@hs-x/cli 0.2.2 → 0.2.4

package/dist/commands/deploy.js

@@ -324,6 +324,10 @@ function isRecord(value) {
     return typeof value === 'object' && value !== null;
 }
 export async function deployCommand({ argv, root, json, }) {
+    // Stamp the whole invocation up front: the human summary reporter is created
+    // late (render time), so without this "Deployed … in 1ms" measured only the
+    // summary step rather than the deploy itself.
+    const commandStartedAt = Date.now();
     if (argv[1] === 'promote') {
         return deployPromoteCommand({ argv, json });
     }
@@ -659,6 +663,7 @@ export async function deployCommand({ argv, root, json, }) {
     else {
         renderDeployHuman({
             argv,
+            startedAt: commandStartedAt,
             plan,
             root,
             planOnly,
@@ -834,6 +839,7 @@ function renderDeployHuman(input) {
     const reporter = createReporter({
         command: 'deploy',
         argv: input.argv,
+        startedAt: input.startedAt,
     });
     const subject = basename(input.root);
     reporter.header(subject);
@@ -882,7 +888,12 @@ function renderDeployHuman(input) {
         if (input.controlPlanePlan.sharedCloudflareQuota) {
             reporter.info(`Shared Cloudflare quota: ${input.controlPlanePlan.sharedCloudflareQuota.visibleSiblingAccountIds.join(', ')}`);
         }
-        reporter.info(`Leases: ${input.controlPlanePlan.leases.length}`);
+        // Credential leases only exist on linked, control-plane-backed deploys;
+        // "Leases: 0" was unexplained jargon on every unlinked deploy, so say
+        // nothing when there are none.
+        if (input.controlPlanePlan.leases.length > 0) {
+            reporter.info(`Cloudflare credential leases issued by the control plane: ${input.controlPlanePlan.leases.length}`);
+        }
     }
     if (input.controlPlaneRecord) {
         reporter.info(`Local control plane record status: ${input.controlPlaneRecord.status}`);
@@ -897,7 +908,7 @@ function renderDeployHuman(input) {
         reporter.info(`Cloudflare deploy: ${deployed}`);
     }
     if (!input.linked && input.cloudflareDeployResult) {
-        reporter.info(`Machine dashboard: ${machineDashboardUrl(input.machineId)}`);
+        reporter.info(`Deploy history for this machine: ${machineDashboardUrl(input.machineId)}`);
     }
     if (input.hubspotUploadResult) {
         const upload = input.hubspotUploadResult;
@@ -1332,6 +1343,7 @@ async function executeCloudflareWorkerDeploy({ argv, root, worker, index, source
         ...(installRuntimeBinding
             ? { installKvNamespaceId: installRuntimeBinding.installKvNamespaceId }
             : {}),
+        ...(controlPlaneUrl ? { checkpointDataset: 'hsx_checkpoint', observability: true } : {}),
         ...(tenantDataPlane
             ? {
                 flagsKvNamespaceId: tenantDataPlane.flagsKvNamespaceId,
@@ -1355,6 +1367,37 @@ async function executeCloudflareWorkerDeploy({ argv, root, worker, index, source
         tenantDataPlane?.flagsKvNamespaceName,
         tenantDataPlane?.tenantD1DatabaseName,
     ].filter((name) => typeof name === 'string' && name.toLowerCase().startsWith(accountResourcePrefix));
+    // wrangler does NOT auto-apply D1 migrations on deploy (found live:
+    // tenant DBs had zero tables across every real deploy since ADR-014) —
+    // apply them explicitly before the worker code that expects them lands.
+    const migrationsDirExists = await stat(join(root, 'node_modules', '@hs-x', 'runtime', 'migrations'))
+        .then((entry) => entry.isDirectory())
+        .catch(() => false);
+    if (tenantDataPlane?.tenantD1DatabaseName && !dryRun && !migrationsDirExists) {
+        process.stderr.write('warning: @hs-x/runtime did not ship its tenant migrations (pre-0.2.4 package) — tenant D1 tables were NOT applied; upgrade @hs-x/runtime.\n');
+    }
+    if (tenantDataPlane?.tenantD1DatabaseName && !dryRun && migrationsDirExists) {
+        try {
+            await runCloudflareCommand([
+                'bun',
+                'x',
+                'wrangler',
+                'd1',
+                'migrations',
+                'apply',
+                tenantDataPlane.tenantD1DatabaseName,
+                '--remote',
+                '--config',
+                relative(root, configPath),
+            ], { cwd: root, env: cloudflareDeployEnv(argv) });
+        }
+        catch (error) {
+            const message = error instanceof Error ? error.message : String(error);
+            if (!/No migrations to apply/i.test(message)) {
+                throw new Error(`Tenant D1 migrations failed: ${message.slice(-300)}`);
+            }
+        }
+    }
     const command = [
         'bun',
         'x',
@@ -1458,7 +1501,19 @@ async function executeCloudflareWorkerDeploy({ argv, root, worker, index, source
                 installKvNamespaceName: installRuntimeBinding.installKvNamespaceName,
                 tokenKeySecretName: installRuntimeBinding.tokenKeySecretName,
                 runtimeBaseUrl: resolvedRuntimeUrl,
-                ...(tenantDataPlane ? { syncGrantSecretName: tenantDataPlane.syncGrantSecretName } : {}),
+                ...(tenantDataPlane
+                    ? {
+                        syncGrantSecretName: tenantDataPlane.syncGrantSecretName,
+                        // Read-through legs need these registered: exemplars read the
+                        // tenant D1; flag tooling reads the flags KV.
+                        tenantD1DatabaseId: tenantDataPlane.tenantD1DatabaseId,
+                        tenantD1DatabaseName: tenantDataPlane.tenantD1DatabaseName,
+                        flagsKvNamespaceId: tenantDataPlane.flagsKvNamespaceId,
+                        ...(tenantDataPlane.flagsKvNamespaceName
+                            ? { flagsKvNamespaceName: tenantDataPlane.flagsKvNamespaceName }
+                            : {}),
+                    }
+                    : {}),
             });
         }
         catch (error) {
@@ -1643,6 +1698,10 @@ async function putDeployInstallRuntimeBinding(input) {
             tokenKeySecretName: input.tokenKeySecretName,
             ...(input.runtimeBaseUrl ? { runtimeBaseUrl: input.runtimeBaseUrl } : {}),
             ...(input.syncGrantSecretName ? { syncGrantSecretName: input.syncGrantSecretName } : {}),
+            ...(input.tenantD1DatabaseId ? { tenantD1DatabaseId: input.tenantD1DatabaseId } : {}),
+            ...(input.tenantD1DatabaseName ? { tenantD1DatabaseName: input.tenantD1DatabaseName } : {}),
+            ...(input.flagsKvNamespaceId ? { flagsKvNamespaceId: input.flagsKvNamespaceId } : {}),
+            ...(input.flagsKvNamespaceName ? { flagsKvNamespaceName: input.flagsKvNamespaceName } : {}),
         },
     });
     const body = await response.json();
@@ -1824,6 +1883,14 @@ export function renderWranglerConfig(input) {
         `name = "${tomlString(input.workerName)}"`,
         `main = "${tomlString(input.entrypointPath)}"`,
         `compatibility_date = "${tomlString(input.compatibilityDate)}"`,
+        // nodejs_compat: guide + scaffold code reads `process.env.X` at module
+        // scope (e.g. defineSource hmac secrets); without it the Worker fails
+        // validation with "process is not defined" (Cloudflare error 10021,
+        // cold-stranger run #2 blocker A). With nodejs_compat and a
+        // compatibility_date >= 2025-04-01, Workers auto-populate process.env
+        // from bindings/secrets; the explicit populate flag keeps that true even
+        // when --compatibility-date is set to an older date.
+        'compatibility_flags = [ "nodejs_compat", "nodejs_compat_populate_process_env" ]',
     ];
     if (input.installKvNamespaceId) {
         lines.push('', '[[kv_namespaces]]', 'binding = "INSTALL_KV"', `id = "${tomlString(input.installKvNamespaceId)}"`);
@@ -1835,6 +1902,15 @@ export function renderWranglerConfig(input) {
     // ADR-015/ADR-014 project-scoped tenant D1 (flag config + installer PII +
     // platform events). migrations_dir lets wrangler auto-apply the tenant
     // migrations on deploy.
+    if (input.observability) {
+        // Workers Logs (GA): ingested + indexed by Cloudflare for 7 days; the
+        // dashboard live-tail reads them via the observability telemetry API
+        // with the account's stored token (read-through program, 2026-06-10).
+        lines.push('', '[observability]', 'enabled = true', '', '[observability.logs]', 'invocation_logs = true');
+    }
+    if (input.checkpointDataset) {
+        lines.push('', '[[analytics_engine_datasets]]', 'binding = "CHECKPOINT"', `dataset = "${tomlString(input.checkpointDataset)}"`);
+    }
     if (input.tenantD1DatabaseId) {
         lines.push('', '[[d1_databases]]', 'binding = "TENANT_DB"');
         if (input.tenantD1DatabaseName) {
@@ -1870,7 +1946,7 @@ async function readDeployHubSpotOAuthSecret(input) {
 function extractWorkerUrl(output) {
     return /https:\/\/[a-zA-Z0-9.-]+\.workers\.dev\b/.exec(output)?.[0];
 }
-async function ensureHubSpotRuntimeProjectArtifacts({ argv, root, app, workers, cloudflareDeployResult, needsRuntime, controlPlanePlan, }) {
+export async function ensureHubSpotRuntimeProjectArtifacts({ argv, root, app, workers, cloudflareDeployResult, needsRuntime, controlPlanePlan, }) {
     if (!needsRuntime) {
         return;
     }
@@ -1891,6 +1967,14 @@ async function ensureHubSpotRuntimeProjectArtifacts({ argv, root, app, workers,
     });
     for (const [file, contents] of Object.entries(generated.files)) {
         const path = join(root, file);
+        // src/app/cards/package.json is user-owned once it exists: HubSpot's own
+        // build errors instruct users to add card dependencies (e.g. hs-uix) to
+        // it, and regenerating the fixed-dep version here silently dropped those
+        // deps so the card never built (cold-stranger run #2 blocker B). Keep the
+        // user's file verbatim; only generate one when absent.
+        if (file === 'src/app/cards/package.json' && (await stat(path).catch(() => undefined))) {
+            continue;
+        }
         await mkdir(dirname(path), { recursive: true });
         await writeFile(path, contents);
     }
@@ -2695,6 +2779,7 @@ async function requestHostedControlPlaneDeployRecordAndMaybePromote({ request, p
             signedManifest: request.manifest,
             signature: `sig_${plan.deployId}`,
             bundleKey: deployBundleKey({ projectId: request.projectId, deployId: plan.deployId }),
+            ...(await collectDeployProvenance(userId)),
         },
     });
     const body = await response.json();
@@ -2833,14 +2918,59 @@ function stringProperty(source, propertyName) {
     return match ? { [propertyName]: match } : {};
 }
 function schemaProperty(source) {
-    const body = /schema\s*:\s*\{([\s\S]*?)\}\s*(?:,|$)/.exec(source)?.[1];
+    // Balanced-brace extraction. The previous non-greedy regex stopped at the
+    // first `}` inside an object-form field (`score: { type: "number", … }`),
+    // truncating the schema and mis-reading nested keys (`type`) as property
+    // names — which made portal-schema plans wrong for any schema that mixes
+    // shorthand strings with object declarations.
+    const body = objectLiteralBody(source, 'schema');
     if (!body) {
         return {};
     }
     const schema = {};
-    for (const match of body.matchAll(/([A-Za-z_$][\w$]*)\s*:\s*["'`]([^"'`]+)["'`]/g)) {
-        if (match[1] && match[2]) {
-            schema[match[1]] = match[2];
+    let index = 0;
+    while (index < body.length) {
+        const entry = /^[\s,]*([A-Za-z_$][\w$]*)\s*:\s*/.exec(body.slice(index));
+        if (!entry || !entry[1])
+            break;
+        const name = entry[1];
+        const valueStart = index + entry[0].length;
+        const char = body[valueStart];
+        if (char === '"' || char === "'" || char === '`') {
+            const close = body.indexOf(char, valueStart + 1);
+            if (close === -1)
+                break;
+            schema[name] = body.slice(valueStart + 1, close);
+            index = close + 1;
+        }
+        else if (char === '{') {
+            let depth = 0;
+            let end = -1;
+            for (let i = valueStart; i < body.length; i += 1) {
+                if (body[i] === '{')
+                    depth += 1;
+                else if (body[i] === '}') {
+                    depth -= 1;
+                    if (depth === 0) {
+                        end = i;
+                        break;
+                    }
+                }
+            }
+            if (end === -1)
+                break;
+            const inner = body.slice(valueStart + 1, end);
+            const type = /type\s*:\s*["'`]([^"'`]+)["'`]/.exec(inner)?.[1];
+            const property = /property\s*:\s*["'`]([^"'`]+)["'`]/.exec(inner)?.[1];
+            schema[name] = { ...(type ? { type } : {}), ...(property ? { property } : {}) };
+            index = end + 1;
+        }
+        else {
+            // Unsupported value shape (identifier, number); skip to the next entry.
+            const nextComma = body.indexOf(',', valueStart);
+            if (nextComma === -1)
+                break;
+            index = nextComma + 1;
         }
     }
     return Object.keys(schema).length > 0 ? { schema } : {};
@@ -3148,4 +3278,40 @@ const deployPromoteSubCmd = Command.make('promote', {
     yield* runQuarantined(opts.json, () => deployCommand({ argv, root, json: opts.json }));
 })));
 export const deployCmd = deployBaseCmd.pipe(Command.withSubcommands([deployPromoteSubCmd]));
+/**
+ * Provenance for the active-deploy card, collected where it's cheapest: the
+ * CLI knows its own version, the git state of the tree it deployed, and the
+ * session identity. Everything best-effort — a non-git tree stamps nothing.
+ */
+async function collectDeployProvenance(userId) {
+    const git = async (args) => {
+        try {
+            const proc = Bun.spawn({ cmd: ['git', ...args], stdout: 'pipe', stderr: 'ignore' });
+            const [out, code] = await Promise.all([new Response(proc.stdout).text(), proc.exited]);
+            const trimmed = out.trim();
+            return code === 0 && trimmed ? trimmed : undefined;
+        }
+        catch {
+            return undefined;
+        }
+    };
+    const [gitCommit, gitBranch] = await Promise.all([
+        git(['rev-parse', '--short', 'HEAD']),
+        git(['rev-parse', '--abbrev-ref', 'HEAD']),
+    ]);
+    let deployedBy;
+    try {
+        const { loadStore, activeSession } = await import('../account-store.js');
+        deployedBy = activeSession(await loadStore())?.email ?? userId;
+    }
+    catch {
+        deployedBy = userId;
+    }
+    return {
+        cliVersion: `hs-x@${CLI_VERSION}`,
+        ...(gitCommit ? { gitCommit } : {}),
+        ...(gitBranch ? { gitBranch } : {}),
+        ...(deployedBy ? { deployedBy } : {}),
+    };
+}
 //# sourceMappingURL=deploy.js.map