@hs-x/cli 0.2.4 → 0.2.6

package/dist/commands/deploy.js

@@ -351,7 +351,7 @@ export async function deployCommand({ argv, root, json, }) {
     const applySchema = argv.includes('--apply-schema');
     const heartbeatFlag = argv.includes('--heartbeat');
     const noHeartbeat = argv.includes('--no-heartbeat');
-    const shouldRecordControlPlane = recordLocal || promoteWhenHealthy;
+    const noRecord = argv.includes('--no-record');
     const explicitControlPlaneUrl = resolveFlag(argv, '--control-plane-url');
     const controlPlaneUrl = explicitControlPlaneUrl ?? (planOnly ? undefined : process.env.HSX_CONTROL_PLANE_URL);
     const linked = await isLinked();
@@ -389,6 +389,20 @@ export async function deployCommand({ argv, root, json, }) {
     const cloudflareDeployRequested = !buildOnly &&
         (explicitCloudflareDeployRequested || (!planOnly && needsRuntime && !explicitHubspotUpload));
     const hubspotUploadRequested = !buildOnly && (explicitHubspotUpload || (!planOnly && !cloudflareDryRun && Boolean(projectId)));
+    // Hosted control-plane deploys record by default: shipping code without
+    // recording the revision guarantees `unknown_code` drift on the next
+    // attestation (the worker attests a deploy id the control plane has no
+    // record of) and `hs-x list` keeps saying "no recorded deploys".
+    // `--no-record` opts out; `--record-local` / `--promote-when-healthy`
+    // force recording regardless (incl. against `--local-control-plane`).
+    const shouldRecordControlPlane = recordLocal ||
+        promoteWhenHealthy ||
+        (!noRecord &&
+            !planOnly &&
+            !buildOnly &&
+            !cloudflareDryRun &&
+            Boolean(controlPlaneUrl) &&
+            (cloudflareDeployRequested || hubspotUploadRequested));
     const portalSchemaRead = await readPortalSchema(argv, workers);
     const portalSchemaPlan = portalSchemaRead
         ? planPortalSchemaManagement({ workers, observed: portalSchemaRead.observed })
@@ -412,6 +426,11 @@ export async function deployCommand({ argv, root, json, }) {
             projectId = answer;
         }
     }
+    if (projectId && accountId && !resolvedAcct.overrodeBinding) {
+        // Sticky binding, project half: project-scoped reads (status/logs/routes/
+        // drift) resolve their project id from here when no flag is passed.
+        await writeProjectBinding(root, accountId, projectId).catch(() => { });
+    }
     if (!json && willChangeAnything && !flagYes && isInteractive()) {
         const summary = buildDeployPlanSummary({
             accountId,
@@ -437,13 +456,31 @@ export async function deployCommand({ argv, root, json, }) {
             return cancelledResult(argv, 'deploy');
         }
     }
-    const portalSchemaApply = applySchema
-        ? await applyPortalSchemaPlan({
-            argv,
-            plan: portalSchemaPlan,
-            source: portalSchemaRead?.source,
-        })
-        : undefined;
+    // The schema apply is the first phase that touches the portal. A failure here
+    // used to throw a raw HubSpot error out of the command — no HSX_E code, no
+    // phase/PLAN output (cold-stranger run #3, finding A). Render the curated
+    // failure WITH the plan that was being applied instead.
+    let portalSchemaApply;
+    if (applySchema) {
+        try {
+            portalSchemaApply = await applyPortalSchemaPlan({
+                argv,
+                plan: portalSchemaPlan,
+                source: portalSchemaRead?.source,
+            });
+        }
+        catch (error) {
+            return portalSchemaApplyFailure({
+                argv,
+                json,
+                root,
+                startedAt: commandStartedAt,
+                workers,
+                portalSchemaPlan,
+                error,
+            });
+        }
+    }
     const manifest = await generateProjectArtifacts({
         root,
         workers,
@@ -906,6 +943,11 @@ function renderDeployHuman(input) {
             .map((worker) => `${worker.workerName}${worker.dryRun ? ' (dry-run)' : ''}`)
             .join(', ');
         reporter.info(`Cloudflare deploy: ${deployed}`);
+        for (const worker of input.cloudflareDeployResult.workers) {
+            if (worker.unauthenticatedInvoke) {
+                reporter.warn('HSX_W_DEPLOY_UNAUTHENTICATED_INVOKE', `${worker.workerName}: workflow-action invoke endpoints accept unsigned requests until the app's OAuth client secret is configured (redeploy with HSX_HUBSPOT_CLIENT_SECRET / --hubspot-client-secret after the OAuth install).`);
+            }
+        }
     }
     if (!input.linked && input.cloudflareDeployResult) {
         reporter.info(`Deploy history for this machine: ${machineDashboardUrl(input.machineId)}`);
@@ -927,6 +969,22 @@ function renderDeployHuman(input) {
         if (upload.deployId !== undefined) {
             reporter.info(`HubSpot deploy id: ${upload.deployId}`);
         }
+        else if (hubspotBuildStatus === 'SUCCESS' &&
+            upload.deploySkipped &&
+            upload.deployStatus !== undefined) {
+            const autoStatus = readStatus(upload.deployStatus) ?? 'UNKNOWN';
+            if (autoStatus === 'SUCCESS') {
+                reporter.info(`HubSpot deploy: auto-deploy SUCCESS (build #${upload.buildId})`);
+            }
+            else {
+                reporter.warn('HSX_W_DEPLOY_HUBSPOT_AUTODEPLOY_FAILED', `HubSpot auto-deploy finished ${autoStatus} — the build is green but the app did NOT ship. Check the deploy log in the HubSpot UI (project ${upload.projectName}).`);
+                for (const subbuild of readSubbuildStatuses(upload.deployStatus)) {
+                    if (subbuild.status !== 'SUCCESS') {
+                        reporter.info(`  [x] ${subbuild.name}: ${subbuild.errorMessage ?? subbuild.status}`);
+                    }
+                }
+            }
+        }
         else if (hubspotBuildStatus === 'SUCCESS' && upload.deploySkipped) {
             reporter.info('HubSpot deploy: skipped (upload-only or auto-deploy handles it)');
         }
@@ -1077,13 +1135,24 @@ async function applyPortalSchemaPlan({ argv, plan, source, }) {
     });
     const applied = [];
     const skipped = [];
+    // Each HubSpot write is wrapped so a failure carries WHICH action failed, the
+    // target object type (scope errors are per-object), and what already applied
+    // before it — the curated failure renderer needs all three.
+    const apply = async (label, objectType, run) => {
+        try {
+            await run();
+        }
+        catch (cause) {
+            throw new PortalSchemaApplyError({ action: label, objectType, applied: [...applied], cause });
+        }
+        applied.push(label);
+    };
     for (const action of plan.actions) {
         if (action.kind === 'will-create-object') {
-            await client.schemaManagement.createSchema({
+            await apply(`create-object:${action.objectType}`, action.objectType, () => client.schemaManagement.createSchema({
                 name: action.objectType,
                 labels: portalObjectLabels(action.objectType),
-            });
-            applied.push(`create-object:${action.objectType}`);
+            }));
             continue;
         }
         if (!action.propertyName || !action.declaredType) {
@@ -1092,25 +1161,23 @@ async function applyPortalSchemaPlan({ argv, plan, source, }) {
         }
         if (action.kind === 'will-create-property') {
             const fieldType = defaultHubSpotFieldType(action.declaredType);
-            await client.schemaManagement.createProperty({
+            await apply(`create-property:${action.objectType}.${action.propertyName}`, action.objectType, () => client.schemaManagement.createProperty({
                 objectType: action.objectType,
                 name: action.propertyName,
                 label: propertyLabel(action.propertyName),
                 type: action.declaredType,
                 ...(fieldType ? { fieldType } : {}),
-            });
-            applied.push(`create-property:${action.objectType}.${action.propertyName}`);
+            }));
             continue;
         }
         if (action.kind === 'will-alter-property') {
             const fieldType = defaultHubSpotFieldType(action.declaredType);
-            await client.schemaManagement.updateProperty({
+            await apply(`alter-property:${action.objectType}.${action.propertyName}`, action.objectType, () => client.schemaManagement.updateProperty({
                 objectType: action.objectType,
                 propertyName: action.propertyName,
                 type: action.declaredType,
                 ...(fieldType ? { fieldType } : {}),
-            });
-            applied.push(`alter-property:${action.objectType}.${action.propertyName}`);
+            }));
         }
     }
     return {
@@ -1119,6 +1186,198 @@ async function applyPortalSchemaPlan({ argv, plan, source, }) {
         skipped,
     };
 }
+/** A portal-schema apply action failed against HubSpot. */
+class PortalSchemaApplyError extends Error {
+    action;
+    objectType;
+    /** Actions that DID apply before the failure (partial-apply visibility). */
+    applied;
+    cause;
+    constructor(input) {
+        super(input.cause instanceof Error ? input.cause.message : String(input.cause));
+        this.name = 'PortalSchemaApplyError';
+        this.action = input.action;
+        this.objectType = input.objectType;
+        this.applied = input.applied;
+        this.cause = input.cause;
+    }
+}
+/**
+ * The raw HubSpot response body off a failed schema call. local-dev-lib wraps
+ * axios failures in `HubSpotHttpError` and lifts `response.data` to `.data`;
+ * a raw axios error keeps it at `.cause.response.data`.
+ */
+function hubSpotErrorBody(error) {
+    if (!isRecord(error))
+        return undefined;
+    if (error.data !== undefined)
+        return error.data;
+    const cause = error.cause;
+    if (isRecord(cause) && isRecord(cause.response))
+        return cause.response.data;
+    return undefined;
+}
+/**
+ * Extract HubSpot's MISSING_SCOPES payload. Captured live (cold-stranger run #3
+ * repro — POST crm/v3/properties/contacts with a PAK lacking the write scope):
+ *
+ *   { "status": "error",
+ *     "message": "This app hasn't been granted all required scopes to make this call. …",
+ *     "category": "MISSING_SCOPES",
+ *     "correlationId": "…",
+ *     "errors": [{ "message": "One or more of the following scopes are required.",
+ *                  "context": { "requiredGranularScopes": ["crm.schemas.contacts.write", …] } }] }
+ *
+ * The list is ANY-OF (any one scope grants the call). Older error shapes use
+ * `requiredScopes` (the only key local-dev-lib knows — which is why its own
+ * message renders an EMPTY scope list for granular-scope errors).
+ * Returns undefined when the error is not a scope error.
+ */
+function hubSpotMissingScopes(error) {
+    const body = hubSpotErrorBody(error);
+    if (!isRecord(body))
+        return undefined;
+    const scopes = [];
+    if (Array.isArray(body.errors)) {
+        for (const entry of body.errors) {
+            if (!isRecord(entry) || !isRecord(entry.context))
+                continue;
+            for (const key of ['requiredGranularScopes', 'requiredScopes']) {
+                const list = entry.context[key];
+                if (!Array.isArray(list))
+                    continue;
+                for (const scope of list) {
+                    if (typeof scope === 'string')
+                        scopes.push(scope);
+                }
+            }
+        }
+    }
+    if (scopes.length === 0 && body.category !== 'MISSING_SCOPES')
+        return undefined;
+    return {
+        scopes: [...new Set(scopes)],
+        ...(typeof body.correlationId === 'string' ? { correlationId: body.correlationId } : {}),
+    };
+}
+// Object types with a dedicated property-settings write scope
+// (crm.schemas.<type>.write — "create, delete, or make changes to property
+// settings"; crm.objects.<type>.write is RECORD writes and does not grant
+// property creation). Everything else falls under crm.schemas.custom.write.
+const HUBSPOT_SCHEMA_SCOPE_OBJECTS = new Set([
+    'appointments',
+    'carts',
+    'commercepayments',
+    'companies',
+    'contacts',
+    'courses',
+    'deals',
+    'invoices',
+    'line_items',
+    'listings',
+    'orders',
+    'quotes',
+    'services',
+    'subscriptions',
+    'tickets',
+    'users',
+]);
+/** The property-definition write scope `--apply-schema` needs for an object type. */
+function propertyWriteScopeFor(objectType) {
+    return HUBSPOT_SCHEMA_SCOPE_OBJECTS.has(objectType)
+        ? `crm.schemas.${objectType}.write`
+        : 'crm.schemas.custom.write';
+}
+/**
+ * Narrow HubSpot's any-of scope list to what actually unblocks THIS apply:
+ * the schemas-write scope for the target object when present, else every scope
+ * that names the object, else the full response list (else the doc-grounded
+ * default for the object type when the response carried none).
+ */
+function relevantMissingScopes(all, objectType) {
+    const expected = propertyWriteScopeFor(objectType);
+    if (all.includes(expected))
+        return [expected];
+    const mentioning = all.filter((scope) => scope.includes(`.${objectType}.`));
+    if (mentioning.length > 0)
+        return mentioning;
+    return all.length > 0 ? all : [expected];
+}
+const HUBSPOT_PAK_URL = 'https://app.hubspot.com/l/personal-access-key';
+/**
+ * Curated rendering for a failed `--apply-schema` leg (cold-stranger run #3,
+ * finding A): the phase + PLAN output still prints, partial progress is shown,
+ * and a HubSpot MISSING_SCOPES response becomes HSX_E_DEPLOY_SCHEMA_SCOPES
+ * naming the exact scopes to grant — never a raw truncated HubSpot error.
+ */
+function portalSchemaApplyFailure(input) {
+    const applyError = input.error instanceof PortalSchemaApplyError ? input.error : undefined;
+    const cause = applyError?.cause ?? input.error;
+    const scopeError = hubSpotMissingScopes(cause);
+    const causeMessage = cause instanceof Error ? cause.message : String(cause);
+    const hubSpotDetail = `${causeMessage.split('\n')[0]}${scopeError?.correlationId ? ` (correlationId ${scopeError.correlationId})` : ''}`;
+    let code;
+    let message;
+    let hint;
+    let missingScopes = [];
+    if (scopeError && applyError) {
+        code = 'HSX_E_DEPLOY_SCHEMA_SCOPES';
+        missingScopes = relevantMissingScopes(scopeError.scopes, applyError.objectType);
+        const scopesText = missingScopes.length === 1
+            ? `the ${missingScopes[0]} scope`
+            : `one of these scopes: ${missingScopes.join(', ')}`;
+        message = `HubSpot rejected ${applyError.action}: your personal access key cannot write ${applyError.objectType} property definitions. Grant ${scopesText}.`;
+        hint = `Edit your personal access key at ${HUBSPOT_PAK_URL} and add ${missingScopes.length === 1 ? missingScopes[0] : 'one of the scopes above'}, then re-run. To preview without applying: hs-x deploy --plan --portal-schema-live.`;
+    }
+    else {
+        code = 'HSX_E_DEPLOY_SCHEMA_APPLY';
+        message = applyError
+            ? `Portal schema apply failed at ${applyError.action}: ${causeMessage.split('\n')[0]}`
+            : causeMessage;
+        hint = 'Preview the schema plan without applying: hs-x deploy --plan --portal-schema-live.';
+    }
+    const exitCode = code === 'HSX_E_DEPLOY_SCHEMA_SCOPES' ? 10 : 1;
+    if (input.json) {
+        write(`${JSON.stringify({
+            schema_version: 1,
+            command: 'deploy',
+            ok: false,
+            ...(input.portalSchemaPlan ? { portalSchemaPlan: input.portalSchemaPlan } : {}),
+            ...(applyError && applyError.applied.length > 0
+                ? { portalSchemaApplied: applyError.applied }
+                : {}),
+            error: {
+                code,
+                message,
+                hint,
+                ...(missingScopes.length > 0 ? { missing_scopes: missingScopes } : {}),
+                detail: hubSpotDetail,
+            },
+        }, null, 2)}\n`);
+        return { exitCode };
+    }
+    const reporter = createReporter({ command: 'deploy', argv: input.argv, startedAt: input.startedAt });
+    reporter.header(basename(input.root));
+    const capCount = input.workers.reduce((count, worker) => count + worker.capabilities.length, 0);
+    reporter
+        .step('Validating project')
+        .ok(`${input.workers.length} workers, ${capCount} capabilities`);
+    if (input.portalSchemaPlan) {
+        reporter.info(renderPortalSchemaPlan(input.portalSchemaPlan).trimEnd());
+    }
+    if (applyError && applyError.applied.length > 0) {
+        for (const done of applyError.applied)
+            reporter.info(`APPLIED  ${done}`);
+    }
+    reporter.step('Applying portal schema').fail(applyError?.action);
+    reporter.error(code, message, {
+        hint,
+        cause: hubSpotDetail,
+        docs_url: `https://hs-x.dev/errors/${code}`,
+    });
+    reporter.done(undefined, exitCode);
+    return { exitCode };
+}
 function renderPortalSchemaPlan(plan) {
     if (plan.items.length === 0) {
         return 'Portal schema: no changes or warnings.\n';
@@ -1520,6 +1779,10 @@ async function executeCloudflareWorkerDeploy({ argv, root, worker, index, source
             process.stderr.write(`warning: could not register the tenant Worker URL with the control plane: ${error instanceof Error ? error.message : String(error)}\n`);
         }
     }
+    // Without the client secret on the Worker, the runtime accepts UNSIGNED
+    // workflow-action invokes (HubSpot must still be able to call them pre-OAuth)
+    // — surface that as a one-line warning instead of leaving it silent.
+    const hasWorkflowActions = worker.capabilities.some((capability) => capability.kind === 'tool');
     return {
         workerName,
         workerSourcePath: relative(root, workerSourcePath),
@@ -1530,6 +1793,9 @@ async function executeCloudflareWorkerDeploy({ argv, root, worker, index, source
         dryRun,
         stdout: output.stdout,
         stderr: output.stderr,
+        ...(hasWorkflowActions && !resolvedHubSpotClientSecret && !dryRun
+            ? { unauthenticatedInvoke: true }
+            : {}),
     };
 }
 async function discoverWorkerSourcePaths(root) {
@@ -2351,6 +2617,14 @@ async function executeHubSpotOnlyUpload({ argv, root, local, uploadOnly, }) {
             : 0;
         if (appId)
             await persistHubSpotAppBinding(root, { appId, projectName, developerAccountId });
+        // Build SUCCESS does NOT mean the app shipped: HubSpot's auto-deploy can
+        // still fail (found live: "Apps are not allowed to have 0 redirect URLs"
+        // failed deploy #4 while the CLI reported green). Verify the deploy too.
+        // Auto-deploy fires on uploads too — verify it regardless of uploadOnly
+        // (the f1-data 0-redirect failure rode exactly this path).
+        const autoDeployStatus = autoDeployEnabled && readStatus(buildStatus) === 'SUCCESS'
+            ? await waitForHubSpotAutoDeploy({ client, projectName, buildStatus })
+            : undefined;
         return {
             projectName,
             archivePath,
@@ -2360,7 +2634,7 @@ async function executeHubSpotOnlyUpload({ argv, root, local, uploadOnly, }) {
             buildId: upload.buildId,
             deployId: undefined,
             buildStatus,
-            deployStatus: undefined,
+            deployStatus: autoDeployStatus,
             deploySkipped: Boolean(uploadOnly || autoDeployEnabled),
             local,
         };
@@ -2401,6 +2675,40 @@ async function optionalHubSpotAppId(client, projectName, appUid) {
         return 0;
     }
 }
+/**
+ * Poll the auto-deploy triggered by a successful build until it reaches a
+ * terminal state. The build status carries the deploy task locator
+ * (deployStatusTaskLocator.id); absent/transient lookups resolve undefined —
+ * the caller treats that as "could not verify", never as success.
+ */
+async function waitForHubSpotAutoDeploy({ client, projectName, buildStatus, timeoutMs = 60_000, intervalMs = 2_000, }) {
+    const locator = buildStatus && typeof buildStatus === 'object'
+        ? buildStatus.deployStatusTaskLocator
+        : undefined;
+    const deployId = locator && typeof locator.id === 'number'
+        ? locator.id
+        : locator && typeof locator.id === 'string'
+            ? Number.parseInt(locator.id, 10)
+            : undefined;
+    if (deployId === undefined || Number.isNaN(deployId))
+        return undefined;
+    const deadline = Date.now() + timeoutMs;
+    let last;
+    while (Date.now() < deadline) {
+        try {
+            last = await client.projects.getDeployStatus({ projectName, deployId });
+        }
+        catch {
+            last = undefined;
+        }
+        const status = readStatus(last);
+        if (status && status !== 'PENDING' && status !== 'BUILDING' && status !== 'DEPLOYING') {
+            return last;
+        }
+        await new Promise((resolve) => setTimeout(resolve, intervalMs));
+    }
+    return last;
+}
 async function waitForHubSpotBuildStatus({ client, projectName, buildId, timeoutMs, intervalMs, }) {
     const startedAt = Date.now();
     let latest;