@hexclave/cli 1.0.61 → 1.0.63

package/dist/index.js

@@ -2,19 +2,23 @@
 import { n as CliError, r as errorMessage$1, t as AuthError } from "./errors-CyPbl0LV.js";
 import * as Sentry from "@sentry/node";
 import "@hexclave/shared/dist/utils/env";
-import { captureError, registerErrorSink, throwErr } from "@hexclave/shared/dist/utils/errors";
+import { StatusError, captureError, registerErrorSink, throwErr } from "@hexclave/shared/dist/utils/errors";
 import { ignoreUnhandledRejection } from "@hexclave/shared/dist/utils/promises";
 import { sentryBaseConfig } from "@hexclave/shared/dist/utils/sentry";
 import { nicify } from "@hexclave/shared/dist/utils/strings";
 import * as os from "os";
 import { homedir } from "os";
-import * as fs from "fs";
+import * as fs$1 from "fs";
 import { chmodSync, closeSync, cpSync, createReadStream, createWriteStream, existsSync, mkdirSync, openSync, readFileSync, readdirSync, renameSync, rmSync, statSync, unlinkSync, writeFileSync, writeSync } from "fs";
-import * as path from "path";
+import * as path$1 from "path";
 import { dirname, join, resolve } from "path";
 import { fileURLToPath } from "url";
 import { Command } from "commander";
 import { StackClientApp } from "@hexclave/js";
+import fs from "node:fs";
+import path from "node:path";
+import { createTar } from "@hexclave/shared/dist/utils/tar";
+import { gzipSync } from "node:zlib";
 import { hexclaveDevEnvStatePath } from "@hexclave/shared/dist/utils/dev-env-state-path";
 import { createHash, randomBytes } from "crypto";
 import { replaceConfigObject } from "@hexclave/shared-backend";
@@ -126,25 +130,25 @@ function initSentry() {
 //#endregion
 //#region src/lib/config.ts
 const ENV_CONFIG_PATH = process.env.STACK_CLI_CONFIG_PATH;
-const HEXCLAVE_CONFIG_PATH = path.join(os.homedir(), ".config", "hexclave", "credentials.json");
-const LEGACY_CONFIG_PATH = path.join(os.homedir(), ".config", "stack-auth", "credentials.json");
+const HEXCLAVE_CONFIG_PATH = path$1.join(os.homedir(), ".config", "hexclave", "credentials.json");
+const LEGACY_CONFIG_PATH = path$1.join(os.homedir(), ".config", "stack-auth", "credentials.json");
 const WRITE_CONFIG_PATH = ENV_CONFIG_PATH ?? HEXCLAVE_CONFIG_PATH;
 function resolveReadConfigPath() {
 	if (ENV_CONFIG_PATH != null) return ENV_CONFIG_PATH;
-	if (fs.existsSync(HEXCLAVE_CONFIG_PATH)) return HEXCLAVE_CONFIG_PATH;
-	if (fs.existsSync(LEGACY_CONFIG_PATH)) return LEGACY_CONFIG_PATH;
+	if (fs$1.existsSync(HEXCLAVE_CONFIG_PATH)) return HEXCLAVE_CONFIG_PATH;
+	if (fs$1.existsSync(LEGACY_CONFIG_PATH)) return LEGACY_CONFIG_PATH;
 	return HEXCLAVE_CONFIG_PATH;
 }
 function readConfigJson() {
 	try {
-		return JSON.parse(fs.readFileSync(resolveReadConfigPath(), "utf-8"));
+		return JSON.parse(fs$1.readFileSync(resolveReadConfigPath(), "utf-8"));
 	} catch {
 		return {};
 	}
 }
 function writeConfigJson(data) {
-	fs.mkdirSync(path.dirname(WRITE_CONFIG_PATH), { recursive: true });
-	fs.writeFileSync(WRITE_CONFIG_PATH, JSON.stringify(data, null, 2) + "\n", { mode: 384 });
+	fs$1.mkdirSync(path$1.dirname(WRITE_CONFIG_PATH), { recursive: true });
+	fs$1.writeFileSync(WRITE_CONFIG_PATH, JSON.stringify(data, null, 2) + "\n", { mode: 384 });
 }
 function readConfigValue(key) {
 	return readConfigJson()[key];
@@ -277,6 +281,453 @@ function registerLogoutCommand(program) {
 	});
 }
 //#endregion
+//#region src/lib/app.ts
+var app_exports = /* @__PURE__ */ __exportAll({
+	getAdminProject: () => getAdminProject,
+	getInternalApp: () => getInternalApp,
+	getInternalUser: () => getInternalUser
+});
+function getInternalApp(auth) {
+	return new StackClientApp({
+		projectId: "internal",
+		publishableClientKey: auth.publishableClientKey,
+		baseUrl: auth.apiUrl,
+		tokenStore: {
+			accessToken: "",
+			refreshToken: auth.refreshToken
+		},
+		noAutomaticPrefetch: true
+	});
+}
+async function getInternalUser(auth) {
+	return await getInternalApp(auth).getUser({ or: "throw" });
+}
+async function getAdminProject(auth) {
+	const project = (await (await getInternalUser(auth)).listOwnedProjects()).find((p) => p.id === auth.projectId);
+	if (!project) throw new AuthError(`Project '${auth.projectId}' not found. Make sure you own this project.`);
+	return project;
+}
+//#endregion
+//#region src/lib/ignore-rules.ts
+function escapeRegExpChar(char) {
+	return /[.*+?^${}()|[\]\\]/.test(char) ? `\\${char}` : char;
+}
+function globSegmentToRegex(segment) {
+	let result = "";
+	for (let i = 0; i < segment.length; i++) {
+		const char = segment[i];
+		if (char === "\\" && i + 1 < segment.length) {
+			result += escapeRegExpChar(segment[i + 1]);
+			i++;
+		} else if (char === "*") result += "[^/]*";
+		else if (char === "?") result += "[^/]";
+		else if (char === "[") {
+			let j = i + 1;
+			let negatedClass = false;
+			if (segment[j] === "!" || segment[j] === "^") {
+				negatedClass = true;
+				j++;
+			}
+			let classEnd = segment[j] === "]" ? segment.indexOf("]", j + 1) : segment.indexOf("]", j);
+			if (classEnd === -1) result += escapeRegExpChar(char);
+			else {
+				const safeInner = [...segment.slice(j, classEnd)].map((c) => c === "-" ? "-" : escapeRegExpChar(c)).join("");
+				result += `[${negatedClass ? "^" : ""}${safeInner}]`;
+				i = classEnd;
+			}
+		} else result += escapeRegExpChar(char);
+	}
+	return result;
+}
+function parseIgnorePattern(line) {
+	let pattern = line.replace(/\r$/, "");
+	pattern = pattern.replace(/(?<!\\) +$/, "");
+	if (pattern === "" || pattern.startsWith("#")) return;
+	let negated = false;
+	if (pattern.startsWith("!")) {
+		negated = true;
+		pattern = pattern.slice(1);
+	}
+	let dirOnly = false;
+	if (pattern.endsWith("/")) {
+		dirOnly = true;
+		pattern = pattern.slice(0, -1);
+	}
+	if (pattern === "") return;
+	const anchored = pattern.includes("/");
+	if (pattern.startsWith("/")) pattern = pattern.slice(1);
+	const segments = pattern.split("/");
+	const regexParts = [];
+	for (let i = 0; i < segments.length; i++) {
+		const segment = segments[i];
+		if (segment === "**") regexParts.push(i === segments.length - 1 ? ".*" : "(?:[^/]+/)*");
+		else regexParts.push(globSegmentToRegex(segment) + (i === segments.length - 1 ? "" : "/"));
+	}
+	const body = regexParts.join("");
+	return {
+		negated,
+		dirOnly,
+		regex: new RegExp(`^${anchored ? "" : "(?:[^/]+/)*"}${body}$`)
+	};
+}
+function parseIgnoreFile(content) {
+	return content.split("\n").map(parseIgnorePattern).filter((rule) => rule !== void 0);
+}
+//#endregion
+//#region src/lib/source-packaging.ts
+const IGNORE_FILE_NAMES = [".gitignore", ".vercelignore"];
+const ALWAYS_EXCLUDED_DIR_NAMES = /* @__PURE__ */ new Set(["node_modules", ".git"]);
+function relativeToScope(scope, absolutePath) {
+	const relativePath = path.relative(scope.baseDirectory, absolutePath);
+	if (relativePath === "" || relativePath === ".." || relativePath.startsWith(`..${path.sep}`) || path.isAbsolute(relativePath)) return;
+	return relativePath.split(path.sep).join("/");
+}
+function isIgnored(scopes, absolutePath, isDirectory) {
+	let ignored = false;
+	for (const scope of scopes) {
+		const scopedPath = relativeToScope(scope, absolutePath);
+		if (scopedPath === void 0) continue;
+		for (const rule of scope.rules) {
+			if (rule.dirOnly && !isDirectory) continue;
+			if (rule.regex.test(scopedPath)) ignored = !rule.negated;
+		}
+	}
+	return ignored;
+}
+function readIgnoreScopes(directory) {
+	const scopes = [];
+	for (const ignoreFileName of IGNORE_FILE_NAMES) {
+		const ignoreFilePath = path.join(directory, ignoreFileName);
+		if (fs.existsSync(ignoreFilePath) && fs.statSync(ignoreFilePath).isFile()) scopes.push({
+			baseDirectory: directory,
+			rules: parseIgnoreFile(fs.readFileSync(ignoreFilePath, "utf-8"))
+		});
+	}
+	return scopes;
+}
+/**
+* Packages `rootDirectory`. `ignoreRootDirectory` is the outermost directory
+* whose ignore files apply; deploy passes the config directory so a service in
+* a monorepo subdirectory inherits the repository-level .gitignore and
+* .vercelignore rules.
+*/
+function packageSourceDirectory(rootDirectory, ignoreRootDirectory = rootDirectory) {
+	const absoluteRootDirectory = path.resolve(rootDirectory);
+	const absoluteIgnoreRootDirectory = path.resolve(ignoreRootDirectory);
+	const rootStat = fs.statSync(absoluteRootDirectory, { throwIfNoEntry: false });
+	if (rootStat == null || !rootStat.isDirectory()) throw new CliError(`Source directory not found: ${absoluteRootDirectory}`);
+	const relativeRootFromIgnoreRoot = path.relative(absoluteIgnoreRootDirectory, absoluteRootDirectory);
+	if (relativeRootFromIgnoreRoot === ".." || relativeRootFromIgnoreRoot.startsWith(`..${path.sep}`) || path.isAbsolute(relativeRootFromIgnoreRoot)) throw new CliError(`Source directory ${absoluteRootDirectory} must be inside the config directory ${absoluteIgnoreRootDirectory}.`);
+	const entries = [];
+	let totalBytes = 0;
+	const walk = (absoluteDir, relativeDir, parentScopes) => {
+		const scopes = [...parentScopes, ...readIgnoreScopes(absoluteDir)];
+		const dirents = fs.readdirSync(absoluteDir, { withFileTypes: true }).sort((a, b) => a.name < b.name ? -1 : a.name > b.name ? 1 : 0);
+		for (const dirent of dirents) {
+			const relativePath = relativeDir === "" ? dirent.name : `${relativeDir}/${dirent.name}`;
+			const absolutePath = path.join(absoluteDir, dirent.name);
+			if (dirent.isSymbolicLink()) continue;
+			if (dirent.isDirectory()) {
+				if (ALWAYS_EXCLUDED_DIR_NAMES.has(dirent.name)) continue;
+				if (isIgnored(scopes, absolutePath, true)) continue;
+				walk(absolutePath, relativePath, scopes);
+			} else if (dirent.isFile()) {
+				if (isIgnored(scopes, absolutePath, false)) continue;
+				const data = fs.readFileSync(absolutePath);
+				totalBytes += data.length;
+				entries.push({
+					path: relativePath,
+					data
+				});
+			}
+		}
+	};
+	const ancestorScopes = [];
+	const relativeSegments = relativeRootFromIgnoreRoot === "" ? [] : relativeRootFromIgnoreRoot.split(path.sep);
+	let currentDirectory = absoluteIgnoreRootDirectory;
+	for (const segment of relativeSegments) {
+		ancestorScopes.push(...readIgnoreScopes(currentDirectory));
+		const childDirectory = path.join(currentDirectory, segment);
+		if (isIgnored(ancestorScopes, childDirectory, true)) throw new CliError(`No files to deploy in ${absoluteRootDirectory} (the source directory is ignored by a parent .gitignore or .vercelignore).`);
+		currentDirectory = childDirectory;
+	}
+	walk(absoluteRootDirectory, "", ancestorScopes);
+	if (entries.length === 0) throw new CliError(`No files to deploy in ${absoluteRootDirectory} (everything is ignored or the directory is empty).`);
+	let tarball;
+	try {
+		tarball = createTar(entries);
+	} catch (error) {
+		if (error instanceof StatusError) throw new CliError(error.message);
+		throw error;
+	}
+	return {
+		tarballGzipped: gzipSync(tarball),
+		fileCount: entries.length,
+		totalBytes
+	};
+}
+//#endregion
+//#region src/commands/deploy.ts
+const CONFIG_FILE_CANDIDATES = [
+	"hexclave.config.ts",
+	"hexclave.config.js",
+	"stack.config.ts",
+	"stack.config.js"
+];
+const SECRET_KEY_REGEX = /^[a-zA-Z0-9_-]+$/;
+const ENV_VAR_KEY_REGEX = /^[A-Za-z_][A-Za-z0-9_]*$/;
+const CONNECTION_VALUE_REGEX = /^[a-zA-Z0-9_-]+\.[A-Za-z0-9_]+$/;
+/**
+* Parses repeated `--secret KEY=VALUE` options. Values may contain `=` (only
+* the first one separates key from value). Keys are the secret keys named by
+* `type: "secret"` env vars in the config; values are never persisted by
+* Hexclave. Exported for unit tests.
+*/
+function parseSecretOptions(secretOptions) {
+	const secrets = /* @__PURE__ */ new Map();
+	for (const option of secretOptions) {
+		const separatorIndex = option.indexOf("=");
+		if (separatorIndex <= 0) throw new CliError(`Invalid --secret value ${JSON.stringify(option)}. Expected the KEY=VALUE format.`);
+		const key = option.slice(0, separatorIndex);
+		const value = option.slice(separatorIndex + 1);
+		if (!SECRET_KEY_REGEX.test(key)) throw new CliError(`Invalid --secret key ${JSON.stringify(key)}. Secret keys must contain only letters, numbers, underscores, and hyphens.`);
+		if (secrets.has(key)) throw new CliError(`Duplicate --secret key ${JSON.stringify(key)}.`);
+		secrets.set(key, value);
+	}
+	return secrets;
+}
+const DEPLOYMENTS_CONFIG_SECTION = "deployments-alpha";
+/**
+* Extracts one service's definition from a loaded config module. The config
+* file holds it under `deployments-alpha.services.<name>` — the exact shape that
+* `hexclave config push` pushes as branch config. Exported for unit tests.
+*/
+function extractServiceDefinition(config, serviceName) {
+	if (config == null || typeof config !== "object") throw new CliError("Config file must export a plain `config` object.");
+	const section = config[DEPLOYMENTS_CONFIG_SECTION];
+	const services = section != null && typeof section === "object" ? section.services : void 0;
+	if (services == null || typeof services !== "object") throw new CliError(`The config file has no \`${DEPLOYMENTS_CONFIG_SECTION}.services\` section. Add one, e.g.:\n  export const config = {\n    "${DEPLOYMENTS_CONFIG_SECTION}": {\n      services: {\n        ${serviceName}: { type: "vercel", rootDirectory: "./", framework: "nextjs" },\n      },\n    },\n  };`);
+	const service = services[serviceName];
+	if (service == null || typeof service !== "object") {
+		const available = Object.keys(services);
+		throw new CliError(`No service named ${JSON.stringify(serviceName)} in the config file's \`${DEPLOYMENTS_CONFIG_SECTION}.services\`.${available.length > 0 ? ` Available services: ${available.join(", ")}` : ""}`);
+	}
+	const record = service;
+	if (record.type !== "vercel") throw new CliError(record.type === void 0 ? `\`${DEPLOYMENTS_CONFIG_SECTION}.services.${serviceName}\` has no \`type\`. Add \`type: "vercel"\`.` : `\`${DEPLOYMENTS_CONFIG_SECTION}.services.${serviceName}.type\` must be "vercel" (got ${JSON.stringify(record.type)}).`);
+	const readString = (key) => {
+		const value = record[key];
+		if (value === void 0) return void 0;
+		if (typeof value !== "string") throw new CliError(`\`${DEPLOYMENTS_CONFIG_SECTION}.services.${serviceName}.${key}\` must be a string.`);
+		return value;
+	};
+	return {
+		framework: readString("framework"),
+		installCommand: readString("installCommand"),
+		buildCommand: readString("buildCommand"),
+		outputDirectory: readString("outputDirectory"),
+		rootDirectory: readString("rootDirectory"),
+		env: extractServiceEnv(record.env, serviceName)
+	};
+}
+function extractServiceEnv(env, serviceName) {
+	if (env === void 0) return {};
+	if (env == null || typeof env !== "object" || Array.isArray(env)) throw new CliError(`\`${DEPLOYMENTS_CONFIG_SECTION}.services.${serviceName}.env\` must be a record of env var entries, e.g. { MY_VAR: { value: "some-value" } }.`);
+	const result = {};
+	for (const [envVarKey, entryValue] of Object.entries(env)) {
+		const path = `\`${DEPLOYMENTS_CONFIG_SECTION}.services.${serviceName}.env.${envVarKey}\``;
+		if (!ENV_VAR_KEY_REGEX.test(envVarKey)) throw new CliError(`${path} has an invalid key. Env var keys must start with a letter or underscore and contain only letters, digits, and underscores.`);
+		if (entryValue == null || typeof entryValue !== "object") throw new CliError(`${path} must be an object like { value: "..." }, { type: "secret", key: "..." }, or { type: "connection", value: "service.output" }.`);
+		const entry = entryValue;
+		switch (entry.type) {
+			case void 0:
+				if (typeof entry.value !== "string") throw new CliError(`${path} must have a string \`value\` (or a \`type\` of "secret" or "connection").`);
+				if (entry.key !== void 0) throw new CliError(`${path} must not have a \`key\` — that's only for env vars with \`type: "secret"\`.`);
+				result[envVarKey] = { value: entry.value };
+				break;
+			case "secret":
+				if (typeof entry.key !== "string" || !SECRET_KEY_REGEX.test(entry.key)) throw new CliError(`${path} has type "secret" and must have a \`key\` naming the secret to pass at deploy time (letters, numbers, underscores, and hyphens only).`);
+				if (entry.value !== void 0) throw new CliError(`${path} has type "secret" and must not have a \`value\` — pass it at deploy time with --secret ${entry.key}=<value> instead, so it is never committed.`);
+				result[envVarKey] = {
+					type: "secret",
+					key: entry.key
+				};
+				break;
+			case "connection":
+				if (typeof entry.value !== "string" || !CONNECTION_VALUE_REGEX.test(entry.value)) throw new CliError(`${path} has type "connection" and must have a \`value\` referencing a service output like "hexclave.projectId".`);
+				result[envVarKey] = {
+					type: "connection",
+					value: entry.value
+				};
+				break;
+			default: throw new CliError(`${path} has an unknown \`type\` ${JSON.stringify(entry.type)}. Supported: "secret", "connection", or no type for a plain value.`);
+		}
+	}
+	return result;
+}
+/**
+* Checks the provided secrets against the secret keys the env definitions
+* reference, so a missing or misspelled secret fails BEFORE packaging and
+* uploading. The backend re-checks this authoritatively. Exported for unit
+* tests.
+*/
+function assertSecretsMatchEnv(env, secrets) {
+	const referencedKeys = new Set(Object.values(env).flatMap((entry) => "type" in entry && entry.type === "secret" ? [entry.key] : []));
+	const missing = [...referencedKeys].filter((key) => !secrets.has(key));
+	if (missing.length > 0) throw new CliError(`Missing secret values for: ${missing.join(", ")}. This service's env vars reference these secrets — pass them with --secret <key>=<value>.`);
+	const unused = [...secrets.keys()].filter((key) => !referencedKeys.has(key));
+	if (unused.length > 0) throw new CliError(`Unknown --secret key(s): ${unused.join(", ")}. No env var of this service references them — check for typos, or add an env var with \`type: "secret"\` referencing them.`);
+}
+/**
+* Resolves the config file path: --config wins (and must exist); otherwise the
+* first existing candidate in cwd, or undefined when there is none — the
+* config file is optional, deploys then use the service's configuration as
+* stored on the backend (dashboard-configured). Exported for unit tests.
+*/
+function resolveDeployConfigPath(configOption, cwd) {
+	if (configOption != null && configOption !== "") {
+		const resolved = path.resolve(cwd, configOption);
+		if (!fs.existsSync(resolved) || !fs.statSync(resolved).isFile()) throw new CliError(`Config file not found: ${resolved}`);
+		return resolved;
+	}
+	for (const candidate of CONFIG_FILE_CANDIDATES) {
+		const resolved = path.resolve(cwd, candidate);
+		if (fs.existsSync(resolved) && fs.statSync(resolved).isFile()) return resolved;
+	}
+}
+async function buildAuthHeadersFactory(auth) {
+	if (isProjectAuthWithSecretServerKey(auth)) {
+		const headers = {
+			"x-stack-access-type": "server",
+			"x-stack-project-id": auth.projectId,
+			"x-stack-secret-server-key": auth.secretServerKey
+		};
+		return () => Promise.resolve(headers);
+	}
+	const user = await getInternalUser(auth);
+	return async () => {
+		const { accessToken } = await user.currentSession.getTokens();
+		if (accessToken == null) throw new AuthError("Could not obtain an access token. Run `hexclave login` again.");
+		return {
+			"x-stack-access-type": "admin",
+			"x-stack-project-id": auth.projectId,
+			"x-stack-admin-access-token": accessToken
+		};
+	};
+}
+async function deployApiFetch(auth, getAuthHeaders, apiPath, init) {
+	const url = `${auth.apiUrl.replace(/\/$/, "")}/api/latest${apiPath}`;
+	const response = await fetch(url, {
+		method: init.method,
+		headers: {
+			...await getAuthHeaders(),
+			...init.jsonBody !== void 0 ? { "content-type": "application/json" } : {}
+		},
+		body: init.jsonBody !== void 0 ? JSON.stringify(init.jsonBody) : void 0
+	});
+	const text = await response.text();
+	if (!response.ok) {
+		let message = text;
+		try {
+			const parsed = JSON.parse(text);
+			if (typeof parsed?.error === "string") message = parsed.error;
+			else if (typeof parsed?.error?.message === "string") message = parsed.error.message;
+		} catch {}
+		throw new CliError(`Deploy request failed (${response.status} at ${init.method} ${apiPath}): ${message.slice(0, 1e3)}`);
+	}
+	try {
+		return text === "" ? void 0 : JSON.parse(text);
+	} catch {
+		throw new CliError(`Unexpected non-JSON response from the Hexclave API at ${init.method} ${apiPath}.`);
+	}
+}
+async function uploadSource(uploadUrl, contentType, bytes) {
+	let parsedUrl;
+	try {
+		parsedUrl = new URL(uploadUrl);
+	} catch {
+		throw new CliError("The Hexclave API returned an invalid object-storage upload URL.");
+	}
+	if (parsedUrl.protocol !== "https:" && parsedUrl.protocol !== "http:") throw new CliError("The Hexclave API returned an upload URL with an unsupported protocol.");
+	const response = await fetch(parsedUrl, {
+		method: "PUT",
+		headers: {
+			"content-type": contentType,
+			"content-length": bytes.length.toString()
+		},
+		body: new Uint8Array(bytes).slice().buffer
+	});
+	if (!response.ok) {
+		const responseBody = await response.text();
+		throw new CliError(`Source upload failed (${response.status} from object storage): ${responseBody.slice(0, 1e3)}`);
+	}
+}
+function registerDeployCommand(program) {
+	program.command("deploy <service>").description("Deploy a service defined under `deployments-alpha.services` in your hexclave.config.ts. Uploads the service's source directory, waits for Vercel to accept the deployment, then prints the run id without waiting for the remote build to finish.").option("--config <path>", "Path to the config file (default: auto-discover hexclave.config.ts in the current directory)").option("--cloud-project-id <id>", "Hexclave project ID to deploy to (defaults to the HEXCLAVE_PROJECT_ID env var)").option("--secret <KEY=VALUE>", "Value for a secret env var of this deploy (repeatable). KEY is the secret key named by a `type: \"secret\"` env var in the config; the value is pushed to the deployment target and never persisted by Hexclave.", (value, previous) => [...previous, value], []).addHelpText("after", "\nAuthentication: uses HEXCLAVE_SECRET_SERVER_KEY if set (recommended for CI), otherwise your `hexclave login` session.").action(async (service, opts) => {
+		const auth = resolveAuth(resolveProjectId(opts.cloudProjectId));
+		const secrets = parseSecretOptions(opts.secret);
+		const authHeaders = await buildAuthHeadersFactory(auth);
+		const configPath = resolveDeployConfigPath(opts.config, process.cwd());
+		let definition;
+		let rootDirectory;
+		let ignoreRootDirectory;
+		if (configPath != null) {
+			const { createJiti } = await import("jiti");
+			const jiti = createJiti(import.meta.url);
+			let configModule;
+			try {
+				configModule = await jiti.import(configPath);
+			} catch (err) {
+				throw new CliError(`Failed to load config file ${configPath}: ${errorMessage$1(err)}`);
+			}
+			if (configModule.config == null) throw new CliError(`Config file ${configPath} must export a \`config\` object (e.g. \`export const config = { "deployments-alpha": { services: { ... } } }\`).`);
+			definition = extractServiceDefinition(configModule.config, service);
+			assertSecretsMatchEnv(definition.env, secrets);
+			ignoreRootDirectory = path.dirname(configPath);
+			rootDirectory = path.resolve(ignoreRootDirectory, definition.rootDirectory ?? ".");
+		} else {
+			const remoteService = await deployApiFetch(auth, authHeaders, `/deployments/services/${encodeURIComponent(service)}`, { method: "GET" });
+			const remoteRootDirectory = typeof remoteService?.root_directory === "string" && remoteService.root_directory !== "" ? remoteService.root_directory : ".";
+			const remoteEnv = {};
+			for (const envVar of Array.isArray(remoteService?.env) ? remoteService.env : []) if (envVar?.type === "secret" && typeof envVar.secret_key === "string" && typeof envVar.key === "string") remoteEnv[envVar.key] = {
+				type: "secret",
+				key: envVar.secret_key
+			};
+			assertSecretsMatchEnv(remoteEnv, secrets);
+			ignoreRootDirectory = process.cwd();
+			rootDirectory = path.resolve(process.cwd(), remoteRootDirectory);
+			console.error(`No config file found — using the service configuration stored in Hexclave (root directory: ${remoteRootDirectory}).`);
+		}
+		console.error(`Packaging ${rootDirectory}...`);
+		const packaged = packageSourceDirectory(rootDirectory, ignoreRootDirectory);
+		console.error(`Packaged ${packaged.fileCount} files (${(packaged.tarballGzipped.length / 1024).toFixed(1)} KiB compressed).`);
+		const upload = await deployApiFetch(auth, authHeaders, "/deployments/uploads", { method: "POST" });
+		if (typeof upload?.id !== "string" || typeof upload?.upload_url !== "string" || typeof upload?.content_type !== "string") throw new CliError("Unexpected response from the Hexclave API when creating the upload.");
+		if (typeof upload.max_bytes === "number" && packaged.tarballGzipped.length > upload.max_bytes) throw new CliError(`The packaged source is too large (${packaged.tarballGzipped.length} bytes, max ${upload.max_bytes}). Check your .gitignore/.vercelignore — build outputs and large assets shouldn't be uploaded.`);
+		console.error(`Uploading source...`);
+		await uploadSource(upload.upload_url, upload.content_type, packaged.tarballGzipped);
+		console.error(`Starting deployment of ${JSON.stringify(service)}...`);
+		const deployResponse = await deployApiFetch(auth, authHeaders, `/deployments/services/${encodeURIComponent(service)}/deploy`, {
+			method: "POST",
+			jsonBody: {
+				upload_id: upload.id,
+				...definition !== void 0 ? {
+					build_config: {
+						framework: definition.framework ?? null,
+						install_command: definition.installCommand ?? null,
+						build_command: definition.buildCommand ?? null,
+						output_directory: definition.outputDirectory ?? null,
+						root_directory: definition.rootDirectory ?? null
+					},
+					env: definition.env
+				} : {},
+				...secrets.size > 0 ? { secrets: Object.fromEntries(secrets) } : {}
+			}
+		});
+		if (typeof deployResponse?.run_id !== "string") throw new CliError("Unexpected response from the Hexclave API when starting the deployment.");
+		console.log(JSON.stringify({ runId: deployResponse.run_id }, null, 2));
+	});
+}
+//#endregion
 //#region src/lib/config-file-path.ts
 function resolveConfigFilePathOption(inputPath, options) {
 	const resolved = resolve(inputPath);
@@ -486,33 +937,6 @@ async function resolveLocalDashboardAuthByConfigPath(configFile) {
 	};
 }
 //#endregion
-//#region src/lib/app.ts
-var app_exports = /* @__PURE__ */ __exportAll({
-	getAdminProject: () => getAdminProject,
-	getInternalApp: () => getInternalApp,
-	getInternalUser: () => getInternalUser
-});
-function getInternalApp(auth) {
-	return new StackClientApp({
-		projectId: "internal",
-		publishableClientKey: auth.publishableClientKey,
-		baseUrl: auth.apiUrl,
-		tokenStore: {
-			accessToken: "",
-			refreshToken: auth.refreshToken
-		},
-		noAutomaticPrefetch: true
-	});
-}
-async function getInternalUser(auth) {
-	return await getInternalApp(auth).getUser({ or: "throw" });
-}
-async function getAdminProject(auth) {
-	const project = (await (await getInternalUser(auth)).listOwnedProjects()).find((p) => p.id === auth.projectId);
-	if (!project) throw new AuthError(`Project '${auth.projectId}' not found. Make sure you own this project.`);
-	return project;
-}
-//#endregion
 //#region src/commands/exec.ts
 function getErrorMessage(err) {
 	if (err instanceof Error) return err.message;
@@ -565,6 +989,77 @@ function registerExecCommand(program) {
 	});
 }
 //#endregion
+//#region src/lib/progress.ts
+const SPINNER_FRAMES$1 = [
+	"⠋",
+	"⠙",
+	"⠹",
+	"⠸",
+	"⠼",
+	"⠴",
+	"⠦",
+	"⠧",
+	"⠇",
+	"⠏"
+];
+const SPINNER_INTERVAL_MS = 80;
+/**
+* Reports long-running CLI work without contaminating stdout. Interactive
+* terminals get a single animated line, while redirected output gets durable
+* lines that remain useful in CI logs.
+*/
+function startProgress(initialMessage, options = {}) {
+	const stream = options.stream ?? process.stderr;
+	const prefix = options.prefix ?? "";
+	let message = initialMessage;
+	let stopped = false;
+	if (!stream.isTTY) {
+		stream.write(`${prefix}${message}...\n`);
+		return {
+			update(nextMessage) {
+				if (stopped || nextMessage === message) return;
+				message = nextMessage;
+				stream.write(`${prefix}${message}...\n`);
+			},
+			stop(finalMessage) {
+				if (stopped) return;
+				stopped = true;
+				if (finalMessage != null) stream.write(`${prefix}${finalMessage}\n`);
+			}
+		};
+	}
+	let frameIndex = 0;
+	const render = () => {
+		stream.write(`\r\x1b[2K${prefix}${SPINNER_FRAMES$1[frameIndex]} ${message}`);
+		frameIndex = (frameIndex + 1) % SPINNER_FRAMES$1.length;
+	};
+	render();
+	const timer = setInterval(render, SPINNER_INTERVAL_MS);
+	timer.unref();
+	return {
+		update(nextMessage) {
+			if (stopped || nextMessage === message) return;
+			message = nextMessage;
+			render();
+		},
+		stop(finalMessage) {
+			if (stopped) return;
+			stopped = true;
+			clearInterval(timer);
+			stream.write("\r\x1B[2K");
+			if (finalMessage != null) stream.write(`${prefix}${finalMessage}\n`);
+		}
+	};
+}
+async function withProgress(message, operation, options) {
+	const progress = startProgress(message, options);
+	try {
+		return await operation();
+	} finally {
+		progress.stop();
+	}
+}
+//#endregion
 //#region src/commands/config-file.ts
 const SHOW_ONBOARDING_STACK_CONFIG_VALUE = "show-onboarding";
 function isConfigOverride(value) {
@@ -675,16 +1170,16 @@ function sourceToSdkSource(source) {
 }
 function resolveConfigFilePathForPull(opts, cwd) {
 	if (opts.configFile != null && opts.configFile !== "") return resolveConfigFilePathOption(opts.configFile);
-	const hexclaveCandidate = path.join(cwd, "hexclave.config.ts");
-	const legacyCandidate = path.join(cwd, "stack.config.ts");
-	const candidate = fs.existsSync(hexclaveCandidate) ? hexclaveCandidate : legacyCandidate;
-	if (!fs.existsSync(candidate)) return hexclaveCandidate;
-	if (fs.statSync(candidate).isDirectory()) throw new CliError(`Default config path points to a directory instead of a file: ${candidate}`);
+	const hexclaveCandidate = path$1.join(cwd, "hexclave.config.ts");
+	const legacyCandidate = path$1.join(cwd, "stack.config.ts");
+	const candidate = fs$1.existsSync(hexclaveCandidate) ? hexclaveCandidate : legacyCandidate;
+	if (!fs$1.existsSync(candidate)) return hexclaveCandidate;
+	if (fs$1.statSync(candidate).isDirectory()) throw new CliError(`Default config path points to a directory instead of a file: ${candidate}`);
 	return candidate;
 }
 function assertConfigPullTarget(filePath, opts) {
 	if (opts.overwrite === true) return;
-	if (fs.existsSync(filePath)) throw new CliError(`A config file already exists at ${filePath}. Pass --overwrite to replace it with the pulled config, or remove the file first.`);
+	if (fs$1.existsSync(filePath)) throw new CliError(`A config file already exists at ${filePath}. Pass --overwrite to replace it with the pulled config, or remove the file first.`);
 }
 function registerConfigCommand(program) {
 	const config = program.command("config").description("Manage project configuration files");
@@ -692,31 +1187,39 @@ function registerConfigCommand(program) {
 		const auth = resolveAuth(resolveProjectId(opts.cloudProjectId));
 		if (!isProjectAuthWithRefreshToken(auth)) throw new CliError("`hexclave config pull` requires `hexclave login`. Remove STACK_SECRET_SERVER_KEY and try again.");
 		const filePath = resolveConfigFilePathForPull(opts, process.cwd());
-		if (path.extname(filePath) !== ".ts") throw new CliError("Config file must have a .ts extension. Typed config files require TypeScript.");
+		if (path$1.extname(filePath) !== ".ts") throw new CliError("Config file must have a .ts extension. Typed config files require TypeScript.");
 		assertConfigPullTarget(filePath, opts);
-		const configOverride = await (await getAdminProject(auth)).getConfigOverride("branch");
-		if (!isValidConfig(configOverride)) throw new CliError("Pulled branch config is not a valid local config object.");
-		await replaceConfigObject(filePath, configOverride);
+		await withProgress("Pulling config", async () => {
+			const configOverride = await (await getAdminProject(auth)).getConfigOverride("branch");
+			if (!isValidConfig(configOverride)) throw new CliError("Pulled branch config is not a valid local config object.");
+			await replaceConfigObject(filePath, configOverride);
+		});
 		console.log(`Config written to ${filePath}`);
 	});
 	config.command("push").description("Push a local config file to branch config").option("--cloud-project-id <id>", "Cloud project ID to push config to (defaults to the STACK_PROJECT_ID env var)").requiredOption("--config-file <path>", "Path to config file (.js or .ts)").option("--source <type>", "Explicit source type for this push. Only 'github' is supported.").option("--source-repo <owner/repo>", "GitHub repository in 'owner/repo' format. Only allowed with --source github.").option("--source-path <path>", "Path to the config file within the source repository. Only allowed with --source github.").option("--source-workflow-path <path>", "Path to the syncing workflow file within the source repository. Only allowed with --source github.").action(async (opts) => {
 		const auth = resolveAuth(resolveProjectId(opts.cloudProjectId));
 		const filePath = resolveConfigFilePathOption(opts.configFile, { mustExist: true });
-		const ext = path.extname(filePath);
+		const ext = path$1.extname(filePath);
 		if (ext !== ".js" && ext !== ".ts") throw new CliError("Config file must have a .js or .ts extension.");
-		const { createJiti } = await import("jiti");
-		const config = parseConfigOverride((await createJiti(import.meta.url).import(filePath)).config);
-		if (config == null) throw new CliError(`Config file must export a plain \`config\` object or "show-onboarding". Example: import type { HexclaveConfig } from "${detectImportPackageFromDir(path.dirname(filePath)) ?? "@hexclave/js"}"; export const config: HexclaveConfig = { ... };`);
 		const source = buildConfigPushSource(opts.configFile, {
 			source: opts.source,
 			sourceRepo: opts.sourceRepo,
 			sourcePath: opts.sourcePath,
 			sourceWorkflowPath: opts.sourceWorkflowPath
 		});
-		if (isProjectAuthWithSecretServerKey(auth)) await pushConfigWithSecretServerKey(auth, config, source);
-		else {
-			if (!isProjectAuthWithRefreshToken(auth)) throw new CliError("`hexclave config push` requires either STACK_SECRET_SERVER_KEY or `hexclave login`.");
-			await (await getAdminProject(auth)).pushConfig(config, { source: sourceToSdkSource(source) });
+		const progress = startProgress("Loading config");
+		try {
+			const { createJiti } = await import("jiti");
+			const config = parseConfigOverride((await createJiti(import.meta.url).import(filePath)).config);
+			if (config == null) throw new CliError(`Config file must export a plain \`config\` object or "show-onboarding". Example: import type { HexclaveConfig } from "${detectImportPackageFromDir(path$1.dirname(filePath)) ?? "@hexclave/js"}"; export const config: HexclaveConfig = { ... };`);
+			progress.update("Pushing config");
+			if (isProjectAuthWithSecretServerKey(auth)) await pushConfigWithSecretServerKey(auth, config, source);
+			else {
+				if (!isProjectAuthWithRefreshToken(auth)) throw new CliError("`hexclave config push` requires either STACK_SECRET_SERVER_KEY or `hexclave login`.");
+				await (await getAdminProject(auth)).pushConfig(config, { source: sourceToSdkSource(source) });
+			}
+		} finally {
+			progress.stop();
 		}
 		console.log("Config pushed successfully.");
 	});
@@ -885,11 +1388,13 @@ async function createProjectInteractively(user, opts = {}) {
 			validate: (v) => v.trim().length > 0 || "Display name cannot be empty."
 		})).trim();
 	}
-	const teams = await user.listTeams();
-	if (teams.length === 0) throw new CliError(`No teams found on your account. Create a team at ${opts.dashboardUrl ?? "https://app.hexclave.com"} first.`);
-	return await user.createProject({
-		displayName,
-		teamId: teams[0].id
+	return await withProgress("Creating project", async () => {
+		const teams = await user.listTeams();
+		if (teams.length === 0) throw new CliError(`No teams found on your account. Create a team at ${opts.dashboardUrl ?? "https://app.hexclave.com"} first.`);
+		return await user.createProject({
+			displayName,
+			teamId: teams[0].id
+		});
 	});
 }
 //#endregion
@@ -938,8 +1443,8 @@ function validateOptions(opts) {
 }
 async function runInit(program, opts) {
 	const flags = program.opts();
-	const outputDir = opts.outputDir ? path.resolve(opts.outputDir) : process.cwd();
-	if (!fs.existsSync(outputDir)) throw new CliError(`Output directory does not exist: ${outputDir}`);
+	const outputDir = opts.outputDir ? path$1.resolve(opts.outputDir) : process.cwd();
+	if (!fs$1.existsSync(outputDir)) throw new CliError(`Output directory does not exist: ${outputDir}`);
 	validateOptions(opts);
 	console.log("Welcome to Hexclave!\n");
 	let mode;
@@ -1010,9 +1515,9 @@ async function handleLinkFromConfigFile(opts) {
 	const configPath = resolveConfigFilePathOption(opts.configFile ?? await input({
 		message: "Path to your existing hexclave.config.ts (or stack.config.ts):",
 		validate: (value) => {
-			const resolved = path.resolve(value);
-			if (!fs.existsSync(resolved)) return `File not found: ${resolved}`;
-			if (fs.statSync(resolved).isDirectory()) return `--config-file must point to a config file, but got a directory: ${resolved}`;
+			const resolved = path$1.resolve(value);
+			if (!fs$1.existsSync(resolved)) return `File not found: ${resolved}`;
+			if (fs$1.statSync(resolved).isDirectory()) return `--config-file must point to a config file, but got a directory: ${resolved}`;
 			return true;
 		}
 	}), { mustExist: true });
@@ -1033,12 +1538,14 @@ async function ensureLoggedInSession() {
 	}
 }
 async function writeProjectKeysToEnv(project, outputDir) {
-	const apiKey = await project.app.createInternalApiKey({
-		description: "Created by CLI init script",
-		expiresAt: new Date(Date.now() + 1e3 * 60 * 60 * 24 * 365 * 200),
-		hasPublishableClientKey: true,
-		hasSecretServerKey: true,
-		hasSuperSecretAdminKey: false
+	const apiKey = await withProgress("Creating project keys", async () => {
+		return await project.app.createInternalApiKey({
+			description: "Created by CLI init script",
+			expiresAt: new Date(Date.now() + 1e3 * 60 * 60 * 24 * 365 * 200),
+			hasPublishableClientKey: true,
+			hasSecretServerKey: true,
+			hasSuperSecretAdminKey: false
+		});
 	});
 	const publishableClientKey = apiKey.publishableClientKey ?? throwErr("createInternalApiKey returned no publishableClientKey despite hasPublishableClientKey=true");
 	const secretServerKey = apiKey.secretServerKey ?? throwErr("createInternalApiKey returned no secretServerKey despite hasSecretServerKey=true");
@@ -1048,33 +1555,34 @@ async function writeProjectKeysToEnv(project, outputDir) {
 		`NEXT_PUBLIC_HEXCLAVE_PUBLISHABLE_CLIENT_KEY=${publishableClientKey}`,
 		`HEXCLAVE_SECRET_SERVER_KEY=${secretServerKey}`
 	].join("\n");
-	const envPath = path.resolve(outputDir, ".env");
-	if (fs.existsSync(envPath)) {
-		const separator = fs.readFileSync(envPath, "utf-8").endsWith("\n") ? "\n" : "\n\n";
+	const envPath = path$1.resolve(outputDir, ".env");
+	if (fs$1.existsSync(envPath)) {
+		const separator = fs$1.readFileSync(envPath, "utf-8").endsWith("\n") ? "\n" : "\n\n";
 		if (isNonInteractiveEnv()) {
-			fs.appendFileSync(envPath, separator + envLines + "\n");
+			fs$1.appendFileSync(envPath, separator + envLines + "\n");
 			console.log("\nAppended Hexclave keys to .env");
 		} else if (await confirm({
 			message: `.env file already exists. Append Hexclave keys?`,
 			default: true
 		})) {
-			fs.appendFileSync(envPath, separator + envLines + "\n");
+			fs$1.appendFileSync(envPath, separator + envLines + "\n");
 			console.log("\nAppended Hexclave keys to .env");
 		} else {
 			console.log("\nHere are your environment variables:\n");
 			console.log(envLines);
 		}
 	} else {
-		fs.writeFileSync(envPath, envLines + "\n");
+		fs$1.writeFileSync(envPath, envLines + "\n");
 		console.log("\nCreated .env with Hexclave keys");
 	}
 }
 async function handleCreateCloud(_flags, opts, outputDir) {
-	const user = await getInternalUser(await ensureLoggedInSession());
+	const sessionAuth = await ensureLoggedInSession();
+	const user = await withProgress("Loading account", async () => await getInternalUser(sessionAuth));
 	const { dashboardUrl } = resolveLoginConfig();
 	const newProject = await createProjectInteractively(user, {
 		displayName: opts.displayName,
-		defaultDisplayName: path.basename(outputDir),
+		defaultDisplayName: path$1.basename(outputDir),
 		dashboardUrl
 	});
 	console.log(`\nCreated project: ${newProject.displayName} (${newProject.id})\n`);
@@ -1082,8 +1590,15 @@ async function handleCreateCloud(_flags, opts, outputDir) {
 	return { projectId: newProject.id };
 }
 async function handleLinkFromCloud(_flags, opts, outputDir) {
-	const user = await getInternalUser(await ensureLoggedInSession());
-	let projects = await user.listOwnedProjects();
+	const sessionAuth = await ensureLoggedInSession();
+	const { user, ownedProjects } = await withProgress("Loading projects", async () => {
+		const user = await getInternalUser(sessionAuth);
+		return {
+			user,
+			ownedProjects: await user.listOwnedProjects()
+		};
+	});
+	let projects = ownedProjects;
 	let autoCreatedProjectId = null;
 	if (projects.length === 0) {
 		if (opts.selectProjectId) throw new CliError(`Project '${opts.selectProjectId}' not found among your owned projects. Check the ID or omit --select-project-id to create a new project interactively.`);
@@ -1097,7 +1612,7 @@ async function handleLinkFromCloud(_flags, opts, outputDir) {
 		}
 		const { dashboardUrl } = resolveLoginConfig();
 		const newProject = await createProjectInteractively(user, {
-			defaultDisplayName: path.basename(outputDir),
+			defaultDisplayName: path$1.basename(outputDir),
 			dashboardUrl
 		});
 		console.log(`\nCreated project: ${newProject.displayName} (${newProject.id})\n`);
@@ -1135,7 +1650,7 @@ async function performLogin() {
 	console.log("Login successful!\n");
 }
 async function handleCreate(opts, outputDir) {
-	const configPath = path.resolve(outputDir, "hexclave.config.ts");
+	const configPath = path$1.resolve(outputDir, "hexclave.config.ts");
 	console.log(`\nCreating a new config file at ${configPath}!\n`);
 	let selectedApps;
 	if (opts.apps) {
@@ -1157,9 +1672,9 @@ async function handleCreate(opts, outputDir) {
 			}))
 		});
 	}
-	const content = renderConfigFileContent({ apps: { installed: Object.fromEntries(selectedApps.map((appId) => [appId, { enabled: true }])) } }, detectImportPackageFromDir(path.dirname(configPath)));
-	fs.mkdirSync(path.dirname(configPath), { recursive: true });
-	if (fs.existsSync(configPath)) {
+	const content = renderConfigFileContent({ apps: { installed: Object.fromEntries(selectedApps.map((appId) => [appId, { enabled: true }])) } }, detectImportPackageFromDir(path$1.dirname(configPath)));
+	fs$1.mkdirSync(path$1.dirname(configPath), { recursive: true });
+	if (fs$1.existsSync(configPath)) {
 		if (isNonInteractiveEnv()) throw new CliError(`Config file already exists at ${configPath}. Refusing to overwrite in non-interactive mode.`);
 		if (!await confirm({
 			message: `Config file already exists at ${configPath}. Overwrite?`,
@@ -1169,7 +1684,7 @@ async function handleCreate(opts, outputDir) {
 			return { configPath };
 		}
 	}
-	fs.writeFileSync(configPath, content);
+	fs$1.writeFileSync(configPath, content);
 	console.log(`\nConfig file written to ${configPath}`);
 	return { configPath };
 }
@@ -1199,7 +1714,10 @@ function registerProjectCommand(program) {
 	project.command("list").description("List your projects (defaults to both cloud and development-environment projects)").option("--cloud", "Only list cloud projects").option("--local", "Only list development-environment projects").action(async (opts) => {
 		const sources = resolveProjectListSources(opts);
 		const results = [];
-		const ownedProjects = await (await getInternalUser(resolveSessionAuth())).listOwnedProjects();
+		const auth = resolveSessionAuth();
+		const ownedProjects = await withProgress("Loading projects", async () => {
+			return await (await getInternalUser(auth)).listOwnedProjects();
+		});
 		for (const p of ownedProjects) {
 			const target = p.isDevelopmentEnvironment ? "local" : "cloud";
 			if (target === "cloud" && sources.cloud || target === "local" && sources.local) results.push({
@@ -1218,7 +1736,8 @@ function registerProjectCommand(program) {
 			Promise.resolve().then(() => auth_exports),
 			Promise.resolve().then(() => create_project_exports)
 		]);
-		const user = await getInternalUser(resolveSessionAuth());
+		const auth = resolveSessionAuth();
+		const user = await withProgress("Loading account", async () => await getInternalUser(auth));
 		const { dashboardUrl } = resolveLoginConfig();
 		const newProject = await createProjectInteractively(user, {
 			displayName: opts.displayName,
@@ -1373,7 +1892,7 @@ async function sha256File(path) {
 	await pipeline(createReadStream(path), hash);
 	return hash.digest("hex");
 }
-async function downloadDashboardRelease(manifest) {
+async function downloadDashboardRelease(manifest, onProgress) {
 	const cacheRoot = dashboardCacheRoot();
 	mkdirSync(cacheRoot, { recursive: true });
 	const suffix = `${process.pid}-${randomBytes(8).toString("hex")}`;
@@ -1381,6 +1900,7 @@ async function downloadDashboardRelease(manifest) {
 	const tmpDir = join(cacheRoot, `.extract-${manifest.version}-${suffix}`);
 	const targetDir = dashboardVersionDir(manifest.version);
 	try {
+		onProgress?.(`Downloading Hexclave dashboard ${manifest.version}`);
 		const response = await fetch(manifest.url, {
 			redirect: "follow",
 			signal: AbortSignal.timeout(DASHBOARD_DOWNLOAD_TIMEOUT_MS)
@@ -1388,6 +1908,7 @@ async function downloadDashboardRelease(manifest) {
 		if (!isAllowedDownloadUrl(response.url)) throw new CliError(`Dashboard ${manifest.version} download was redirected to a disallowed URL (${response.url}).`);
 		if (!response.ok || response.body == null) throw new CliError(`Failed to download dashboard ${manifest.version} (HTTP ${response.status}) from ${manifest.url}.`);
 		await pipeline(Readable.fromWeb(response.body), createWriteStream(tmpZip));
+		onProgress?.(`Verifying Hexclave dashboard ${manifest.version}`);
 		const digest = await sha256File(tmpZip);
 		if (digest !== manifest.sha256) throw new CliError(`Dashboard ${manifest.version} failed its integrity check (expected ${manifest.sha256}, got ${digest}).`);
 		rmSync(tmpDir, {
@@ -1395,6 +1916,7 @@ async function downloadDashboardRelease(manifest) {
 			force: true
 		});
 		mkdirSync(tmpDir, { recursive: true });
+		onProgress?.(`Extracting Hexclave dashboard ${manifest.version}`);
 		await extractZip(tmpZip, { dir: tmpDir });
 		if (!existsSync(join(tmpDir, DASHBOARD_SERVER_RELATIVE_PATH))) throw new CliError(`Dashboard ${manifest.version} archive is missing its server entrypoint.`);
 		writeFileSync(join(tmpDir, DASHBOARD_COMPLETE_MARKER), `${manifest.sha256}\n`);
@@ -1433,7 +1955,7 @@ async function resolveDashboardRuntime(opts = {}) {
 			version: manifest.version
 		};
 		try {
-			await downloadDashboardRelease(manifest);
+			await downloadDashboardRelease(manifest, opts.onProgress);
 			return {
 				root: dashboardVersionDir(manifest.version),
 				version: manifest.version
@@ -1548,30 +2070,6 @@ function maybeOpenOnboardingPage(session, port) {
 	if (openUrlInBrowser(url)) logDev(`Onboarding is still pending for project ${session.project_id}. Opened: ${url}`);
 	else logDev(`Onboarding is still pending for project ${session.project_id}. Open this URL manually: ${url}`);
 }
-function startProgressLog(message) {
-	if (!process.stderr.isTTY) {
-		logDev(`${message}...`);
-		return { stop() {
-			logDev(`${message}... done!`);
-		} };
-	}
-	let dotCount = 0;
-	let stopped = false;
-	const render = () => {
-		process.stderr.write(`\r\x1b[2K${LOG_PREFIX}${message}${".".repeat(dotCount)}`);
-		dotCount = (dotCount + 1) % 4;
-	};
-	render();
-	const timer = setInterval(render, 400);
-	timer.unref();
-	return { stop() {
-		if (stopped) return;
-		stopped = true;
-		clearInterval(timer);
-		process.stderr.write("\r\x1B[2K");
-		logDev(`${message}... done!`);
-	} };
-}
 function dashboardRuntimeRoot(port) {
 	return join(dirname(devEnvStatePath()), `${DASHBOARD_RUNTIME_DIR_NAME}-${port}`);
 }
@@ -1731,7 +2229,9 @@ async function startDashboardIfNeeded(options) {
 	const url = dashboardUrl(options.port);
 	const devDashboardCommand = devDashboardCommandFromEnv(process.env);
 	const dashboardOverride = dashboardDirOverride();
-	const manifest = devDashboardCommand != null || dashboardOverride != null ? null : await fetchDashboardManifest();
+	const skipReleaseLookup = devDashboardCommand != null || dashboardOverride != null;
+	if (!skipReleaseLookup) logDev("Checking for Hexclave dashboard updates...");
+	const manifest = skipReleaseLookup ? null : await fetchDashboardManifest();
 	const latestVersion = manifest?.version;
 	if (await isDashboardReachable(url, options.secret)) {
 		const runningDashboard = readDevEnvState().localDashboardsByPort?.[String(options.port)];
@@ -1751,8 +2251,11 @@ async function startDashboardIfNeeded(options) {
 			return;
 		}
 	}
-	const release = devDashboardCommand == null ? await resolveDashboardRuntime({ manifest }) : null;
-	const progress = startProgressLog(`Hexclave dashboard not found on port ${options.port}. Starting now`);
+	const release = devDashboardCommand == null ? await resolveDashboardRuntime({
+		manifest,
+		onProgress: (message) => logDev(`${message}...`)
+	}) : null;
+	const progress = startProgress(`Hexclave dashboard not found on port ${options.port}. Starting now`, { prefix: LOG_PREFIX });
 	const dashboardEnv = {
 		...process.env,
 		NODE_ENV: devDashboardCommand == null ? "production" : "development",
@@ -2267,7 +2770,7 @@ function registerDoctorCommand(program) {
 	});
 }
 async function runDoctor(opts) {
-	const projectDir = opts.outputDir ? path.resolve(opts.outputDir) : process.cwd();
+	const projectDir = opts.outputDir ? path$1.resolve(opts.outputDir) : process.cwd();
 	const pkgRead = readPackageJson(projectDir);
 	if (pkgRead.kind === "missing") {
 		if (opts.json) console.log(JSON.stringify({
@@ -2328,9 +2831,9 @@ function isPackageJson(value) {
 	return value !== null && typeof value === "object" && !Array.isArray(value);
 }
 function readPackageJson(projectDir) {
-	const pkgPath = path.join(projectDir, "package.json");
-	if (!fs.existsSync(pkgPath)) return { kind: "missing" };
-	const raw = fs.readFileSync(pkgPath, "utf-8");
+	const pkgPath = path$1.join(projectDir, "package.json");
+	if (!fs$1.existsSync(pkgPath)) return { kind: "missing" };
+	const raw = fs$1.readFileSync(pkgPath, "utf-8");
 	try {
 		const parsed = JSON.parse(raw);
 		if (!isPackageJson(parsed)) return {
@@ -2350,8 +2853,8 @@ function readPackageJson(projectDir) {
 	}
 }
 function resolveSrcPrefix(framework, projectDir) {
-	if (framework === "next") return fs.existsSync(path.join(projectDir, "src/app")) ? "src/" : "";
-	return fs.existsSync(path.join(projectDir, "src")) ? "src/" : "";
+	if (framework === "next") return fs$1.existsSync(path$1.join(projectDir, "src/app")) ? "src/" : "";
+	return fs$1.existsSync(path$1.join(projectDir, "src")) ? "src/" : "";
 }
 function resolveFramework(override, pkg, projectDir) {
 	if (override) {
@@ -2369,7 +2872,7 @@ function resolveFramework(override, pkg, projectDir) {
 		...pkg.devDependencies ?? {}
 	};
 	if (allDeps.next) {
-		if (!(fs.existsSync(path.join(projectDir, "app")) || fs.existsSync(path.join(projectDir, "src/app")))) return {
+		if (!(fs$1.existsSync(path$1.join(projectDir, "app")) || fs$1.existsSync(path$1.join(projectDir, "src/app")))) return {
 			kind: "unsupported",
 			reason: "Detected Next.js but no app router (app/ or src/app/). The pages router is not yet supported by Hexclave doctor."
 		};
@@ -2536,7 +3039,7 @@ function fileExistsCheck(id, label, candidates, extraHint) {
 		label,
 		run: (ctx) => {
 			const resolved = candidates.map((c) => `${ctx.srcPrefix}${c}`);
-			for (const rel of resolved) if (fs.existsSync(path.join(ctx.projectDir, rel))) return {
+			for (const rel of resolved) if (fs$1.existsSync(path$1.join(ctx.projectDir, rel))) return {
 				id,
 				label: `${label} found (${rel})`,
 				status: "pass"
@@ -2567,8 +3070,8 @@ function layoutWrapsStackProviderCheck() {
 			const candidates = baseCandidates.map((c) => `${ctx.srcPrefix}${c}`);
 			let foundPath = null;
 			for (const candidate of candidates) {
-				const full = path.join(ctx.projectDir, candidate);
-				if (fs.existsSync(full)) {
+				const full = path$1.join(ctx.projectDir, candidate);
+				if (fs$1.existsSync(full)) {
 					foundPath = full;
 					break;
 				}
@@ -2579,10 +3082,10 @@ function layoutWrapsStackProviderCheck() {
 				status: "fail",
 				detail: `Expected one of: ${candidates.join(", ")}`
 			};
-			const content = fs.readFileSync(foundPath, "utf-8");
+			const content = fs$1.readFileSync(foundPath, "utf-8");
 			const importsProvider = /import\s*\{[^}]*\b(?:HexclaveProvider|StackProvider)\b[^}]*\}\s*from\s*["'](?:@hexclave\/next|@stackframe\/stack)["']/.test(content);
 			const wrapsJsx = /<(?:HexclaveProvider|StackProvider)\b/.test(content);
-			const rel = path.relative(ctx.projectDir, foundPath);
+			const rel = path$1.relative(ctx.projectDir, foundPath);
 			if (importsProvider && wrapsJsx) return {
 				id,
 				label,
@@ -2665,8 +3168,8 @@ function configFileCheck() {
 			let foundPath = null;
 			let foundRel = null;
 			for (const c of candidates) {
-				const full = path.join(ctx.projectDir, c);
-				if (fs.existsSync(full)) {
+				const full = path$1.join(ctx.projectDir, c);
+				if (fs$1.existsSync(full)) {
 					foundPath = full;
 					foundRel = c;
 					break;
@@ -2721,9 +3224,9 @@ function readEnvFiles(projectDir) {
 	const files = [".env.local", ".env"];
 	const result = /* @__PURE__ */ new Map();
 	for (const f of files) {
-		const full = path.join(projectDir, f);
-		if (!fs.existsSync(full)) continue;
-		const content = fs.readFileSync(full, "utf-8");
+		const full = path$1.join(projectDir, f);
+		if (!fs$1.existsSync(full)) continue;
+		const content = fs$1.readFileSync(full, "utf-8");
 		for (const line of content.split("\n")) {
 			const trimmed = line.trim();
 			if (!trimmed || trimmed.startsWith("#")) continue;
@@ -2772,8 +3275,13 @@ function registerWhoamiCommand(program) {
 	program.command("whoami").description("Show the currently logged-in Hexclave CLI user").action(async () => {
 		const flags = program.opts();
 		const auth = resolveSessionAuth();
-		const user = await getInternalUser(auth);
-		const teams = await user.listTeams();
+		const { user, teams } = await withProgress("Loading account", async () => {
+			const user = await getInternalUser(auth);
+			return {
+				user,
+				teams: await user.listTeams()
+			};
+		});
 		const result = {
 			id: user.id,
 			displayName: user.displayName,
@@ -2810,6 +3318,7 @@ program.name("hexclave").description("Hexclave CLI. For more information, go to
 registerLoginCommand(program);
 registerLogoutCommand(program);
 registerExecCommand(program);
+registerDeployCommand(program);
 registerConfigCommand(program);
 registerInitCommand(program);
 registerProjectCommand(program);
@@ -2834,9 +3343,9 @@ async function main() {
 			console.error(`Error: ${err.message}`);
 			process.exit(1);
 		}
+		console.error(err);
 		captureError("stack-cli-fatal", err);
 		await Sentry.flush(2e3);
-		console.error(err);
 		process.exit(1);
 	}
 }