@hs-x/cli 0.2.3 → 0.2.4

package/dist/commands/deploy.d.ts

@@ -1,3 +1,6 @@
+import { type WorkerManifest } from '@hs-x/codegen';
+import type { AppEventDeclaration, AppObjectAssociationDeclaration, AppObjectDeclaration, CardDefinition } from '@hs-x/types';
+import type { AppBillingDeclaration } from '@hs-x/types';
 import * as Command from '@effect/cli/Command';
 import { Option } from 'effect';
 import { Cwd } from '../services/cwd.js';
@@ -7,6 +10,21 @@ export declare function deployCommand({ argv, root, json, }: {
     readonly root: string;
     readonly json: boolean;
 }): Promise<CliResult>;
+interface CloudflareWorkerDeployResult {
+    readonly workerName: string;
+    readonly workerSourcePath: string;
+    readonly entrypointPath: string;
+    readonly configPath?: string;
+    readonly url: string | undefined;
+    readonly command: readonly string[];
+    readonly dryRun: boolean;
+    readonly stdout: string;
+    readonly stderr: string;
+}
+interface CloudflareDeployResult {
+    readonly deployId: string;
+    readonly workers: readonly CloudflareWorkerDeployResult[];
+}
 export declare function renderWranglerConfig(input: {
     readonly workerName: string;
     readonly entrypointPath: string;
@@ -22,6 +40,32 @@ export declare function renderWranglerConfig(input: {
     /** Enable Workers Logs ingestion (linked deploys; read by the dashboard tail). */
     readonly observability?: boolean;
 }): string;
+export declare function ensureHubSpotRuntimeProjectArtifacts({ argv, root, app, workers, cloudflareDeployResult, needsRuntime, controlPlanePlan, }: {
+    readonly argv: readonly string[];
+    readonly root: string;
+    readonly app: HsxAppConfig;
+    readonly workers: readonly WorkerManifest[];
+    readonly cloudflareDeployResult: CloudflareDeployResult | undefined;
+    readonly needsRuntime: boolean;
+    readonly controlPlanePlan?: {
+        readonly runtimeBindings?: {
+            readonly oauthCallbackPath: string;
+        };
+    };
+}): Promise<void>;
+interface HsxAppConfig {
+    readonly appName: string;
+    readonly description?: string;
+    readonly distribution: string;
+    readonly auth: string;
+    readonly platformVersion: string;
+    readonly scopes: readonly string[];
+    readonly appObjects: readonly AppObjectDeclaration[];
+    readonly appObjectAssociations: readonly AppObjectAssociationDeclaration[];
+    readonly appEvents: readonly AppEventDeclaration[];
+    readonly cards: readonly CardDefinition[];
+    readonly billing?: AppBillingDeclaration;
+}
 export declare const deployCmd: Command.Command<"deploy", Cwd, import("../cli-error.js").CliError, {
     readonly json: boolean;
     readonly cwd: Option.Option<string>;
@@ -76,4 +120,5 @@ export declare const deployCmd: Command.Command<"deploy", Cwd, import("../cli-er
         readonly yes: boolean;
     }>;
 }>;
+export {};
 //# sourceMappingURL=deploy.d.ts.map

package/dist/commands/deploy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"deploy.d.ts","sourceRoot":"","sources":["../../src/commands/deploy.ts"],"names":[],"mappings":"AA+BA,OAAO,KAAK,OAAO,MAAM,qBAAqB,CAAC;AAE/C,OAAO,EAAU,MAAM,EAAE,MAAM,QAAQ,CAAC;AAgBxC,OAAO,EAAE,GAAG,EAAE,MAAM,oBAAoB,CAAC;AAyBzC,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AA+a9C,wBAAsB,aAAa,CAAC,EAClC,IAAI,EACJ,IAAI,EACJ,IAAI,GACL,EAAE;IACD,QAAQ,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;CACxB,GAAG,OAAO,CAAC,SAAS,CAAC,CAoarB;AAslDD,wBAAgB,oBAAoB,CAAC,KAAK,EAAE;IAC1C,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,oBAAoB,CAAC,EAAE,MAAM,CAAC;IACvC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IACrC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IACrC,QAAQ,CAAC,oBAAoB,CAAC,EAAE,MAAM,CAAC;IACvC,wFAAwF;IACxF,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,CAAC;IACtC,6EAA6E;IAC7E,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IACpC,kFAAkF;IAClF,QAAQ,CAAC,aAAa,CAAC,EAAE,OAAO,CAAC;CAClC,GAAG,MAAM,CAoDT;AAqpDD,eAAO,MAAM,SAAS;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAAqE,CAAC"}
+{"version":3,"file":"deploy.d.ts","sourceRoot":"","sources":["../../src/commands/deploy.ts"],"names":[],"mappings":"AAQA,OAAO,EAGL,KAAK,cAAc,EAOpB,MAAM,eAAe,CAAC;AAIvB,OAAO,KAAK,EACV,mBAAmB,EACnB,+BAA+B,EAC/B,oBAAoB,EACpB,cAAc,EACf,MAAM,aAAa,CAAC;AAErB,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AAEzD,OAAO,KAAK,OAAO,MAAM,qBAAqB,CAAC;AAE/C,OAAO,EAAU,MAAM,EAAE,MAAM,QAAQ,CAAC;AAgBxC,OAAO,EAAE,GAAG,EAAE,MAAM,oBAAoB,CAAC;AAyBzC,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AA+a9C,wBAAsB,aAAa,CAAC,EAClC,IAAI,EACJ,IAAI,EACJ,IAAI,GACL,EAAE;IACD,QAAQ,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;CACxB,GAAG,OAAO,CAAC,SAAS,CAAC,CAoarB;AA4nBD,UAAU,4BAA4B;IACpC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,CAAC;IACjC,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,UAAU,sBAAsB;IAC9B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,OAAO,EAAE,SAAS,4BAA4B,EAAE,CAAC;CAC3D;AAogCD,wBAAgB,oBAAoB,CAAC,KAAK,EAAE;IAC1C,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,oBAAoB,CAAC,EAAE,MAAM,CAAC;IACvC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IACrC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IACrC,QAAQ,CAAC,oBAAoB,CAAC,EAAE,MAAM,CAAC;IACvC,wFAAwF;IACxF,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,CAAC;IACtC,6EAA6E;IAC7E,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IACpC,kFAAkF;IAClF,QAAQ,CAAC,aAAa,CAAC,EAAE,OAAO,CAAC;CAClC,GAAG,MAAM,CA4DT;AA2CD,wBAAsB,oCAAoC,CAAC,EACzD,IAAI,EACJ,IAAI,EACJ,GAAG,EACH,OAAO,EACP,sBAAsB,EACtB,YAAY,EACZ,gBAAgB,GACjB,EAAE;IACD,QAAQ,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC;IAC3B,QAAQ,CAAC,OAAO,EAAE,SAAS,cAAc,EAAE,CAAC;IAC5C,QAAQ,CAAC,sBAAsB,EAAE,sBAAsB,GAAG,SAAS,CAAC;IACpE,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;IAC/B,QAAQ,CAAC,gBAAgB,CAAC,EAAE;QAAE,QAAQ,CAAC,eAAe,CAAC,EAAE;YAAE,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAA;SAAE,CAAA;KAAE,CAAC;CACnG,GAAG,OAAO,CAAC,IAAI,CAAC,CAsChB;AAWD,UAAU,YAAY;IACpB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,QAAQ,CAAC,UAAU,EAAE,SAAS,oBAAoB,EAAE,CAAC;IACrD,QAAQ,CAAC,qBAAqB,EAAE,SAAS,+BAA+B,EAAE,CAAC;IAC3E,QAAQ,CAAC,SAAS,EAAE,SAAS,mBAAmB,EAAE,CAAC;IACnD,QAAQ,CAAC,KAAK,EAAE,SAAS,cAAc,EAAE,CAAC;IAC1C,QAAQ,CAAC,OAAO,CAAC,EAAE,qBAAqB,CAAC;CAC1C;AA4kDD,eAAO,MAAM,SAAS;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAAqE,CAAC"}

package/dist/commands/deploy.js

@@ -1367,6 +1367,37 @@ async function executeCloudflareWorkerDeploy({ argv, root, worker, index, source
         tenantDataPlane?.flagsKvNamespaceName,
         tenantDataPlane?.tenantD1DatabaseName,
     ].filter((name) => typeof name === 'string' && name.toLowerCase().startsWith(accountResourcePrefix));
+    // wrangler does NOT auto-apply D1 migrations on deploy (found live:
+    // tenant DBs had zero tables across every real deploy since ADR-014) —
+    // apply them explicitly before the worker code that expects them lands.
+    const migrationsDirExists = await stat(join(root, 'node_modules', '@hs-x', 'runtime', 'migrations'))
+        .then((entry) => entry.isDirectory())
+        .catch(() => false);
+    if (tenantDataPlane?.tenantD1DatabaseName && !dryRun && !migrationsDirExists) {
+        process.stderr.write('warning: @hs-x/runtime did not ship its tenant migrations (pre-0.2.4 package) — tenant D1 tables were NOT applied; upgrade @hs-x/runtime.\n');
+    }
+    if (tenantDataPlane?.tenantD1DatabaseName && !dryRun && migrationsDirExists) {
+        try {
+            await runCloudflareCommand([
+                'bun',
+                'x',
+                'wrangler',
+                'd1',
+                'migrations',
+                'apply',
+                tenantDataPlane.tenantD1DatabaseName,
+                '--remote',
+                '--config',
+                relative(root, configPath),
+            ], { cwd: root, env: cloudflareDeployEnv(argv) });
+        }
+        catch (error) {
+            const message = error instanceof Error ? error.message : String(error);
+            if (!/No migrations to apply/i.test(message)) {
+                throw new Error(`Tenant D1 migrations failed: ${message.slice(-300)}`);
+            }
+        }
+    }
     const command = [
         'bun',
         'x',
@@ -1470,7 +1501,19 @@ async function executeCloudflareWorkerDeploy({ argv, root, worker, index, source
                 installKvNamespaceName: installRuntimeBinding.installKvNamespaceName,
                 tokenKeySecretName: installRuntimeBinding.tokenKeySecretName,
                 runtimeBaseUrl: resolvedRuntimeUrl,
-                ...(tenantDataPlane ? { syncGrantSecretName: tenantDataPlane.syncGrantSecretName } : {}),
+                ...(tenantDataPlane
+                    ? {
+                        syncGrantSecretName: tenantDataPlane.syncGrantSecretName,
+                        // Read-through legs need these registered: exemplars read the
+                        // tenant D1; flag tooling reads the flags KV.
+                        tenantD1DatabaseId: tenantDataPlane.tenantD1DatabaseId,
+                        tenantD1DatabaseName: tenantDataPlane.tenantD1DatabaseName,
+                        flagsKvNamespaceId: tenantDataPlane.flagsKvNamespaceId,
+                        ...(tenantDataPlane.flagsKvNamespaceName
+                            ? { flagsKvNamespaceName: tenantDataPlane.flagsKvNamespaceName }
+                            : {}),
+                    }
+                    : {}),
             });
         }
         catch (error) {
@@ -1655,6 +1698,10 @@ async function putDeployInstallRuntimeBinding(input) {
             tokenKeySecretName: input.tokenKeySecretName,
             ...(input.runtimeBaseUrl ? { runtimeBaseUrl: input.runtimeBaseUrl } : {}),
             ...(input.syncGrantSecretName ? { syncGrantSecretName: input.syncGrantSecretName } : {}),
+            ...(input.tenantD1DatabaseId ? { tenantD1DatabaseId: input.tenantD1DatabaseId } : {}),
+            ...(input.tenantD1DatabaseName ? { tenantD1DatabaseName: input.tenantD1DatabaseName } : {}),
+            ...(input.flagsKvNamespaceId ? { flagsKvNamespaceId: input.flagsKvNamespaceId } : {}),
+            ...(input.flagsKvNamespaceName ? { flagsKvNamespaceName: input.flagsKvNamespaceName } : {}),
         },
     });
     const body = await response.json();
@@ -1836,6 +1883,14 @@ export function renderWranglerConfig(input) {
         `name = "${tomlString(input.workerName)}"`,
         `main = "${tomlString(input.entrypointPath)}"`,
         `compatibility_date = "${tomlString(input.compatibilityDate)}"`,
+        // nodejs_compat: guide + scaffold code reads `process.env.X` at module
+        // scope (e.g. defineSource hmac secrets); without it the Worker fails
+        // validation with "process is not defined" (Cloudflare error 10021,
+        // cold-stranger run #2 blocker A). With nodejs_compat and a
+        // compatibility_date >= 2025-04-01, Workers auto-populate process.env
+        // from bindings/secrets; the explicit populate flag keeps that true even
+        // when --compatibility-date is set to an older date.
+        'compatibility_flags = [ "nodejs_compat", "nodejs_compat_populate_process_env" ]',
     ];
     if (input.installKvNamespaceId) {
         lines.push('', '[[kv_namespaces]]', 'binding = "INSTALL_KV"', `id = "${tomlString(input.installKvNamespaceId)}"`);
@@ -1891,7 +1946,7 @@ async function readDeployHubSpotOAuthSecret(input) {
 function extractWorkerUrl(output) {
     return /https:\/\/[a-zA-Z0-9.-]+\.workers\.dev\b/.exec(output)?.[0];
 }
-async function ensureHubSpotRuntimeProjectArtifacts({ argv, root, app, workers, cloudflareDeployResult, needsRuntime, controlPlanePlan, }) {
+export async function ensureHubSpotRuntimeProjectArtifacts({ argv, root, app, workers, cloudflareDeployResult, needsRuntime, controlPlanePlan, }) {
     if (!needsRuntime) {
         return;
     }
@@ -1912,6 +1967,14 @@ async function ensureHubSpotRuntimeProjectArtifacts({ argv, root, app, workers,
     });
     for (const [file, contents] of Object.entries(generated.files)) {
         const path = join(root, file);
+        // src/app/cards/package.json is user-owned once it exists: HubSpot's own
+        // build errors instruct users to add card dependencies (e.g. hs-uix) to
+        // it, and regenerating the fixed-dep version here silently dropped those
+        // deps so the card never built (cold-stranger run #2 blocker B). Keep the
+        // user's file verbatim; only generate one when absent.
+        if (file === 'src/app/cards/package.json' && (await stat(path).catch(() => undefined))) {
+            continue;
+        }
         await mkdir(dirname(path), { recursive: true });
         await writeFile(path, contents);
     }
@@ -2716,6 +2779,7 @@ async function requestHostedControlPlaneDeployRecordAndMaybePromote({ request, p
             signedManifest: request.manifest,
             signature: `sig_${plan.deployId}`,
             bundleKey: deployBundleKey({ projectId: request.projectId, deployId: plan.deployId }),
+            ...(await collectDeployProvenance(userId)),
         },
     });
     const body = await response.json();
@@ -2854,14 +2918,59 @@ function stringProperty(source, propertyName) {
     return match ? { [propertyName]: match } : {};
 }
 function schemaProperty(source) {
-    const body = /schema\s*:\s*\{([\s\S]*?)\}\s*(?:,|$)/.exec(source)?.[1];
+    // Balanced-brace extraction. The previous non-greedy regex stopped at the
+    // first `}` inside an object-form field (`score: { type: "number", … }`),
+    // truncating the schema and mis-reading nested keys (`type`) as property
+    // names — which made portal-schema plans wrong for any schema that mixes
+    // shorthand strings with object declarations.
+    const body = objectLiteralBody(source, 'schema');
     if (!body) {
         return {};
     }
     const schema = {};
-    for (const match of body.matchAll(/([A-Za-z_$][\w$]*)\s*:\s*["'`]([^"'`]+)["'`]/g)) {
-        if (match[1] && match[2]) {
-            schema[match[1]] = match[2];
+    let index = 0;
+    while (index < body.length) {
+        const entry = /^[\s,]*([A-Za-z_$][\w$]*)\s*:\s*/.exec(body.slice(index));
+        if (!entry || !entry[1])
+            break;
+        const name = entry[1];
+        const valueStart = index + entry[0].length;
+        const char = body[valueStart];
+        if (char === '"' || char === "'" || char === '`') {
+            const close = body.indexOf(char, valueStart + 1);
+            if (close === -1)
+                break;
+            schema[name] = body.slice(valueStart + 1, close);
+            index = close + 1;
+        }
+        else if (char === '{') {
+            let depth = 0;
+            let end = -1;
+            for (let i = valueStart; i < body.length; i += 1) {
+                if (body[i] === '{')
+                    depth += 1;
+                else if (body[i] === '}') {
+                    depth -= 1;
+                    if (depth === 0) {
+                        end = i;
+                        break;
+                    }
+                }
+            }
+            if (end === -1)
+                break;
+            const inner = body.slice(valueStart + 1, end);
+            const type = /type\s*:\s*["'`]([^"'`]+)["'`]/.exec(inner)?.[1];
+            const property = /property\s*:\s*["'`]([^"'`]+)["'`]/.exec(inner)?.[1];
+            schema[name] = { ...(type ? { type } : {}), ...(property ? { property } : {}) };
+            index = end + 1;
+        }
+        else {
+            // Unsupported value shape (identifier, number); skip to the next entry.
+            const nextComma = body.indexOf(',', valueStart);
+            if (nextComma === -1)
+                break;
+            index = nextComma + 1;
         }
     }
     return Object.keys(schema).length > 0 ? { schema } : {};
@@ -3169,4 +3278,40 @@ const deployPromoteSubCmd = Command.make('promote', {
     yield* runQuarantined(opts.json, () => deployCommand({ argv, root, json: opts.json }));
 })));
 export const deployCmd = deployBaseCmd.pipe(Command.withSubcommands([deployPromoteSubCmd]));
+/**
+ * Provenance for the active-deploy card, collected where it's cheapest: the
+ * CLI knows its own version, the git state of the tree it deployed, and the
+ * session identity. Everything best-effort — a non-git tree stamps nothing.
+ */
+async function collectDeployProvenance(userId) {
+    const git = async (args) => {
+        try {
+            const proc = Bun.spawn({ cmd: ['git', ...args], stdout: 'pipe', stderr: 'ignore' });
+            const [out, code] = await Promise.all([new Response(proc.stdout).text(), proc.exited]);
+            const trimmed = out.trim();
+            return code === 0 && trimmed ? trimmed : undefined;
+        }
+        catch {
+            return undefined;
+        }
+    };
+    const [gitCommit, gitBranch] = await Promise.all([
+        git(['rev-parse', '--short', 'HEAD']),
+        git(['rev-parse', '--abbrev-ref', 'HEAD']),
+    ]);
+    let deployedBy;
+    try {
+        const { loadStore, activeSession } = await import('../account-store.js');
+        deployedBy = activeSession(await loadStore())?.email ?? userId;
+    }
+    catch {
+        deployedBy = userId;
+    }
+    return {
+        cliVersion: `hs-x@${CLI_VERSION}`,
+        ...(gitCommit ? { gitCommit } : {}),
+        ...(gitBranch ? { gitBranch } : {}),
+        ...(deployedBy ? { deployedBy } : {}),
+    };
+}
 //# sourceMappingURL=deploy.js.map