@hexclave/cli 1.0.118 → 1.0.120

package/dist/index.js

@@ -14,7 +14,7 @@ import { dirname, join, resolve } from "path";
 import { fileURLToPath } from "url";
 import { Command } from "commander";
 import { StackClientApp } from "@hexclave/js";
-import { CONFIG_FILE_DEPLOYMENT_SOURCE_ID, DEPLOYMENT_ENV_VAR_KEY_REGEX, DEPLOYMENT_PORT_KEY_REGEX, DEPLOYMENT_SERVICE_TYPES, DEPLOYMENT_SOURCE_ID_REGEX, DEPLOYMENT_VOLUME_ID_REGEX, HEXCLAVE_OUTPUT_KEYS, HEXCLAVE_SERVICE_ID, MAX_DEPLOYMENT_COMMAND_LENGTH, MAX_DEPLOYMENT_SOURCE_ID_LENGTH, MAX_INSTANCES_PER_SERVICE, MAX_PERSISTENT_VOLUMES_PER_SERVICE, MAX_PORTS_PER_SERVICE, MAX_VOLUME_ID_LENGTH, MAX_VOLUME_SIZE_GB, MIN_VOLUME_SIZE_GB, SERVICE_OUTPUT_KEYS, buildSourceManifest, connectionRequiresTargetDeployed, deploymentPortEntries, deploymentPortEntry, deploymentPortOwnsStandardPorts, deploymentServiceIsBuilt, deploymentServiceUsesGeneratedDockerfile, formatConnectionValue, isValidDeploymentCommand, parseConnectionValue, parseDeploymentImageRef, reservedStandardPortConflicts, standardPortsHolderPort } from "@hexclave/shared/dist/deployments";
+import { BUILDER_MEMORY_SIZES, DEFAULT_DEPLOYMENT_RUNTIME, DEPLOYMENT_ENV_VAR_KEY_REGEX, DEPLOYMENT_PORT_KEY_REGEX, DEPLOYMENT_SERVICE_TYPES, DEPLOYMENT_SOURCE_ID_REGEX, DEPLOYMENT_VERSION_TOKENS, DEPLOYMENT_VOLUME_ID_REGEX, HEXCLAVE_OUTPUT_KEYS, HEXCLAVE_SERVICE_ID, MAX_DEPLOYMENT_COMMAND_LENGTH, MAX_DEPLOYMENT_SOURCE_ID_LENGTH, MAX_INSTANCES_PER_SERVICE, MAX_PERSISTENT_VOLUMES_PER_SERVICE, MAX_PORTS_PER_SERVICE, MAX_VOLUME_ID_LENGTH, MAX_VOLUME_SIZE_GB, MIN_VOLUME_SIZE_GB, SERVICE_OUTPUT_KEYS, buildSourceManifest, connectionRequiresTargetDeployed, deploymentMemorySizesForType, deploymentPortEntries, deploymentPortEntry, deploymentPortOwnsStandardPorts, deploymentRuntimeForVersion, deploymentServiceIsBuilt, deploymentServiceUsesGeneratedDockerfile, formatConnectionValue, isValidDeploymentCommand, parseConnectionValue, parseDeploymentImageRef, reservedStandardPortConflicts, standardPortsHolderPort, suggestDeploymentMemorySize } from "@hexclave/shared/dist/deployments";
 import fs from "node:fs";
 import path from "node:path";
 import { createUrlIfValid } from "@hexclave/shared/dist/utils/urls";
@@ -24,11 +24,11 @@ import { gzipSync } from "node:zlib";
 import http from "node:http";
 import https from "node:https";
 import { PROJECT_SECRET_KEY_REGEX } from "@hexclave/shared/dist/project-secrets";
+import { hexclaveDevEnvStatePath } from "@hexclave/shared/dist/utils/dev-env-state-path";
+import { createHash, randomBytes } from "crypto";
 import { replaceConfigObject } from "@hexclave/shared-backend";
 import { detectImportPackageFromDir } from "@hexclave/shared/dist/config-eval";
 import { isValidConfig } from "@hexclave/shared/dist/config/format";
-import { hexclaveDevEnvStatePath } from "@hexclave/shared/dist/utils/dev-env-state-path";
-import { createHash, randomBytes } from "crypto";
 import { ALL_APPS, expandAppSoftRequirements } from "@hexclave/shared/dist/apps/apps-config";
 import { renderConfigFileContent } from "@hexclave/shared/dist/config-rendering";
 import { checkbox, confirm, input, select } from "@inquirer/prompts";
@@ -1057,13 +1057,6 @@ async function attemptUpload(request, settings) {
 //#endregion
 //#region src/lib/deployment-config.ts
 const DEPLOY_FILE_CANDIDATES = ["hexclave.deploy.ts", "hexclave.deploy.js"];
-/** Whether `cwd` contains a deploy file at all. */
-function hasDeployFile(cwd) {
-	return DEPLOY_FILE_CANDIDATES.some((candidate) => {
-		const resolved = path.resolve(cwd, candidate);
-		return fs.existsSync(resolved) && fs.statSync(resolved).isFile();
-	});
-}
 /**
 * Resolves the deploy file path: --deploy-file wins (and must exist); otherwise
 * the first existing candidate in `cwd`. A deploy file is REQUIRED — service
@@ -1193,6 +1186,7 @@ const KNOWN_SERVICE_FIELDS = /* @__PURE__ */ new Set([
 	"ports",
 	"minInstances",
 	"maxInstances",
+	"memory",
 	"rootDirectory",
 	"dockerfilePath",
 	"image",
@@ -1203,6 +1197,28 @@ const KNOWN_SERVICE_FIELDS = /* @__PURE__ */ new Set([
 	"env"
 ]);
 const KNOWN_VOLUME_FIELDS = /* @__PURE__ */ new Set(["path", "sizeGb"]);
+const KNOWN_DEPLOY_FIELDS = /* @__PURE__ */ new Set(["services", "builder"]);
+const KNOWN_BUILDER_FIELDS = /* @__PURE__ */ new Set(["memory"]);
+/**
+* Reads a memory size token, refusing anything but the canonical spelling.
+*
+* `available` is the ladder for this particular slot — a "server" has no 512MB
+* shape and the builder starts where the services stop — so the message names
+* what this thing can be rather than every token that exists.
+*
+* Near-misses get a "did you mean": `"4gb"`, `"4 GB"` and `"4Gi"` are all
+* refused, but they are what somebody types first, and a bare list of seven
+* tokens leaves the reader to spot the difference by eye.
+*/
+function readMemoryField(raw, at, available) {
+	if (raw === void 0) return void 0;
+	const options = available.map((size) => JSON.stringify(size)).join(", ");
+	if (typeof raw !== "string") throw new CliError(`${at} must be one of ${options} (got ${JSON.stringify(raw)}). Write the size with its unit, e.g. \`memory: "4GB"\`.`);
+	if (available.includes(raw)) return raw;
+	const suggestion = suggestDeploymentMemorySize(raw);
+	if (suggestion !== null && available.includes(suggestion)) throw new CliError(`${at} is ${JSON.stringify(raw)}. Write it as ${JSON.stringify(suggestion)} — sizes have one spelling each, in MB or GB (note the capital B; "Mb" is megabits).`);
+	throw new CliError(`${at} must be one of ${options} (got ${JSON.stringify(raw)}).`);
+}
 function readOptionalIntegerField(record, serviceId, field) {
 	const value = record[field];
 	if (value === void 0) return void 0;
@@ -1269,6 +1285,21 @@ function evaluatePorts(serviceId, isPublic, portsRaw) {
 	}
 	return ports;
 }
+/**
+* Reads the deploy export's `builder`.
+*
+* Returns undefined when the file says nothing OR when it declares an empty
+* object: both mean "no opinion", and storing `{}` would make an empty
+* declaration look different from an absent one to every reader downstream.
+*/
+function evaluateBuilder(deployFilePath, builderRaw) {
+	if (builderRaw === void 0) return void 0;
+	if (builderRaw === null || typeof builderRaw !== "object" || Array.isArray(builderRaw)) throw new CliError(`deploy.builder of ${deployFilePath} must be an object, e.g. \`builder: { memory: "32GB" }\`.`);
+	const record = builderRaw;
+	for (const field of Object.keys(record)) if (!KNOWN_BUILDER_FIELDS.has(field)) throw new CliError(`deploy.builder of ${deployFilePath} has an unknown field ${JSON.stringify(field)}. Known fields: ${[...KNOWN_BUILDER_FIELDS].join(", ")}.`);
+	const memory = readMemoryField(record.memory, `deploy.builder.memory of ${deployFilePath}`, BUILDER_MEMORY_SIZES);
+	return memory === void 0 ? void 0 : { memory };
+}
 function evaluatePersistentVolumes(serviceId, volumesRaw) {
 	if (volumesRaw === void 0 || volumesRaw === null) return void 0;
 	if (typeof volumesRaw !== "object" || Array.isArray(volumesRaw)) throw new CliError(`deploy.services.${serviceId}.persistentVolumes must be an object keyed by volume id, e.g. \`persistentVolumes: { data: { path: "/data", sizeGb: 10 } }\`.`);
@@ -1358,13 +1389,17 @@ const EXAMPLE_DEPLOYMENT_EXPORT = `  export const deploymentGroupId = "my-app";
 * its directory).
 */
 function evaluateDeploymentConfig(options) {
-	const { deployFilePath, deploymentGroupIdExport, legacyIdExport, deployExport, mode } = options;
+	const { deployFilePath, deploymentGroupIdExport, legacyIdExport, deployExport, versionExport, mode } = options;
 	const deployFileDirectory = path.dirname(deployFilePath);
 	if (legacyIdExport !== void 0) throw new CliError(`The deploy file ${deployFilePath} has an \`id\` export, which is no longer supported. Rename it to \`deploymentGroupId\`, e.g. \`export const deploymentGroupId = ${JSON.stringify(typeof legacyIdExport === "string" ? legacyIdExport : "backend")};\`.`);
 	if (deploymentGroupIdExport === void 0) throw new CliError(`The deploy file ${deployFilePath} has no \`deploymentGroupId\` export. Add one naming this deployment group, e.g. \`export const deploymentGroupId = "backend";\` — it is how Hexclave tells the deploy files of different repositories apart.`);
 	if (typeof deploymentGroupIdExport !== "string") throw new CliError(`The \`deploymentGroupId\` export of ${deployFilePath} must be a string naming this deployment group (got ${typeof deploymentGroupIdExport}).`);
 	const sourceId = deploymentGroupIdExport;
 	if (!DEPLOYMENT_SOURCE_ID_REGEX.test(sourceId) || sourceId.length > MAX_DEPLOYMENT_SOURCE_ID_LENGTH) throw new CliError(`Invalid deployment group id ${JSON.stringify(sourceId)} in ${deployFilePath}. Ids must be at most ${MAX_DEPLOYMENT_SOURCE_ID_LENGTH} characters and contain only letters, numbers, underscores, dots, and hyphens (not starting with a dot or hyphen).`);
+	const version = versionExport === void 0 ? void 0 : versionExport;
+	if (version !== void 0 && typeof version !== "string") throw new CliError(`The \`version\` export of ${deployFilePath} must be a string (got ${typeof version}). Remove it unless you were given a value for it.`);
+	const runtime = deploymentRuntimeForVersion(version);
+	if (runtime === null) throw new CliError(`The deploy file ${deployFilePath} has an unknown \`version\` export ${JSON.stringify(version)}. Remove it, or use one of: ${DEPLOYMENT_VERSION_TOKENS.join(", ")}.`);
 	if (deployExport === void 0) throw new CliError(`The deploy file ${deployFilePath} has no \`deploy\` export. Add one, e.g.:\n${EXAMPLE_DEPLOYMENT_EXPORT}`);
 	if (typeof deployExport !== "function") throw new CliError(`The \`deploy\` export of ${deployFilePath} must be a function of the deployment context, e.g.:\n${EXAMPLE_DEPLOYMENT_EXPORT}`);
 	const { context, referencedServiceIds } = createServicesContext(mode);
@@ -1379,7 +1414,8 @@ function evaluateDeploymentConfig(options) {
 	if (deployRaw !== null && typeof deployRaw === "object" && "then" in deployRaw && typeof deployRaw.then === "function") throw new CliError(`The \`deploy\` export of ${deployFilePath} must be synchronous, but it returned a Promise. Remove the \`async\` keyword — secrets and connections are resolved for you, nothing here needs to be awaited.`);
 	if (deployRaw === null || typeof deployRaw !== "object" || Array.isArray(deployRaw)) throw new CliError(`The \`deploy\` export of ${deployFilePath} must return an object with a \`services\` member, e.g.:\n${EXAMPLE_DEPLOYMENT_EXPORT}`);
 	const deployRecord = deployRaw;
-	for (const field of Object.keys(deployRecord)) if (field !== "services") throw new CliError(`The \`deploy\` export of ${deployFilePath} returned an unknown field ${JSON.stringify(field)}. The only supported field is \`services\`.`);
+	for (const field of Object.keys(deployRecord)) if (!KNOWN_DEPLOY_FIELDS.has(field)) throw new CliError(`The \`deploy\` export of ${deployFilePath} returned an unknown field ${JSON.stringify(field)}. Supported fields: ${[...KNOWN_DEPLOY_FIELDS].join(", ")}.`);
+	const builder = evaluateBuilder(deployFilePath, deployRecord.builder);
 	const servicesRaw = deployRecord.services;
 	if (servicesRaw === void 0) throw new CliError(`The \`deploy\` export of ${deployFilePath} returned no \`services\`. Add them, e.g.:\n${EXAMPLE_DEPLOYMENT_EXPORT}`);
 	if (servicesRaw === null || typeof servicesRaw !== "object" || Array.isArray(servicesRaw)) throw new CliError(`deploy.services of ${deployFilePath} must be a record of services keyed by service id.`);
@@ -1390,7 +1426,7 @@ function evaluateDeploymentConfig(options) {
 		if (serviceRaw === null || typeof serviceRaw !== "object" || Array.isArray(serviceRaw)) throw new CliError(`deploy.services.${serviceId} must be an object.`);
 		const record = serviceRaw;
 		for (const field of Object.keys(record)) if (!KNOWN_SERVICE_FIELDS.has(field)) throw new CliError(`deploy.services.${serviceId} has an unknown field ${JSON.stringify(field)}. Known fields: ${[...KNOWN_SERVICE_FIELDS].join(", ")}.`);
-		if (!DEPLOYMENT_SERVICE_TYPES.includes(record.type)) throw new CliError(record.type === void 0 ? `deploy.services.${serviceId} has no \`type\`. Add \`type: "server"\` (single suspending instance, may have persistentVolumes) or \`type: "serverless"\` (scales out, stops on scale-down).` : `deploy.services.${serviceId}.type must be ${DEPLOYMENT_SERVICE_TYPES.map((knownType) => JSON.stringify(knownType)).join(" or ")} (got ${JSON.stringify(record.type)}).`);
+		if (!DEPLOYMENT_SERVICE_TYPES.includes(record.type)) throw new CliError(record.type === void 0 ? `deploy.services.${serviceId} has no \`type\`. Add \`type: "server"\` (single always-on instance, may have persistentVolumes, paid plan) or \`type: "serverless"\` (scales out, stops on scale-down).` : `deploy.services.${serviceId}.type must be ${DEPLOYMENT_SERVICE_TYPES.map((knownType) => JSON.stringify(knownType)).join(" or ")} (got ${JSON.stringify(record.type)}).`);
 		const serviceType = record.type;
 		if (record.public !== void 0 && typeof record.public !== "boolean") throw new CliError(`deploy.services.${serviceId}.public must be true or false (got ${JSON.stringify(record.public)}). It defaults to false — services are private, reachable only by other services in this project.`);
 		const isPublic = record.public === true;
@@ -1428,6 +1464,7 @@ function evaluateDeploymentConfig(options) {
 			if (maxInstances !== void 0 && maxInstances !== 1) throw new CliError(`deploy.services.${serviceId} is a "server", which is always a single instance, so maxInstances must be 1 (got ${maxInstances}). Use \`type: "serverless"\` to scale out.`);
 			if (minInstances !== void 0 && minInstances !== 0 && minInstances !== 1) throw new CliError(`deploy.services.${serviceId} is a "server", which holds a single instance, so minInstances must be 1 (always on, the default) or 0 (suspend when idle) — got ${minInstances}. Use \`type: "serverless"\` to run several instances.`);
 		}
+		const memory = readMemoryField(record.memory, `deploy.services.${serviceId}.memory`, deploymentMemorySizesForType(serviceType, runtime));
 		const persistentVolumes = evaluatePersistentVolumes(serviceId, record.persistentVolumes);
 		if (persistentVolumes !== void 0 && serviceType !== "server") throw new CliError(`deploy.services.${serviceId} declares persistentVolumes but is a "serverless" service. A volume is a disk on one machine — it cannot be shared between instances, so each one would get its own separate copy. Change it to \`type: "server"\`, or drop the volume and keep state in a database or object storage instead.`);
 		if (buildCommand !== void 0 && startCommand === void 0 && image === void 0 && dockerfilePath === void 0) throw new CliError(`deploy.services.${serviceId} has a \`buildCommand\` but no \`image\` or \`dockerfilePath\`, so it is built on the Hexclave base image — which has no command of its own. Add a \`startCommand\` saying how to run it (e.g. startCommand: "npm start").`);
@@ -1441,6 +1478,7 @@ function evaluateDeploymentConfig(options) {
 				ports,
 				min_instances: serviceType === "server" ? minInstances ?? 1 : minInstances,
 				max_instances: maxInstances,
+				memory,
 				root_directory: deploymentServiceIsBuilt({
 					image,
 					build_command: buildCommand
@@ -1495,16 +1533,17 @@ function evaluateDeploymentConfig(options) {
 	for (const [serviceId, service] of services) for (const [envVarKey, value] of Object.entries(service.env)) {
 		if (value.kind !== "connection") continue;
 		const parsed = parseConnectionValue(value.reference);
-		if (parsed === null || parsed.serviceId !== serviceId || parsed.outputKey !== "url") continue;
-		if (service.definition.public !== true) continue;
-		const ports = deploymentPortEntries(service.definition.ports);
-		const port = parsed.port === null ? ports.filter((entry) => entry.protocol === "http")[0] : ports.find((entry) => entry.port === parsed.port);
-		if (port === void 0) continue;
-		throw new CliError(`deploy.services.${serviceId}.env.${envVarKey} connects to the service's own public URL (port ${port.port}), which cannot exist before the service does. Use service("${serviceId}").hostname() for its own address.`);
+		if (parsed === null || parsed.serviceId !== serviceId) continue;
+		const targetIsPublic = parsed.port === null || deploymentPortEntry(service.definition.ports, parsed.port) === null ? null : service.definition.public === true;
+		if (!connectionRequiresTargetDeployed(runtime, parsed.outputKey, parsed.port, targetIsPublic)) continue;
+		throw new CliError(`deploy.services.${serviceId}.env.${envVarKey} connects to the service's own ${parsed.outputKey}, which cannot exist before the service is deployed. ${runtime === "fly" && parsed.outputKey === "url" ? `Use service("${serviceId}").hostname() for its own address.` : "Set it as a plain env var, or have the service read its own address at runtime."}`);
 	}
 	return {
 		sourceId,
-		services
+		services,
+		builder,
+		runtime,
+		version
 	};
 }
 /**
@@ -1513,7 +1552,7 @@ function evaluateDeploymentConfig(options) {
 * services within one level are independent of each other. Throws on circular
 * dependencies, naming the cycle.
 */
-function computeDeploymentLevels(services) {
+function computeDeploymentLevels(services, runtime = DEFAULT_DEPLOYMENT_RUNTIME) {
 	const dependencies = /* @__PURE__ */ new Map();
 	for (const [serviceId, service] of services) {
 		const serviceDependencies = /* @__PURE__ */ new Set();
@@ -1525,7 +1564,7 @@ function computeDeploymentLevels(services) {
 			const target = services.get(targetServiceId);
 			if (target === void 0) continue;
 			const targetIsPublic = parsed.port === null || deploymentPortEntry(target.definition.ports, parsed.port) === null ? null : target.definition.public === true;
-			if (!connectionRequiresTargetDeployed(parsed.outputKey, parsed.port, targetIsPublic)) continue;
+			if (!connectionRequiresTargetDeployed(runtime, parsed.outputKey, parsed.port, targetIsPublic)) continue;
 			if (targetServiceId !== HEXCLAVE_SERVICE_ID && targetServiceId !== serviceId) serviceDependencies.add(targetServiceId);
 		}
 		dependencies.set(serviceId, serviceDependencies);
@@ -1615,9 +1654,9 @@ function resolveHexclaveOutputFromSessionEnv(envVarKey, outputKey, sessionEnv) {
 	}
 }
 /**
-* Loads a TypeScript/JavaScript module via jiti. Shared by the deploy-file and
-* config-file loaders below so both fail with the same error on an unloadable
-* file; `description` names which of the two it was.
+* Loads a TypeScript/JavaScript module via jiti, reporting an unloadable file as
+* a CliError rather than whatever jiti threw. `description` is how the file is
+* named in that error.
 */
 async function importModule(filePath, description) {
 	const { createJiti } = await import("jiti");
@@ -1639,452 +1678,157 @@ async function importDeployModule(deployFilePath) {
 	return {
 		deploymentGroupId: module.deploymentGroupId,
 		legacyId: module.id,
-		deploy: module.deploy
+		deploy: module.deploy,
+		version: module.version
 	};
 }
+//#endregion
+//#region src/commands/deploy.ts
+const RUN_POLL_INTERVAL_MS = 3e3;
+const RUN_POLL_TIMEOUT_MS = 3600 * 1e3;
+const MAX_CONSECUTIVE_POLL_FAILURES = 5;
+const BUILD_LOG_DRAIN_TIMEOUT_MS = 15e3;
 /**
-* Loads a config file (hexclave.config.ts) and returns its `config` export, plus
-* a `deploy` export if it has one — a project small enough to keep its
-* services in the config file may declare them there instead of in a deploy
-* file. Those services belong to a deployment group named after the file (the
-* config file has no `deploymentGroupId` export of its own), so they can coexist
-* with the deploy files of other repositories deploying into the same project.
+* The secret keys that MUST have a stored value for these services to deploy:
+* every secret referenced without a default value. Exported for unit tests.
 */
-async function importConfigModule(configPath) {
-	const module = await importModule(configPath, "config file");
-	return {
-		config: module.config,
-		deploy: module.deploy
-	};
+function collectRequiredSecretKeys(services) {
+	const requiredKeys = /* @__PURE__ */ new Set();
+	for (const service of services) for (const value of Object.values(service.env)) if (value.kind === "secret" && value.defaultValue === void 0) requiredKeys.add(value.secretKey);
+	return [...requiredKeys].sort();
 }
-//#endregion
-//#region src/lib/config-file-path.ts
-function resolveConfigFilePathOption(inputPath, options) {
-	const resolved = resolve(inputPath);
-	const optionName = options?.optionName ?? "--config-file";
-	if (!existsSync(resolved)) {
-		if (options?.mustExist === true) throw new CliError(`Config file not found: ${resolved}`);
-		return resolved;
+async function buildAuthHeadersFactory(auth) {
+	if (isProjectAuthWithSecretServerKey(auth)) {
+		const headers = {
+			"x-stack-access-type": "server",
+			"x-stack-project-id": auth.projectId,
+			"x-stack-secret-server-key": auth.secretServerKey
+		};
+		return () => Promise.resolve(headers);
 	}
-	const stat = statSync(resolved);
-	if (stat.isDirectory()) throw new CliError(`${optionName} must point to a config file, but got a directory: ${resolved}`);
-	if (!stat.isFile()) throw new CliError(`${optionName} must point to a regular config file: ${resolved}`);
-	return resolved;
-}
-//#endregion
-//#region src/lib/progress.ts
-const SPINNER_FRAMES$1 = [
-	"⠋",
-	"⠙",
-	"⠹",
-	"⠸",
-	"⠼",
-	"⠴",
-	"⠦",
-	"⠧",
-	"⠇",
-	"⠏"
-];
-const SPINNER_INTERVAL_MS = 80;
-/**
-* Reports long-running CLI work without contaminating stdout. Interactive
-* terminals get a single animated line, while redirected output gets durable
-* lines that remain useful in CI logs.
-*/
-function startProgress(initialMessage, options = {}) {
-	const stream = options.stream ?? process.stderr;
-	const prefix = options.prefix ?? "";
-	let message = initialMessage;
-	let stopped = false;
-	if (!stream.isTTY) {
-		stream.write(`${prefix}${message}...\n`);
+	const user = await getInternalUser(auth);
+	return async () => {
+		const { accessToken } = await user.currentSession.getTokens();
+		if (accessToken == null) throw new AuthError("Could not obtain an access token. Run `hexclave login` again.");
 		return {
-			update(nextMessage) {
-				if (stopped || nextMessage === message) return;
-				message = nextMessage;
-				stream.write(`${prefix}${message}...\n`);
-			},
-			stop(finalMessage) {
-				if (stopped) return;
-				stopped = true;
-				if (finalMessage != null) stream.write(`${prefix}${finalMessage}\n`);
-			}
+			"x-stack-access-type": "admin",
+			"x-stack-project-id": auth.projectId,
+			"x-stack-admin-access-token": accessToken
 		};
-	}
-	let frameIndex = 0;
-	const render = () => {
-		stream.write(`\r\x1b[2K${prefix}${SPINNER_FRAMES$1[frameIndex]} ${message}`);
-		frameIndex = (frameIndex + 1) % SPINNER_FRAMES$1.length;
 	};
-	render();
-	const timer = setInterval(render, SPINNER_INTERVAL_MS);
-	timer.unref();
-	return {
-		update(nextMessage) {
-			if (stopped || nextMessage === message) return;
-			message = nextMessage;
-			render();
+}
+async function deployApiFetch(auth, getAuthHeaders, apiPath, init) {
+	const url = `${auth.apiUrl.replace(/\/$/, "")}/api/latest${apiPath}`;
+	const response = await fetch(url, {
+		method: init.method,
+		headers: {
+			...await getAuthHeaders(),
+			...init.jsonBody !== void 0 ? { "content-type": "application/json" } : {}
 		},
-		stop(finalMessage) {
-			if (stopped) return;
-			stopped = true;
-			clearInterval(timer);
-			stream.write("\r\x1B[2K");
-			if (finalMessage != null) stream.write(`${prefix}${finalMessage}\n`);
-		}
-	};
+		body: init.jsonBody !== void 0 ? JSON.stringify(init.jsonBody) : void 0
+	});
+	const text = await response.text();
+	if (!response.ok) {
+		let message = text;
+		try {
+			const parsed = JSON.parse(text);
+			if (typeof parsed?.error === "string") message = parsed.error;
+			else if (typeof parsed?.error?.message === "string") message = parsed.error.message;
+		} catch {}
+		throw new CliError(`Deploy request failed (${response.status} at ${init.method} ${apiPath}): ${message.slice(0, 1e3)}`);
+	}
+	try {
+		return text === "" ? void 0 : JSON.parse(text);
+	} catch {
+		throw new CliError(`Unexpected non-JSON response from the Hexclave API at ${init.method} ${apiPath}.`);
+	}
 }
-async function withProgress(message, operation, options) {
-	const progress = startProgress(message, options);
+function wait$1(ms) {
+	return new Promise((resolvePromise) => setTimeout(resolvePromise, ms));
+}
+/**
+* Awaits `promise`, giving up after `ms`. The timer is cleared either way, so
+* winning the race doesn't leave a pending timeout holding the process open for
+* the rest of the window.
+*/
+async function awaitAtMost(promise, ms) {
+	let timer = void 0;
+	const timeout = new Promise((resolvePromise) => {
+		timer = setTimeout(resolvePromise, ms);
+	});
 	try {
-		return await operation();
+		await Promise.race([promise, timeout]);
 	} finally {
-		progress.stop();
+		clearTimeout(timer);
 	}
 }
-//#endregion
-//#region src/commands/config-file.ts
-const SHOW_ONBOARDING_STACK_CONFIG_VALUE = "show-onboarding";
-function isConfigOverride(value) {
-	if (value === null || typeof value !== "object" || Array.isArray(value)) return false;
-	const prototype = Object.getPrototypeOf(value);
-	return prototype === Object.prototype || prototype === null;
+/**
+* followBuildLogs, with any failure of the log stream ITSELF reduced to a
+* warning. Wrapped rather than left bare because this promise is only awaited
+* once the deploy is over: an unhandled rejection in the meantime would be
+* reported as a crash, and a build log that cannot be read is a degraded
+* deploy, never a failed one.
+*/
+async function followBuildLogsSafely(options) {
+	try {
+		await followBuildLogs(options);
+	} catch (error) {
+		console.error(`Warning: stopped streaming the build logs (${errorMessage$1(error)}). They are still readable in the dashboard.`);
+	}
 }
-function parseConfigOverride(value) {
-	if (value === SHOW_ONBOARDING_STACK_CONFIG_VALUE) return {};
-	return isConfigOverride(value) ? value : null;
+/** The build-log endpoint for one deployment. */
+function deploymentBuildLogsUrl(apiUrl, deploymentId) {
+	return `${apiUrl.replace(/\/$/, "")}/api/latest/deployments/deployments/${encodeURIComponent(deploymentId)}/logs`;
 }
-const OWNER_REPO_SEGMENT = /^[A-Za-z0-9._-]+$/;
-function parseOwnerRepo(value, flagName) {
-	const parts = value.split("/");
-	if (parts.length !== 2 || !OWNER_REPO_SEGMENT.test(parts[0]) || !OWNER_REPO_SEGMENT.test(parts[1])) throw new CliError(`${flagName} must be in the format 'owner/repo' using only letters, digits, '.', '_' or '-' (got '${value}').`);
-	return {
-		owner: parts[0],
-		repo: parts[1]
-	};
+function collectPublicUrls(deploySet, services, results) {
+	return deploySet.flatMap((serviceId) => {
+		const service = services.get(serviceId) ?? (() => {
+			throw new CliError(`Internal error: deploy set contains unknown service ${JSON.stringify(serviceId)}.`);
+		})();
+		const result = results.get(serviceId) ?? (() => {
+			throw new CliError(`Internal error: no deploy result for service ${JSON.stringify(serviceId)}.`);
+		})();
+		if (service.definition.public !== true || result.status !== "deployed" || result.url === null) return [];
+		const holderUrl = result.url;
+		return deploymentPortEntries(service.definition.ports).map((entry) => deploymentPortOwnsStandardPorts(service.definition.ports, true, entry.port) ? {
+			serviceId,
+			url: holderUrl
+		} : {
+			serviceId,
+			url: `${holderUrl}:${entry.port}`
+		});
+	});
 }
-function parseGitHubRepositoryEnv() {
-	const repository = process.env.GITHUB_REPOSITORY;
-	if (!repository) return null;
-	try {
-		return parseOwnerRepo(repository, "GITHUB_REPOSITORY");
-	} catch {
-		return null;
+/**
+* Where to read this deployment in the dashboard.
+*
+* The deployments page keeps its selection in the URL, so this can open the
+* exact thing a reader wants: the deployment's service map, or one service's
+* build log. `panel` is the dashboard's own tab id, not a name invented here.
+*/
+function deploymentDashboardUrl(options) {
+	const params = new URLSearchParams({ deploymentId: options.deploymentId });
+	if (options.serviceId != null && options.serviceId !== "") {
+		params.set("serviceId", options.serviceId);
+		if (options.buildLogs === true) params.set("panel", "build-logs");
 	}
+	const route = `/projects/${encodeURIComponent(options.projectId)}/deployments`;
+	const parsed = createUrlIfValid(options.dashboardUrl);
+	if (parsed == null) return `${options.dashboardUrl.replace(/\/+$/, "")}${route}?${params.toString()}`;
+	parsed.pathname = `${parsed.pathname.replace(/\/+$/, "")}${route}`;
+	parsed.search = params.toString();
+	parsed.hash = "";
+	return parsed.toString();
 }
-function normalizeRepoRelativePath(value, flagName) {
-	const normalized = value.trim().replace(/^(?:\.?\/+)+/, "");
-	if (normalized.length === 0) throw new CliError(`${flagName} must be a non-empty repo-relative path string.`);
-	return normalized;
-}
-function buildConfigPushSource(configFilePath, flags) {
-	const dependentFlags = [
-		["--source-repo", flags.sourceRepo],
-		["--source-path", flags.sourcePath],
-		["--source-workflow-path", flags.sourceWorkflowPath]
-	];
-	const providedDependent = dependentFlags.filter(([, v]) => v !== void 0).map(([k]) => k);
-	if (flags.source !== void 0) {
-		if (flags.source !== "github") throw new CliError(`Invalid --source value '${flags.source}'. Only 'github' is supported.`);
-		const missing = dependentFlags.filter(([, v]) => v === void 0).map(([k]) => k);
-		if (missing.length > 0) throw new CliError(`When --source github is specified, the following flags are also required: ${missing.join(", ")}.`);
-		const { owner, repo } = parseOwnerRepo(flags.sourceRepo ?? throwErr("Expected --source-repo to be provided when --source github is specified; this should have been caught by the missing-flags check."), "--source-repo");
-		const sourcePath = normalizeRepoRelativePath(flags.sourcePath ?? throwErr("Expected --source-path to be provided when --source github is specified; this should have been caught by the missing-flags check."), "--source-path");
-		const sourceWorkflowPath = normalizeRepoRelativePath(flags.sourceWorkflowPath ?? throwErr("Expected --source-workflow-path to be provided when --source github is specified; this should have been caught by the missing-flags check."), "--source-workflow-path");
-		const sha = process.env.GITHUB_SHA;
-		const branch = process.env.GITHUB_REF_NAME;
-		if (!sha) throw new CliError("--source github requires the GITHUB_SHA environment variable (commit hash) to be set.");
-		if (!branch) throw new CliError("--source github requires the GITHUB_REF_NAME environment variable (branch) to be set.");
-		return {
-			type: "pushed-from-github",
-			owner,
-			repo,
-			branch,
-			commit_hash: sha,
-			config_file_path: sourcePath,
-			workflow_path: sourceWorkflowPath
-		};
-	}
-	if (providedDependent.length > 0) throw new CliError(`${providedDependent.join(", ")} can only be used with --source github.`);
-	const repository = parseGitHubRepositoryEnv();
-	const sha = process.env.GITHUB_SHA;
-	const branch = process.env.GITHUB_REF_NAME;
-	if (repository && sha && branch) return {
-		type: "pushed-from-github",
-		owner: repository.owner,
-		repo: repository.repo,
-		branch,
-		commit_hash: sha,
-		config_file_path: configFilePath
-	};
-	return { type: "pushed-from-unknown" };
-}
-async function pushConfigWithSecretServerKey(auth, config, source) {
-	const endpoint = `${auth.apiUrl.replace(/\/$/, "")}/api/v1/internal/config/override/branch`;
-	const response = await fetch(endpoint, {
-		method: "PUT",
-		headers: {
-			"content-type": "application/json",
-			"x-stack-project-id": auth.projectId,
-			"x-stack-access-type": "server",
-			"x-stack-secret-server-key": auth.secretServerKey
-		},
-		body: JSON.stringify({
-			config_string: JSON.stringify(config),
-			source
-		})
-	});
-	if (response.ok) return;
-	const responseText = await response.text();
-	throw new CliError(`Failed to push config with HEXCLAVE_SECRET_SERVER_KEY: ${responseText.length > 0 ? responseText : `Request failed with status ${response.status}.`}`);
-}
-/**
-* Pushes a parsed config override to the project's branch config. Shared by
-* `hexclave config push` and `hexclave deploy` (which pushes the config file
-* by default before deploying) so both use the exact same auth paths.
-*/
-async function pushConfigToProject(auth, config, source) {
-	if (isProjectAuthWithSecretServerKey(auth)) await pushConfigWithSecretServerKey(auth, config, source);
-	else {
-		if (!isProjectAuthWithRefreshToken(auth)) throw new CliError("Pushing the config requires either HEXCLAVE_SECRET_SERVER_KEY or `hexclave login`.");
-		await (await getAdminProject(auth)).pushConfig(config, { source: sourceToSdkSource(source) });
-	}
-}
-function sourceToSdkSource(source) {
-	if (source.type === "pushed-from-github") return {
-		type: "pushed-from-github",
-		owner: source.owner,
-		repo: source.repo,
-		branch: source.branch,
-		commitHash: source.commit_hash,
-		configFilePath: source.config_file_path,
-		workflowPath: source.workflow_path
-	};
-	if (source.type === "pushed-from-unknown") return { type: "pushed-from-unknown" };
-	return { type: "unlinked" };
-}
-function resolveConfigFilePathForPull(opts, cwd) {
-	if (opts.configFile != null && opts.configFile !== "") return resolveConfigFilePathOption(opts.configFile);
-	const hexclaveCandidate = path$1.join(cwd, "hexclave.config.ts");
-	const legacyCandidate = path$1.join(cwd, "stack.config.ts");
-	const candidate = fs$1.existsSync(hexclaveCandidate) ? hexclaveCandidate : legacyCandidate;
-	if (!fs$1.existsSync(candidate)) return hexclaveCandidate;
-	if (fs$1.statSync(candidate).isDirectory()) throw new CliError(`Default config path points to a directory instead of a file: ${candidate}`);
-	return candidate;
-}
-function assertConfigPullTarget(filePath, opts) {
-	if (opts.overwrite === true) return;
-	if (fs$1.existsSync(filePath)) throw new CliError(`A config file already exists at ${filePath}. Pass --overwrite to replace it with the pulled config, or remove the file first.`);
-}
-function registerConfigCommand(program) {
-	const config = program.command("config").description("Manage project configuration files");
-	config.command("pull").description("Pull branch config to a local file").option("--cloud-project-id <id>", "Cloud project ID to pull config from (defaults to the HEXCLAVE_PROJECT_ID env var; STACK_PROJECT_ID is also supported)").option("--config-file <path>", "Path to write config file (.ts); defaults to ./hexclave.config.ts in the current directory").option("--overwrite", "Replace the config file if one already exists at the target path").action(async (opts) => {
-		const auth = resolveAuth(resolveProjectId(opts.cloudProjectId));
-		if (!isProjectAuthWithRefreshToken(auth)) throw new CliError("`hexclave config pull` requires `hexclave login`. Unset HEXCLAVE_SECRET_SERVER_KEY (or the legacy STACK_SECRET_SERVER_KEY) and try again.");
-		const filePath = resolveConfigFilePathForPull(opts, process.cwd());
-		if (path$1.extname(filePath) !== ".ts") throw new CliError("Config file must have a .ts extension. Typed config files require TypeScript.");
-		assertConfigPullTarget(filePath, opts);
-		await withProgress("Pulling config", async () => {
-			const configOverride = await (await getAdminProject(auth)).getConfigOverride("branch");
-			if (!isValidConfig(configOverride)) throw new CliError("Pulled branch config is not a valid local config object.");
-			await replaceConfigObject(filePath, configOverride);
-		});
-		console.log(`Config written to ${filePath}`);
-	});
-	config.command("push").description("Push a local config file to branch config").option("--cloud-project-id <id>", "Cloud project ID to push config to (defaults to the HEXCLAVE_PROJECT_ID env var; STACK_PROJECT_ID is also supported)").requiredOption("--config-file <path>", "Path to config file (.js or .ts)").option("--source <type>", "Explicit source type for this push. Only 'github' is supported.").option("--source-repo <owner/repo>", "GitHub repository in 'owner/repo' format. Only allowed with --source github.").option("--source-path <path>", "Path to the config file within the source repository. Only allowed with --source github.").option("--source-workflow-path <path>", "Path to the syncing workflow file within the source repository. Only allowed with --source github.").action(async (opts) => {
-		const auth = resolveAuth(resolveProjectId(opts.cloudProjectId));
-		const filePath = resolveConfigFilePathOption(opts.configFile, { mustExist: true });
-		const ext = path$1.extname(filePath);
-		if (ext !== ".js" && ext !== ".ts") throw new CliError("Config file must have a .js or .ts extension.");
-		const source = buildConfigPushSource(opts.configFile, {
-			source: opts.source,
-			sourceRepo: opts.sourceRepo,
-			sourcePath: opts.sourcePath,
-			sourceWorkflowPath: opts.sourceWorkflowPath
-		});
-		const progress = startProgress("Loading config");
-		try {
-			const { createJiti } = await import("jiti");
-			const config = parseConfigOverride((await createJiti(import.meta.url).import(filePath)).config);
-			if (config == null) throw new CliError(`Config file must export a plain \`config\` object or "show-onboarding". Example: import type { HexclaveConfig } from "${detectImportPackageFromDir(path$1.dirname(filePath)) ?? "@hexclave/js"}"; export const config: HexclaveConfig = { ... };`);
-			progress.update("Pushing config");
-			await pushConfigToProject(auth, config, source);
-		} finally {
-			progress.stop();
-		}
-		console.log("Config pushed successfully.");
-	});
-}
-//#endregion
-//#region src/commands/deploy.ts
-const CONFIG_FILE_CANDIDATES = [
-	"hexclave.config.ts",
-	"hexclave.config.js",
-	"stack.config.ts",
-	"stack.config.js"
-];
-const RUN_POLL_INTERVAL_MS = 3e3;
-const RUN_POLL_TIMEOUT_MS = 3600 * 1e3;
-const MAX_CONSECUTIVE_POLL_FAILURES = 5;
-const BUILD_LOG_DRAIN_TIMEOUT_MS = 15e3;
-/**
-* Resolves the project config file for `--config-push`: --config-file wins (and
-* must exist); otherwise the first existing candidate in cwd. Returns null when
-* nothing was passed and no candidate exists. Exported for unit tests.
-*/
-function resolveConfigPushPath(configOption, cwd) {
-	if (configOption != null && configOption !== "") {
-		const resolved = path.resolve(cwd, configOption);
-		if (!fs.existsSync(resolved) || !fs.statSync(resolved).isFile()) throw new CliError(`Config file not found: ${resolved}`);
-		return resolved;
-	}
-	for (const candidate of CONFIG_FILE_CANDIDATES) {
-		const resolved = path.resolve(cwd, candidate);
-		if (fs.existsSync(resolved) && fs.statSync(resolved).isFile()) return resolved;
-	}
-	return null;
-}
-/**
-* The secret keys that MUST have a stored value for these services to deploy:
-* every secret referenced without a default value. Exported for unit tests.
-*/
-function collectRequiredSecretKeys(services) {
-	const requiredKeys = /* @__PURE__ */ new Set();
-	for (const service of services) for (const value of Object.values(service.env)) if (value.kind === "secret" && value.defaultValue === void 0) requiredKeys.add(value.secretKey);
-	return [...requiredKeys].sort();
-}
-async function buildAuthHeadersFactory(auth) {
-	if (isProjectAuthWithSecretServerKey(auth)) {
-		const headers = {
-			"x-stack-access-type": "server",
-			"x-stack-project-id": auth.projectId,
-			"x-stack-secret-server-key": auth.secretServerKey
-		};
-		return () => Promise.resolve(headers);
-	}
-	const user = await getInternalUser(auth);
-	return async () => {
-		const { accessToken } = await user.currentSession.getTokens();
-		if (accessToken == null) throw new AuthError("Could not obtain an access token. Run `hexclave login` again.");
-		return {
-			"x-stack-access-type": "admin",
-			"x-stack-project-id": auth.projectId,
-			"x-stack-admin-access-token": accessToken
-		};
-	};
-}
-async function deployApiFetch(auth, getAuthHeaders, apiPath, init) {
-	const url = `${auth.apiUrl.replace(/\/$/, "")}/api/latest${apiPath}`;
-	const response = await fetch(url, {
-		method: init.method,
-		headers: {
-			...await getAuthHeaders(),
-			...init.jsonBody !== void 0 ? { "content-type": "application/json" } : {}
-		},
-		body: init.jsonBody !== void 0 ? JSON.stringify(init.jsonBody) : void 0
-	});
-	const text = await response.text();
-	if (!response.ok) {
-		let message = text;
-		try {
-			const parsed = JSON.parse(text);
-			if (typeof parsed?.error === "string") message = parsed.error;
-			else if (typeof parsed?.error?.message === "string") message = parsed.error.message;
-		} catch {}
-		throw new CliError(`Deploy request failed (${response.status} at ${init.method} ${apiPath}): ${message.slice(0, 1e3)}`);
-	}
-	try {
-		return text === "" ? void 0 : JSON.parse(text);
-	} catch {
-		throw new CliError(`Unexpected non-JSON response from the Hexclave API at ${init.method} ${apiPath}.`);
-	}
-}
-function wait$1(ms) {
-	return new Promise((resolvePromise) => setTimeout(resolvePromise, ms));
-}
-/**
-* Awaits `promise`, giving up after `ms`. The timer is cleared either way, so
-* winning the race doesn't leave a pending timeout holding the process open for
-* the rest of the window.
-*/
-async function awaitAtMost(promise, ms) {
-	let timer = void 0;
-	const timeout = new Promise((resolvePromise) => {
-		timer = setTimeout(resolvePromise, ms);
-	});
-	try {
-		await Promise.race([promise, timeout]);
-	} finally {
-		clearTimeout(timer);
-	}
-}
-/**
-* followBuildLogs, with any failure of the log stream ITSELF reduced to a
-* warning. Wrapped rather than left bare because this promise is only awaited
-* once the deploy is over: an unhandled rejection in the meantime would be
-* reported as a crash, and a build log that cannot be read is a degraded
-* deploy, never a failed one.
-*/
-async function followBuildLogsSafely(options) {
-	try {
-		await followBuildLogs(options);
-	} catch (error) {
-		console.error(`Warning: stopped streaming the build logs (${errorMessage$1(error)}). They are still readable in the dashboard.`);
-	}
-}
-/** The build-log endpoint for one deployment. */
-function deploymentBuildLogsUrl(apiUrl, deploymentId) {
-	return `${apiUrl.replace(/\/$/, "")}/api/latest/deployments/deployments/${encodeURIComponent(deploymentId)}/logs`;
-}
-function collectPublicUrls(deploySet, services, results) {
-	return deploySet.flatMap((serviceId) => {
-		const service = services.get(serviceId) ?? (() => {
-			throw new CliError(`Internal error: deploy set contains unknown service ${JSON.stringify(serviceId)}.`);
-		})();
-		const result = results.get(serviceId) ?? (() => {
-			throw new CliError(`Internal error: no deploy result for service ${JSON.stringify(serviceId)}.`);
-		})();
-		if (service.definition.public !== true || result.status !== "deployed" || result.url === null) return [];
-		const holderUrl = result.url;
-		return deploymentPortEntries(service.definition.ports).map((entry) => deploymentPortOwnsStandardPorts(service.definition.ports, true, entry.port) ? {
-			serviceId,
-			url: holderUrl
-		} : {
-			serviceId,
-			url: `${holderUrl}:${entry.port}`
-		});
-	});
-}
-/**
-* Where to read this deployment in the dashboard.
-*
-* The deployments page keeps its selection in the URL, so this can open the
-* exact thing a reader wants: the deployment's service map, or one service's
-* build log. `panel` is the dashboard's own tab id, not a name invented here.
-*/
-function deploymentDashboardUrl(options) {
-	const params = new URLSearchParams({ deploymentId: options.deploymentId });
-	if (options.serviceId != null && options.serviceId !== "") {
-		params.set("serviceId", options.serviceId);
-		if (options.buildLogs === true) params.set("panel", "build-logs");
-	}
-	const route = `/projects/${encodeURIComponent(options.projectId)}/deployments`;
-	const parsed = createUrlIfValid(options.dashboardUrl);
-	if (parsed == null) return `${options.dashboardUrl.replace(/\/+$/, "")}${route}?${params.toString()}`;
-	parsed.pathname = `${parsed.pathname.replace(/\/+$/, "")}${route}`;
-	parsed.search = params.toString();
-	parsed.hash = "";
-	return parsed.toString();
-}
-/**
-* The service whose build log the reader is about to go looking for: the first
-* one that failed, in the order the deploy applied them. Null when none did.
-*
-* The FIRST rather than every one, because a level's failure skips everything
-* after it — later failures are consequences, and the first is the cause.
-*/
-function firstFailedService(deploySet, results) {
-	return deploySet.find((serviceId) => results.get(serviceId)?.status === "failed") ?? null;
+/**
+* The service whose build log the reader is about to go looking for: the first
+* one that failed, in the order the deploy applied them. Null when none did.
+*
+* The FIRST rather than every one, because a level's failure skips everything
+* after it — later failures are consequences, and the first is the cause.
+*/
+function firstFailedService(deploySet, results) {
+	return deploySet.find((serviceId) => results.get(serviceId)?.status === "failed") ?? null;
 }
 /**
 * Packages the deployment source ONCE and uploads it. Every service is built
@@ -2228,51 +1972,69 @@ async function waitForDeployment(options) {
 	}
 }
 /**
-* What this deploy ships: a deploy file when there is one, otherwise the config
-* file, for a project small enough to keep its services there. The config file
-* has no `deploymentGroupId` export, so its deployments belong to a group named
-* after the file itself — which is what lets them coexist with the deploy files
-* of other repositories deploying into the same project.
+* The environment a `hexclave deploy` inherits, reduced to the GitLab-style
+* `CI_*` variables that describe the commit being deployed. Sent with the deploy
+* request and injected into every service's env, so a build can stamp the
+* revision it came from without the deploy file having to name a CI provider.
+*
+* GitLab already sets these, so they pass straight through; GitHub Actions gets
+* translated into the same names, and anything else that exports them by hand
+* wins over both. A variable nothing can answer is simply absent — never an
+* empty string, which a service would read as "set, but blank".
+*
+* Exported for unit tests.
+*/
+function collectCiEnv(rawEnv) {
+	const env = Object.fromEntries(Object.entries(rawEnv).filter((entry) => typeof entry[1] === "string" && entry[1] !== ""));
+	const ciEnv = {
+		CI_COMMIT_SHA: env.CI_COMMIT_SHA ?? env.GITHUB_SHA,
+		CI_COMMIT_SHORT_SHA: env.CI_COMMIT_SHORT_SHA ?? env.GITHUB_SHA?.slice(0, 8),
+		CI_COMMIT_REF_NAME: env.CI_COMMIT_REF_NAME ?? env.GITHUB_HEAD_REF ?? env.GITHUB_REF_NAME,
+		CI_COMMIT_BRANCH: env.CI_COMMIT_BRANCH ?? (env.GITHUB_REF_TYPE === "branch" && !env.GITHUB_HEAD_REF ? env.GITHUB_REF_NAME : void 0),
+		CI_COMMIT_TAG: env.CI_COMMIT_TAG ?? (env.GITHUB_REF_TYPE === "tag" ? env.GITHUB_REF_NAME : void 0),
+		CI_REPOSITORY_URL: env.CI_SERVER_URL && env.CI_PROJECT_PATH ? `${env.CI_SERVER_URL}/${env.CI_PROJECT_PATH}.git` : env.GITHUB_SERVER_URL && env.GITHUB_REPOSITORY ? `${env.GITHUB_SERVER_URL}/${env.GITHUB_REPOSITORY}.git` : void 0
+	};
+	return Object.fromEntries(Object.entries(ciEnv).filter((entry) => entry[1] !== void 0 && entry[1] !== ""));
+}
+/**
+* What this deploy ships: the `deploy` export of a deploy file. Deployments live
+* in their OWN file — hexclave.config.ts holds the project's configuration and
+* nothing else — so a project with no deploy file has nothing to deploy.
 */
 async function resolveDeploySource(deployFileOption, cwd) {
-	if (deployFileOption == null || deployFileOption === "") {
-		const configPath = resolveConfigPushPath(void 0, cwd);
-		if (configPath !== null && !hasDeployFile(cwd)) {
-			const configModule = await importConfigModule(configPath);
-			if (configModule.deploy !== void 0) return {
-				path: configPath,
-				deploymentGroupIdExport: CONFIG_FILE_DEPLOYMENT_SOURCE_ID,
-				deployExport: configModule.deploy
-			};
-		}
-	}
 	const deployFilePath = resolveDeployFilePath(deployFileOption, cwd);
 	const deployModule = await importDeployModule(deployFilePath);
 	return {
 		path: deployFilePath,
 		deploymentGroupIdExport: deployModule.deploymentGroupId,
 		legacyIdExport: deployModule.legacyId,
-		deployExport: deployModule.deploy
+		deployExport: deployModule.deploy,
+		versionExport: deployModule.version
 	};
 }
 function registerDeployCommand(program) {
-	program.command("deploy").description("Deploy the services defined by the `deploy` export of your hexclave.deploy.ts. Syncs the service definitions, then deploys every service in dependency order and waits for the remote builds to finish.").option("--service-id <id>", "Deploy only this service (its connections resolve against already-deployed services)").option("--deploy-file <path>", "Path to the deploy file (default: auto-discover hexclave.deploy.ts in the current directory)").option("--config-push", "Also push the project config file's `config` export to the project before deploying").option("--config-file <path>", "Path to the project config file for --config-push (default: auto-discover hexclave.config.ts in the current directory)").option("--cloud-project-id <id>", "Hexclave project ID to deploy to (defaults to the HEXCLAVE_PROJECT_ID env var)").option("--no-build-logs", "Don't stream the remote build's output; report service status only").addHelpText("after", "\nAuthentication: uses HEXCLAVE_SECRET_SERVER_KEY if set (recommended for CI), otherwise your `hexclave login` session.\nSecrets: values for secret() env vars are read from the dashboard (Project Settings > Secrets); the deploy fails up front and lists every secret that still needs a value there.").action(async (opts) => {
+	program.command("deploy").description("Deploy the services defined by the `deploy` export of your hexclave.deploy.ts. Syncs the service definitions, then deploys every service in dependency order and waits for the remote builds to finish.").option("--service-id <id>", "Deploy only this service (its connections resolve against already-deployed services)").option("--deploy-file <path>", "Path to the deploy file (default: auto-discover hexclave.deploy.ts in the current directory)").option("--cloud-project-id <id>", "Hexclave project ID to deploy to (defaults to the HEXCLAVE_PROJECT_ID env var)").option("--no-build-logs", "Don't stream the remote build's output; report service status only").addHelpText("after", "\nAuthentication: uses HEXCLAVE_SECRET_SERVER_KEY if set (recommended for CI), otherwise your `hexclave login` session.\nSecrets: values for secret() env vars are read from the dashboard (Project Settings > Secrets); the deploy fails up front and lists every secret that still needs a value there.").action(async (opts) => {
 		const auth = resolveAuth(resolveProjectId(opts.cloudProjectId));
 		const authHeaders = await buildAuthHeadersFactory(auth);
 		const deploySource = await resolveDeploySource(opts.deployFile, process.cwd());
-		const { sourceId, services } = evaluateDeploymentConfig({
+		const { sourceId, services, builder, runtime, version } = evaluateDeploymentConfig({
 			deployFilePath: deploySource.path,
 			deploymentGroupIdExport: deploySource.deploymentGroupIdExport,
 			legacyIdExport: deploySource.legacyIdExport,
 			deployExport: deploySource.deployExport,
+			versionExport: deploySource.versionExport,
 			mode: "deploy"
 		});
 		let levels;
 		if (opts.serviceId != null) {
 			if (services.get(opts.serviceId) == null) throw new CliError(`No service named ${JSON.stringify(opts.serviceId)} in the deploy file's \`deploy\` export. Available services: ${[...services.keys()].join(", ")}.`);
 			levels = [[opts.serviceId]];
-		} else levels = computeDeploymentLevels(services);
+		} else levels = computeDeploymentLevels(services, runtime);
 		const deploySet = levels.flat();
+		if (builder?.memory !== void 0 && !deploySet.some((serviceId) => {
+			const service = services.get(serviceId);
+			return service !== void 0 && deploymentServiceIsBuilt(service.definition);
+		})) console.error(`Note: deploy.builder sets memory ${JSON.stringify(builder.memory)}, but ${opts.serviceId != null ? `services.${opts.serviceId} runs` : "every service in this deploy runs"} an already-built image, so no builder machine starts and the size has no effect here.`);
 		const requiredSecretKeys = collectRequiredSecretKeys(deploySet.map((serviceId) => services.get(serviceId) ?? (() => {
 			throw new CliError(`Internal error: deploy set contains unknown service ${JSON.stringify(serviceId)}.`);
 		})()));
@@ -2287,22 +2049,14 @@ function registerDeployCommand(program) {
 				"All of them must be set in the dashboard under Project Settings > Secrets before this deploy can run."
 			].join("\n"));
 		}
-		if (opts.configPush === true) {
-			const configPath = resolveConfigPushPath(opts.configFile, process.cwd());
-			if (configPath == null) throw new CliError(`--config-push was passed, but no config file was found in ${process.cwd()} (looked for ${CONFIG_FILE_CANDIDATES.join(", ")}). Pass --config-file <path>, or drop --config-push to deploy without publishing the project config.`);
-			const configModule = await importConfigModule(configPath);
-			if (configModule.config === void 0) throw new CliError(`--config-push was passed, but ${configPath} has no \`config\` export. Add one, or drop --config-push.`);
-			const config = parseConfigOverride(configModule.config);
-			if (config == null) throw new CliError(`The \`config\` export of ${configPath} must be a plain object (or "show-onboarding"). Fix it, or drop --config-push to deploy without pushing the config.`);
-			console.error("Pushing config...");
-			await pushConfigToProject(auth, config, buildConfigPushSource(path.relative(process.cwd(), configPath).split(path.sep).join("/"), {}));
-		}
 		console.error(`Syncing ${services.size} service definition${services.size === 1 ? "" : "s"} for deployment source ${JSON.stringify(sourceId)}...`);
 		const syncResponse = await deployApiFetch(auth, authHeaders, "/deployments/services", {
 			method: "PUT",
 			jsonBody: {
 				source_id: sourceId,
-				services: Object.fromEntries([...services.values()].map((service) => [service.serviceId, service.definition]))
+				services: Object.fromEntries([...services.values()].map((service) => [service.serviceId, service.definition])),
+				...builder === void 0 ? {} : { builder },
+				...version === void 0 ? {} : { version }
 			}
 		});
 		if (typeof syncResponse?.sync_id !== "string") throw new CliError("Unexpected response from the Hexclave API when syncing service definitions.");
@@ -2334,12 +2088,18 @@ function registerDeployCommand(program) {
 				secret_defaults: Object.fromEntries(deploySet.map((serviceId) => [serviceId, collectSecretDefaults(services.get(serviceId) ?? (() => {
 					throw new CliError(`Internal error: deploy set contains unknown service ${JSON.stringify(serviceId)}.`);
 				})())])),
+				ci_env: collectCiEnv(process.env),
 				triggered_by: "cli"
 			}
 		});
 		if (typeof deploymentResponse?.id !== "string") throw new CliError("Unexpected response from the Hexclave API when starting the deployment.");
 		const deploymentId = deploymentResponse.id;
 		console.error(`Deployment #${deploymentResponse.number} started. ${buildsFromSource ? "Waiting for the remote build..." : "Nothing to build — waiting for the services to come up..."}`);
+		for (const notice of Array.isArray(deploymentResponse.notices) ? deploymentResponse.notices : []) {
+			if (typeof notice !== "string") continue;
+			console.error("");
+			console.error(notice);
+		}
 		const streamBuildLogs = buildsFromSource && opts.buildLogs !== false;
 		let deploymentFinished = false;
 		const buildLogsAbort = new AbortController();
@@ -2433,6 +2193,20 @@ function registerDeployCommand(program) {
 	});
 }
 //#endregion
+//#region src/lib/config-file-path.ts
+function resolveConfigFilePathOption(inputPath, options) {
+	const resolved = resolve(inputPath);
+	const optionName = options?.optionName ?? "--config-file";
+	if (!existsSync(resolved)) {
+		if (options?.mustExist === true) throw new CliError(`Config file not found: ${resolved}`);
+		return resolved;
+	}
+	const stat = statSync(resolved);
+	if (stat.isDirectory()) throw new CliError(`${optionName} must point to a config file, but got a directory: ${resolved}`);
+	if (!stat.isFile()) throw new CliError(`${optionName} must point to a regular config file: ${resolved}`);
+	return resolved;
+}
+//#endregion
 //#region src/lib/dev-env-state.ts
 function devEnvStatePath() {
 	return hexclaveDevEnvStatePath();
@@ -2680,6 +2454,254 @@ function registerExecCommand(program) {
 	});
 }
 //#endregion
+//#region src/lib/progress.ts
+const SPINNER_FRAMES$1 = [
+	"⠋",
+	"⠙",
+	"⠹",
+	"⠸",
+	"⠼",
+	"⠴",
+	"⠦",
+	"⠧",
+	"⠇",
+	"⠏"
+];
+const SPINNER_INTERVAL_MS = 80;
+/**
+* Reports long-running CLI work without contaminating stdout. Interactive
+* terminals get a single animated line, while redirected output gets durable
+* lines that remain useful in CI logs.
+*/
+function startProgress(initialMessage, options = {}) {
+	const stream = options.stream ?? process.stderr;
+	const prefix = options.prefix ?? "";
+	let message = initialMessage;
+	let stopped = false;
+	if (!stream.isTTY) {
+		stream.write(`${prefix}${message}...\n`);
+		return {
+			update(nextMessage) {
+				if (stopped || nextMessage === message) return;
+				message = nextMessage;
+				stream.write(`${prefix}${message}...\n`);
+			},
+			stop(finalMessage) {
+				if (stopped) return;
+				stopped = true;
+				if (finalMessage != null) stream.write(`${prefix}${finalMessage}\n`);
+			}
+		};
+	}
+	let frameIndex = 0;
+	const render = () => {
+		stream.write(`\r\x1b[2K${prefix}${SPINNER_FRAMES$1[frameIndex]} ${message}`);
+		frameIndex = (frameIndex + 1) % SPINNER_FRAMES$1.length;
+	};
+	render();
+	const timer = setInterval(render, SPINNER_INTERVAL_MS);
+	timer.unref();
+	return {
+		update(nextMessage) {
+			if (stopped || nextMessage === message) return;
+			message = nextMessage;
+			render();
+		},
+		stop(finalMessage) {
+			if (stopped) return;
+			stopped = true;
+			clearInterval(timer);
+			stream.write("\r\x1B[2K");
+			if (finalMessage != null) stream.write(`${prefix}${finalMessage}\n`);
+		}
+	};
+}
+async function withProgress(message, operation, options) {
+	const progress = startProgress(message, options);
+	try {
+		return await operation();
+	} finally {
+		progress.stop();
+	}
+}
+//#endregion
+//#region src/commands/config-file.ts
+const SHOW_ONBOARDING_STACK_CONFIG_VALUE = "show-onboarding";
+function isConfigOverride(value) {
+	if (value === null || typeof value !== "object" || Array.isArray(value)) return false;
+	const prototype = Object.getPrototypeOf(value);
+	return prototype === Object.prototype || prototype === null;
+}
+function parseConfigOverride(value) {
+	if (value === SHOW_ONBOARDING_STACK_CONFIG_VALUE) return {};
+	return isConfigOverride(value) ? value : null;
+}
+const OWNER_REPO_SEGMENT = /^[A-Za-z0-9._-]+$/;
+function parseOwnerRepo(value, flagName) {
+	const parts = value.split("/");
+	if (parts.length !== 2 || !OWNER_REPO_SEGMENT.test(parts[0]) || !OWNER_REPO_SEGMENT.test(parts[1])) throw new CliError(`${flagName} must be in the format 'owner/repo' using only letters, digits, '.', '_' or '-' (got '${value}').`);
+	return {
+		owner: parts[0],
+		repo: parts[1]
+	};
+}
+function parseGitHubRepositoryEnv() {
+	const repository = process.env.GITHUB_REPOSITORY;
+	if (!repository) return null;
+	try {
+		return parseOwnerRepo(repository, "GITHUB_REPOSITORY");
+	} catch {
+		return null;
+	}
+}
+function normalizeRepoRelativePath(value, flagName) {
+	const normalized = value.trim().replace(/^(?:\.?\/+)+/, "");
+	if (normalized.length === 0) throw new CliError(`${flagName} must be a non-empty repo-relative path string.`);
+	return normalized;
+}
+function buildConfigPushSource(configFilePath, flags) {
+	const dependentFlags = [
+		["--source-repo", flags.sourceRepo],
+		["--source-path", flags.sourcePath],
+		["--source-workflow-path", flags.sourceWorkflowPath]
+	];
+	const providedDependent = dependentFlags.filter(([, v]) => v !== void 0).map(([k]) => k);
+	if (flags.source !== void 0) {
+		if (flags.source !== "github") throw new CliError(`Invalid --source value '${flags.source}'. Only 'github' is supported.`);
+		const missing = dependentFlags.filter(([, v]) => v === void 0).map(([k]) => k);
+		if (missing.length > 0) throw new CliError(`When --source github is specified, the following flags are also required: ${missing.join(", ")}.`);
+		const { owner, repo } = parseOwnerRepo(flags.sourceRepo ?? throwErr("Expected --source-repo to be provided when --source github is specified; this should have been caught by the missing-flags check."), "--source-repo");
+		const sourcePath = normalizeRepoRelativePath(flags.sourcePath ?? throwErr("Expected --source-path to be provided when --source github is specified; this should have been caught by the missing-flags check."), "--source-path");
+		const sourceWorkflowPath = normalizeRepoRelativePath(flags.sourceWorkflowPath ?? throwErr("Expected --source-workflow-path to be provided when --source github is specified; this should have been caught by the missing-flags check."), "--source-workflow-path");
+		const sha = process.env.GITHUB_SHA;
+		const branch = process.env.GITHUB_REF_NAME;
+		if (!sha) throw new CliError("--source github requires the GITHUB_SHA environment variable (commit hash) to be set.");
+		if (!branch) throw new CliError("--source github requires the GITHUB_REF_NAME environment variable (branch) to be set.");
+		return {
+			type: "pushed-from-github",
+			owner,
+			repo,
+			branch,
+			commit_hash: sha,
+			config_file_path: sourcePath,
+			workflow_path: sourceWorkflowPath
+		};
+	}
+	if (providedDependent.length > 0) throw new CliError(`${providedDependent.join(", ")} can only be used with --source github.`);
+	const repository = parseGitHubRepositoryEnv();
+	const sha = process.env.GITHUB_SHA;
+	const branch = process.env.GITHUB_REF_NAME;
+	if (repository && sha && branch) return {
+		type: "pushed-from-github",
+		owner: repository.owner,
+		repo: repository.repo,
+		branch,
+		commit_hash: sha,
+		config_file_path: configFilePath
+	};
+	return { type: "pushed-from-unknown" };
+}
+async function pushConfigWithSecretServerKey(auth, config, source) {
+	const endpoint = `${auth.apiUrl.replace(/\/$/, "")}/api/v1/internal/config/override/branch`;
+	const response = await fetch(endpoint, {
+		method: "PUT",
+		headers: {
+			"content-type": "application/json",
+			"x-stack-project-id": auth.projectId,
+			"x-stack-access-type": "server",
+			"x-stack-secret-server-key": auth.secretServerKey
+		},
+		body: JSON.stringify({
+			config_string: JSON.stringify(config),
+			source
+		})
+	});
+	if (response.ok) return;
+	const responseText = await response.text();
+	throw new CliError(`Failed to push config with HEXCLAVE_SECRET_SERVER_KEY: ${responseText.length > 0 ? responseText : `Request failed with status ${response.status}.`}`);
+}
+/**
+* Pushes a parsed config override to the project's branch config, for
+* `hexclave config push`. Publishing the project's configuration is deliberately
+* its own command: `hexclave deploy` ships this repository's services and never
+* touches the config, so one of several repositories deploying into a project
+* cannot overwrite the others' configuration on the way past.
+*/
+async function pushConfigToProject(auth, config, source) {
+	if (isProjectAuthWithSecretServerKey(auth)) await pushConfigWithSecretServerKey(auth, config, source);
+	else {
+		if (!isProjectAuthWithRefreshToken(auth)) throw new CliError("Pushing the config requires either HEXCLAVE_SECRET_SERVER_KEY or `hexclave login`.");
+		await (await getAdminProject(auth)).pushConfig(config, { source: sourceToSdkSource(source) });
+	}
+}
+function sourceToSdkSource(source) {
+	if (source.type === "pushed-from-github") return {
+		type: "pushed-from-github",
+		owner: source.owner,
+		repo: source.repo,
+		branch: source.branch,
+		commitHash: source.commit_hash,
+		configFilePath: source.config_file_path,
+		workflowPath: source.workflow_path
+	};
+	if (source.type === "pushed-from-unknown") return { type: "pushed-from-unknown" };
+	return { type: "unlinked" };
+}
+function resolveConfigFilePathForPull(opts, cwd) {
+	if (opts.configFile != null && opts.configFile !== "") return resolveConfigFilePathOption(opts.configFile);
+	const hexclaveCandidate = path$1.join(cwd, "hexclave.config.ts");
+	const legacyCandidate = path$1.join(cwd, "stack.config.ts");
+	const candidate = fs$1.existsSync(hexclaveCandidate) ? hexclaveCandidate : legacyCandidate;
+	if (!fs$1.existsSync(candidate)) return hexclaveCandidate;
+	if (fs$1.statSync(candidate).isDirectory()) throw new CliError(`Default config path points to a directory instead of a file: ${candidate}`);
+	return candidate;
+}
+function assertConfigPullTarget(filePath, opts) {
+	if (opts.overwrite === true) return;
+	if (fs$1.existsSync(filePath)) throw new CliError(`A config file already exists at ${filePath}. Pass --overwrite to replace it with the pulled config, or remove the file first.`);
+}
+function registerConfigCommand(program) {
+	const config = program.command("config").description("Manage project configuration files");
+	config.command("pull").description("Pull branch config to a local file").option("--cloud-project-id <id>", "Cloud project ID to pull config from (defaults to the HEXCLAVE_PROJECT_ID env var; STACK_PROJECT_ID is also supported)").option("--config-file <path>", "Path to write config file (.ts); defaults to ./hexclave.config.ts in the current directory").option("--overwrite", "Replace the config file if one already exists at the target path").action(async (opts) => {
+		const auth = resolveAuth(resolveProjectId(opts.cloudProjectId));
+		if (!isProjectAuthWithRefreshToken(auth)) throw new CliError("`hexclave config pull` requires `hexclave login`. Unset HEXCLAVE_SECRET_SERVER_KEY (or the legacy STACK_SECRET_SERVER_KEY) and try again.");
+		const filePath = resolveConfigFilePathForPull(opts, process.cwd());
+		if (path$1.extname(filePath) !== ".ts") throw new CliError("Config file must have a .ts extension. Typed config files require TypeScript.");
+		assertConfigPullTarget(filePath, opts);
+		await withProgress("Pulling config", async () => {
+			const configOverride = await (await getAdminProject(auth)).getConfigOverride("branch");
+			if (!isValidConfig(configOverride)) throw new CliError("Pulled branch config is not a valid local config object.");
+			await replaceConfigObject(filePath, configOverride);
+		});
+		console.log(`Config written to ${filePath}`);
+	});
+	config.command("push").description("Push a local config file to branch config").option("--cloud-project-id <id>", "Cloud project ID to push config to (defaults to the HEXCLAVE_PROJECT_ID env var; STACK_PROJECT_ID is also supported)").requiredOption("--config-file <path>", "Path to config file (.js or .ts)").option("--source <type>", "Explicit source type for this push. Only 'github' is supported.").option("--source-repo <owner/repo>", "GitHub repository in 'owner/repo' format. Only allowed with --source github.").option("--source-path <path>", "Path to the config file within the source repository. Only allowed with --source github.").option("--source-workflow-path <path>", "Path to the syncing workflow file within the source repository. Only allowed with --source github.").action(async (opts) => {
+		const auth = resolveAuth(resolveProjectId(opts.cloudProjectId));
+		const filePath = resolveConfigFilePathOption(opts.configFile, { mustExist: true });
+		const ext = path$1.extname(filePath);
+		if (ext !== ".js" && ext !== ".ts") throw new CliError("Config file must have a .js or .ts extension.");
+		const source = buildConfigPushSource(opts.configFile, {
+			source: opts.source,
+			sourceRepo: opts.sourceRepo,
+			sourcePath: opts.sourcePath,
+			sourceWorkflowPath: opts.sourceWorkflowPath
+		});
+		const progress = startProgress("Loading config");
+		try {
+			const { createJiti } = await import("jiti");
+			const configModule = await createJiti(import.meta.url).import(filePath);
+			if ("deploy" in configModule) throw new CliError(`${filePath} has a \`deploy\` export. Service definitions no longer live in the config file — move it to a hexclave.deploy.ts (with an \`export const deploymentGroupId = "..."\` naming the deployment group) and ship it with \`hexclave deploy\`, which is a separate command from \`hexclave config push\`.`);
+			const config = parseConfigOverride(configModule.config);
+			if (config == null) throw new CliError(`Config file must export a plain \`config\` object or "show-onboarding". Example: import type { HexclaveConfig } from "${detectImportPackageFromDir(path$1.dirname(filePath)) ?? "@hexclave/js"}"; export const config: HexclaveConfig = { ... };`);
+			progress.update("Pushing config");
+			await pushConfigToProject(auth, config, source);
+		} finally {
+			progress.stop();
+		}
+		console.log("Config pushed successfully.");
+	});
+}
+//#endregion
 //#region src/lib/claude-agent.ts
 const SPINNER_FRAMES = [
 	"⠋",
@@ -3571,7 +3593,7 @@ function splitDevCommandArgs(commandArgs) {
 	};
 }
 /**
-* Wraps a devCommand string (from the config's `services` export) for
+* Wraps a devCommand string (from the deploy file's `deploy` export) for
 * execution through the platform shell — unlike the `-- <command> [args...]`
 * form, a devCommand is a single command LINE (e.g. "pnpm dev --port 3000")
 * and may use shell syntax. Exported for unit tests.
@@ -4189,6 +4211,7 @@ function registerDevCommand(program) {
 				deploymentGroupIdExport: deployModule.deploymentGroupId,
 				legacyIdExport: deployModule.legacyId,
 				deployExport: deployModule.deploy,
+				versionExport: deployModule.version,
 				mode: "dev"
 			});
 			devService = services.get(opts.serviceId);
@@ -4201,7 +4224,7 @@ function registerDevCommand(program) {
 					return null;
 				}
 			})();
-			if (rootDirectoryStats == null || !rootDirectoryStats.isDirectory()) throw new CliError(`The rootDirectory of the service ${JSON.stringify(opts.serviceId)} is ${devService.absoluteRootDirectory}, which ${rootDirectoryStats == null ? "does not exist" : "is not a directory"}. Fix \`rootDirectory\` in the config file's services export — it is where the service's devCommand runs.`);
+			if (rootDirectoryStats == null || !rootDirectoryStats.isDirectory()) throw new CliError(`The rootDirectory of the service ${JSON.stringify(opts.serviceId)} is ${devService.absoluteRootDirectory}, which ${rootDirectoryStats == null ? "does not exist" : "is not a directory"}. Fix \`rootDirectory\` in the deploy file's \`deploy\` export — it is where the service's devCommand runs.`);
 		}
 		const childCommand = commandArgs.length > 0 ? splitDevCommandArgs(commandArgs) : shellChildCommand(devService?.devCommand ?? (() => {
 			throw new CliError("Internal error: no dev command resolved despite the checks above.");