@hexclave/cli 1.0.118 → 1.0.119

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hexclave/cli",
-  "version": "1.0.118",
+  "version": "1.0.119",
   "repository": "https://github.com/hexclave/hexclave",
   "description": "The CLI for Hexclave. https://hexclave.com",
   "main": "dist/index.js",
@@ -27,9 +27,9 @@
     "extract-zip": "^2.0.1",
     "jiti": "^2.4.2",
     "tar": "^7.4.3",
-    "@hexclave/shared-backend": "1.0.118",
-    "@hexclave/js": "1.0.118",
-    "@hexclave/shared": "1.0.118"
+    "@hexclave/shared-backend": "1.0.119",
+    "@hexclave/js": "1.0.119",
+    "@hexclave/shared": "1.0.119"
   },
   "devDependencies": {
     "@types/cross-spawn": "^6.0.6",

package/src/commands/config-file.ts

@@ -22,7 +22,7 @@ function isConfigOverride(value: unknown): value is EnvironmentConfigOverrideOve
   return prototype === Object.prototype || prototype === null;
 }
 
-export function parseConfigOverride(value: unknown): EnvironmentConfigOverrideOverride | null {
+function parseConfigOverride(value: unknown): EnvironmentConfigOverrideOverride | null {
   if (value === SHOW_ONBOARDING_STACK_CONFIG_VALUE) {
     return {};
   }
@@ -176,11 +176,13 @@ async function pushConfigWithSecretServerKey(
 }
 
 /**
- * Pushes a parsed config override to the project's branch config. Shared by
- * `hexclave config push` and `hexclave deploy` (which pushes the config file
- * by default before deploying) so both use the exact same auth paths.
+ * Pushes a parsed config override to the project's branch config, for
+ * `hexclave config push`. Publishing the project's configuration is deliberately
+ * its own command: `hexclave deploy` ships this repository's services and never
+ * touches the config, so one of several repositories deploying into a project
+ * cannot overwrite the others' configuration on the way past.
  */
-export async function pushConfigToProject(auth: ProjectAuth, config: EnvironmentConfigOverrideOverride, source: BranchConfigSourceApi): Promise<void> {
+async function pushConfigToProject(auth: ProjectAuth, config: EnvironmentConfigOverrideOverride, source: BranchConfigSourceApi): Promise<void> {
   if (isProjectAuthWithSecretServerKey(auth)) {
     await pushConfigWithSecretServerKey(auth, config, source);
   } else {
@@ -322,7 +324,17 @@ export function registerConfigCommand(program: Command) {
         // `@hexclave/js`) from the project's own node_modules.
         const { createJiti } = await import("jiti");
         const jiti = createJiti(import.meta.url);
-        const configModule: { config?: unknown } = await jiti.import(filePath);
+        const configModule: { config?: unknown, deploy?: unknown } = await jiti.import(filePath);
+
+        // Services used to be allowed here. Refused rather than ignored: a
+        // silently skipped `deploy` export would leave the author believing
+        // their services were published by a command that never looks at them.
+        // Keyed on the export EXISTING rather than on its value: `export let
+        // deploy;` is still a file whose author thinks it deploys something.
+        // (`in` rather than Object.hasOwn: this package targets ES2021.)
+        if ("deploy" in configModule) {
+          throw new CliError(`${filePath} has a \`deploy\` export. Service definitions no longer live in the config file — move it to a hexclave.deploy.ts (with an \`export const deploymentGroupId = "..."\` naming the deployment group) and ship it with \`hexclave deploy\`, which is a separate command from \`hexclave config push\`.`);
+        }
 
         const config = parseConfigOverride(configModule.config);
         if (config == null) {

package/src/commands/deploy.test.ts

@@ -2,8 +2,8 @@ import fs from "node:fs";
 import os from "node:os";
 import path from "node:path";
 import { afterEach, describe, expect, it, vi } from "vitest";
-import { evaluateDeploymentConfig, importConfigModule, importDeployModule, resolveDeployFilePath, type ServicesFunctionContext } from "../lib/deployment-config.js";
-import { collectPublicUrls, collectRequiredSecretKeys, deploymentDashboardUrl, firstFailedService, packageAndUploadSource, resolveConfigPushPath, type ServiceDeployResult } from "./deploy.js";
+import { evaluateDeploymentConfig, importDeployModule, resolveDeployFilePath, type ServicesFunctionContext } from "../lib/deployment-config.js";
+import { collectCiEnv, collectPublicUrls, collectRequiredSecretKeys, deploymentDashboardUrl, firstFailedService, packageAndUploadSource, type ServiceDeployResult } from "./deploy.js";
 
 const TEST_AUTH = {
   apiUrl: "https://api.example.com",
@@ -46,19 +46,15 @@ describe("deploy command helpers", () => {
     expect(resolveDeployFilePath(undefined, dir)).toBe(path.join(dir, "hexclave.deploy.ts"));
   });
 
-  it("loads the author-facing deploy export from deploy and config files", async () => {
+  it("loads the author-facing deploy export from a deploy file", async () => {
     const dir = makeTempDir();
     const deployFilePath = path.join(dir, "hexclave.deploy.ts");
-    const configFilePath = path.join(dir, "hexclave.config.ts");
     fs.writeFileSync(deployFilePath, 'export const deploymentGroupId = "source"; export const deploy = () => ({ services: {} });');
-    fs.writeFileSync(configFilePath, "export const config = {}; export const deploy = () => ({ services: {} });");
 
     const deployModule = await importDeployModule(deployFilePath);
-    const configModule = await importConfigModule(configFilePath);
     expect(deployModule.deploymentGroupId).toBe("source");
     expect(deployModule.legacyId).toBeUndefined();
     expect(deployModule.deploy).toBeTypeOf("function");
-    expect(configModule.deploy).toBeTypeOf("function");
   });
 
   // The deploy file is a different document from hexclave.config.ts, so a
@@ -69,14 +65,83 @@ describe("deploy command helpers", () => {
     expect(() => resolveDeployFilePath(undefined, dir)).toThrow("No deploy file found");
   });
 
-  it("resolves the config file for --config-push, and returns null when there is none", () => {
-    const dir = makeTempDir();
-    expect(resolveConfigPushPath(undefined, dir)).toBe(null);
-    fs.writeFileSync(path.join(dir, "stack.config.ts"), "export const config = {};");
-    expect(resolveConfigPushPath(undefined, dir)).toBe(path.join(dir, "stack.config.ts"));
-    fs.writeFileSync(path.join(dir, "hexclave.config.ts"), "export const config = {};");
-    expect(resolveConfigPushPath(undefined, dir)).toBe(path.join(dir, "hexclave.config.ts"));
-    expect(() => resolveConfigPushPath("missing.config.ts", dir)).toThrow("Config file not found");
+  describe("collectCiEnv", () => {
+    it("is empty outside CI", () => {
+      expect(collectCiEnv({ PATH: "/usr/bin", HOME: "/home/me" })).toEqual({});
+    });
+
+    it("passes GitLab's own variables through", () => {
+      expect(collectCiEnv({
+        CI_COMMIT_SHA: "0123456789abcdef",
+        CI_COMMIT_SHORT_SHA: "01234567",
+        CI_COMMIT_REF_NAME: "feat/x",
+        CI_COMMIT_BRANCH: "feat/x",
+        CI_SERVER_URL: "https://gitlab.com",
+        CI_PROJECT_PATH: "acme/app",
+      })).toEqual({
+        CI_COMMIT_SHA: "0123456789abcdef",
+        CI_COMMIT_SHORT_SHA: "01234567",
+        CI_COMMIT_REF_NAME: "feat/x",
+        CI_COMMIT_BRANCH: "feat/x",
+        CI_REPOSITORY_URL: "https://gitlab.com/acme/app.git",
+      });
+    });
+
+    it("translates a GitHub Actions push", () => {
+      // GITHUB_HEAD_REF is exported as an EMPTY string on a push, which is why
+      // the ?? chains cannot be trusted with the raw environment: CI_COMMIT_REF_NAME
+      // would come out blank instead of falling through to GITHUB_REF_NAME.
+      expect(collectCiEnv({
+        GITHUB_SHA: "0123456789abcdef",
+        GITHUB_HEAD_REF: "",
+        GITHUB_REF_NAME: "main",
+        GITHUB_REF_TYPE: "branch",
+        GITHUB_SERVER_URL: "https://github.com",
+        GITHUB_REPOSITORY: "acme/app",
+      })).toEqual({
+        CI_COMMIT_SHA: "0123456789abcdef",
+        CI_COMMIT_SHORT_SHA: "01234567",
+        CI_COMMIT_REF_NAME: "main",
+        CI_COMMIT_BRANCH: "main",
+        CI_REPOSITORY_URL: "https://github.com/acme/app.git",
+      });
+    });
+
+    it("reports a GitHub Actions pull request's head branch, and no CI_COMMIT_BRANCH", () => {
+      // GITHUB_REF_NAME is the merge ref on a pull request, so the commit is on
+      // no branch of its own — naming one would point at something that isn't
+      // what was built.
+      expect(collectCiEnv({
+        GITHUB_SHA: "0123456789abcdef",
+        GITHUB_HEAD_REF: "feat/x",
+        GITHUB_REF_NAME: "42/merge",
+        GITHUB_REF_TYPE: "branch",
+      })).toEqual({
+        CI_COMMIT_SHA: "0123456789abcdef",
+        CI_COMMIT_SHORT_SHA: "01234567",
+        CI_COMMIT_REF_NAME: "feat/x",
+      });
+    });
+
+    it("reports a GitHub Actions tag build as a tag", () => {
+      expect(collectCiEnv({
+        GITHUB_SHA: "0123456789abcdef",
+        GITHUB_REF_NAME: "v1.2.3",
+        GITHUB_REF_TYPE: "tag",
+      })).toEqual({
+        CI_COMMIT_SHA: "0123456789abcdef",
+        CI_COMMIT_SHORT_SHA: "01234567",
+        CI_COMMIT_REF_NAME: "v1.2.3",
+        CI_COMMIT_TAG: "v1.2.3",
+      });
+    });
+
+    it("lets an explicitly set CI_ variable win over the GitHub translation", () => {
+      expect(collectCiEnv({
+        CI_COMMIT_SHA: "handwritten",
+        GITHUB_SHA: "0123456789abcdef",
+      })).toMatchObject({ CI_COMMIT_SHA: "handwritten", CI_COMMIT_SHORT_SHA: "01234567" });
+    });
   });
 
   it("returns one final URL for each successfully deployed public service", () => {

package/src/commands/deploy.ts

@@ -1,4 +1,4 @@
-import { CONFIG_FILE_DEPLOYMENT_SOURCE_ID, buildSourceManifest, connectionRequiresTargetDeployed, deploymentPortEntries, deploymentPortEntry, deploymentPortOwnsStandardPorts, deploymentServiceIsBuilt, deploymentServiceUsesGeneratedDockerfile, parseConnectionValue, type DeploymentSourceManifest } from "@hexclave/shared/dist/deployments";
+import { buildSourceManifest, connectionRequiresTargetDeployed, deploymentPortEntries, deploymentPortEntry, deploymentPortOwnsStandardPorts, deploymentServiceIsBuilt, deploymentServiceUsesGeneratedDockerfile, parseConnectionValue, type DeploymentRuntime, type DeploymentSourceManifest } from "@hexclave/shared/dist/deployments";
 import { Command } from "commander";
 import fs from "node:fs";
 import path from "node:path";
@@ -9,13 +9,7 @@ import { AuthError, CliError, errorMessage } from "../lib/errors.js";
 import { followBuildLogs, type FollowBuildLogsOptions } from "../lib/build-logs.js";
 import { packageSourceDirectory } from "../lib/source-packaging.js";
 import { formatDuration, uploadSource, uploadSourceMultipart, type MultipartUploadSlot } from "../lib/source-upload.js";
-import { collectSecretDefaults, computeDeploymentLevels, evaluateDeploymentConfig, hasDeployFile, importConfigModule, importDeployModule, resolveDeployFilePath, type EvaluatedService } from "../lib/deployment-config.js";
-import { buildConfigPushSource, parseConfigOverride, pushConfigToProject } from "./config-file.js";
-
-// The names checked (in order) when --config-file is not passed with
-// --config-push; same preference order as `hexclave config push`'s pull-side
-// resolution.
-const CONFIG_FILE_CANDIDATES = ["hexclave.config.ts", "hexclave.config.js", "stack.config.ts", "stack.config.js"];
+import { collectSecretDefaults, computeDeploymentLevels, evaluateDeploymentConfig, importDeployModule, resolveDeployFilePath, type EvaluatedService } from "../lib/deployment-config.js";
 
 const RUN_POLL_INTERVAL_MS = 3_000;
 // Generous cap so a wedged remote build doesn't hang CI forever; the remote
@@ -30,40 +24,12 @@ const BUILD_LOG_DRAIN_TIMEOUT_MS = 15_000;
 export type DeployOptions = {
   serviceId?: string,
   deployFile?: string,
-  configFile?: string,
   cloudProjectId?: string,
-  // Opt-in: pushing the project's configuration is a separate concern from
-  // deploying this repository's services, and several repositories can deploy
-  // into one project — so a deploy must not silently publish whichever config
-  // file happens to sit next to the deploy file.
-  configPush?: boolean,
   // Commander's `--no-build-logs`: undefined/true stream the remote build's
   // output into this terminal, false leaves the deploy reporting status only.
   buildLogs?: boolean,
 };
 
-/**
- * Resolves the project config file for `--config-push`: --config-file wins (and
- * must exist); otherwise the first existing candidate in cwd. Returns null when
- * nothing was passed and no candidate exists. Exported for unit tests.
- */
-export function resolveConfigPushPath(configOption: string | undefined, cwd: string): string | null {
-  if (configOption != null && configOption !== "") {
-    const resolved = path.resolve(cwd, configOption);
-    if (!fs.existsSync(resolved) || !fs.statSync(resolved).isFile()) {
-      throw new CliError(`Config file not found: ${resolved}`);
-    }
-    return resolved;
-  }
-  for (const candidate of CONFIG_FILE_CANDIDATES) {
-    const resolved = path.resolve(cwd, candidate);
-    if (fs.existsSync(resolved) && fs.statSync(resolved).isFile()) {
-      return resolved;
-    }
-  }
-  return null;
-}
-
 /**
  * The secret keys that MUST have a stored value for these services to deploy:
  * every secret referenced without a default value. Exported for unit tests.
@@ -480,7 +446,7 @@ async function waitForDeployment(options: {
 }
 
 /** Transitive dependents of `failedServiceId`, by connection edges within this deploy. */
-function collectTransitiveDependents(failedServiceId: string, services: Map<string, EvaluatedService>): Set<string> {
+function collectTransitiveDependents(failedServiceId: string, services: Map<string, EvaluatedService>, runtime: DeploymentRuntime): Set<string> {
   const directDependents = new Map<string, Set<string>>();
   for (const [serviceId, service] of services) {
     for (const value of Object.values(service.env)) {
@@ -494,10 +460,9 @@ function collectTransitiveDependents(failedServiceId: string, services: Map<stri
       const targetIsPublic = parsed.port === null || deploymentPortEntry(target.definition.ports, parsed.port) === null
         ? null
         : target.definition.public === true;
-      // Same rule as computeDeploymentLevels: a deterministic reference is not a
-      // dependency, so a failed target must not skip services that never needed
-      // it to be deployed.
-      if (!connectionRequiresTargetDeployed(parsed.outputKey, parsed.port, targetIsPublic)) continue;
+      // Same rule as computeDeploymentLevels: only a reference that needed its
+      // target deployed makes its holder a dependent of it.
+      if (!connectionRequiresTargetDeployed(runtime, parsed.outputKey, parsed.port, targetIsPublic)) continue;
       const dependents = directDependents.get(parsed.serviceId) ?? new Set<string>();
       dependents.add(serviceId);
       directDependents.set(parsed.serviceId, dependents);
@@ -518,35 +483,62 @@ function collectTransitiveDependents(failedServiceId: string, services: Map<stri
 }
 
 /**
- * What this deploy ships: a deploy file when there is one, otherwise the config
- * file, for a project small enough to keep its services there. The config file
- * has no `deploymentGroupId` export, so its deployments belong to a group named
- * after the file itself — which is what lets them coexist with the deploy files
- * of other repositories deploying into the same project.
+ * The environment a `hexclave deploy` inherits, reduced to the GitLab-style
+ * `CI_*` variables that describe the commit being deployed. Sent with the deploy
+ * request and injected into every service's env, so a build can stamp the
+ * revision it came from without the deploy file having to name a CI provider.
+ *
+ * GitLab already sets these, so they pass straight through; GitHub Actions gets
+ * translated into the same names, and anything else that exports them by hand
+ * wins over both. A variable nothing can answer is simply absent — never an
+ * empty string, which a service would read as "set, but blank".
+ *
+ * Exported for unit tests.
+ */
+export function collectCiEnv(rawEnv: NodeJS.ProcessEnv): Record<string, string> {
+  // GitHub Actions exports the variables it has no answer for as EMPTY strings
+  // rather than leaving them unset — GITHUB_HEAD_REF is "" on a push. Folding
+  // those to undefined first is what makes the `??` chains below fall through
+  // to the next candidate instead of stopping on a blank.
+  const env: Record<string, string | undefined> = Object.fromEntries(
+    Object.entries(rawEnv).filter((entry): entry is [string, string] => typeof entry[1] === "string" && entry[1] !== ""),
+  );
+  const ciEnv: Record<string, string | undefined> = {
+    CI_COMMIT_SHA: env.CI_COMMIT_SHA ?? env.GITHUB_SHA,
+    CI_COMMIT_SHORT_SHA: env.CI_COMMIT_SHORT_SHA ?? env.GITHUB_SHA?.slice(0, 8),
+    CI_COMMIT_REF_NAME: env.CI_COMMIT_REF_NAME ?? env.GITHUB_HEAD_REF ?? env.GITHUB_REF_NAME,
+    // The branch a commit is ON, which a pull-request build is not: GITHUB_REF_NAME
+    // is the merge ref there, so GITHUB_HEAD_REF being set rules this out.
+    CI_COMMIT_BRANCH: env.CI_COMMIT_BRANCH ?? (env.GITHUB_REF_TYPE === "branch" && !env.GITHUB_HEAD_REF ? env.GITHUB_REF_NAME : undefined),
+    CI_COMMIT_TAG: env.CI_COMMIT_TAG ?? (env.GITHUB_REF_TYPE === "tag" ? env.GITHUB_REF_NAME : undefined),
+    CI_REPOSITORY_URL: env.CI_SERVER_URL && env.CI_PROJECT_PATH
+      ? `${env.CI_SERVER_URL}/${env.CI_PROJECT_PATH}.git`
+      : env.GITHUB_SERVER_URL && env.GITHUB_REPOSITORY
+        ? `${env.GITHUB_SERVER_URL}/${env.GITHUB_REPOSITORY}.git`
+        : undefined,
+  };
+  return Object.fromEntries(
+    Object.entries(ciEnv).filter((entry): entry is [string, string] => entry[1] !== undefined && entry[1] !== ""),
+  );
+}
+
+/**
+ * What this deploy ships: the `deploy` export of a deploy file. Deployments live
+ * in their OWN file — hexclave.config.ts holds the project's configuration and
+ * nothing else — so a project with no deploy file has nothing to deploy.
  */
 async function resolveDeploySource(deployFileOption: string | undefined, cwd: string): Promise<{
   path: string,
   deploymentGroupIdExport: unknown,
-  // The deploy file's `id` export, if it still uses that old name. Only a deploy
-  // file can have one; the config file's group id is the file name.
+  // The deploy file's `id` export, if it still uses that old name.
   legacyIdExport?: unknown,
   deployExport: unknown,
+  // The internal `version` export, if any.
+  versionExport: unknown,
 }> {
-  if (deployFileOption == null || deployFileOption === "") {
-    const configPath = resolveConfigPushPath(undefined, cwd);
-    // Only if there is no deploy file at all: a repository that has both keeps
-    // its services in the deploy file, and silently preferring the config file's
-    // would deploy something other than what the author is editing.
-    if (configPath !== null && !hasDeployFile(cwd)) {
-      const configModule = await importConfigModule(configPath);
-      if (configModule.deploy !== undefined) {
-        return { path: configPath, deploymentGroupIdExport: CONFIG_FILE_DEPLOYMENT_SOURCE_ID, deployExport: configModule.deploy };
-      }
-    }
-  }
   const deployFilePath = resolveDeployFilePath(deployFileOption, cwd);
   const deployModule = await importDeployModule(deployFilePath);
-  return { path: deployFilePath, deploymentGroupIdExport: deployModule.deploymentGroupId, legacyIdExport: deployModule.legacyId, deployExport: deployModule.deploy };
+  return { path: deployFilePath, deploymentGroupIdExport: deployModule.deploymentGroupId, legacyIdExport: deployModule.legacyId, deployExport: deployModule.deploy, versionExport: deployModule.version };
 }
 
 export function registerDeployCommand(program: Command) {
@@ -555,8 +547,6 @@ export function registerDeployCommand(program: Command) {
     .description("Deploy the services defined by the `deploy` export of your hexclave.deploy.ts. Syncs the service definitions, then deploys every service in dependency order and waits for the remote builds to finish.")
     .option("--service-id <id>", "Deploy only this service (its connections resolve against already-deployed services)")
     .option("--deploy-file <path>", "Path to the deploy file (default: auto-discover hexclave.deploy.ts in the current directory)")
-    .option("--config-push", "Also push the project config file's `config` export to the project before deploying")
-    .option("--config-file <path>", "Path to the project config file for --config-push (default: auto-discover hexclave.config.ts in the current directory)")
     .option("--cloud-project-id <id>", "Hexclave project ID to deploy to (defaults to the HEXCLAVE_PROJECT_ID env var)")
     .option("--no-build-logs", "Don't stream the remote build's output; report service status only")
     .addHelpText("after", "\nAuthentication: uses HEXCLAVE_SECRET_SERVER_KEY if set (recommended for CI), otherwise your `hexclave login` session.\nSecrets: values for secret() env vars are read from the dashboard (Project Settings > Secrets); the deploy fails up front and lists every secret that still needs a value there.")
@@ -564,15 +554,14 @@ export function registerDeployCommand(program: Command) {
       const auth = resolveAuth(resolveProjectId(opts.cloudProjectId));
       const authHeaders = await buildAuthHeadersFactory(auth);
 
-      // A deploy file if there is one; otherwise the config file, for a project
-      // that keeps its services there. The config file has no `deploymentGroupId`
-      // export, so its deployments belong to a group named after the file itself.
+      // Always the deploy file: services live there, never in hexclave.config.ts.
       const deploySource = await resolveDeploySource(opts.deployFile, process.cwd());
-      const { sourceId, services } = evaluateDeploymentConfig({
+      const { sourceId, services, builder, runtime, version } = evaluateDeploymentConfig({
         deployFilePath: deploySource.path,
         deploymentGroupIdExport: deploySource.deploymentGroupIdExport,
         legacyIdExport: deploySource.legacyIdExport,
         deployExport: deploySource.deployExport,
+        versionExport: deploySource.versionExport,
         mode: "deploy",
       });
 
@@ -587,10 +576,21 @@ export function registerDeployCommand(program: Command) {
         }
         levels = [[opts.serviceId]];
       } else {
-        levels = computeDeploymentLevels(services);
+        levels = computeDeploymentLevels(services, runtime);
       }
       const deploySet = levels.flat();
 
+      // A builder size with nothing to build is a note, not an error: the deploy
+      // is still exactly what the author asked for, and a `--service-id` deploy
+      // of one prebuilt service out of a file whose other services DO build is
+      // an entirely ordinary thing to do.
+      if (builder?.memory !== undefined && !deploySet.some((serviceId) => {
+        const service = services.get(serviceId);
+        return service !== undefined && deploymentServiceIsBuilt(service.definition);
+      })) {
+        console.error(`Note: deploy.builder sets memory ${JSON.stringify(builder.memory)}, but ${opts.serviceId != null ? `services.${opts.serviceId} runs` : "every service in this deploy runs"} an already-built image, so no builder machine starts and the size has no effect here.`);
+      }
+
       // Pre-flight: every secret without a default must have a stored value
       // BEFORE anything is packaged or uploaded. The backend re-checks this
       // authoritatively per deploy.
@@ -619,32 +619,6 @@ export function registerDeployCommand(program: Command) {
         }
       }
 
-      // Config push is OPT-IN. A project can be deployed from several
-      // repositories, and each push replaces the project's whole configuration —
-      // so a deploy that published it by default would let any of those
-      // repositories silently overwrite the others' config with its own.
-      if (opts.configPush === true) {
-        const configPath = resolveConfigPushPath(opts.configFile, process.cwd());
-        if (configPath == null) {
-          throw new CliError(`--config-push was passed, but no config file was found in ${process.cwd()} (looked for ${CONFIG_FILE_CANDIDATES.join(", ")}). Pass --config-file <path>, or drop --config-push to deploy without publishing the project config.`);
-        }
-        const configModule = await importConfigModule(configPath);
-        if (configModule.config === undefined) {
-          throw new CliError(`--config-push was passed, but ${configPath} has no \`config\` export. Add one, or drop --config-push.`);
-        }
-        const config = parseConfigOverride(configModule.config);
-        if (config == null) {
-          throw new CliError(`The \`config\` export of ${configPath} must be a plain object (or "show-onboarding"). Fix it, or drop --config-push to deploy without pushing the config.`);
-        }
-        console.error("Pushing config...");
-        // The GitHub-Actions auto-detection inside buildConfigPushSource
-        // records this path verbatim as the repo-relative config_file_path,
-        // so pass a cwd-relative posix path, not the resolved absolute one
-        // (which would bake the runner's filesystem layout into the source).
-        const relativeConfigPath = path.relative(process.cwd(), configPath).split(path.sep).join("/");
-        await pushConfigToProject(auth, config, buildConfigPushSource(relativeConfigPath, {}));
-      }
-
       // Sync ALL definitions (even for a --service-id deploy) so the server sees
       // the deploy file's whole truth: services it no longer declares are torn
       // down here, and syncing only a subset would read as "the rest were
@@ -655,6 +629,14 @@ export function registerDeployCommand(program: Command) {
         jsonBody: {
           source_id: sourceId,
           services: Object.fromEntries([...services.values()].map((service) => [service.serviceId, service.definition])),
+          // Synced with the definitions rather than sent with the deploy: the
+          // builder is part of what the deploy file says, so it belongs inside
+          // the same sync fence — a deploy cannot then pair one checkout's
+          // source with another checkout's builder size.
+          ...(builder === undefined ? {} : { builder }),
+          // The internal `version` export, when set: which infrastructure runtime the
+          // project runs on. Synced with the definitions for the same reason the builder is.
+          ...(version === undefined ? {} : { version }),
         },
       });
       if (typeof syncResponse?.sync_id !== "string") {
@@ -711,6 +693,11 @@ export function registerDeployCommand(program: Command) {
               throw new CliError(`Internal error: deploy set contains unknown service ${JSON.stringify(serviceId)}.`);
             })()),
           ])),
+          // The GitLab-style CI variables this deploy was invoked with. Request-
+          // scoped like the secret defaults: they describe THIS deploy, so
+          // storing them on the definition would leave a stale commit sha on
+          // every service the next deploy doesn't ship.
+          ci_env: collectCiEnv(process.env),
           triggered_by: "cli",
         },
       });
@@ -720,6 +707,20 @@ export function registerDeployCommand(program: Command) {
       const deploymentId = deploymentResponse.id;
       console.error(`Deployment #${deploymentResponse.number} started. ${buildsFromSource ? "Waiting for the remote build..." : "Nothing to build — waiting for the services to come up..."}`);
 
+      // Anything the API wants the author to know about this deploy that is not
+      // a failure — today, that a Free-plan deployment stops after the plan's
+      // window. Printed HERE, at the start, rather than with the URLs at the end:
+      // a limit is only fair if it is read before it bites, and the end of a
+      // deploy is where the reader has already stopped paying attention.
+      //
+      // Tolerated as missing: an older API returns no such field, and a deploy
+      // must not fail over a message.
+      for (const notice of Array.isArray(deploymentResponse.notices) ? deploymentResponse.notices : []) {
+        if (typeof notice !== "string") continue;
+        console.error("");
+        console.error(notice);
+      }
+
       // Stream the remote build's output into this terminal while it runs. A
       // deploy is mostly one long remote build, and until now the only way to
       // see what it was doing was to open the dashboard — which is no help at

package/src/commands/dev.ts

@@ -102,7 +102,7 @@ function splitDevCommandArgs(commandArgs: string[]): ChildCommand {
 }
 
 /**
- * Wraps a devCommand string (from the config's `services` export) for
+ * Wraps a devCommand string (from the deploy file's `deploy` export) for
  * execution through the platform shell — unlike the `-- <command> [args...]`
  * form, a devCommand is a single command LINE (e.g. "pnpm dev --port 3000")
  * and may use shell syntax. Exported for unit tests.
@@ -952,8 +952,8 @@ export function registerDevCommand(program: Command) {
 
       const configFilePath = resolveConfigFilePathOption(opts.configFile, { mustExist: opts.serviceId != null });
 
-      // Evaluate the services export BEFORE starting the dashboard so config
-      // mistakes fail fast (and without a half-started session).
+      // Evaluate the deploy file's services BEFORE starting the dashboard so a
+      // mistake there fails fast (and without a half-started session).
       let devService: EvaluatedService | undefined;
       if (opts.serviceId != null) {
         // Services live in the DEPLOY file, not the config file: --config-file
@@ -967,6 +967,7 @@ export function registerDevCommand(program: Command) {
           deploymentGroupIdExport: deployModule.deploymentGroupId,
           legacyIdExport: deployModule.legacyId,
           deployExport: deployModule.deploy,
+          versionExport: deployModule.version,
           mode: "dev",
         });
         devService = services.get(opts.serviceId);
@@ -992,7 +993,7 @@ export function registerDevCommand(program: Command) {
           }
         })();
         if (rootDirectoryStats == null || !rootDirectoryStats.isDirectory()) {
-          throw new CliError(`The rootDirectory of the service ${JSON.stringify(opts.serviceId)} is ${devService.absoluteRootDirectory}, which ${rootDirectoryStats == null ? "does not exist" : "is not a directory"}. Fix \`rootDirectory\` in the config file's services export — it is where the service's devCommand runs.`);
+          throw new CliError(`The rootDirectory of the service ${JSON.stringify(opts.serviceId)} is ${devService.absoluteRootDirectory}, which ${rootDirectoryStats == null ? "does not exist" : "is not a directory"}. Fix \`rootDirectory\` in the deploy file's \`deploy\` export — it is where the service's devCommand runs.`);
         }
       }
       // The selection guard above makes these modes mutually exclusive.