@hs-x/cli 0.2.3 → 0.2.5

package/dist/commands/deploy.js

@@ -412,6 +412,11 @@ export async function deployCommand({ argv, root, json, }) {
             projectId = answer;
         }
     }
+    if (projectId && accountId && !resolvedAcct.overrodeBinding) {
+        // Sticky binding, project half: project-scoped reads (status/logs/routes/
+        // drift) resolve their project id from here when no flag is passed.
+        await writeProjectBinding(root, accountId, projectId).catch(() => { });
+    }
     if (!json && willChangeAnything && !flagYes && isInteractive()) {
         const summary = buildDeployPlanSummary({
             accountId,
@@ -437,13 +442,31 @@ export async function deployCommand({ argv, root, json, }) {
             return cancelledResult(argv, 'deploy');
         }
     }
-    const portalSchemaApply = applySchema
-        ? await applyPortalSchemaPlan({
-            argv,
-            plan: portalSchemaPlan,
-            source: portalSchemaRead?.source,
-        })
-        : undefined;
+    // The schema apply is the first phase that touches the portal. A failure here
+    // used to throw a raw HubSpot error out of the command — no HSX_E code, no
+    // phase/PLAN output (cold-stranger run #3, finding A). Render the curated
+    // failure WITH the plan that was being applied instead.
+    let portalSchemaApply;
+    if (applySchema) {
+        try {
+            portalSchemaApply = await applyPortalSchemaPlan({
+                argv,
+                plan: portalSchemaPlan,
+                source: portalSchemaRead?.source,
+            });
+        }
+        catch (error) {
+            return portalSchemaApplyFailure({
+                argv,
+                json,
+                root,
+                startedAt: commandStartedAt,
+                workers,
+                portalSchemaPlan,
+                error,
+            });
+        }
+    }
     const manifest = await generateProjectArtifacts({
         root,
         workers,
@@ -906,6 +929,11 @@ function renderDeployHuman(input) {
             .map((worker) => `${worker.workerName}${worker.dryRun ? ' (dry-run)' : ''}`)
             .join(', ');
         reporter.info(`Cloudflare deploy: ${deployed}`);
+        for (const worker of input.cloudflareDeployResult.workers) {
+            if (worker.unauthenticatedInvoke) {
+                reporter.warn('HSX_W_DEPLOY_UNAUTHENTICATED_INVOKE', `${worker.workerName}: workflow-action invoke endpoints accept unsigned requests until the app's OAuth client secret is configured (redeploy with HSX_HUBSPOT_CLIENT_SECRET / --hubspot-client-secret after the OAuth install).`);
+            }
+        }
     }
     if (!input.linked && input.cloudflareDeployResult) {
         reporter.info(`Deploy history for this machine: ${machineDashboardUrl(input.machineId)}`);
@@ -927,6 +955,22 @@ function renderDeployHuman(input) {
         if (upload.deployId !== undefined) {
             reporter.info(`HubSpot deploy id: ${upload.deployId}`);
         }
+        else if (hubspotBuildStatus === 'SUCCESS' &&
+            upload.deploySkipped &&
+            upload.deployStatus !== undefined) {
+            const autoStatus = readStatus(upload.deployStatus) ?? 'UNKNOWN';
+            if (autoStatus === 'SUCCESS') {
+                reporter.info(`HubSpot deploy: auto-deploy SUCCESS (build #${upload.buildId})`);
+            }
+            else {
+                reporter.warn('HSX_W_DEPLOY_HUBSPOT_AUTODEPLOY_FAILED', `HubSpot auto-deploy finished ${autoStatus} — the build is green but the app did NOT ship. Check the deploy log in the HubSpot UI (project ${upload.projectName}).`);
+                for (const subbuild of readSubbuildStatuses(upload.deployStatus)) {
+                    if (subbuild.status !== 'SUCCESS') {
+                        reporter.info(`  [x] ${subbuild.name}: ${subbuild.errorMessage ?? subbuild.status}`);
+                    }
+                }
+            }
+        }
         else if (hubspotBuildStatus === 'SUCCESS' && upload.deploySkipped) {
             reporter.info('HubSpot deploy: skipped (upload-only or auto-deploy handles it)');
         }
@@ -1077,13 +1121,24 @@ async function applyPortalSchemaPlan({ argv, plan, source, }) {
     });
     const applied = [];
     const skipped = [];
+    // Each HubSpot write is wrapped so a failure carries WHICH action failed, the
+    // target object type (scope errors are per-object), and what already applied
+    // before it — the curated failure renderer needs all three.
+    const apply = async (label, objectType, run) => {
+        try {
+            await run();
+        }
+        catch (cause) {
+            throw new PortalSchemaApplyError({ action: label, objectType, applied: [...applied], cause });
+        }
+        applied.push(label);
+    };
     for (const action of plan.actions) {
         if (action.kind === 'will-create-object') {
-            await client.schemaManagement.createSchema({
+            await apply(`create-object:${action.objectType}`, action.objectType, () => client.schemaManagement.createSchema({
                 name: action.objectType,
                 labels: portalObjectLabels(action.objectType),
-            });
-            applied.push(`create-object:${action.objectType}`);
+            }));
             continue;
         }
         if (!action.propertyName || !action.declaredType) {
@@ -1092,25 +1147,23 @@ async function applyPortalSchemaPlan({ argv, plan, source, }) {
         }
         if (action.kind === 'will-create-property') {
             const fieldType = defaultHubSpotFieldType(action.declaredType);
-            await client.schemaManagement.createProperty({
+            await apply(`create-property:${action.objectType}.${action.propertyName}`, action.objectType, () => client.schemaManagement.createProperty({
                 objectType: action.objectType,
                 name: action.propertyName,
                 label: propertyLabel(action.propertyName),
                 type: action.declaredType,
                 ...(fieldType ? { fieldType } : {}),
-            });
-            applied.push(`create-property:${action.objectType}.${action.propertyName}`);
+            }));
             continue;
         }
         if (action.kind === 'will-alter-property') {
             const fieldType = defaultHubSpotFieldType(action.declaredType);
-            await client.schemaManagement.updateProperty({
+            await apply(`alter-property:${action.objectType}.${action.propertyName}`, action.objectType, () => client.schemaManagement.updateProperty({
                 objectType: action.objectType,
                 propertyName: action.propertyName,
                 type: action.declaredType,
                 ...(fieldType ? { fieldType } : {}),
-            });
-            applied.push(`alter-property:${action.objectType}.${action.propertyName}`);
+            }));
         }
     }
     return {
@@ -1119,6 +1172,198 @@ async function applyPortalSchemaPlan({ argv, plan, source, }) {
         skipped,
     };
 }
+/** A portal-schema apply action failed against HubSpot. */
+class PortalSchemaApplyError extends Error {
+    action;
+    objectType;
+    /** Actions that DID apply before the failure (partial-apply visibility). */
+    applied;
+    cause;
+    constructor(input) {
+        super(input.cause instanceof Error ? input.cause.message : String(input.cause));
+        this.name = 'PortalSchemaApplyError';
+        this.action = input.action;
+        this.objectType = input.objectType;
+        this.applied = input.applied;
+        this.cause = input.cause;
+    }
+}
+/**
+ * The raw HubSpot response body off a failed schema call. local-dev-lib wraps
+ * axios failures in `HubSpotHttpError` and lifts `response.data` to `.data`;
+ * a raw axios error keeps it at `.cause.response.data`.
+ */
+function hubSpotErrorBody(error) {
+    if (!isRecord(error))
+        return undefined;
+    if (error.data !== undefined)
+        return error.data;
+    const cause = error.cause;
+    if (isRecord(cause) && isRecord(cause.response))
+        return cause.response.data;
+    return undefined;
+}
+/**
+ * Extract HubSpot's MISSING_SCOPES payload. Captured live (cold-stranger run #3
+ * repro — POST crm/v3/properties/contacts with a PAK lacking the write scope):
+ *
+ *   { "status": "error",
+ *     "message": "This app hasn't been granted all required scopes to make this call. …",
+ *     "category": "MISSING_SCOPES",
+ *     "correlationId": "…",
+ *     "errors": [{ "message": "One or more of the following scopes are required.",
+ *                  "context": { "requiredGranularScopes": ["crm.schemas.contacts.write", …] } }] }
+ *
+ * The list is ANY-OF (any one scope grants the call). Older error shapes use
+ * `requiredScopes` (the only key local-dev-lib knows — which is why its own
+ * message renders an EMPTY scope list for granular-scope errors).
+ * Returns undefined when the error is not a scope error.
+ */
+function hubSpotMissingScopes(error) {
+    const body = hubSpotErrorBody(error);
+    if (!isRecord(body))
+        return undefined;
+    const scopes = [];
+    if (Array.isArray(body.errors)) {
+        for (const entry of body.errors) {
+            if (!isRecord(entry) || !isRecord(entry.context))
+                continue;
+            for (const key of ['requiredGranularScopes', 'requiredScopes']) {
+                const list = entry.context[key];
+                if (!Array.isArray(list))
+                    continue;
+                for (const scope of list) {
+                    if (typeof scope === 'string')
+                        scopes.push(scope);
+                }
+            }
+        }
+    }
+    if (scopes.length === 0 && body.category !== 'MISSING_SCOPES')
+        return undefined;
+    return {
+        scopes: [...new Set(scopes)],
+        ...(typeof body.correlationId === 'string' ? { correlationId: body.correlationId } : {}),
+    };
+}
+// Object types with a dedicated property-settings write scope
+// (crm.schemas.<type>.write — "create, delete, or make changes to property
+// settings"; crm.objects.<type>.write is RECORD writes and does not grant
+// property creation). Everything else falls under crm.schemas.custom.write.
+const HUBSPOT_SCHEMA_SCOPE_OBJECTS = new Set([
+    'appointments',
+    'carts',
+    'commercepayments',
+    'companies',
+    'contacts',
+    'courses',
+    'deals',
+    'invoices',
+    'line_items',
+    'listings',
+    'orders',
+    'quotes',
+    'services',
+    'subscriptions',
+    'tickets',
+    'users',
+]);
+/** The property-definition write scope `--apply-schema` needs for an object type. */
+function propertyWriteScopeFor(objectType) {
+    return HUBSPOT_SCHEMA_SCOPE_OBJECTS.has(objectType)
+        ? `crm.schemas.${objectType}.write`
+        : 'crm.schemas.custom.write';
+}
+/**
+ * Narrow HubSpot's any-of scope list to what actually unblocks THIS apply:
+ * the schemas-write scope for the target object when present, else every scope
+ * that names the object, else the full response list (else the doc-grounded
+ * default for the object type when the response carried none).
+ */
+function relevantMissingScopes(all, objectType) {
+    const expected = propertyWriteScopeFor(objectType);
+    if (all.includes(expected))
+        return [expected];
+    const mentioning = all.filter((scope) => scope.includes(`.${objectType}.`));
+    if (mentioning.length > 0)
+        return mentioning;
+    return all.length > 0 ? all : [expected];
+}
+const HUBSPOT_PAK_URL = 'https://app.hubspot.com/l/personal-access-key';
+/**
+ * Curated rendering for a failed `--apply-schema` leg (cold-stranger run #3,
+ * finding A): the phase + PLAN output still prints, partial progress is shown,
+ * and a HubSpot MISSING_SCOPES response becomes HSX_E_DEPLOY_SCHEMA_SCOPES
+ * naming the exact scopes to grant — never a raw truncated HubSpot error.
+ */
+function portalSchemaApplyFailure(input) {
+    const applyError = input.error instanceof PortalSchemaApplyError ? input.error : undefined;
+    const cause = applyError?.cause ?? input.error;
+    const scopeError = hubSpotMissingScopes(cause);
+    const causeMessage = cause instanceof Error ? cause.message : String(cause);
+    const hubSpotDetail = `${causeMessage.split('\n')[0]}${scopeError?.correlationId ? ` (correlationId ${scopeError.correlationId})` : ''}`;
+    let code;
+    let message;
+    let hint;
+    let missingScopes = [];
+    if (scopeError && applyError) {
+        code = 'HSX_E_DEPLOY_SCHEMA_SCOPES';
+        missingScopes = relevantMissingScopes(scopeError.scopes, applyError.objectType);
+        const scopesText = missingScopes.length === 1
+            ? `the ${missingScopes[0]} scope`
+            : `one of these scopes: ${missingScopes.join(', ')}`;
+        message = `HubSpot rejected ${applyError.action}: your personal access key cannot write ${applyError.objectType} property definitions. Grant ${scopesText}.`;
+        hint = `Edit your personal access key at ${HUBSPOT_PAK_URL} and add ${missingScopes.length === 1 ? missingScopes[0] : 'one of the scopes above'}, then re-run. To preview without applying: hs-x deploy --plan --portal-schema-live.`;
+    }
+    else {
+        code = 'HSX_E_DEPLOY_SCHEMA_APPLY';
+        message = applyError
+            ? `Portal schema apply failed at ${applyError.action}: ${causeMessage.split('\n')[0]}`
+            : causeMessage;
+        hint = 'Preview the schema plan without applying: hs-x deploy --plan --portal-schema-live.';
+    }
+    const exitCode = code === 'HSX_E_DEPLOY_SCHEMA_SCOPES' ? 10 : 1;
+    if (input.json) {
+        write(`${JSON.stringify({
+            schema_version: 1,
+            command: 'deploy',
+            ok: false,
+            ...(input.portalSchemaPlan ? { portalSchemaPlan: input.portalSchemaPlan } : {}),
+            ...(applyError && applyError.applied.length > 0
+                ? { portalSchemaApplied: applyError.applied }
+                : {}),
+            error: {
+                code,
+                message,
+                hint,
+                ...(missingScopes.length > 0 ? { missing_scopes: missingScopes } : {}),
+                detail: hubSpotDetail,
+            },
+        }, null, 2)}\n`);
+        return { exitCode };
+    }
+    const reporter = createReporter({ command: 'deploy', argv: input.argv, startedAt: input.startedAt });
+    reporter.header(basename(input.root));
+    const capCount = input.workers.reduce((count, worker) => count + worker.capabilities.length, 0);
+    reporter
+        .step('Validating project')
+        .ok(`${input.workers.length} workers, ${capCount} capabilities`);
+    if (input.portalSchemaPlan) {
+        reporter.info(renderPortalSchemaPlan(input.portalSchemaPlan).trimEnd());
+    }
+    if (applyError && applyError.applied.length > 0) {
+        for (const done of applyError.applied)
+            reporter.info(`APPLIED  ${done}`);
+    }
+    reporter.step('Applying portal schema').fail(applyError?.action);
+    reporter.error(code, message, {
+        hint,
+        cause: hubSpotDetail,
+        docs_url: `https://hs-x.dev/errors/${code}`,
+    });
+    reporter.done(undefined, exitCode);
+    return { exitCode };
+}
 function renderPortalSchemaPlan(plan) {
     if (plan.items.length === 0) {
         return 'Portal schema: no changes or warnings.\n';
@@ -1367,6 +1612,37 @@ async function executeCloudflareWorkerDeploy({ argv, root, worker, index, source
         tenantDataPlane?.flagsKvNamespaceName,
         tenantDataPlane?.tenantD1DatabaseName,
     ].filter((name) => typeof name === 'string' && name.toLowerCase().startsWith(accountResourcePrefix));
+    // wrangler does NOT auto-apply D1 migrations on deploy (found live:
+    // tenant DBs had zero tables across every real deploy since ADR-014) —
+    // apply them explicitly before the worker code that expects them lands.
+    const migrationsDirExists = await stat(join(root, 'node_modules', '@hs-x', 'runtime', 'migrations'))
+        .then((entry) => entry.isDirectory())
+        .catch(() => false);
+    if (tenantDataPlane?.tenantD1DatabaseName && !dryRun && !migrationsDirExists) {
+        process.stderr.write('warning: @hs-x/runtime did not ship its tenant migrations (pre-0.2.4 package) — tenant D1 tables were NOT applied; upgrade @hs-x/runtime.\n');
+    }
+    if (tenantDataPlane?.tenantD1DatabaseName && !dryRun && migrationsDirExists) {
+        try {
+            await runCloudflareCommand([
+                'bun',
+                'x',
+                'wrangler',
+                'd1',
+                'migrations',
+                'apply',
+                tenantDataPlane.tenantD1DatabaseName,
+                '--remote',
+                '--config',
+                relative(root, configPath),
+            ], { cwd: root, env: cloudflareDeployEnv(argv) });
+        }
+        catch (error) {
+            const message = error instanceof Error ? error.message : String(error);
+            if (!/No migrations to apply/i.test(message)) {
+                throw new Error(`Tenant D1 migrations failed: ${message.slice(-300)}`);
+            }
+        }
+    }
     const command = [
         'bun',
         'x',
@@ -1470,13 +1746,29 @@ async function executeCloudflareWorkerDeploy({ argv, root, worker, index, source
                 installKvNamespaceName: installRuntimeBinding.installKvNamespaceName,
                 tokenKeySecretName: installRuntimeBinding.tokenKeySecretName,
                 runtimeBaseUrl: resolvedRuntimeUrl,
-                ...(tenantDataPlane ? { syncGrantSecretName: tenantDataPlane.syncGrantSecretName } : {}),
+                ...(tenantDataPlane
+                    ? {
+                        syncGrantSecretName: tenantDataPlane.syncGrantSecretName,
+                        // Read-through legs need these registered: exemplars read the
+                        // tenant D1; flag tooling reads the flags KV.
+                        tenantD1DatabaseId: tenantDataPlane.tenantD1DatabaseId,
+                        tenantD1DatabaseName: tenantDataPlane.tenantD1DatabaseName,
+                        flagsKvNamespaceId: tenantDataPlane.flagsKvNamespaceId,
+                        ...(tenantDataPlane.flagsKvNamespaceName
+                            ? { flagsKvNamespaceName: tenantDataPlane.flagsKvNamespaceName }
+                            : {}),
+                    }
+                    : {}),
             });
         }
         catch (error) {
             process.stderr.write(`warning: could not register the tenant Worker URL with the control plane: ${error instanceof Error ? error.message : String(error)}\n`);
         }
     }
+    // Without the client secret on the Worker, the runtime accepts UNSIGNED
+    // workflow-action invokes (HubSpot must still be able to call them pre-OAuth)
+    // — surface that as a one-line warning instead of leaving it silent.
+    const hasWorkflowActions = worker.capabilities.some((capability) => capability.kind === 'tool');
     return {
         workerName,
         workerSourcePath: relative(root, workerSourcePath),
@@ -1487,6 +1779,9 @@ async function executeCloudflareWorkerDeploy({ argv, root, worker, index, source
         dryRun,
         stdout: output.stdout,
         stderr: output.stderr,
+        ...(hasWorkflowActions && !resolvedHubSpotClientSecret && !dryRun
+            ? { unauthenticatedInvoke: true }
+            : {}),
     };
 }
 async function discoverWorkerSourcePaths(root) {
@@ -1655,6 +1950,10 @@ async function putDeployInstallRuntimeBinding(input) {
             tokenKeySecretName: input.tokenKeySecretName,
             ...(input.runtimeBaseUrl ? { runtimeBaseUrl: input.runtimeBaseUrl } : {}),
             ...(input.syncGrantSecretName ? { syncGrantSecretName: input.syncGrantSecretName } : {}),
+            ...(input.tenantD1DatabaseId ? { tenantD1DatabaseId: input.tenantD1DatabaseId } : {}),
+            ...(input.tenantD1DatabaseName ? { tenantD1DatabaseName: input.tenantD1DatabaseName } : {}),
+            ...(input.flagsKvNamespaceId ? { flagsKvNamespaceId: input.flagsKvNamespaceId } : {}),
+            ...(input.flagsKvNamespaceName ? { flagsKvNamespaceName: input.flagsKvNamespaceName } : {}),
         },
     });
     const body = await response.json();
@@ -1836,6 +2135,14 @@ export function renderWranglerConfig(input) {
         `name = "${tomlString(input.workerName)}"`,
         `main = "${tomlString(input.entrypointPath)}"`,
         `compatibility_date = "${tomlString(input.compatibilityDate)}"`,
+        // nodejs_compat: guide + scaffold code reads `process.env.X` at module
+        // scope (e.g. defineSource hmac secrets); without it the Worker fails
+        // validation with "process is not defined" (Cloudflare error 10021,
+        // cold-stranger run #2 blocker A). With nodejs_compat and a
+        // compatibility_date >= 2025-04-01, Workers auto-populate process.env
+        // from bindings/secrets; the explicit populate flag keeps that true even
+        // when --compatibility-date is set to an older date.
+        'compatibility_flags = [ "nodejs_compat", "nodejs_compat_populate_process_env" ]',
     ];
     if (input.installKvNamespaceId) {
         lines.push('', '[[kv_namespaces]]', 'binding = "INSTALL_KV"', `id = "${tomlString(input.installKvNamespaceId)}"`);
@@ -1891,7 +2198,7 @@ async function readDeployHubSpotOAuthSecret(input) {
 function extractWorkerUrl(output) {
     return /https:\/\/[a-zA-Z0-9.-]+\.workers\.dev\b/.exec(output)?.[0];
 }
-async function ensureHubSpotRuntimeProjectArtifacts({ argv, root, app, workers, cloudflareDeployResult, needsRuntime, controlPlanePlan, }) {
+export async function ensureHubSpotRuntimeProjectArtifacts({ argv, root, app, workers, cloudflareDeployResult, needsRuntime, controlPlanePlan, }) {
     if (!needsRuntime) {
         return;
     }
@@ -1912,6 +2219,14 @@ async function ensureHubSpotRuntimeProjectArtifacts({ argv, root, app, workers,
     });
     for (const [file, contents] of Object.entries(generated.files)) {
         const path = join(root, file);
+        // src/app/cards/package.json is user-owned once it exists: HubSpot's own
+        // build errors instruct users to add card dependencies (e.g. hs-uix) to
+        // it, and regenerating the fixed-dep version here silently dropped those
+        // deps so the card never built (cold-stranger run #2 blocker B). Keep the
+        // user's file verbatim; only generate one when absent.
+        if (file === 'src/app/cards/package.json' && (await stat(path).catch(() => undefined))) {
+            continue;
+        }
         await mkdir(dirname(path), { recursive: true });
         await writeFile(path, contents);
     }
@@ -2288,6 +2603,14 @@ async function executeHubSpotOnlyUpload({ argv, root, local, uploadOnly, }) {
             : 0;
         if (appId)
             await persistHubSpotAppBinding(root, { appId, projectName, developerAccountId });
+        // Build SUCCESS does NOT mean the app shipped: HubSpot's auto-deploy can
+        // still fail (found live: "Apps are not allowed to have 0 redirect URLs"
+        // failed deploy #4 while the CLI reported green). Verify the deploy too.
+        // Auto-deploy fires on uploads too — verify it regardless of uploadOnly
+        // (the f1-data 0-redirect failure rode exactly this path).
+        const autoDeployStatus = autoDeployEnabled && readStatus(buildStatus) === 'SUCCESS'
+            ? await waitForHubSpotAutoDeploy({ client, projectName, buildStatus })
+            : undefined;
         return {
             projectName,
             archivePath,
@@ -2297,7 +2620,7 @@ async function executeHubSpotOnlyUpload({ argv, root, local, uploadOnly, }) {
             buildId: upload.buildId,
             deployId: undefined,
             buildStatus,
-            deployStatus: undefined,
+            deployStatus: autoDeployStatus,
             deploySkipped: Boolean(uploadOnly || autoDeployEnabled),
             local,
         };
@@ -2338,6 +2661,40 @@ async function optionalHubSpotAppId(client, projectName, appUid) {
         return 0;
     }
 }
+/**
+ * Poll the auto-deploy triggered by a successful build until it reaches a
+ * terminal state. The build status carries the deploy task locator
+ * (deployStatusTaskLocator.id); absent/transient lookups resolve undefined —
+ * the caller treats that as "could not verify", never as success.
+ */
+async function waitForHubSpotAutoDeploy({ client, projectName, buildStatus, timeoutMs = 60_000, intervalMs = 2_000, }) {
+    const locator = buildStatus && typeof buildStatus === 'object'
+        ? buildStatus.deployStatusTaskLocator
+        : undefined;
+    const deployId = locator && typeof locator.id === 'number'
+        ? locator.id
+        : locator && typeof locator.id === 'string'
+            ? Number.parseInt(locator.id, 10)
+            : undefined;
+    if (deployId === undefined || Number.isNaN(deployId))
+        return undefined;
+    const deadline = Date.now() + timeoutMs;
+    let last;
+    while (Date.now() < deadline) {
+        try {
+            last = await client.projects.getDeployStatus({ projectName, deployId });
+        }
+        catch {
+            last = undefined;
+        }
+        const status = readStatus(last);
+        if (status && status !== 'PENDING' && status !== 'BUILDING' && status !== 'DEPLOYING') {
+            return last;
+        }
+        await new Promise((resolve) => setTimeout(resolve, intervalMs));
+    }
+    return last;
+}
 async function waitForHubSpotBuildStatus({ client, projectName, buildId, timeoutMs, intervalMs, }) {
     const startedAt = Date.now();
     let latest;
@@ -2716,6 +3073,7 @@ async function requestHostedControlPlaneDeployRecordAndMaybePromote({ request, p
             signedManifest: request.manifest,
             signature: `sig_${plan.deployId}`,
             bundleKey: deployBundleKey({ projectId: request.projectId, deployId: plan.deployId }),
+            ...(await collectDeployProvenance(userId)),
         },
     });
     const body = await response.json();
@@ -2854,14 +3212,59 @@ function stringProperty(source, propertyName) {
     return match ? { [propertyName]: match } : {};
 }
 function schemaProperty(source) {
-    const body = /schema\s*:\s*\{([\s\S]*?)\}\s*(?:,|$)/.exec(source)?.[1];
+    // Balanced-brace extraction. The previous non-greedy regex stopped at the
+    // first `}` inside an object-form field (`score: { type: "number", … }`),
+    // truncating the schema and mis-reading nested keys (`type`) as property
+    // names — which made portal-schema plans wrong for any schema that mixes
+    // shorthand strings with object declarations.
+    const body = objectLiteralBody(source, 'schema');
     if (!body) {
         return {};
     }
     const schema = {};
-    for (const match of body.matchAll(/([A-Za-z_$][\w$]*)\s*:\s*["'`]([^"'`]+)["'`]/g)) {
-        if (match[1] && match[2]) {
-            schema[match[1]] = match[2];
+    let index = 0;
+    while (index < body.length) {
+        const entry = /^[\s,]*([A-Za-z_$][\w$]*)\s*:\s*/.exec(body.slice(index));
+        if (!entry || !entry[1])
+            break;
+        const name = entry[1];
+        const valueStart = index + entry[0].length;
+        const char = body[valueStart];
+        if (char === '"' || char === "'" || char === '`') {
+            const close = body.indexOf(char, valueStart + 1);
+            if (close === -1)
+                break;
+            schema[name] = body.slice(valueStart + 1, close);
+            index = close + 1;
+        }
+        else if (char === '{') {
+            let depth = 0;
+            let end = -1;
+            for (let i = valueStart; i < body.length; i += 1) {
+                if (body[i] === '{')
+                    depth += 1;
+                else if (body[i] === '}') {
+                    depth -= 1;
+                    if (depth === 0) {
+                        end = i;
+                        break;
+                    }
+                }
+            }
+            if (end === -1)
+                break;
+            const inner = body.slice(valueStart + 1, end);
+            const type = /type\s*:\s*["'`]([^"'`]+)["'`]/.exec(inner)?.[1];
+            const property = /property\s*:\s*["'`]([^"'`]+)["'`]/.exec(inner)?.[1];
+            schema[name] = { ...(type ? { type } : {}), ...(property ? { property } : {}) };
+            index = end + 1;
+        }
+        else {
+            // Unsupported value shape (identifier, number); skip to the next entry.
+            const nextComma = body.indexOf(',', valueStart);
+            if (nextComma === -1)
+                break;
+            index = nextComma + 1;
         }
     }
     return Object.keys(schema).length > 0 ? { schema } : {};
@@ -3169,4 +3572,40 @@ const deployPromoteSubCmd = Command.make('promote', {
     yield* runQuarantined(opts.json, () => deployCommand({ argv, root, json: opts.json }));
 })));
 export const deployCmd = deployBaseCmd.pipe(Command.withSubcommands([deployPromoteSubCmd]));
+/**
+ * Provenance for the active-deploy card, collected where it's cheapest: the
+ * CLI knows its own version, the git state of the tree it deployed, and the
+ * session identity. Everything best-effort — a non-git tree stamps nothing.
+ */
+async function collectDeployProvenance(userId) {
+    const git = async (args) => {
+        try {
+            const proc = Bun.spawn({ cmd: ['git', ...args], stdout: 'pipe', stderr: 'ignore' });
+            const [out, code] = await Promise.all([new Response(proc.stdout).text(), proc.exited]);
+            const trimmed = out.trim();
+            return code === 0 && trimmed ? trimmed : undefined;
+        }
+        catch {
+            return undefined;
+        }
+    };
+    const [gitCommit, gitBranch] = await Promise.all([
+        git(['rev-parse', '--short', 'HEAD']),
+        git(['rev-parse', '--abbrev-ref', 'HEAD']),
+    ]);
+    let deployedBy;
+    try {
+        const { loadStore, activeSession } = await import('../account-store.js');
+        deployedBy = activeSession(await loadStore())?.email ?? userId;
+    }
+    catch {
+        deployedBy = userId;
+    }
+    return {
+        cliVersion: `hs-x@${CLI_VERSION}`,
+        ...(gitCommit ? { gitCommit } : {}),
+        ...(gitBranch ? { gitBranch } : {}),
+        ...(deployedBy ? { deployedBy } : {}),
+    };
+}
 //# sourceMappingURL=deploy.js.map