@walkeros/cli 4.2.0 → 4.2.1-next-1781538735002

package/dist/index.js

@@ -25,6 +25,10 @@ function createCLILogger(options = {}) {
     handler: (level, message, _context, scope) => {
       const scopePath = scope.length > 0 ? `[${scope.join(":")}] ` : "";
       const fullMessage = `${scopePath}${message}`;
+      try {
+        options.onLine?.(level, fullMessage);
+      } catch {
+      }
       if (level === Level.ERROR) {
         if (!json) console.error(chalk.red(fullMessage));
         return;
@@ -2755,6 +2759,9 @@ ${firstError.text}`
 ` + (location ? `  at ${location.file}:${location.line}:${location.column}` : "")
   );
 }
+function buildDataPayload(flowSettings) {
+  return buildSplitConfigObject(flowSettings, detectNamedImports(flowSettings)).dataPayloadObj;
+}
 function buildSplitConfigObject(flowSettings, namedImports) {
   const sources = flowSettings.sources || {};
   const destinations = flowSettings.destinations || {};
@@ -2777,7 +2784,7 @@ function buildSplitConfigObject(flowSettings, namedImports) {
     }
     return props;
   }
-  function buildSplitStepEntry(section, stepId, step) {
+  function buildSplitStepEntry(section, stepId2, step) {
     const codeVar = resolveCodeVar(step);
     const stepProps = getStepProps(step);
     const { codeProps, dataProps } = classifyStepProperties(stepProps);
@@ -2788,13 +2795,13 @@ function buildSplitConfigObject(flowSettings, namedImports) {
       codeEntries.push(`${key}: ${processConfigValue(value)}`);
     }
     for (const key of Object.keys(dataProps)) {
-      codeEntries.push(`${key}: __data.${section}.${stepId}.${key}`);
+      codeEntries.push(`${key}: __data.${section}.${stepId2}.${key}`);
     }
     if (Object.keys(dataProps).length > 0) {
       if (!dataPayloadObj[section]) dataPayloadObj[section] = {};
-      dataPayloadObj[section][stepId] = dataProps;
+      dataPayloadObj[section][stepId2] = dataProps;
     }
-    return `    ${stepId}: {
+    return `    ${stepId2}: {
       ${codeEntries.join(",\n      ")}
     }`;
   }
@@ -2904,7 +2911,7 @@ ${destinationsEntries.join(",\n")}
   stores${collectorStr}
 }`;
   const dataPayload = JSON.stringify(dataPayloadObj, null, 2);
-  return { storesDeclaration, codeConfigObject, dataPayload };
+  return { storesDeclaration, codeConfigObject, dataPayloadObj, dataPayload };
 }
 function generateSplitWireConfigModule(storesDeclaration, codeConfigObject, userCode) {
   const codeSection = userCode ? `
@@ -3848,7 +3855,8 @@ import {
   createIngest,
   getPlatform as getPlatform3,
   getNextSteps,
-  buildCacheContext
+  buildCacheContext,
+  stepId
 } from "@walkeros/core";
 import {
   enrichEvent,
@@ -4052,13 +4060,13 @@ function installTimerInterception(options = {}) {
       setInterval: Reflect.get(target, "setInterval"),
       clearInterval: Reflect.get(target, "clearInterval")
     });
-    const trackedSetTimeout = (callback, delay, ...args) => {
+    const trackedSetTimeout = (callback, delay2, ...args) => {
       if (typeof callback !== "function") return 0;
       const id = nextId++;
       pending.set(id, {
         id,
         callback,
-        delay: delay ?? 0,
+        delay: delay2 ?? 0,
         type: "timeout",
         args,
         cleared: false
@@ -4071,13 +4079,13 @@ function installTimerInterception(options = {}) {
       const entry = pending.get(numId);
       if (entry) entry.cleared = true;
     };
-    const trackedSetInterval = (callback, delay, ...args) => {
+    const trackedSetInterval = (callback, delay2, ...args) => {
       if (typeof callback !== "function") return 0;
       const id = nextId++;
       pending.set(id, {
         id,
         callback,
-        delay: delay ?? 0,
+        delay: delay2 ?? 0,
         type: "interval",
         args,
         cleared: false
@@ -4354,7 +4362,7 @@ function toError(error) {
   return error instanceof Error ? error : new Error(getErrorMessage(error));
 }
 function buildSimulationResult(args) {
-  const { step, name, startTime, captured, usage, error } = args;
+  const { step, name, startTime, captured, usage, mappingKey, error } = args;
   const events = (captured ?? []).filter(hasEvent).map((entry) => entry.event);
   const calls = usage ? Object.values(usage).flat().map((call) => ({ fn: call.fn, args: call.args, ts: call.ts })) : [];
   return {
@@ -4363,6 +4371,7 @@ function buildSimulationResult(args) {
     events,
     calls,
     duration: Date.now() - startTime,
+    ...mappingKey !== void 0 ? { mappingKey } : {},
     ...error !== void 0 ? { error: toError(error) } : {}
   };
 }
@@ -4956,7 +4965,9 @@ async function simulateSource(configOrPath, input, options) {
             `Source package "${sourceConfig.package}" has no createTrigger in /dev export`
           );
         }
-        const flowConfig = module.wireConfig(module.__configData ?? void 0);
+        const flowConfig = module.wireConfig(
+          options.data ?? module.__configData ?? void 0
+        );
         applyOverrides(flowConfig, prepared.overrides);
         const captured = [];
         flowConfig.hooks = {
@@ -5061,7 +5072,9 @@ async function simulateTransformer(configOrPath, event, options) {
         networkCalls
       },
       async (module) => {
-        const flowConfig = module.wireConfig(module.__configData ?? void 0);
+        const flowConfig = module.wireConfig(
+          options.data ?? module.__configData ?? void 0
+        );
         applyOverrides(flowConfig, prepared.overrides);
         if (flowConfig.sources) flowConfig.sources = {};
         if (flowConfig.destinations) flowConfig.destinations = {};
@@ -5227,7 +5240,9 @@ async function simulateCollector(configOrPath, event, options) {
         networkCalls
       },
       async (module) => {
-        const flowConfig = module.wireConfig(module.__configData ?? void 0);
+        const flowConfig = module.wireConfig(
+          options.data ?? module.__configData ?? void 0
+        );
         applyOverrides(flowConfig, prepared.overrides);
         if (flowConfig.sources) flowConfig.sources = {};
         if (flowConfig.destinations) flowConfig.destinations = {};
@@ -5330,7 +5345,9 @@ async function simulateDestination(configOrPath, event, options) {
         networkCalls
       },
       async (module) => {
-        const flowConfig = module.wireConfig(module.__configData ?? void 0);
+        const flowConfig = module.wireConfig(
+          options.data ?? module.__configData ?? void 0
+        );
         applyOverrides(flowConfig, prepared.overrides);
         const destPkg = (prepared.flowSettings.destinations ?? {})[options.destinationId];
         let trackedCalls = [];
@@ -5366,6 +5383,16 @@ async function simulateDestination(configOrPath, event, options) {
           );
         }
         logger.info(`Simulating destination: ${options.destinationId}`);
+        let mappingKey;
+        const targetStepId = stepId("destination", options.destinationId);
+        const captureMappingKey = (state) => {
+          if (state.stepId === targetStepId && state.mappingKey) {
+            mappingKey = state.mappingKey;
+          }
+        };
+        if (collector.observers instanceof Set) {
+          collector.observers.add(captureMappingKey);
+        }
         await collector.push(event, {
           include: [options.destinationId]
         });
@@ -5374,7 +5401,8 @@ async function simulateDestination(configOrPath, event, options) {
           step: "destination",
           name: options.destinationId,
           startTime,
-          usage: trackedCalls.length ? { [options.destinationId]: trackedCalls } : void 0
+          usage: trackedCalls.length ? { [options.destinationId]: trackedCalls } : void 0,
+          mappingKey
         });
       },
       (error) => buildSimulationResult({
@@ -5399,13 +5427,88 @@ async function simulateDestination(configOrPath, event, options) {
 // src/commands/run/index.ts
 init_cli_logger();
 init_core();
-init_tmp();
-init_config_file();
-init_auth();
 import path18 from "path";
 import { writeFileSync as writeFileSync5 } from "fs";
 import { homedir as homedir2 } from "os";
 import { join as join7 } from "path";
+import { Level as Level2 } from "@walkeros/core";
+
+// src/runtime/runner.ts
+import { resolve as resolve3, dirname as dirname3 } from "path";
+
+// src/runtime/load-bundle.ts
+import { resolve as resolve2 } from "path";
+import { pathToFileURL as pathToFileURL2 } from "url";
+async function loadBundle(file, context2, logger) {
+  const absolutePath = resolve2(file);
+  const fileUrl = pathToFileURL2(absolutePath).href;
+  logger?.debug?.(`Importing bundle: ${absolutePath}`);
+  const module = await import(`${fileUrl}?t=${Date.now()}`);
+  if (!module.default || typeof module.default !== "function") {
+    throw new Error(
+      `Invalid bundle: ${file} must export a default factory function`
+    );
+  }
+  logger?.debug?.("Calling factory function...");
+  const result = await module.default(context2 ?? {});
+  if (!result || !result.collector || typeof result.collector.push !== "function") {
+    throw new Error(
+      `Invalid bundle: factory must return { collector } with a push function`
+    );
+  }
+  return {
+    collector: result.collector,
+    ...typeof result.httpHandler === "function" ? { httpHandler: result.httpHandler } : {}
+  };
+}
+
+// src/runtime/runner.ts
+async function loadFlow(file, config, logger, loggerConfig, healthServer, observers) {
+  const absolutePath = resolve3(file);
+  const flowDir = dirname3(absolutePath);
+  process.chdir(flowDir);
+  const flowContext = {
+    ...config,
+    ...loggerConfig ? { logger: loggerConfig } : {},
+    ...healthServer ? { sourceSettings: { port: void 0 } } : {},
+    ...observers ? { observers } : {}
+  };
+  const result = await loadBundle(absolutePath, flowContext, logger);
+  if (healthServer && typeof result.httpHandler === "function") {
+    healthServer.setFlowHandler(result.httpHandler);
+  }
+  return {
+    collector: {
+      command: result.collector.command,
+      status: result.collector.status
+    },
+    file,
+    httpHandler: result.httpHandler
+  };
+}
+async function swapFlow(currentHandle, newFile, config, logger, loggerConfig, healthServer, observers) {
+  logger.info("Shutting down current flow for hot-swap...");
+  if (healthServer) {
+    healthServer.setFlowHandler(null);
+  }
+  try {
+    if (currentHandle.collector.command) {
+      await currentHandle.collector.command("shutdown");
+    }
+  } catch (error) {
+    logger.debug(`Shutdown warning: ${error}`);
+  }
+  const newHandle = await loadFlow(
+    newFile,
+    config,
+    logger,
+    loggerConfig,
+    healthServer,
+    observers
+  );
+  logger.info("Flow swapped successfully");
+  return newHandle;
+}
 
 // src/runtime/resolve-bundle.ts
 init_stdin();
@@ -5416,11 +5519,127 @@ import {
   rmSync,
   writeFileSync as writeFileSync2
 } from "fs";
-import { dirname as dirname3, join as join4 } from "path";
+import { dirname as dirname4, join as join4 } from "path";
 import { Readable } from "stream";
 import { x as tarExtract } from "tar";
+
+// src/runtime/fetch-retry.ts
+var DEFAULT_PER_ATTEMPT_TIMEOUT_MS = 3e4;
+var DEFAULT_MAX_TOTAL_MS = 6e4;
+var DEFAULT_ATTEMPTS = 3;
+var MIN_ATTEMPT_BUDGET_MS = 1e3;
+var BASE_BACKOFF_MS = [2e3, 5e3];
+var JITTER = 0.2;
+var RETRYABLE_NETWORK_CODES = /* @__PURE__ */ new Set([
+  "ECONNRESET",
+  "ECONNREFUSED",
+  "ETIMEDOUT",
+  "EAI_AGAIN",
+  "ENOTFOUND"
+]);
+function readErrorCode(value) {
+  if (typeof value !== "object" || value === null) return void 0;
+  const code = Reflect.get(value, "code");
+  return typeof code === "string" ? code : void 0;
+}
+function readErrorName(value) {
+  if (typeof value !== "object" || value === null) return void 0;
+  const name = Reflect.get(value, "name");
+  return typeof name === "string" ? name : void 0;
+}
+function isTransientThrow(error) {
+  const name = readErrorName(error);
+  if (name === "TimeoutError" || name === "AbortError") return true;
+  const directCode = readErrorCode(error);
+  if (directCode && RETRYABLE_NETWORK_CODES.has(directCode)) return true;
+  if (typeof error === "object" && error !== null) {
+    const causeCode = readErrorCode(Reflect.get(error, "cause"));
+    if (causeCode && RETRYABLE_NETWORK_CODES.has(causeCode)) return true;
+  }
+  return error instanceof TypeError;
+}
+function isTransientStatus(status) {
+  return status >= 500 || status === 429;
+}
+function readErrorMessage(value) {
+  if (typeof value !== "object" || value === null) return void 0;
+  const message = Reflect.get(value, "message");
+  return typeof message === "string" ? message : void 0;
+}
+function describeReason(reason) {
+  if (reason.kind === "status") return `HTTP ${reason.status}`;
+  const name = readErrorName(reason.error);
+  const message = reason.error instanceof Error ? reason.error.message : String(reason.error);
+  let detail = name ? `${name}: ${message}` : message;
+  if (typeof reason.error === "object" && reason.error !== null) {
+    const cause = Reflect.get(reason.error, "cause");
+    const causeCode = readErrorCode(cause);
+    const causeMessage = readErrorMessage(cause);
+    const causeDetail = causeCode ?? causeMessage;
+    if (causeDetail) detail = `${detail} (${causeDetail})`;
+  }
+  return detail;
+}
+function backoffForAttempt(index) {
+  const base = BASE_BACKOFF_MS[Math.min(index, BASE_BACKOFF_MS.length - 1)] ?? 0;
+  const spread = base * JITTER;
+  return base + (Math.random() * 2 - 1) * spread;
+}
+function delay(ms) {
+  return new Promise((resolve5) => {
+    setTimeout(resolve5, ms);
+  });
+}
+async function fetchWithRetry(url, options = {}) {
+  const attempts = options.attempts ?? DEFAULT_ATTEMPTS;
+  const perAttemptTimeoutMs = options.perAttemptTimeoutMs ?? DEFAULT_PER_ATTEMPT_TIMEOUT_MS;
+  const maxTotalMs = options.maxTotalMs ?? DEFAULT_MAX_TOTAL_MS;
+  const init = options.init;
+  const start = Date.now();
+  let lastReason;
+  let made = 0;
+  for (let attempt = 0; attempt < attempts; attempt++) {
+    const remaining = maxTotalMs - (Date.now() - start);
+    if (remaining <= MIN_ATTEMPT_BUDGET_MS) break;
+    const attemptTimeoutMs = Math.min(perAttemptTimeoutMs, remaining);
+    made = attempt + 1;
+    let reason;
+    try {
+      const controller = new AbortController();
+      const timeoutId = setTimeout(() => controller.abort(), attemptTimeoutMs);
+      let response;
+      try {
+        response = await fetch(url, {
+          ...init,
+          signal: controller.signal
+        });
+      } finally {
+        clearTimeout(timeoutId);
+      }
+      if (!isTransientStatus(response.status)) return response;
+      await response.body?.cancel();
+      reason = { kind: "status", status: response.status };
+    } catch (error) {
+      if (!isTransientThrow(error)) throw error;
+      reason = { kind: "throw", error };
+    }
+    lastReason = reason;
+    const isLastAttempt = attempt === attempts - 1;
+    const budgetSpent = Date.now() - start >= maxTotalMs;
+    if (isLastAttempt || budgetSpent) break;
+    const sleepMs = Math.min(
+      backoffForAttempt(attempt),
+      maxTotalMs - (Date.now() - start)
+    );
+    if (sleepMs <= 0) break;
+    await delay(sleepMs);
+  }
+  const cause = lastReason ? describeReason(lastReason) : "no attempts made";
+  throw new Error(`Fetch failed after ${made} attempts: ${cause}`);
+}
+
+// src/runtime/resolve-bundle.ts
 var ARCHIVE_ENTRY = "flow.mjs";
-var FETCH_TIMEOUT_MS = 3e4;
 function getDefaultWritePath() {
   if (existsSync2("/app/flow")) return "/app/flow/flow.mjs";
   return "/tmp/walkeros-flow.mjs";
@@ -5438,16 +5657,14 @@ function isArchive(value, contentType) {
   return false;
 }
 function writeBundleToDisk(writePath, content) {
-  const dir = dirname3(writePath);
+  const dir = dirname4(writePath);
   if (!existsSync2(dir)) {
     mkdirSync2(dir, { recursive: true });
   }
   writeFileSync2(writePath, content, "utf-8");
 }
 async function fetchOk(url) {
-  const response = await fetch(url, {
-    signal: AbortSignal.timeout(FETCH_TIMEOUT_MS)
-  });
+  const response = await fetchWithRetry(url);
   if (!response.ok) {
     throw new Error(
       `Failed to fetch bundle from ${url}: ${response.status} ${response.statusText}`
@@ -5499,7 +5716,7 @@ async function readBundleFromStdin(writePath) {
 }
 async function resolveBundle(bundleEnv) {
   const writePath = getDefaultWritePath();
-  const archiveDestDir = dirname3(writePath);
+  const archiveDestDir = dirname4(writePath);
   if (!isUrl2(bundleEnv) && existsSync2(bundleEnv)) {
     if (isArchive(bundleEnv)) {
       const path20 = await extractToDir(
@@ -5568,10 +5785,7 @@ async function fetchConfig(options) {
     options.token,
     options.lastEtag ? { "If-None-Match": options.lastEtag } : void 0
   );
-  const response = await fetch(url, {
-    headers,
-    signal: AbortSignal.timeout(3e4)
-  });
+  const response = await fetchWithRetry(url, { init: { headers } });
   if (response.status === 304) {
     return { changed: false };
   }
@@ -5592,301 +5806,151 @@ async function fetchConfig(options) {
   };
 }
 
-// src/commands/run/index.ts
+// src/runtime/index.ts
 init_cache();
 
-// src/commands/run/validators.ts
-init_asset_resolver();
-import { existsSync as existsSync4 } from "fs";
-
-// src/schemas/primitives.ts
-import { z } from "@walkeros/core/dev";
-var PortSchema = z.number().int("Port must be an integer").min(1, "Port must be at least 1").max(65535, "Port must be at most 65535").describe("HTTP server port number");
-var FilePathSchema = z.string().min(1, "File path cannot be empty").describe("Path to configuration file");
-
-// src/schemas/run.ts
-import { z as z2 } from "@walkeros/core/dev";
-var RunOptionsSchema = z2.object({
-  flow: FilePathSchema,
-  port: PortSchema.default(8080),
-  flowName: z2.string().optional().describe("Specific flow name to run")
-});
-
-// src/schemas/validate.ts
-import { z as z3 } from "@walkeros/core/dev";
-var ValidationTypeSchema = z3.enum(["contract", "event", "flow", "mapping"]).describe('Validation type: "event", "flow", "mapping", or "contract"');
-var ValidateOptionsSchema = z3.object({
-  flow: z3.string().optional().describe("Flow name for multi-flow configs"),
-  path: z3.string().optional().describe(
-    'Entry path for package schema validation (e.g., "destinations.snowplow", "sources.browser")'
-  )
-});
-var ValidateInputShape = {
-  type: ValidationTypeSchema,
-  input: z3.string().min(1).describe("JSON string, file path, or URL to validate"),
-  flow: z3.string().optional().describe("Flow name for multi-flow configs"),
-  path: z3.string().optional().describe(
-    'Entry path for package schema validation (e.g., "destinations.snowplow"). When provided, validates the entry against its package JSON Schema instead of using --type.'
-  )
-};
-var ValidateInputSchema = z3.object(ValidateInputShape);
-
-// src/schemas/bundle.ts
-import { z as z4 } from "@walkeros/core/dev";
-var BundleOptionsSchema = z4.object({
-  silent: z4.boolean().optional().describe("Suppress all output"),
-  verbose: z4.boolean().optional().describe("Enable verbose logging"),
-  stats: z4.boolean().optional().default(true).describe("Return bundle statistics"),
-  cache: z4.boolean().optional().default(true).describe("Enable package caching"),
-  flowName: z4.string().optional().describe("Flow name for multi-flow configs")
-});
-var BundleInputShape = {
-  configPath: FilePathSchema.describe(
-    "Path to flow configuration file (JSON or JavaScript), URL, or inline JSON string"
-  ),
-  flow: z4.string().optional().describe("Flow name for multi-flow configs"),
-  stats: z4.boolean().optional().default(true).describe("Return bundle statistics"),
-  output: z4.string().optional().describe("Output file path (defaults to config-defined)")
-};
-var BundleInputSchema = z4.object(BundleInputShape);
+// src/runtime/heartbeat.ts
+import { randomBytes } from "crypto";
 
-// src/schemas/simulate.ts
-import { z as z5 } from "@walkeros/core/dev";
-var PlatformSchema = z5.enum(["web", "server"]).describe("Platform type for event processing");
-var SimulateOptionsSchema = z5.object({
-  silent: z5.boolean().optional().describe("Suppress all output"),
-  verbose: z5.boolean().optional().describe("Enable verbose logging"),
-  json: z5.boolean().optional().describe("Format output as JSON")
-});
-var SimulateInputShape = {
-  configPath: FilePathSchema.describe(
-    "Path to flow configuration file, URL, or inline JSON string"
-  ),
-  event: z5.string().min(1).optional().describe(
-    "Event as JSON string, file path, or URL. For sources: { content, trigger?, env? }."
-  ),
-  flow: z5.string().optional().describe("Flow name for multi-flow configs"),
-  platform: PlatformSchema.optional().describe("Override platform detection"),
-  step: z5.string().optional().describe(
-    'Step target in type.name format (e.g. "source.browser", "destination.gtag")'
-  )
-};
-var SimulateInputSchema = z5.object(SimulateInputShape);
+// src/version.ts
+import { readFileSync as readFileSync3 } from "fs";
+import { fileURLToPath } from "url";
+import { dirname as dirname5, join as join6 } from "path";
+var versionFilename = fileURLToPath(import.meta.url);
+var versionDirname = dirname5(versionFilename);
+function findPackageJson() {
+  const paths = [
+    join6(versionDirname, "../package.json"),
+    // dist/ or src/
+    join6(versionDirname, "../../package.json")
+    // src/core/ (not used, but safe)
+  ];
+  for (const p of paths) {
+    try {
+      return readFileSync3(p, "utf-8");
+    } catch {
+    }
+  }
+  return JSON.stringify({ version: "0.0.0" });
+}
+var VERSION = JSON.parse(findPackageJson()).version;
 
-// src/schemas/push.ts
-import { z as z6 } from "@walkeros/core/dev";
-var PushOptionsSchema = z6.object({
-  silent: z6.boolean().optional().describe("Suppress all output"),
-  verbose: z6.boolean().optional().describe("Enable verbose logging"),
-  json: z6.boolean().optional().describe("Format output as JSON")
-});
-var PushInputShape = {
-  configPath: FilePathSchema.describe("Path to flow configuration file"),
-  event: z6.string().min(1).describe("Event as JSON string, file path, or URL"),
-  flow: z6.string().optional().describe("Flow name for multi-flow configs"),
-  platform: PlatformSchema.optional().describe("Override platform detection")
-};
-var PushInputSchema = z6.object(PushInputShape);
+// src/runtime/heartbeat.ts
+init_http();
 
-// src/commands/run/validators.ts
-function validateFlowFile(filePath) {
-  const absolutePath = resolveAsset(filePath, "bundle");
-  if (!existsSync4(absolutePath)) {
-    throw new Error(
-      `Flow file not found: ${filePath}
-   Resolved path: ${absolutePath}
-   Make sure the file exists and the path is correct`
-    );
-  }
-  return absolutePath;
+// src/runtime/redact.ts
+var MAX_LENGTH = 256;
+var MIN_TOKEN_LEN = 20;
+var ENTROPY_THRESHOLD = 4;
+var FORCE_MASK_PREFIXES = [
+  "sk-",
+  "sk_",
+  "pk_",
+  "ghp_",
+  "gho_",
+  "xoxb-",
+  "xoxp-",
+  "AKIA"
+];
+var RE_URL_CREDS = /(:\/\/[^/:@\s]+:)[^@\s]+(@)/g;
+var RE_JSON_PRIVATE_KEY = /("private_key"\s*:\s*)"[^"]*"/g;
+var RE_PEM_BEGIN = /^\s*-----BEGIN [A-Z ]*PRIVATE KEY-----/i;
+var RE_PEM_END = /-----END[A-Z -]*-----/i;
+var TOKEN_VALUE_CLASS = "[A-Za-z0-9+/._-]";
+var RE_KV_SECRET = new RegExp(
+  `(^|\\s)([A-Za-z_][A-Za-z0-9_.]{0,63}\\s*[=:]\\s*)(${TOKEN_VALUE_CLASS}{12,}={0,2})`,
+  "g"
+);
+var RE_TOKEN_RUN = new RegExp(`${TOKEN_VALUE_CLASS}{${MIN_TOKEN_LEN},}`, "g");
+function escapeRegex(s) {
+  return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+var PREFIX_ALTERNATION = [...FORCE_MASK_PREFIXES].sort((a, b) => b.length - a.length).map(escapeRegex).join("|");
+var RE_PREFIXED_TOKEN = new RegExp(
+  `(?:${PREFIX_ALTERNATION})${TOKEN_VALUE_CLASS}*`,
+  "g"
+);
+function shannonEntropy(s) {
+  if (s.length === 0) return 0;
+  const counts = /* @__PURE__ */ new Map();
+  for (const ch of s) counts.set(ch, (counts.get(ch) ?? 0) + 1);
+  let entropy = 0;
+  for (const count of counts.values()) {
+    const p = count / s.length;
+    entropy -= p * Math.log2(p);
+  }
+  return entropy;
+}
+var RE_ALL_HEX = /^[0-9a-fA-F]+$/;
+var RE_ALL_DIGIT = /^[0-9]+$/;
+var RE_BASE64_SPECIAL = /[+/=]/;
+var RE_HAS_DIGIT = /[0-9]/;
+var RE_HAS_LETTER = /[A-Za-z]/;
+function shouldMaskToken(run2) {
+  if (RE_ALL_HEX.test(run2)) return true;
+  if (RE_ALL_DIGIT.test(run2)) return true;
+  if (RE_BASE64_SPECIAL.test(run2)) return true;
+  if (RE_HAS_DIGIT.test(run2) && RE_HAS_LETTER.test(run2)) return true;
+  if (shannonEntropy(run2) >= ENTROPY_THRESHOLD) return true;
+  return false;
 }
-function validatePort(port) {
-  const result = PortSchema.safeParse(port);
-  if (!result.success) {
-    throw new Error(
-      `Invalid port: ${port}
-   Port must be an integer between 1 and 65535
-   Example: --port 8080`
-    );
+function removePemBlocks(lines) {
+  const out = [];
+  let inBlock = false;
+  for (const line of lines) {
+    if (!inBlock) {
+      if (RE_PEM_BEGIN.test(line)) {
+        inBlock = true;
+        continue;
+      }
+      out.push(line);
+    } else {
+      if (RE_PEM_END.test(line)) {
+        inBlock = false;
+      }
+    }
   }
+  return out;
 }
-
-// src/commands/run/index.ts
-init_utils3();
-
-// src/commands/run/pipeline.ts
-init_tmp();
-import { writeFileSync as writeFileSync4 } from "fs";
-import fs17 from "fs-extra";
-import {
-  createBatchedPoster,
-  createTelemetryObserver,
-  getTraceUntil,
-  resolveTelemetryOptions
-} from "@walkeros/core";
-
-// src/runtime/health-server.ts
-import http from "http";
-function createHealthServer(port, logger) {
-  return new Promise((resolve5, reject) => {
-    let flowHandler = null;
-    let ready = false;
-    let failureReason = null;
-    const server = http.createServer((req, res) => {
-      if (req.url === "/health" && req.method === "GET") {
-        res.writeHead(200, { "Content-Type": "application/json" });
-        res.end(JSON.stringify({ status: "ok" }));
-        return;
-      }
-      if (req.url === "/ready" && req.method === "GET") {
-        const code = ready ? 200 : 503;
-        const status = ready ? "ready" : failureReason ? "failed" : "not_ready";
-        res.writeHead(code, { "Content-Type": "application/json" });
-        res.end(
-          JSON.stringify(
-            failureReason && !ready ? { status, reason: failureReason } : { status }
-          )
-        );
-        return;
-      }
-      if (flowHandler) {
-        flowHandler(req, res);
-        return;
-      }
-      res.writeHead(503, { "Content-Type": "application/json" });
-      res.end(JSON.stringify({ error: "No flow loaded" }));
-    });
-    server.keepAliveTimeout = 5e3;
-    server.headersTimeout = 1e4;
-    server.listen(port, "0.0.0.0", () => {
-      logger.info(`Health server listening on port ${port}`);
-      resolve5({
-        server,
-        setFlowHandler(handler) {
-          flowHandler = handler;
-        },
-        setReady(value) {
-          ready = value;
-          if (value) failureReason = null;
-        },
-        setFailed(reason) {
-          ready = false;
-          failureReason = reason;
-        },
-        close: () => new Promise((res, rej) => {
-          server.close((err) => err ? rej(err) : res());
-        })
-      });
-    });
-    server.on("error", reject);
-  });
-}
-
-// src/runtime/runner.ts
-import { resolve as resolve3, dirname as dirname4 } from "path";
-
-// src/runtime/load-bundle.ts
-import { resolve as resolve2 } from "path";
-import { pathToFileURL as pathToFileURL2 } from "url";
-async function loadBundle(file, context2, logger) {
-  const absolutePath = resolve2(file);
-  const fileUrl = pathToFileURL2(absolutePath).href;
-  logger?.debug?.(`Importing bundle: ${absolutePath}`);
-  const module = await import(`${fileUrl}?t=${Date.now()}`);
-  if (!module.default || typeof module.default !== "function") {
-    throw new Error(
-      `Invalid bundle: ${file} must export a default factory function`
-    );
-  }
-  logger?.debug?.("Calling factory function...");
-  const result = await module.default(context2 ?? {});
-  if (!result || !result.collector || typeof result.collector.push !== "function") {
-    throw new Error(
-      `Invalid bundle: factory must return { collector } with a push function`
-    );
-  }
-  return {
-    collector: result.collector,
-    ...typeof result.httpHandler === "function" ? { httpHandler: result.httpHandler } : {}
-  };
-}
-
-// src/runtime/runner.ts
-async function loadFlow(file, config, logger, loggerConfig, healthServer, observers) {
-  const absolutePath = resolve3(file);
-  const flowDir = dirname4(absolutePath);
-  process.chdir(flowDir);
-  const flowContext = {
-    ...config,
-    ...loggerConfig ? { logger: loggerConfig } : {},
-    ...healthServer ? { sourceSettings: { port: void 0 } } : {},
-    ...observers ? { observers } : {}
-  };
-  const result = await loadBundle(absolutePath, flowContext, logger);
-  if (healthServer && typeof result.httpHandler === "function") {
-    healthServer.setFlowHandler(result.httpHandler);
-  }
-  return {
-    collector: {
-      command: result.collector.command,
-      status: result.collector.status
-    },
-    file,
-    httpHandler: result.httpHandler
-  };
-}
-async function swapFlow(currentHandle, newFile, config, logger, loggerConfig, healthServer, observers) {
-  logger.info("Shutting down current flow for hot-swap...");
-  if (healthServer) {
-    healthServer.setFlowHandler(null);
-  }
-  try {
-    if (currentHandle.collector.command) {
-      await currentHandle.collector.command("shutdown");
-    }
-  } catch (error) {
-    logger.debug(`Shutdown warning: ${error}`);
-  }
-  const newHandle = await loadFlow(
-    newFile,
-    config,
-    logger,
-    loggerConfig,
-    healthServer,
-    observers
+function maskLine(line) {
+  let s = line;
+  s = s.replace(RE_URL_CREDS, "$1***$2");
+  s = s.replace(RE_KV_SECRET, "$1$2***");
+  s = s.replace(RE_PREFIXED_TOKEN, "***");
+  s = s.replace(
+    RE_TOKEN_RUN,
+    (match) => shouldMaskToken(match) ? "***" : match
   );
-  logger.info("Flow swapped successfully");
-  return newHandle;
+  return s;
+}
+function redactLine(line) {
+  const withoutJsonKey = line.replace(RE_JSON_PRIVATE_KEY, '$1"***"');
+  const rawLines = withoutJsonKey.split("\n");
+  const cleanLines = removePemBlocks(rawLines);
+  const maskedLines = cleanLines.map(maskLine);
+  const joined = maskedLines.join("\n");
+  if (joined.length > MAX_LENGTH) {
+    return joined.slice(0, MAX_LENGTH - 1) + "\u2026";
+  }
+  return joined;
+}
+function redactErrors(errors) {
+  return errors.map((e) => ({
+    message: redactLine(e.message),
+    count: e.count,
+    firstSeen: new Date(e.firstSeen).toISOString(),
+    lastSeen: new Date(e.lastSeen).toISOString()
+  }));
 }
-
-// src/runtime/heartbeat.ts
-import { randomBytes } from "crypto";
-
-// src/version.ts
-import { readFileSync as readFileSync3 } from "fs";
-import { fileURLToPath } from "url";
-import { dirname as dirname5, join as join6 } from "path";
-var versionFilename = fileURLToPath(import.meta.url);
-var versionDirname = dirname5(versionFilename);
-function findPackageJson() {
-  const paths = [
-    join6(versionDirname, "../package.json"),
-    // dist/ or src/
-    join6(versionDirname, "../../package.json")
-    // src/core/ (not used, but safe)
-  ];
-  for (const p of paths) {
-    try {
-      return readFileSync3(p, "utf-8");
-    } catch {
-    }
-  }
-  return JSON.stringify({ version: "0.0.0" });
+function redactLogs(entries) {
+  return entries.map((e) => ({
+    time: new Date(e.time).toISOString(),
+    level: e.level,
+    message: redactLine(e.message)
+  }));
 }
-var VERSION = JSON.parse(findPackageJson()).version;
 
 // src/runtime/heartbeat.ts
-init_http();
 function computeCounterDelta(current, last) {
   const destinations = {};
   for (const [name, dest] of Object.entries(current.destinations)) {
@@ -5947,6 +6011,8 @@ function createHeartbeat(config, logger) {
         };
         counters = computeCounterDelta(current, lastReported);
       }
+      const errors = config.getErrors ? redactErrors(config.getErrors()) : [];
+      const logs = config.getLogs ? redactLogs(config.getLogs().slice(-50)) : [];
       const response = await fetch(
         `${config.appUrl}/api/projects/${config.projectId}/runners/heartbeat`,
         {
@@ -5963,7 +6029,9 @@ function createHeartbeat(config, logger) {
             configVersion,
             cliVersion: VERSION,
             uptime: Math.floor((Date.now() - startTime) / 1e3),
-            ...counters && { counters }
+            ...counters && { counters },
+            ...errors.length && { recentErrors: errors },
+            ...logs.length && { recentLogs: logs }
           }),
           signal: AbortSignal.timeout(1e4)
         }
@@ -6038,6 +6106,275 @@ function createPoller(config, logger) {
   return { start, stop, pollOnce };
 }
 
+// src/runtime/health-server.ts
+import http from "http";
+function createHealthServer(port, logger) {
+  return new Promise((resolve5, reject) => {
+    let flowHandler = null;
+    let ready = false;
+    let failureReason = null;
+    const server = http.createServer((req, res) => {
+      if (req.url === "/health" && req.method === "GET") {
+        res.writeHead(200, { "Content-Type": "application/json" });
+        res.end(JSON.stringify({ status: "ok" }));
+        return;
+      }
+      if (req.url === "/ready" && req.method === "GET") {
+        const code = ready ? 200 : 503;
+        const status = ready ? "ready" : failureReason ? "failed" : "not_ready";
+        res.writeHead(code, { "Content-Type": "application/json" });
+        res.end(
+          JSON.stringify(
+            failureReason && !ready ? { status, reason: failureReason } : { status }
+          )
+        );
+        return;
+      }
+      if (flowHandler) {
+        flowHandler(req, res);
+        return;
+      }
+      res.writeHead(503, { "Content-Type": "application/json" });
+      res.end(JSON.stringify({ error: "No flow loaded" }));
+    });
+    server.keepAliveTimeout = 5e3;
+    server.headersTimeout = 1e4;
+    server.listen(port, "0.0.0.0", () => {
+      logger.info(`Health server listening on port ${port}`);
+      resolve5({
+        server,
+        setFlowHandler(handler) {
+          flowHandler = handler;
+        },
+        setReady(value) {
+          ready = value;
+          if (value) failureReason = null;
+        },
+        setFailed(reason) {
+          ready = false;
+          failureReason = reason;
+        },
+        close: () => new Promise((res, rej) => {
+          server.close((err) => err ? rej(err) : res());
+        })
+      });
+    });
+    server.on("error", reject);
+  });
+}
+
+// src/runtime/secrets-fetcher.ts
+init_http();
+var SecretsHttpError = class extends Error {
+  constructor(status, statusText) {
+    super(`Failed to fetch secrets: ${status} ${statusText}`);
+    this.status = status;
+    this.name = "SecretsHttpError";
+  }
+  status;
+};
+async function fetchSecrets(options) {
+  const { appUrl, token, projectId, flowId } = options;
+  const url = `${appUrl}/api/projects/${encodeURIComponent(projectId)}/flows/${encodeURIComponent(flowId)}/secrets/values`;
+  const res = await fetchWithRetry(url, {
+    maxTotalMs: 2e4,
+    init: {
+      headers: mergeAuthHeaders(token, { "Content-Type": "application/json" })
+    }
+  });
+  await throwIfRunnerAuthFailure(res);
+  if (!res.ok) {
+    throw new SecretsHttpError(res.status, res.statusText);
+  }
+  const json = await res.json();
+  return json.values;
+}
+
+// src/runtime/log-ring.ts
+var LogRing = class {
+  constructor(max) {
+    this.max = max;
+  }
+  max;
+  entries = [];
+  add(entry) {
+    this.entries.push(entry);
+    if (this.entries.length > this.max) this.entries.shift();
+  }
+  snapshot(limit = this.max) {
+    return this.entries.slice(Math.max(0, this.entries.length - limit));
+  }
+};
+var ErrorRing = class {
+  constructor(maxUnique, now = () => Date.now()) {
+    this.maxUnique = maxUnique;
+    this.now = now;
+  }
+  maxUnique;
+  now;
+  map = /* @__PURE__ */ new Map();
+  add(message) {
+    const ts = this.now();
+    const existing = this.map.get(message);
+    if (existing) {
+      existing.count += 1;
+      existing.lastSeen = ts;
+      return;
+    }
+    if (this.map.size >= this.maxUnique) {
+      let oldestKey;
+      let oldest = Infinity;
+      for (const [k, v] of this.map) {
+        if (v.lastSeen < oldest) {
+          oldest = v.lastSeen;
+          oldestKey = k;
+        }
+      }
+      if (oldestKey !== void 0) this.map.delete(oldestKey);
+    }
+    this.map.set(message, { message, count: 1, firstSeen: ts, lastSeen: ts });
+  }
+  snapshot() {
+    return [...this.map.values()].sort((a, b) => b.lastSeen - a.lastSeen);
+  }
+};
+
+// src/commands/run/index.ts
+init_tmp();
+init_config_file();
+init_auth();
+init_cache();
+
+// src/commands/run/validators.ts
+init_asset_resolver();
+import { existsSync as existsSync4 } from "fs";
+
+// src/schemas/primitives.ts
+import { z } from "@walkeros/core/dev";
+var PortSchema = z.number().int("Port must be an integer").min(1, "Port must be at least 1").max(65535, "Port must be at most 65535").describe("HTTP server port number");
+var FilePathSchema = z.string().min(1, "File path cannot be empty").describe("Path to configuration file");
+
+// src/schemas/run.ts
+import { z as z2 } from "@walkeros/core/dev";
+var RunOptionsSchema = z2.object({
+  flow: FilePathSchema,
+  port: PortSchema.default(8080),
+  flowName: z2.string().optional().describe("Specific flow name to run")
+});
+
+// src/schemas/validate.ts
+import { z as z3 } from "@walkeros/core/dev";
+var ValidationTypeSchema = z3.enum(["contract", "event", "flow", "mapping"]).describe('Validation type: "event", "flow", "mapping", or "contract"');
+var ValidateOptionsSchema = z3.object({
+  flow: z3.string().optional().describe("Flow name for multi-flow configs"),
+  path: z3.string().optional().describe(
+    'Entry path for package schema validation (e.g., "destinations.snowplow", "sources.browser")'
+  )
+});
+var ValidateInputShape = {
+  type: ValidationTypeSchema,
+  input: z3.string().min(1).describe("JSON string, file path, or URL to validate"),
+  flow: z3.string().optional().describe("Flow name for multi-flow configs"),
+  path: z3.string().optional().describe(
+    'Entry path for package schema validation (e.g., "destinations.snowplow"). When provided, validates the entry against its package JSON Schema instead of using --type.'
+  )
+};
+var ValidateInputSchema = z3.object(ValidateInputShape);
+
+// src/schemas/bundle.ts
+import { z as z4 } from "@walkeros/core/dev";
+var BundleOptionsSchema = z4.object({
+  silent: z4.boolean().optional().describe("Suppress all output"),
+  verbose: z4.boolean().optional().describe("Enable verbose logging"),
+  stats: z4.boolean().optional().default(true).describe("Return bundle statistics"),
+  cache: z4.boolean().optional().default(true).describe("Enable package caching"),
+  flowName: z4.string().optional().describe("Flow name for multi-flow configs")
+});
+var BundleInputShape = {
+  configPath: FilePathSchema.describe(
+    "Path to flow configuration file (JSON or JavaScript), URL, or inline JSON string"
+  ),
+  flow: z4.string().optional().describe("Flow name for multi-flow configs"),
+  stats: z4.boolean().optional().default(true).describe("Return bundle statistics"),
+  output: z4.string().optional().describe("Output file path (defaults to config-defined)")
+};
+var BundleInputSchema = z4.object(BundleInputShape);
+
+// src/schemas/simulate.ts
+import { z as z5 } from "@walkeros/core/dev";
+var PlatformSchema = z5.enum(["web", "server"]).describe("Platform type for event processing");
+var SimulateOptionsSchema = z5.object({
+  silent: z5.boolean().optional().describe("Suppress all output"),
+  verbose: z5.boolean().optional().describe("Enable verbose logging"),
+  json: z5.boolean().optional().describe("Format output as JSON")
+});
+var SimulateInputShape = {
+  configPath: FilePathSchema.describe(
+    "Path to flow configuration file, URL, or inline JSON string"
+  ),
+  event: z5.string().min(1).optional().describe(
+    "Event as JSON string, file path, or URL. For sources: { content, trigger?, env? }."
+  ),
+  flow: z5.string().optional().describe("Flow name for multi-flow configs"),
+  platform: PlatformSchema.optional().describe("Override platform detection"),
+  step: z5.string().optional().describe(
+    'Step target in type.name format (e.g. "source.browser", "destination.gtag")'
+  )
+};
+var SimulateInputSchema = z5.object(SimulateInputShape);
+
+// src/schemas/push.ts
+import { z as z6 } from "@walkeros/core/dev";
+var PushOptionsSchema = z6.object({
+  silent: z6.boolean().optional().describe("Suppress all output"),
+  verbose: z6.boolean().optional().describe("Enable verbose logging"),
+  json: z6.boolean().optional().describe("Format output as JSON")
+});
+var PushInputShape = {
+  configPath: FilePathSchema.describe("Path to flow configuration file"),
+  event: z6.string().min(1).describe("Event as JSON string, file path, or URL"),
+  flow: z6.string().optional().describe("Flow name for multi-flow configs"),
+  platform: PlatformSchema.optional().describe("Override platform detection")
+};
+var PushInputSchema = z6.object(PushInputShape);
+
+// src/commands/run/validators.ts
+function validateFlowFile(filePath) {
+  const absolutePath = resolveAsset(filePath, "bundle");
+  if (!existsSync4(absolutePath)) {
+    throw new Error(
+      `Flow file not found: ${filePath}
+   Resolved path: ${absolutePath}
+   Make sure the file exists and the path is correct`
+    );
+  }
+  return absolutePath;
+}
+function validatePort(port) {
+  const result = PortSchema.safeParse(port);
+  if (!result.success) {
+    throw new Error(
+      `Invalid port: ${port}
+   Port must be an integer between 1 and 65535
+   Example: --port 8080`
+    );
+  }
+}
+
+// src/commands/run/index.ts
+init_utils3();
+
+// src/commands/run/pipeline.ts
+init_tmp();
+import { writeFileSync as writeFileSync4 } from "fs";
+import fs17 from "fs-extra";
+import {
+  createBatchedPoster,
+  createTelemetryObserver,
+  getTraceUntil,
+  resolveTelemetryOptions
+} from "@walkeros/core";
+
 // src/runtime/trace-poller.ts
 init_http();
 import { setTraceUntil } from "@walkeros/core";
@@ -6100,42 +6437,26 @@ function createTracePoller(config, logger) {
 }
 var defaultFetch = (url, init) => fetch(url, init);
 
-// src/runtime/secrets-fetcher.ts
-init_http();
-var SecretsHttpError = class extends Error {
-  constructor(status, statusText) {
-    super(`Failed to fetch secrets: ${status} ${statusText}`);
-    this.status = status;
-    this.name = "SecretsHttpError";
-  }
-  status;
-};
-async function fetchSecrets(options) {
-  const { appUrl, token, projectId, flowId } = options;
-  const url = `${appUrl}/api/projects/${encodeURIComponent(projectId)}/flows/${encodeURIComponent(flowId)}/secrets/values`;
-  const res = await fetch(url, {
-    headers: mergeAuthHeaders(token, { "Content-Type": "application/json" })
-  });
-  await throwIfRunnerAuthFailure(res);
-  if (!res.ok) {
-    throw new SecretsHttpError(res.status, res.statusText);
-  }
-  const json = await res.json();
-  return json.values;
-}
-
 // src/commands/run/pipeline.ts
 init_cache();
 async function runPipeline(options) {
   const { bundlePath, port, logger, loggerConfig, api } = options;
   let configVersion;
+  const configFrozen = readConfigFrozen();
   if (api) {
     await injectSecrets(api, logger);
   }
   logger.info(`walkeros/flow v${VERSION}`);
   logger.info(`Instance: ${getInstanceId()}`);
+  if (configFrozen) {
+    logger.info("Config frozen: hot-swap and heartbeat disabled");
+  }
   const healthServer = await createHealthServer(port, logger);
-  const telemetryObservers = buildTelemetryObservers(api?.flowId ?? "flow");
+  const observeLevel = readObserveLevel(logger);
+  const telemetryObservers = buildTelemetryObservers(
+    api?.flowId ?? "flow",
+    observeLevel
+  );
   const runtimeConfig = { port };
   let handle;
   try {
@@ -6164,20 +6485,24 @@ async function runPipeline(options) {
   const ingestToken = process.env.WALKEROS_INGEST_TOKEN;
   const deploymentId = process.env.WALKEROS_DEPLOYMENT_ID;
   if (observerBase && ingestToken && deploymentId) {
-    tracePoller = createTracePoller(
-      {
-        url: `${observerBase}/trace/${deploymentId}`,
-        token: ingestToken,
-        intervalMs: 15e3
-      },
-      logger
-    );
-    tracePoller.start();
-    logger.info("Trace poller: active (every 15s)");
+    if (observeLevel === "trace") {
+      logger.info("Trace poller: skipped (observe level is trace)");
+    } else {
+      tracePoller = createTracePoller(
+        {
+          url: `${observerBase}/trace/${deploymentId}`,
+          token: ingestToken,
+          intervalMs: 15e3
+        },
+        logger
+      );
+      tracePoller.start();
+      logger.info("Trace poller: active (every 15s)");
+    }
   }
   let currentBundleCleanup;
   let currentConfigPath;
-  if (api) {
+  if (api && !configFrozen) {
     heartbeat = createHeartbeat(
       {
         appUrl: api.appUrl,
@@ -6187,7 +6512,9 @@ async function runPipeline(options) {
         deploymentId: api.deploymentId,
         configVersion,
         intervalMs: api.heartbeatIntervalMs,
-        getCounters: () => handle.collector.status
+        getCounters: () => handle.collector.status,
+        getErrors: () => options.errorRing?.snapshot() ?? [],
+        getLogs: () => options.logRing?.snapshot() ?? []
       },
       logger
     );
@@ -6294,17 +6621,39 @@ async function runPipeline(options) {
   await new Promise(() => {
   });
 }
-function buildTelemetryObservers(flowId) {
+var OBSERVE_LEVELS = [
+  "off",
+  "standard",
+  "trace"
+];
+function readConfigFrozen() {
+  const raw = process.env.WALKEROS_CONFIG_FROZEN;
+  return raw === "1" || raw === "true";
+}
+function readObserveLevel(logger) {
+  const raw = process.env.WALKEROS_OBSERVE_LEVEL;
+  if (raw === void 0 || raw === "") return void 0;
+  const level = OBSERVE_LEVELS.find((candidate) => candidate === raw);
+  if (!level) {
+    logger.warn(
+      `Ignoring invalid WALKEROS_OBSERVE_LEVEL "${raw}" (expected off, standard, or trace)`
+    );
+    return void 0;
+  }
+  return level;
+}
+function buildTelemetryObservers(flowId, observeLevel) {
   const base = process.env.WALKEROS_OBSERVER_URL;
   const token = process.env.WALKEROS_INGEST_TOKEN;
   const deploymentId = process.env.WALKEROS_DEPLOYMENT_ID;
   if (!base || !token || !deploymentId) return void 0;
   const url = `${base}/ingest/${deploymentId}`;
   const emit = createBatchedPoster({ url, token });
+  const observe = observeLevel !== void 0 ? { level: observeLevel } : void 0;
   return [
     createTelemetryObserver(
       emit,
-      () => resolveTelemetryOptions({ flowId, traceUntil: getTraceUntil() })
+      () => resolveTelemetryOptions({ flowId, observe, traceUntil: getTraceUntil() })
     )
   ];
 }
@@ -6347,7 +6696,21 @@ async function lazyPrepareBundleForRun(configPath, options) {
 async function runCommand(options) {
   const timer = createTimer();
   timer.start();
-  const logger = createCLILogger(options);
+  const errorRing = new ErrorRing(20);
+  const logRing = new LogRing(100);
+  const LEVEL_NAME = {
+    [Level2.ERROR]: "error",
+    [Level2.WARN]: "warn",
+    [Level2.INFO]: "info",
+    [Level2.DEBUG]: "debug"
+  };
+  const logger = createCLILogger({
+    ...options,
+    onLine: (level, message) => {
+      if (level === Level2.ERROR) errorRing.add(message);
+      logRing.add({ time: Date.now(), level: LEVEL_NAME[level], message });
+    }
+  });
   try {
     if (options.envFile) {
       const { loadEnvFile: loadEnvFile2 } = await Promise.resolve().then(() => (init_env_file(), env_file_exports));
@@ -6417,7 +6780,9 @@ async function runCommand(options) {
       port,
       logger: logger.scope("runner"),
       loggerConfig: options.verbose ? { level: 0 } : void 0,
-      api: apiConfig
+      api: apiConfig,
+      errorRing,
+      logRing
     });
   } catch (error) {
     const duration = timer.getElapsed() / 1e3;
@@ -7235,7 +7600,7 @@ function validateMapping(input) {
 // src/commands/validate/validators/entry.ts
 import Ajv from "ajv";
 import { fetchPackageSchema } from "@walkeros/core";
-var CLIENT_HEADER = "walkeros-cli/4.2.0";
+var CLIENT_HEADER = "walkeros-cli/4.2.1-next-1781538735002";
 var SECTIONS = ["destinations", "sources", "transformers"];
 function resolveEntry(path20, flowConfig) {
   const flows = flowConfig.flows;
@@ -7800,8 +8165,8 @@ import createClient from "openapi-fetch";
 init_config_file();
 import { createHash } from "crypto";
 import semver4 from "semver";
-var bakedContractVersion = true ? "1.1.0" : PLACEHOLDER;
-var bakedContractHash = true ? "847253b928a84dcdfc448e296418a5e48fa97b95f4a655e47e400d59d8e7f3cd" : "";
+var bakedContractVersion = true ? "2.1.0" : PLACEHOLDER;
+var bakedContractHash = true ? "e5c8e836e1bd59ac2c56d40a998943f301e7e4516528c66d87dc51d6525c8b57" : "";
 function isRecord2(value) {
   return value !== null && typeof value === "object" && !Array.isArray(value);
 }
@@ -7932,9 +8297,13 @@ function createApiClient() {
 }
 
 // src/core/api-error.ts
+var EXIT_RETRYABLE = 75;
 var ApiError = class extends Error {
   code;
   details;
+  status;
+  retryable;
+  retryAfterSeconds;
   // Populated only for CLIENT_OUTDATED responses (HTTP 426).
   minVersion;
   clientVersion;
@@ -7946,6 +8315,9 @@ var ApiError = class extends Error {
     this.name = "ApiError";
     this.code = options?.code;
     this.details = options?.details;
+    this.status = options?.status;
+    this.retryable = options?.retryable;
+    this.retryAfterSeconds = options?.retryAfterSeconds;
     this.minVersion = options?.minVersion;
     this.clientVersion = options?.clientVersion;
     this.client = options?.client;
@@ -7953,25 +8325,62 @@ var ApiError = class extends Error {
     this.docs = options?.docs;
   }
 };
-function throwApiError(error, fallbackMessage) {
-  if (error && typeof error === "object" && "error" in error && typeof error.error === "object") {
-    const inner = error.error;
-    const message = inner.message || fallbackMessage;
-    const code = inner.code;
-    const details = inner.details?.errors;
-    const options = { code, details };
-    if (code === "CLIENT_OUTDATED") {
-      options.minVersion = inner.minVersion;
-      options.clientVersion = inner.clientVersion;
-      options.client = inner.client;
-      options.upgrade = inner.upgrade;
-      options.docs = inner.docs;
-    }
-    throw new ApiError(message, options);
+function extractApiErrorOptions(error, fallbackMessage) {
+  if (!error || typeof error !== "object" || !("error" in error) || typeof error.error !== "object") {
+    return null;
+  }
+  const inner = error.error;
+  const message = inner.message || fallbackMessage;
+  const code = inner.code;
+  const details = inner.details?.errors;
+  const options = { code, details };
+  if (code === "CLIENT_OUTDATED") {
+    options.minVersion = inner.minVersion;
+    options.clientVersion = inner.clientVersion;
+    options.client = inner.client;
+    options.upgrade = inner.upgrade;
+    options.docs = inner.docs;
   }
+  return { message, options };
+}
+function throwApiError(error, fallbackMessage) {
+  const extracted = extractApiErrorOptions(error, fallbackMessage);
+  if (extracted) throw new ApiError(extracted.message, extracted.options);
   throw new ApiError(fallbackMessage);
 }
+function parseRetryAfter(value) {
+  if (!value) return void 0;
+  const trimmed = value.trim();
+  if (/^\d+$/.test(trimmed)) return parseInt(trimmed, 10);
+  const when = Date.parse(trimmed);
+  if (Number.isNaN(when)) return void 0;
+  return Math.max(0, Math.round((when - Date.now()) / 1e3));
+}
+function throwApiResponseError(response, body, fallbackMessage) {
+  const status = response.status;
+  const retryAfterSeconds = parseRetryAfter(
+    response.headers.get("retry-after")
+  );
+  const retryable = status === 429 || status === 503 && retryAfterSeconds !== void 0;
+  const extracted = extractApiErrorOptions(body, fallbackMessage);
+  const message = extracted?.message ?? fallbackMessage;
+  const options = {
+    ...extracted?.options ?? {},
+    status,
+    retryable,
+    retryAfterSeconds
+  };
+  throw new ApiError(message, options);
+}
+function machineReadableErrorLine(err) {
+  const code = err instanceof ApiError ? err.code ?? "UNKNOWN" : "UNKNOWN";
+  const retryable = err instanceof ApiError ? err.retryable === true : false;
+  const retryAfter = err instanceof ApiError && err.retryAfterSeconds !== void 0 ? ` retryAfter=${err.retryAfterSeconds}` : "";
+  const message = err instanceof Error ? err.message : String(err);
+  return `error: code=${code} retryable=${retryable}${retryAfter} message=${message}`;
+}
 function handleCliError(err) {
+  console.error(machineReadableErrorLine(err));
   if (err instanceof ApiError && err.code === "CLIENT_OUTDATED") {
     console.error(`
 ${err.message}
@@ -7981,8 +8390,12 @@ ${err.message}
 `);
     process.exit(2);
   }
-  const message = err instanceof Error ? err.message : String(err);
-  console.error(message);
+  if (err instanceof ApiError && err.retryable) {
+    const hint = err.retryAfterSeconds !== void 0 ? ` Retry after ${err.retryAfterSeconds}s.` : " This is temporary, retry shortly.";
+    console.error(`${err.message}${hint}`);
+    process.exit(EXIT_RETRYABLE);
+  }
+  console.error(err instanceof Error ? err.message : String(err));
   process.exit(1);
 }
 
@@ -8278,6 +8691,7 @@ async function readFlowStdin() {
 }
 
 // src/commands/deploy/index.ts
+import { randomUUID } from "crypto";
 init_auth();
 init_http();
 init_sse();
@@ -8308,8 +8722,9 @@ async function getAvailableFlowNames(options) {
   const settings = flow.settings;
   return settings?.map((c) => c.name) ?? [];
 }
+var DEFAULT_DEPLOY_WAIT_MS = 12 * 60 * 1e3;
 async function streamDeploymentStatus(projectId, deploymentId, options) {
-  const timeoutMs = options.timeout ?? 12e4;
+  const timeoutMs = options.timeout ?? DEFAULT_DEPLOY_WAIT_MS;
   const response = await apiFetch(
     `/api/projects/${projectId}/deployments/${deploymentId}/stream`,
     {
@@ -8368,7 +8783,10 @@ async function deploy(options) {
   }
   const { data, error } = await client.POST(
     "/api/projects/{projectId}/flows/{flowId}/deploy",
-    { params: { path: { projectId, flowId: options.flowId } } }
+    {
+      params: { path: { projectId, flowId: options.flowId } },
+      headers: { "Idempotency-Key": randomUUID() }
+    }
   );
   if (error) {
     try {
@@ -8398,13 +8816,38 @@ Available: ${names.join(", ")}`,
 }
 async function deploySettings(options) {
   const { flowId, projectId, settingsId } = options;
-  const response = await apiFetch(
+  const triggerDeploy = () => apiFetch(
     `/api/projects/${projectId}/flows/${flowId}/settings/${settingsId}/deploy`,
-    { method: "POST" }
+    { method: "POST", headers: { "Idempotency-Key": randomUUID() } }
   );
+  let response = await triggerDeploy();
+  if (!response.ok && options.wait) {
+    let retryBody = {};
+    try {
+      retryBody = await response.clone().json();
+    } catch {
+      retryBody = {};
+    }
+    try {
+      throwApiResponseError(
+        response,
+        retryBody,
+        `Deploy failed (${response.status})`
+      );
+    } catch (e) {
+      if (e instanceof ApiError && e.retryable) {
+        const waitSeconds = Math.min(e.retryAfterSeconds ?? 5, 60);
+        options.onStatus?.("rate_limited", `retrying in ${waitSeconds}s`);
+        await new Promise((resolve5) => setTimeout(resolve5, waitSeconds * 1e3));
+        response = await triggerDeploy();
+      } else {
+        throw e;
+      }
+    }
+  }
   if (!response.ok) {
     const body = await response.json().catch(() => ({}));
-    throwApiError(body, `Deploy failed (${response.status})`);
+    throwApiResponseError(response, body, `Deploy failed (${response.status})`);
   }
   const data = await response.json();
   if (!options.wait) return data;
@@ -8428,7 +8871,7 @@ async function getDeployment(options) {
     );
     if (!response.ok) {
       const body = await response.json().catch(() => ({}));
-      throwApiError(body, "Failed to get deployment");
+      throwApiResponseError(response, body, "Failed to get deployment");
     }
     return response.json();
   }
@@ -8441,16 +8884,20 @@ async function getDeployment(options) {
   return data;
 }
 var statusLabels = {
-  bundling: "Building bundle...",
-  "bundling:building": "Building bundle...",
-  "bundling:publishing": "Publishing to web...",
-  deploying: "Deploying container...",
+  "deploying:building": "Building bundle...",
+  "deploying:publishing": "Publishing to web...",
   "deploying:provisioning": "Provisioning container...",
   "deploying:starting": "Starting container...",
+  deploying: "Deploying...",
   active: "Container is live",
   published: "Published",
+  stopped: "Stopped",
   failed: "Deployment failed"
 };
+function renderStatusLabel(status, substatus) {
+  const key = substatus ? `${status}:${substatus}` : status;
+  return statusLabels[key] || statusLabels[status] || `Status: ${status}`;
+}
 async function deployCommand(flowId, options) {
   const log = createCLILogger(options);
   const timeoutMs = options.timeout ? parseInt(options.timeout, 10) * 1e3 : void 0;
@@ -8462,10 +8909,7 @@ async function deployCommand(flowId, options) {
       wait: options.wait !== false,
       timeout: timeoutMs,
       onStatus: options.json ? void 0 : (status, substatus) => {
-        const key = substatus ? `${status}:${substatus}` : status;
-        log.info(
-          statusLabels[key] || statusLabels[status] || `Status: ${status}`
-        );
+        log.info(renderStatusLabel(status, substatus));
       }
     });
     if (options.json) {
@@ -8480,7 +8924,7 @@ async function deployCommand(flowId, options) {
     } else if (r.status === "failed") {
       log.error(`Failed: ${r.errorMessage || "Unknown error"}`);
       process.exit(1);
-    } else if (r.status === "bundling") {
+    } else if (r.status === "deploying") {
       log.info(`Deployment started: ${r.deploymentId} (${r.type})`);
     } else {
       log.info(`Status: ${r.status}`);
@@ -8708,20 +9152,16 @@ async function createDeployCommand(config, options) {
     log.info(`Deployment created: ${result.id}`);
     log.info(`  Slug:  ${result.slug}`);
     log.info(`  Type:  ${result.type}`);
-    if (result.deployToken) {
-      log.info(`  Token: ${result.deployToken}`);
-      log.warn("  Save this token \u2014 it will not be shown again.");
-    }
     log.info("");
     log.info("Run locally:");
     log.info(
       `  walkeros run ${isRemoteFlow ? "flow.json" : config} --deploy ${result.id}`
     );
     log.info("");
-    log.info("Docker:");
-    log.info(
-      `  docker run -e WALKEROS_DEPLOY_TOKEN=${result.deployToken ?? "<token>"} \\`
-    );
+    log.info("Create a deploy token for this flow in the app");
+    log.info("(Settings, Self-hosted deploy token) and set it as");
+    log.info("WALKEROS_DEPLOY_TOKEN, then run with Docker:");
+    log.info("  docker run -e WALKEROS_DEPLOY_TOKEN \\");
     log.info("             -e WALKEROS_APP_URL=https://app.walkeros.io \\");
     log.info("             walkeros/flow:latest");
   } catch (err) {
@@ -8807,14 +9247,14 @@ init_config_file();
 
 // src/telemetry/install-id.ts
 init_config_file();
-import { randomUUID } from "crypto";
+import { randomUUID as randomUUID2 } from "crypto";
 function getInstallationId() {
   return readConfig()?.installationId;
 }
 function createInstallationId() {
   const existing = readConfig()?.installationId;
   if (existing) return existing;
-  const id = randomUUID();
+  const id = randomUUID2();
   writeTelemetryOnlyConfig({ installationId: id });
   return id;
 }
@@ -8875,6 +9315,8 @@ function telemetryDisableCommand() {
 
 // src/index.ts
 init_bundle();
+init_bundler();
+init_config_classifier();
 
 // src/commands/bundle/validate-structure.ts
 init_structural_validators();
@@ -9560,12 +10002,15 @@ export {
   apiFetch,
   bakedContractHash,
   bakedContractVersion,
+  buildDataPayload,
   bundle,
   bundleCommand,
   canonicalContractHash,
+  classifyStepProperties,
   clientContextHeaders,
   compareContract,
   compareOutput,
+  containsCodeMarkers,
   createApiClient,
   createDeployCommand,
   createDeployment,