), URL, or inline JSON string"
+  ),
+  flow: n3.string().optional().describe("Flow name for multi-flow configs"),
+  stats: n3.boolean().optional().default(true).describe("Return bundle statistics"),
+  output: n3.string().optional().describe("Output file path (defaults to config-defined)")
+};
+var BundleInputSchema = n3.object(BundleInputShape);
+
+// src/schemas/simulate.ts
+init_dev();
+var PlatformSchema = n3.enum(["web", "server"]).describe("Platform type for event processing");
+var SimulateOptionsSchema = n3.object({
+  silent: n3.boolean().optional().describe("Suppress all output"),
+  verbose: n3.boolean().optional().describe("Enable verbose logging"),
+  json: n3.boolean().optional().describe("Format output as JSON")
+});
+var SimulateInputShape = {
+  configPath: FilePathSchema.describe(
+    "Path to flow configuration file, URL, or inline JSON string"
+  ),
+  event: n3.string().min(1).optional().describe(
+    "Event as JSON string, file path, or URL. For sources: { content, trigger?, env? }."
+  ),
+  flow: n3.string().optional().describe("Flow name for multi-flow configs"),
+  platform: PlatformSchema.optional().describe("Override platform detection"),
+  step: n3.string().optional().describe(
+    'Step target in type.name format (e.g. "source.browser", "destination.gtag")'
+  )
+};
+var SimulateInputSchema = n3.object(SimulateInputShape);
+
+// src/schemas/push.ts
+init_dev();
+var PushOptionsSchema = n3.object({
+  silent: n3.boolean().optional().describe("Suppress all output"),
+  verbose: n3.boolean().optional().describe("Enable verbose logging"),
+  json: n3.boolean().optional().describe("Format output as JSON")
+});
+var PushInputShape = {
+  configPath: FilePathSchema.describe("Path to flow configuration file"),
+  event: n3.string().min(1).describe("Event as JSON string, file path, or URL"),
+  flow: n3.string().optional().describe("Flow name for multi-flow configs"),
+  platform: PlatformSchema.optional().describe("Override platform detection")
+};
+var PushInputSchema = n3.object(PushInputShape);
+
+// src/commands/run/validators.ts
+function validateFlowFile(filePath) {
+  const absolutePath = resolveAsset(filePath, "bundle");
+  if (!existsSync4(absolutePath)) {
+    throw new Error(
+      `Flow file not found: ${filePath}
+   Resolved path: ${absolutePath}
+   Make sure the file exists and the path is correct`
+    );
+  }
+  return absolutePath;
+}
+function validatePort(port) {
+  const result = PortSchema.safeParse(port);
+  if (!result.success) {
+    throw new Error(
+      `Invalid port: ${port}
+   Port must be an integer between 1 and 65535
+   Example: --port 8080`
+    );
+  }
+}
+
+// src/commands/run/index.ts
+init_utils3();
+
+// src/commands/run/pipeline.ts
+init_dist();
+init_tmp();
+import { writeFileSync as writeFileSync4 } from "fs";
+import fs17 from "fs-extra";
+
 // src/runtime/trace-poller.ts
 init_dist();
 init_http();
@@ -9469,42 +9855,26 @@ function createTracePoller(config, logger) {
 }
 var defaultFetch = (url, init) => fetch(url, init);
 
-// src/runtime/secrets-fetcher.ts
-init_http();
-var SecretsHttpError = class extends Error {
-  constructor(status, statusText) {
-    super(`Failed to fetch secrets: ${status} ${statusText}`);
-    this.status = status;
-    this.name = "SecretsHttpError";
-  }
-  status;
-};
-async function fetchSecrets(options) {
-  const { appUrl, token, projectId, flowId } = options;
-  const url = `${appUrl}/api/projects/${encodeURIComponent(projectId)}/flows/${encodeURIComponent(flowId)}/secrets/values`;
-  const res = await fetch(url, {
-    headers: mergeAuthHeaders(token, { "Content-Type": "application/json" })
-  });
-  await throwIfRunnerAuthFailure(res);
-  if (!res.ok) {
-    throw new SecretsHttpError(res.status, res.statusText);
-  }
-  const json = await res.json();
-  return json.values;
-}
-
 // src/commands/run/pipeline.ts
 init_cache();
 async function runPipeline(options) {
   const { bundlePath, port, logger, loggerConfig, api } = options;
   let configVersion;
+  const configFrozen = readConfigFrozen();
   if (api) {
     await injectSecrets(api, logger);
   }
   logger.info(`walkeros/flow v${VERSION}`);
   logger.info(`Instance: ${getInstanceId()}`);
+  if (configFrozen) {
+    logger.info("Config frozen: hot-swap and heartbeat disabled");
+  }
   const healthServer = await createHealthServer(port, logger);
-  const telemetryObservers = buildTelemetryObservers(api?.flowId ?? "flow");
+  const observeLevel = readObserveLevel(logger);
+  const telemetryObservers = buildTelemetryObservers(
+    api?.flowId ?? "flow",
+    observeLevel
+  );
   const runtimeConfig = { port };
   let handle;
   try {
@@ -9533,20 +9903,24 @@ async function runPipeline(options) {
   const ingestToken = process.env.WALKEROS_INGEST_TOKEN;
   const deploymentId = process.env.WALKEROS_DEPLOYMENT_ID;
   if (observerBase && ingestToken && deploymentId) {
-    tracePoller = createTracePoller(
-      {
-        url: `${observerBase}/trace/${deploymentId}`,
-        token: ingestToken,
-        intervalMs: 15e3
-      },
-      logger
-    );
-    tracePoller.start();
-    logger.info("Trace poller: active (every 15s)");
+    if (observeLevel === "trace") {
+      logger.info("Trace poller: skipped (observe level is trace)");
+    } else {
+      tracePoller = createTracePoller(
+        {
+          url: `${observerBase}/trace/${deploymentId}`,
+          token: ingestToken,
+          intervalMs: 15e3
+        },
+        logger
+      );
+      tracePoller.start();
+      logger.info("Trace poller: active (every 15s)");
+    }
   }
   let currentBundleCleanup;
   let currentConfigPath;
-  if (api) {
+  if (api && !configFrozen) {
     heartbeat = createHeartbeat(
       {
         appUrl: api.appUrl,
@@ -9556,7 +9930,9 @@ async function runPipeline(options) {
         deploymentId: api.deploymentId,
         configVersion,
         intervalMs: api.heartbeatIntervalMs,
-        getCounters: () => handle.collector.status
+        getCounters: () => handle.collector.status,
+        getErrors: () => options.errorRing?.snapshot() ?? [],
+        getLogs: () => options.logRing?.snapshot() ?? []
       },
       logger
     );
@@ -9663,17 +10039,39 @@ async function runPipeline(options) {
   await new Promise(() => {
   });
 }
-function buildTelemetryObservers(flowId) {
+var OBSERVE_LEVELS = [
+  "off",
+  "standard",
+  "trace"
+];
+function readConfigFrozen() {
+  const raw = process.env.WALKEROS_CONFIG_FROZEN;
+  return raw === "1" || raw === "true";
+}
+function readObserveLevel(logger) {
+  const raw = process.env.WALKEROS_OBSERVE_LEVEL;
+  if (raw === void 0 || raw === "") return void 0;
+  const level = OBSERVE_LEVELS.find((candidate) => candidate === raw);
+  if (!level) {
+    logger.warn(
+      `Ignoring invalid WALKEROS_OBSERVE_LEVEL "${raw}" (expected off, standard, or trace)`
+    );
+    return void 0;
+  }
+  return level;
+}
+function buildTelemetryObservers(flowId, observeLevel) {
   const base = process.env.WALKEROS_OBSERVER_URL;
   const token = process.env.WALKEROS_INGEST_TOKEN;
   const deploymentId = process.env.WALKEROS_DEPLOYMENT_ID;
   if (!base || !token || !deploymentId) return void 0;
   const url = `${base}/ingest/${deploymentId}`;
   const emit = ht({ url, token });
+  const observe = observeLevel !== void 0 ? { level: observeLevel } : void 0;
   return [
     ft(
       emit,
-      () => pt({ flowId, traceUntil: mt() })
+      () => pt({ flowId, observe, traceUntil: mt() })
     )
   ];
 }
@@ -9716,7 +10114,21 @@ async function lazyPrepareBundleForRun(configPath, options) {
 async function runCommand(options) {
   const timer = createTimer();
   timer.start();
-  const logger = createCLILogger(options);
+  const errorRing = new ErrorRing(20);
+  const logRing = new LogRing(100);
+  const LEVEL_NAME = {
+    [l.ERROR]: "error",
+    [l.WARN]: "warn",
+    [l.INFO]: "info",
+    [l.DEBUG]: "debug"
+  };
+  const logger = createCLILogger({
+    ...options,
+    onLine: (level, message) => {
+      if (level === l.ERROR) errorRing.add(message);
+      logRing.add({ time: Date.now(), level: LEVEL_NAME[level], message });
+    }
+  });
   try {
     if (options.envFile) {
       const { loadEnvFile: loadEnvFile2 } = await Promise.resolve().then(() => (init_env_file(), env_file_exports));
@@ -9786,7 +10198,9 @@ async function runCommand(options) {
       port,
       logger: logger.scope("runner"),
       loggerConfig: options.verbose ? { level: 0 } : void 0,
-      api: apiConfig
+      api: apiConfig,
+      errorRing,
+      logRing
     });
   } catch (error) {
     const duration = timer.getElapsed() / 1e3;
@@ -11940,7 +12354,7 @@ function validateMapping(input) {
 // src/commands/validate/validators/entry.ts
 init_dist();
 import Ajv from "ajv";
-var CLIENT_HEADER = "walkeros-cli/4.2.0";
+var CLIENT_HEADER = "walkeros-cli/4.2.1-next-1781538735002";
 var SECTIONS = ["destinations", "sources", "transformers"];
 function resolveEntry(path19, flowConfig) {
   const flows = flowConfig.flows;
@@ -12575,6 +12989,7 @@ init_sse();
 init_cli_logger();
 init_output();
 init_flows();
+import { randomUUID as randomUUID2 } from "crypto";
 async function resolveSettingsId(options) {
   const flow = await getFlow({
     flowId: options.flowId,
@@ -12600,8 +13015,9 @@ async function getAvailableFlowNames(options) {
   const settings = flow.settings;
   return settings?.map((c2) => c2.name) ?? [];
 }
+var DEFAULT_DEPLOY_WAIT_MS = 12 * 60 * 1e3;
 async function streamDeploymentStatus(projectId, deploymentId, options) {
-  const timeoutMs = options.timeout ?? 12e4;
+  const timeoutMs = options.timeout ?? DEFAULT_DEPLOY_WAIT_MS;
   const response = await apiFetch(
     `/api/projects/${projectId}/deployments/${deploymentId}/stream`,
     {
@@ -12660,7 +13076,10 @@ async function deploy(options) {
   }
   const { data, error } = await client.POST(
     "/api/projects/{projectId}/flows/{flowId}/deploy",
-    { params: { path: { projectId, flowId: options.flowId } } }
+    {
+      params: { path: { projectId, flowId: options.flowId } },
+      headers: { "Idempotency-Key": randomUUID2() }
+    }
   );
   if (error) {
     try {
@@ -12690,13 +13109,38 @@ Available: ${names.join(", ")}`,
 }
 async function deploySettings(options) {
   const { flowId, projectId, settingsId } = options;
-  const response = await apiFetch(
+  const triggerDeploy = () => apiFetch(
     `/api/projects/${projectId}/flows/${flowId}/settings/${settingsId}/deploy`,
-    { method: "POST" }
+    { method: "POST", headers: { "Idempotency-Key": randomUUID2() } }
   );
+  let response = await triggerDeploy();
+  if (!response.ok && options.wait) {
+    let retryBody = {};
+    try {
+      retryBody = await response.clone().json();
+    } catch {
+      retryBody = {};
+    }
+    try {
+      throwApiResponseError(
+        response,
+        retryBody,
+        `Deploy failed (${response.status})`
+      );
+    } catch (e4) {
+      if (e4 instanceof ApiError && e4.retryable) {
+        const waitSeconds = Math.min(e4.retryAfterSeconds ?? 5, 60);
+        options.onStatus?.("rate_limited", `retrying in ${waitSeconds}s`);
+        await new Promise((resolve4) => setTimeout(resolve4, waitSeconds * 1e3));
+        response = await triggerDeploy();
+      } else {
+        throw e4;
+      }
+    }
+  }
   if (!response.ok) {
     const body = await response.json().catch(() => ({}));
-    throwApiError(body, `Deploy failed (${response.status})`);
+    throwApiResponseError(response, body, `Deploy failed (${response.status})`);
   }
   const data = await response.json();
   if (!options.wait) return data;
@@ -12708,16 +13152,20 @@ async function deploySettings(options) {
   return { ...data, ...result };
 }
 var statusLabels = {
-  bundling: "Building bundle...",
-  "bundling:building": "Building bundle...",
-  "bundling:publishing": "Publishing to web...",
-  deploying: "Deploying container...",
+  "deploying:building": "Building bundle...",
+  "deploying:publishing": "Publishing to web...",
   "deploying:provisioning": "Provisioning container...",
   "deploying:starting": "Starting container...",
+  deploying: "Deploying...",
   active: "Container is live",
   published: "Published",
+  stopped: "Stopped",
   failed: "Deployment failed"
 };
+function renderStatusLabel(status, substatus) {
+  const key = substatus ? `${status}:${substatus}` : status;
+  return statusLabels[key] || statusLabels[status] || `Status: ${status}`;
+}
 async function deployCommand(flowId, options) {
   const log = createCLILogger(options);
   const timeoutMs = options.timeout ? parseInt(options.timeout, 10) * 1e3 : void 0;
@@ -12729,10 +13177,7 @@ async function deployCommand(flowId, options) {
       wait: options.wait !== false,
       timeout: timeoutMs,
       onStatus: options.json ? void 0 : (status, substatus) => {
-        const key = substatus ? `${status}:${substatus}` : status;
-        log.info(
-          statusLabels[key] || statusLabels[status] || `Status: ${status}`
-        );
+        log.info(renderStatusLabel(status, substatus));
       }
     });
     if (options.json) {
@@ -12747,7 +13192,7 @@ async function deployCommand(flowId, options) {
     } else if (r5.status === "failed") {
       log.error(`Failed: ${r5.errorMessage || "Unknown error"}`);
       process.exit(1);
-    } else if (r5.status === "bundling") {
+    } else if (r5.status === "deploying") {
       log.info(`Deployment started: ${r5.deploymentId} (${r5.type})`);
     } else {
       log.info(`Status: ${r5.status}`);
@@ -12902,20 +13347,16 @@ async function createDeployCommand(config, options) {
     log.info(`Deployment created: ${result.id}`);
     log.info(`  Slug:  ${result.slug}`);
     log.info(`  Type:  ${result.type}`);
-    if (result.deployToken) {
-      log.info(`  Token: ${result.deployToken}`);
-      log.warn("  Save this token \u2014 it will not be shown again.");
-    }
     log.info("");
     log.info("Run locally:");
     log.info(
       `  walkeros run ${isRemoteFlow ? "flow.json" : config} --deploy ${result.id}`
     );
     log.info("");
-    log.info("Docker:");
-    log.info(
-      `  docker run -e WALKEROS_DEPLOY_TOKEN=${result.deployToken ?? "<token>"} \\`
-    );
+    log.info("Create a deploy token for this flow in the app");
+    log.info("(Settings, Self-hosted deploy token) and set it as");
+    log.info("WALKEROS_DEPLOY_TOKEN, then run with Docker:");
+    log.info("  docker run -e WALKEROS_DEPLOY_TOKEN \\");
     log.info("             -e WALKEROS_APP_URL=https://app.walkeros.io \\");
     log.info("             walkeros/flow:latest");
   } catch (err) {
@@ -13231,7 +13672,7 @@ deployCmd.command("create [config]").description(
 });
 deployCmd.command("start <flowId>").description("Deploy a flow to walkerOS cloud (auto-detects web or server)").option("--project <id>", "project ID (defaults to WALKEROS_PROJECT_ID)").option("-f, --flow <name>", "flow name for multi-config flows").option("--no-wait", "do not wait for deployment to complete").option(
   "--timeout <seconds>",
-  "timeout for deployment polling (default: 120)"
+  "timeout in seconds for deployment polling (default: 720, the 12-minute server deploy budget)"
 ).option("-o, --output <path>", "output file path").option("--json", "output as JSON").option("-v, --verbose", "verbose output").option("-s, --silent", "suppress output").action(async (flowId, options) => {
   await deployCommand(flowId, options);
 });