@hexclave/cli 1.0.61 → 1.0.63

package/src/commands/deploy.ts

@@ -0,0 +1,407 @@
+import { Command } from "commander";
+import fs from "node:fs";
+import path from "node:path";
+import { getInternalUser } from "../lib/app.js";
+import { isProjectAuthWithSecretServerKey, resolveAuth, resolveProjectId, type ProjectAuth } from "../lib/auth.js";
+import { AuthError, CliError, errorMessage } from "../lib/errors.js";
+import { packageSourceDirectory } from "../lib/source-packaging.js";
+
+// The names checked (in order) when --config is not passed; same preference
+// order as `hexclave config push`'s pull-side resolution.
+const CONFIG_FILE_CANDIDATES = ["hexclave.config.ts", "hexclave.config.js", "stack.config.ts", "stack.config.js"];
+
+export type DeployOptions = {
+  config?: string,
+  cloudProjectId?: string,
+  secret: string[],
+};
+
+const SECRET_KEY_REGEX = /^[a-zA-Z0-9_-]+$/;
+const ENV_VAR_KEY_REGEX = /^[A-Za-z_][A-Za-z0-9_]*$/;
+// Must match the backend's connection value validation: `<serviceId>.<outputKey>`.
+const CONNECTION_VALUE_REGEX = /^[a-zA-Z0-9_-]+\.[A-Za-z0-9_]+$/;
+
+/**
+ * Parses repeated `--secret KEY=VALUE` options. Values may contain `=` (only
+ * the first one separates key from value). Keys are the secret keys named by
+ * `type: "secret"` env vars in the config; values are never persisted by
+ * Hexclave. Exported for unit tests.
+ */
+export function parseSecretOptions(secretOptions: string[]): Map<string, string> {
+  const secrets = new Map<string, string>();
+  for (const option of secretOptions) {
+    const separatorIndex = option.indexOf("=");
+    if (separatorIndex <= 0) {
+      throw new CliError(`Invalid --secret value ${JSON.stringify(option)}. Expected the KEY=VALUE format.`);
+    }
+    const key = option.slice(0, separatorIndex);
+    const value = option.slice(separatorIndex + 1);
+    if (!SECRET_KEY_REGEX.test(key)) {
+      throw new CliError(`Invalid --secret key ${JSON.stringify(key)}. Secret keys must contain only letters, numbers, underscores, and hyphens.`);
+    }
+    if (secrets.has(key)) {
+      throw new CliError(`Duplicate --secret key ${JSON.stringify(key)}.`);
+    }
+    secrets.set(key, value);
+  }
+  return secrets;
+}
+
+// The top-level config section the Deployments app owns. The `-alpha` suffix is
+// part of the public key while the app is in alpha, and it must match the app id
+// in the backend's config schema — a mismatch here silently reads an empty
+// section rather than failing, so it is defined once and reused below.
+const DEPLOYMENTS_CONFIG_SECTION = "deployments-alpha";
+
+// The config-side shape of one env var. Mirrors the schema of
+// `deployments-alpha.services.<name>.env.<KEY>` and is sent to the deploy
+// endpoint verbatim.
+export type ServiceEnvVarConfig =
+  | { value: string }
+  | { type: "secret", key: string }
+  | { type: "connection", value: string };
+
+export type ServiceDefinition = {
+  framework?: string,
+  installCommand?: string,
+  buildCommand?: string,
+  outputDirectory?: string,
+  rootDirectory?: string,
+  env: Record<string, ServiceEnvVarConfig>,
+};
+
+/**
+ * Extracts one service's definition from a loaded config module. The config
+ * file holds it under `deployments-alpha.services.<name>` — the exact shape that
+ * `hexclave config push` pushes as branch config. Exported for unit tests.
+ */
+export function extractServiceDefinition(config: unknown, serviceName: string): ServiceDefinition {
+  if (config == null || typeof config !== "object") {
+    throw new CliError("Config file must export a plain `config` object.");
+  }
+  const section = (config as Record<string, unknown>)[DEPLOYMENTS_CONFIG_SECTION];
+  const services = section != null && typeof section === "object" ? (section as { services?: unknown }).services : undefined;
+  if (services == null || typeof services !== "object") {
+    throw new CliError(`The config file has no \`${DEPLOYMENTS_CONFIG_SECTION}.services\` section. Add one, e.g.:\n  export const config = {\n    "${DEPLOYMENTS_CONFIG_SECTION}": {\n      services: {\n        ${serviceName}: { type: "vercel", rootDirectory: "./", framework: "nextjs" },\n      },\n    },\n  };`);
+  }
+  const service = (services as Record<string, unknown>)[serviceName];
+  if (service == null || typeof service !== "object") {
+    const available = Object.keys(services);
+    throw new CliError(`No service named ${JSON.stringify(serviceName)} in the config file's \`${DEPLOYMENTS_CONFIG_SECTION}.services\`.${available.length > 0 ? ` Available services: ${available.join(", ")}` : ""}`);
+  }
+  const record = service as Record<string, unknown>;
+  if (record.type !== "vercel") {
+    throw new CliError(record.type === undefined
+      ? `\`${DEPLOYMENTS_CONFIG_SECTION}.services.${serviceName}\` has no \`type\`. Add \`type: "vercel"\`.`
+      : `\`${DEPLOYMENTS_CONFIG_SECTION}.services.${serviceName}.type\` must be "vercel" (got ${JSON.stringify(record.type)}).`);
+  }
+  const readString = (key: string): string | undefined => {
+    const value = record[key];
+    if (value === undefined) return undefined;
+    if (typeof value !== "string") {
+      throw new CliError(`\`${DEPLOYMENTS_CONFIG_SECTION}.services.${serviceName}.${key}\` must be a string.`);
+    }
+    return value;
+  };
+  return {
+    framework: readString("framework"),
+    installCommand: readString("installCommand"),
+    buildCommand: readString("buildCommand"),
+    outputDirectory: readString("outputDirectory"),
+    rootDirectory: readString("rootDirectory"),
+    env: extractServiceEnv(record.env, serviceName),
+  };
+}
+
+function extractServiceEnv(env: unknown, serviceName: string): Record<string, ServiceEnvVarConfig> {
+  if (env === undefined) return {};
+  if (env == null || typeof env !== "object" || Array.isArray(env)) {
+    throw new CliError(`\`${DEPLOYMENTS_CONFIG_SECTION}.services.${serviceName}.env\` must be a record of env var entries, e.g. { MY_VAR: { value: "some-value" } }.`);
+  }
+  const result: Record<string, ServiceEnvVarConfig> = {};
+  for (const [envVarKey, entryValue] of Object.entries(env as Record<string, unknown>)) {
+    const path = `\`${DEPLOYMENTS_CONFIG_SECTION}.services.${serviceName}.env.${envVarKey}\``;
+    if (!ENV_VAR_KEY_REGEX.test(envVarKey)) {
+      throw new CliError(`${path} has an invalid key. Env var keys must start with a letter or underscore and contain only letters, digits, and underscores.`);
+    }
+    if (entryValue == null || typeof entryValue !== "object") {
+      throw new CliError(`${path} must be an object like { value: "..." }, { type: "secret", key: "..." }, or { type: "connection", value: "service.output" }.`);
+    }
+    const entry = entryValue as { type?: unknown, value?: unknown, key?: unknown };
+    switch (entry.type) {
+      case undefined: {
+        if (typeof entry.value !== "string") {
+          throw new CliError(`${path} must have a string \`value\` (or a \`type\` of "secret" or "connection").`);
+        }
+        if (entry.key !== undefined) {
+          throw new CliError(`${path} must not have a \`key\` — that's only for env vars with \`type: "secret"\`.`);
+        }
+        result[envVarKey] = { value: entry.value };
+        break;
+      }
+      case "secret": {
+        if (typeof entry.key !== "string" || !SECRET_KEY_REGEX.test(entry.key)) {
+          throw new CliError(`${path} has type "secret" and must have a \`key\` naming the secret to pass at deploy time (letters, numbers, underscores, and hyphens only).`);
+        }
+        if (entry.value !== undefined) {
+          throw new CliError(`${path} has type "secret" and must not have a \`value\` — pass it at deploy time with --secret ${entry.key}=<value> instead, so it is never committed.`);
+        }
+        result[envVarKey] = { type: "secret", key: entry.key };
+        break;
+      }
+      case "connection": {
+        if (typeof entry.value !== "string" || !CONNECTION_VALUE_REGEX.test(entry.value)) {
+          throw new CliError(`${path} has type "connection" and must have a \`value\` referencing a service output like "hexclave.projectId".`);
+        }
+        result[envVarKey] = { type: "connection", value: entry.value };
+        break;
+      }
+      default: {
+        throw new CliError(`${path} has an unknown \`type\` ${JSON.stringify(entry.type)}. Supported: "secret", "connection", or no type for a plain value.`);
+      }
+    }
+  }
+  return result;
+}
+
+/**
+ * Checks the provided secrets against the secret keys the env definitions
+ * reference, so a missing or misspelled secret fails BEFORE packaging and
+ * uploading. The backend re-checks this authoritatively. Exported for unit
+ * tests.
+ */
+export function assertSecretsMatchEnv(env: Record<string, ServiceEnvVarConfig>, secrets: ReadonlyMap<string, string>): void {
+  const referencedKeys = new Set(Object.values(env).flatMap((entry) => "type" in entry && entry.type === "secret" ? [entry.key] : []));
+  const missing = [...referencedKeys].filter((key) => !secrets.has(key));
+  if (missing.length > 0) {
+    throw new CliError(`Missing secret values for: ${missing.join(", ")}. This service's env vars reference these secrets — pass them with --secret <key>=<value>.`);
+  }
+  const unused = [...secrets.keys()].filter((key) => !referencedKeys.has(key));
+  if (unused.length > 0) {
+    throw new CliError(`Unknown --secret key(s): ${unused.join(", ")}. No env var of this service references them — check for typos, or add an env var with \`type: "secret"\` referencing them.`);
+  }
+}
+
+/**
+ * Resolves the config file path: --config wins (and must exist); otherwise the
+ * first existing candidate in cwd, or undefined when there is none — the
+ * config file is optional, deploys then use the service's configuration as
+ * stored on the backend (dashboard-configured). Exported for unit tests.
+ */
+export function resolveDeployConfigPath(configOption: string | undefined, cwd: string): string | undefined {
+  if (configOption != null && configOption !== "") {
+    const resolved = path.resolve(cwd, configOption);
+    if (!fs.existsSync(resolved) || !fs.statSync(resolved).isFile()) {
+      throw new CliError(`Config file not found: ${resolved}`);
+    }
+    return resolved;
+  }
+  for (const candidate of CONFIG_FILE_CANDIDATES) {
+    const resolved = path.resolve(cwd, candidate);
+    if (fs.existsSync(resolved) && fs.statSync(resolved).isFile()) {
+      return resolved;
+    }
+  }
+  return undefined;
+}
+
+// Returns a FACTORY rather than a fixed header object: the deploy flow can
+// span minutes (large uploads), and the refresh-token path's access token may
+// expire mid-flow. getTokens() transparently refreshes when needed, so calling
+// the factory per request always yields a valid token; the secret-server-key
+// path is static.
+async function buildAuthHeadersFactory(auth: ProjectAuth): Promise<() => Promise<Record<string, string>>> {
+  if (isProjectAuthWithSecretServerKey(auth)) {
+    const headers = {
+      "x-stack-access-type": "server",
+      "x-stack-project-id": auth.projectId,
+      "x-stack-secret-server-key": auth.secretServerKey,
+    };
+    return () => Promise.resolve(headers);
+  }
+  // Refresh-token auth: the admin access token for a project is simply the
+  // internal-project access token of a user who owns it.
+  const user = await getInternalUser(auth);
+  return async () => {
+    const { accessToken } = await user.currentSession.getTokens();
+    if (accessToken == null) {
+      throw new AuthError("Could not obtain an access token. Run `hexclave login` again.");
+    }
+    return {
+      "x-stack-access-type": "admin",
+      "x-stack-project-id": auth.projectId,
+      "x-stack-admin-access-token": accessToken,
+    };
+  };
+}
+
+// Returns `any` on purpose: this is a thin JSON transport; each call site
+// immediately validates the specific fields it needs (and errors cleanly on
+// unexpected shapes), so a structural type here would just duplicate that.
+async function deployApiFetch(auth: ProjectAuth, getAuthHeaders: () => Promise<Record<string, string>>, apiPath: string, init: {
+  method: string,
+  jsonBody?: unknown,
+}): Promise<any> {
+  const url = `${auth.apiUrl.replace(/\/$/, "")}/api/latest${apiPath}`;
+  const response = await fetch(url, {
+    method: init.method,
+    headers: {
+      ...await getAuthHeaders(),
+      ...(init.jsonBody !== undefined ? { "content-type": "application/json" } : {}),
+    },
+    body: init.jsonBody !== undefined ? JSON.stringify(init.jsonBody) : undefined,
+  });
+  const text = await response.text();
+  if (!response.ok) {
+    let message = text;
+    try {
+      const parsed = JSON.parse(text);
+      if (typeof parsed?.error === "string") message = parsed.error;
+      else if (typeof parsed?.error?.message === "string") message = parsed.error.message;
+    } catch {
+      // Response body isn't JSON; use it as-is.
+    }
+    throw new CliError(`Deploy request failed (${response.status} at ${init.method} ${apiPath}): ${message.slice(0, 1000)}`);
+  }
+  try {
+    return text === "" ? undefined : JSON.parse(text);
+  } catch {
+    throw new CliError(`Unexpected non-JSON response from the Hexclave API at ${init.method} ${apiPath}.`);
+  }
+}
+
+async function uploadSource(uploadUrl: string, contentType: string, bytes: Uint8Array): Promise<void> {
+  let parsedUrl: URL;
+  try {
+    parsedUrl = new URL(uploadUrl);
+  } catch {
+    throw new CliError("The Hexclave API returned an invalid object-storage upload URL.");
+  }
+  if (parsedUrl.protocol !== "https:" && parsedUrl.protocol !== "http:") {
+    throw new CliError("The Hexclave API returned an upload URL with an unsupported protocol.");
+  }
+  const response = await fetch(parsedUrl, {
+    method: "PUT",
+    headers: {
+      // This header is signed into the R2/S3 URL and must match exactly.
+      "content-type": contentType,
+      "content-length": bytes.length.toString(),
+    },
+    // Copy into a plain ArrayBuffer: TS's BodyInit doesn't accept
+    // Uint8Array<ArrayBufferLike>, and slicing also drops any surrounding
+    // bytes of a shared buffer.
+    body: new Uint8Array(bytes).slice().buffer,
+  });
+  if (!response.ok) {
+    const responseBody = await response.text();
+    throw new CliError(`Source upload failed (${response.status} from object storage): ${responseBody.slice(0, 1000)}`);
+  }
+}
+
+export function registerDeployCommand(program: Command) {
+  program
+    .command("deploy <service>")
+    .description("Deploy a service defined under `deployments-alpha.services` in your hexclave.config.ts. Uploads the service's source directory, waits for Vercel to accept the deployment, then prints the run id without waiting for the remote build to finish.")
+    .option("--config <path>", "Path to the config file (default: auto-discover hexclave.config.ts in the current directory)")
+    .option("--cloud-project-id <id>", "Hexclave project ID to deploy to (defaults to the HEXCLAVE_PROJECT_ID env var)")
+    .option("--secret <KEY=VALUE>", "Value for a secret env var of this deploy (repeatable). KEY is the secret key named by a `type: \"secret\"` env var in the config; the value is pushed to the deployment target and never persisted by Hexclave.", (value: string, previous: string[]) => [...previous, value], [] as string[])
+    .addHelpText("after", "\nAuthentication: uses HEXCLAVE_SECRET_SERVER_KEY if set (recommended for CI), otherwise your `hexclave login` session.")
+    .action(async (service: string, opts: DeployOptions) => {
+      const auth = resolveAuth(resolveProjectId(opts.cloudProjectId));
+      const secrets = parseSecretOptions(opts.secret);
+      const authHeaders = await buildAuthHeadersFactory(auth);
+
+      const configPath = resolveDeployConfigPath(opts.config, process.cwd());
+      let definition: ServiceDefinition | undefined;
+      let rootDirectory: string;
+      let ignoreRootDirectory: string;
+      if (configPath != null) {
+        // Config-as-code mode: the config file's definition (build config and
+        // env vars) governs this deploy and is upserted into the service
+        // definition by the backend.
+        const { createJiti } = await import("jiti");
+        const jiti = createJiti(import.meta.url);
+        let configModule: { config?: unknown };
+        try {
+          configModule = await jiti.import(configPath);
+        } catch (err: unknown) {
+          throw new CliError(`Failed to load config file ${configPath}: ${errorMessage(err)}`);
+        }
+        if (configModule.config == null) {
+          throw new CliError(`Config file ${configPath} must export a \`config\` object (e.g. \`export const config = { "deployments-alpha": { services: { ... } } }\`).`);
+        }
+        definition = extractServiceDefinition(configModule.config, service);
+        // Fail on missing/misspelled secrets BEFORE packaging and uploading.
+        // The backend re-checks this authoritatively.
+        assertSecretsMatchEnv(definition.env, secrets);
+        // The source directory is the service's rootDirectory, resolved
+        // relative to the config file (not the cwd) so deploys behave the same
+        // from anywhere in the repo.
+        ignoreRootDirectory = path.dirname(configPath);
+        rootDirectory = path.resolve(ignoreRootDirectory, definition.rootDirectory ?? ".");
+      } else {
+        // Dashboard mode: no config file, so the service's definition as
+        // stored on the backend governs the deploy (the service must already
+        // exist there). The root directory decides what gets packaged and is
+        // resolved against the cwd; the stored env definitions let us check
+        // the provided secrets before uploading.
+        const remoteService = await deployApiFetch(auth, authHeaders, `/deployments/services/${encodeURIComponent(service)}`, { method: "GET" });
+        const remoteRootDirectory = typeof remoteService?.root_directory === "string" && remoteService.root_directory !== "" ? remoteService.root_directory : ".";
+        const remoteEnv: Record<string, ServiceEnvVarConfig> = {};
+        for (const envVar of Array.isArray(remoteService?.env) ? remoteService.env : []) {
+          if (envVar?.type === "secret" && typeof envVar.secret_key === "string" && typeof envVar.key === "string") {
+            remoteEnv[envVar.key] = { type: "secret", key: envVar.secret_key };
+          }
+        }
+        assertSecretsMatchEnv(remoteEnv, secrets);
+        ignoreRootDirectory = process.cwd();
+        rootDirectory = path.resolve(process.cwd(), remoteRootDirectory);
+        console.error(`No config file found — using the service configuration stored in Hexclave (root directory: ${remoteRootDirectory}).`);
+      }
+      console.error(`Packaging ${rootDirectory}...`);
+      const packaged = packageSourceDirectory(rootDirectory, ignoreRootDirectory);
+      console.error(`Packaged ${packaged.fileCount} files (${(packaged.tarballGzipped.length / 1024).toFixed(1)} KiB compressed).`);
+
+      const upload = await deployApiFetch(auth, authHeaders, "/deployments/uploads", { method: "POST" });
+      if (typeof upload?.id !== "string" || typeof upload?.upload_url !== "string" || typeof upload?.content_type !== "string") {
+        throw new CliError("Unexpected response from the Hexclave API when creating the upload.");
+      }
+      if (typeof upload.max_bytes === "number" && packaged.tarballGzipped.length > upload.max_bytes) {
+        throw new CliError(`The packaged source is too large (${packaged.tarballGzipped.length} bytes, max ${upload.max_bytes}). Check your .gitignore/.vercelignore — build outputs and large assets shouldn't be uploaded.`);
+      }
+      console.error(`Uploading source...`);
+      await uploadSource(upload.upload_url, upload.content_type, packaged.tarballGzipped);
+
+      console.error(`Starting deployment of ${JSON.stringify(service)}...`);
+      // Without a config file, build_config and env are omitted entirely: the
+      // backend then uses the stored definition field-by-field. WITH a config
+      // file, absent build fields are sent as null ("unset") — the file is the
+      // whole truth, so deleting a field from it must actually remove the
+      // stored value instead of silently keeping it forever.
+      const deployResponse = await deployApiFetch(auth, authHeaders, `/deployments/services/${encodeURIComponent(service)}/deploy`, {
+        method: "POST",
+        jsonBody: {
+          upload_id: upload.id,
+          ...(definition !== undefined ? {
+            build_config: {
+              framework: definition.framework ?? null,
+              install_command: definition.installCommand ?? null,
+              build_command: definition.buildCommand ?? null,
+              output_directory: definition.outputDirectory ?? null,
+              root_directory: definition.rootDirectory ?? null,
+            },
+            env: definition.env,
+          } : {}),
+          ...(secrets.size > 0 ? { secrets: Object.fromEntries(secrets) } : {}),
+        },
+      });
+      if (typeof deployResponse?.run_id !== "string") {
+        throw new CliError("Unexpected response from the Hexclave API when starting the deployment.");
+      }
+
+      // Source preparation is synchronous, but the remote build continues
+      // after this returns. CI therefore does NOT fail on a later build
+      // failure (a waiting/streaming flag is planned post-MVP).
+      console.log(JSON.stringify({ runId: deployResponse.run_id }, null, 2));
+    });
+}

package/src/commands/dev.ts

@@ -9,6 +9,7 @@ import { DASHBOARD_SERVER_RELATIVE_PATH, dashboardDirOverride, fetchDashboardMan
 import { devEnvStatePath, ensureLocalDashboardSecret, readDevEnvState, recordLocalDashboardProcess } from "../lib/dev-env-state.js";
 import { CliError, errorMessage } from "../lib/errors.js";
 import { DASHBOARD_PORT_ENV_VAR, dashboardPort, dashboardRequest, dashboardUrl, createRemoteDevelopmentEnvironmentSession, type DashboardSessionResponse } from "../lib/local-dashboard.js";
+import { startProgress } from "../lib/progress.js";
 
 type ChildCommand = {
   command: string,
@@ -69,10 +70,6 @@ const REQUIRED_DASHBOARD_RUNTIME_ENV_VARS = new Set([
   DASHBOARD_PORT_ENV_VAR,
 ]);
 
-type ProgressLogger = {
-  stop: (finalMessage?: string) => void,
-};
-
 type DashboardSessionState = {
   session: DashboardSessionResponse,
   dashboardReachableSinceMs: number,
@@ -150,37 +147,6 @@ function maybeOpenOnboardingPage(session: DashboardSessionResponse, port: number
   }
 }
 
-function startProgressLog(message: string): ProgressLogger {
-  if (!process.stderr.isTTY) {
-    logDev(`${message}...`);
-    return {
-      stop() {
-        logDev(`${message}... done!`);
-      },
-    };
-  }
-
-  let dotCount = 0;
-  let stopped = false;
-  const render = () => {
-    process.stderr.write(`\r\x1b[2K${LOG_PREFIX}${message}${".".repeat(dotCount)}`);
-    dotCount = (dotCount + 1) % 4;
-  };
-  render();
-  const timer = setInterval(render, 400);
-  timer.unref();
-
-  return {
-    stop() {
-      if (stopped) return;
-      stopped = true;
-      clearInterval(timer);
-      process.stderr.write("\r\x1b[2K");
-      logDev(`${message}... done!`);
-    },
-  };
-}
-
 function dashboardRuntimeRoot(port: number): string {
   return join(dirname(devEnvStatePath()), `${DASHBOARD_RUNTIME_DIR_NAME}-${port}`);
 }
@@ -430,6 +396,9 @@ async function startDashboardIfNeeded(options: { apiBaseUrl: string, secret: str
   // or falls back to cache.
   const dashboardOverride = dashboardDirOverride();
   const skipReleaseLookup = devDashboardCommand != null || dashboardOverride != null;
+  if (!skipReleaseLookup) {
+    logDev("Checking for Hexclave dashboard updates...");
+  }
   const manifest: DashboardManifest | null = skipReleaseLookup ? null : await fetchDashboardManifest();
   const latestVersion = manifest?.version;
 
@@ -461,9 +430,11 @@ async function startDashboardIfNeeded(options: { apiBaseUrl: string, secret: str
 
   // Download (or reuse a cached copy of) the dashboard build to launch. Not
   // needed when a custom dev dashboard command runs the dashboard itself.
-  const release = devDashboardCommand == null ? await resolveDashboardRuntime({ manifest }) : null;
+  const release = devDashboardCommand == null
+    ? await resolveDashboardRuntime({ manifest, onProgress: (message) => logDev(`${message}...`) })
+    : null;
 
-  const progress = startProgressLog(`Hexclave dashboard not found on port ${options.port}. Starting now`);
+  const progress = startProgress(`Hexclave dashboard not found on port ${options.port}. Starting now`, { prefix: LOG_PREFIX });
   const dashboardEnv = {
     ...process.env,
     NODE_ENV: devDashboardCommand == null ? "production" : "development",

package/src/commands/init.ts

@@ -16,6 +16,7 @@ import { createProjectInteractively } from "../lib/create-project.js";
 import { AuthError, CliError } from "../lib/errors.js";
 import { createInitPrompt } from "../lib/init-prompt.js";
 import { isNonInteractiveEnv } from "../lib/interactive.js";
+import { withProgress } from "../lib/progress.js";
 
 const VALID_INIT_MODES = ["create", "create-cloud", "link-config", "link-cloud"] as const;
 type InitMode = typeof VALID_INIT_MODES[number];
@@ -223,12 +224,14 @@ async function writeProjectKeysToEnv(
   project: { id: string, app: { createInternalApiKey: (opts: { description: string, expiresAt: Date, hasPublishableClientKey: boolean, hasSecretServerKey: boolean, hasSuperSecretAdminKey: boolean }) => Promise<{ publishableClientKey?: string | null, secretServerKey?: string | null }> } },
   outputDir: string,
 ) {
-  const apiKey = await project.app.createInternalApiKey({
-    description: "Created by CLI init script",
-    expiresAt: new Date(Date.now() + 1000 * 60 * 60 * 24 * 365 * 200), // 200 years
-    hasPublishableClientKey: true,
-    hasSecretServerKey: true,
-    hasSuperSecretAdminKey: false,
+  const apiKey = await withProgress("Creating project keys", async () => {
+    return await project.app.createInternalApiKey({
+      description: "Created by CLI init script",
+      expiresAt: new Date(Date.now() + 1000 * 60 * 60 * 24 * 365 * 200), // 200 years
+      hasPublishableClientKey: true,
+      hasSecretServerKey: true,
+      hasSuperSecretAdminKey: false,
+    });
   });
 
   const publishableClientKey = apiKey.publishableClientKey ?? throwErr("createInternalApiKey returned no publishableClientKey despite hasPublishableClientKey=true");
@@ -272,7 +275,7 @@ async function writeProjectKeysToEnv(
 
 async function handleCreateCloud(_flags: Record<string, unknown>, opts: InitOptions, outputDir: string): Promise<{ configPath?: string, projectId?: string }> {
   const sessionAuth = await ensureLoggedInSession();
-  const user = await getInternalUser(sessionAuth);
+  const user = await withProgress("Loading account", async () => await getInternalUser(sessionAuth));
 
   const { dashboardUrl } = resolveLoginConfig();
   const newProject = await createProjectInteractively(user, {
@@ -288,8 +291,12 @@ async function handleCreateCloud(_flags: Record<string, unknown>, opts: InitOpti
 
 async function handleLinkFromCloud(_flags: Record<string, unknown>, opts: InitOptions, outputDir: string): Promise<{ configPath?: string, projectId?: string }> {
   const sessionAuth = await ensureLoggedInSession();
-  const user = await getInternalUser(sessionAuth);
-  let projects = await user.listOwnedProjects();
+  const { user, ownedProjects } = await withProgress("Loading projects", async () => {
+    const user = await getInternalUser(sessionAuth);
+    const ownedProjects = await user.listOwnedProjects();
+    return { user, ownedProjects };
+  });
+  let projects = ownedProjects;
   let autoCreatedProjectId: string | null = null;
 
   if (projects.length === 0) {

package/src/commands/project.ts

@@ -3,6 +3,7 @@ import { getInternalUser } from "../lib/app.js";
 import { resolveLoginConfig, resolveSessionAuth } from "../lib/auth.js";
 import { createProjectInteractively } from "../lib/create-project.js";
 import { CliError } from "../lib/errors.js";
+import { withProgress } from "../lib/progress.js";
 
 export type ProjectTarget = "cloud" | "local";
 
@@ -60,8 +61,10 @@ export function registerProjectCommand(program: Command) {
       const sources = resolveProjectListSources(opts);
       const results: ProjectListEntry[] = [];
       const auth = resolveSessionAuth();
-      const user = await getInternalUser(auth);
-      const ownedProjects = await user.listOwnedProjects();
+      const ownedProjects = await withProgress("Loading projects", async () => {
+        const user = await getInternalUser(auth);
+        return await user.listOwnedProjects();
+      });
       for (const p of ownedProjects) {
         const target: ProjectTarget = p.isDevelopmentEnvironment ? "local" : "cloud";
         if ((target === "cloud" && sources.cloud) || (target === "local" && sources.local)) {
@@ -91,7 +94,7 @@ export function registerProjectCommand(program: Command) {
         import("../lib/create-project.js"),
       ]);
       const auth = resolveSessionAuth();
-      const user = await getInternalUser(auth);
+      const user = await withProgress("Loading account", async () => await getInternalUser(auth));
       const { dashboardUrl } = resolveLoginConfig();
 
       const newProject = await createProjectInteractively(user, {

package/src/commands/whoami.ts

@@ -1,6 +1,7 @@
 import { Command } from "commander";
 import { getInternalUser } from "../lib/app.js";
 import { resolveSessionAuth } from "../lib/auth.js";
+import { withProgress } from "../lib/progress.js";
 
 export function registerWhoamiCommand(program: Command) {
   program
@@ -9,8 +10,11 @@ export function registerWhoamiCommand(program: Command) {
     .action(async () => {
       const flags = program.opts();
       const auth = resolveSessionAuth();
-      const user = await getInternalUser(auth);
-      const teams = await user.listTeams();
+      const { user, teams } = await withProgress("Loading account", async () => {
+        const user = await getInternalUser(auth);
+        const teams = await user.listTeams();
+        return { user, teams };
+      });
 
       const result = {
         id: user.id,

package/src/index.ts

@@ -8,6 +8,7 @@ import { cliVersion } from "./lib/own-package.js";
 import { AuthError, CliError } from "./lib/errors.js";
 import { registerLoginCommand } from "./commands/login.js";
 import { registerLogoutCommand } from "./commands/logout.js";
+import { registerDeployCommand } from "./commands/deploy.js";
 import { registerExecCommand } from "./commands/exec.js";
 import { registerConfigCommand } from "./commands/config-file.js";
 import { registerInitCommand } from "./commands/init.js";
@@ -28,6 +29,7 @@ program
 registerLoginCommand(program);
 registerLogoutCommand(program);
 registerExecCommand(program);
+registerDeployCommand(program);
 registerConfigCommand(program);
 registerInitCommand(program);
 registerProjectCommand(program);
@@ -51,9 +53,11 @@ async function main() {
       console.error(`Error: ${err.message}`);
       process.exit(1);
     }
+    // Report the failure before flushing telemetry; the flush can consume its
+    // full timeout, and users should not stare at a silent CLI after it failed.
+    console.error(err);
     captureError("stack-cli-fatal", err);
     await Sentry.flush(2000);
-    console.error(err);
     process.exit(1);
   }
 }

package/src/lib/create-project.ts

@@ -3,6 +3,7 @@ import type { CurrentInternalUser } from "@hexclave/js";
 import { DEFAULT_DASHBOARD_URL } from "./auth.js";
 import { CliError } from "./errors.js";
 import { isNonInteractiveEnv } from "./interactive.js";
+import { withProgress } from "./progress.js";
 
 type CreateProjectOptions = {
   displayName?: string,
@@ -26,14 +27,16 @@ export async function createProjectInteractively(
     })).trim();
   }
 
-  const teams = await user.listTeams();
-  if (teams.length === 0) {
-    const dashboardUrl = opts.dashboardUrl ?? DEFAULT_DASHBOARD_URL;
-    throw new CliError(`No teams found on your account. Create a team at ${dashboardUrl} first.`);
-  }
+  return await withProgress("Creating project", async () => {
+    const teams = await user.listTeams();
+    if (teams.length === 0) {
+      const dashboardUrl = opts.dashboardUrl ?? DEFAULT_DASHBOARD_URL;
+      throw new CliError(`No teams found on your account. Create a team at ${dashboardUrl} first.`);
+    }
 
-  return await user.createProject({
-    displayName,
-    teamId: teams[0].id,
+    return await user.createProject({
+      displayName,
+      teamId: teams[0].id,
+    });
   });
 }