@hs-x/cli 0.3.6 → 0.4.0

package/dist/commands/deploy.js

@@ -1,14 +1,13 @@
 import { spawn } from 'node:child_process';
 import { createHash, randomBytes } from 'node:crypto';
-import { cp, lstat, mkdir, mkdtemp, readFile, readdir, realpath, rename, rmdir, stat, unlink, writeFile, } from 'node:fs/promises';
+import { lstat, mkdir, readFile, readdir, realpath, rename, rmdir, stat, unlink, writeFile, } from 'node:fs/promises';
 import { createServer } from 'node:http';
-import { tmpdir } from 'node:os';
 import { basename, dirname, isAbsolute, join, relative, resolve } from 'node:path';
 import { pathToFileURL } from 'node:url';
 import * as Command from '@effect/cli/Command';
 import * as Options from '@effect/cli/Options';
 import { cloudflareResourceName, generateHubSpotRuntimeProject, generateProjectArtifacts, planPortalSchemaManagement, planWorkerCronTriggers, renderAlchemyProgram, renderCloudflareWorkerEntrypoint, stampMigratedRunServerlessShimOrigin, } from '@hs-x/codegen';
-import { HttpClientRequest, Schema, schemas } from '@hs-x/types';
+import { HttpClientRequest, Schema, schemas, signDeploymentAttestationGrant } from '@hs-x/types';
 import { validateProject } from '@hs-x/validator';
 import { Effect, Option } from 'effect';
 import { isLinked } from '../account-store.js';
@@ -16,24 +15,32 @@ import { exitWith } from '../cli-error.js';
 import { accountIdOption, controlPlaneUrlOption, cwdOption, deployIdOption, forceOption, jsonOption, projectIdOption, runHandler, runQuarantined, userIdOption, yesOption, } from '../cli/kit.js';
 import { resolveCloudflareCredentials } from '../cloudflare-kv.js';
 import { loadCloudflarePointer } from '../cloudflare-pointer.js';
+import { resolveOrProvisionCloudflareScopedResource } from '../cloudflare-scoped-resource.js';
 import { DEFAULT_CONTROL_PLANE_URL, formatConfigUrl, loadCliConfig, resolveControlPlaneUrl, } from '../config.js';
 import { CLI_VERSION } from '../constants.js';
 import { controlPlaneAuthHeaders } from '../control-plane-fetch.js';
 import { loadCreateControlPlane } from '../control-plane-loader.js';
+import { createControlPlaneTenantProvisioningAuthority, } from '../control-plane-tenant-provisioning.js';
 import { captureDeployRevision } from '../deploy-revision-capture.js';
+import { resolveDeployTargets } from '../deploy-targets.js';
 import { executeCliHttp } from '../effect-http.js';
-import { createDeployHubSpotDeveloperClient } from '../hubspot-developer-client.js';
+import { DirectHubSpotAccountResolutionError, createDeployHubSpotDeveloperClient, resolveDirectHubSpotContext, } from '../hubspot-developer-client.js';
+import { HubSpotProjectArchiveSourceError, fingerprintHubSpotArchiveSource, writeLocalHubSpotProjectArchive, } from '../hubspot-project-archive.js';
+import { detectLocalProjectMode, readHubSpotProjectDescriptor, validateHubSpotProject, } from '../hubspot-project.js';
 import { hydrateAncestorEnv } from '../load-env.js';
 import { LocalProjectPickerCancelled, resolveLocalProject } from '../local-project-picker.js';
-import { getMachineId } from '../machine-id.js';
+import { getMachineId, getMachineSecret, previewMachineId } from '../machine-id.js';
+import { requestMutationConsent } from '../mutation-consent.js';
 import { cachePath } from '../paths.js';
 import { readProjectBinding, writeProjectBinding } from '../project-binding.js';
 import { isInteractive, promptConfirm, promptMultiSelect, promptPassword, promptSelect, promptText, } from '../prompt.js';
 import { createReporter } from '../reporter/index.js';
 import { Cwd } from '../services/cwd.js';
+import { createTenantDataPlaneProvisioningCoordinator, } from '../tenant-data-plane-provisioning.js';
 import { ensureTenantStateStore, preflightTenantStateCredentials, } from '../tenant-state.js';
 import { defaultTokenKeyCustodyAdapter, escrowTokenKey, resolveEscrowedTokenKey, tokenKeyCustodyIdFor, } from '../token-key-custody.js';
 import { deployPromoteCommand, requestControlPlaneDeployPromotion } from './deploy-promote.js';
+import { withTransientDeployRetry } from './deploy-retry.js';
 async function hostedHttp(input) {
     const headers = { ...(input.headers ?? {}) };
     let request = HttpClientRequest.make(input.method ?? 'GET')(input.url).pipe(HttpClientRequest.setHeaders(headers));
@@ -149,10 +156,11 @@ async function promptMissingText(message, current, validate) {
  * across concurrent worker deploys), then persist answers to the process env so
  * sibling workers reuse them.
  *
- * OAuth-only bootstrap deploys retain the historical warning-only behavior
- * because the Auth page may not exist until after upload. Card backends fail
- * closed before the Worker deploy: shipping one without the HMAC key guarantees
- * that every live `hubspot.fetch` returns 401.
+ * OAuth-only bootstrap deploys may proceed with a warning because the Auth page
+ * may not exist until after upload, but every HubSpot-authored runtime route
+ * returns 503 until the secret is configured and the Worker is redeployed.
+ * Card backends fail earlier, at deploy time, because they cannot be useful in
+ * that bootstrap state.
  */
 /** @internal Exported for the deploy credential-gate regression suite. */
 export async function resolveHubSpotRuntimeCredentials(input) {
@@ -333,7 +341,7 @@ async function promptMissingCloudflareCredentials(input) {
         reporter.info('Easiest: `hs-x connect cloudflare` signs in via your browser and stores it for every future deploy.');
         reporter.info(`Or paste an API token (HS-X template): ${CLOUDFLARE_TOKEN_TEMPLATE_URL}`);
         for (;;) {
-            const token = await promptText({
+            const token = await promptPassword({
                 message: 'Paste your Cloudflare API token',
                 validate: (v) => (v.length >= 30 ? undefined : 'Token looks too short.'),
             });
@@ -534,6 +542,447 @@ function workerSourceSummaries(workers) {
 function workerSyncSchemaModes(workers) {
     return workers.flatMap((worker) => worker.capabilities.flatMap((capability) => capability.kind === 'sync' ? [`${capability.id}: ${capability.manageSchema ?? false}`] : []));
 }
+function includesCliFlag(argv, flag) {
+    return argv.some((argument) => argument === flag || argument.startsWith(`${flag}=`));
+}
+function directDeployAccountView(account) {
+    return {
+        id: account.id,
+        ...(account.name ? { name: account.name } : {}),
+        source: account.source,
+        selectedBy: account.selectedBy,
+        authReady: account.authReady,
+        ...(account.configSource ? { configSource: account.configSource } : {}),
+    };
+}
+function directDeployAccountLabel(account) {
+    if (!account)
+        return 'unresolved HubSpot account';
+    return account.name ? `${account.name} (${account.id})` : account.id;
+}
+function directDeployAccountFailure(cause) {
+    if (cause instanceof DirectHubSpotAccountResolutionError) {
+        const suffix = ` ${cause.hint}`;
+        return {
+            reasonCode: cause.code,
+            message: cause.message.endsWith(suffix)
+                ? cause.message.slice(0, -suffix.length)
+                : cause.message,
+            hint: cause.hint,
+        };
+    }
+    return {
+        reasonCode: 'HSX_E_DIRECT_HUBSPOT_ACCOUNT_CONFIG',
+        message: cause instanceof Error ? cause.message : String(cause),
+        hint: 'Fix the HubSpot CLI account configuration and retry.',
+    };
+}
+function describeHubSpotDeployFailure(cause) {
+    const record = isRecord(cause) ? cause : undefined;
+    const data = isRecord(record?.data) ? record.data : undefined;
+    const body = isRecord(record?.body) ? record.body : undefined;
+    const validationErrors = Array.isArray(record?.validationErrors)
+        ? record.validationErrors.filter((item) => typeof item === 'string')
+        : [];
+    const values = [
+        cause instanceof Error ? cause.message : String(cause),
+        typeof record?.status === 'number' ? `HTTP ${record.status}` : undefined,
+        typeof data?.message === 'string' ? data.message : undefined,
+        typeof body?.message === 'string' ? body.message : undefined,
+        typeof record?.category === 'string' ? record.category : undefined,
+        typeof data?.category === 'string' ? data.category : undefined,
+        ...validationErrors,
+        typeof record?.correlationId === 'string'
+            ? `correlation ${record.correlationId}`
+            : typeof data?.correlationId === 'string'
+                ? `correlation ${data.correlationId}`
+                : typeof body?.correlationId === 'string'
+                    ? `correlation ${body.correlationId}`
+                    : undefined,
+    ].filter((value) => Boolean(value));
+    return [...new Set(values)].join(' · ');
+}
+function directDeployDoneMessage(upload) {
+    if (upload.deploySkipped && !upload.autoDeployExpected) {
+        return 'Uploaded and built in HubSpot; deployment skipped';
+    }
+    if (upload.autoDeployExpected)
+        return 'Uploaded, built, and auto-deployed in HubSpot';
+    return 'Uploaded, built, and deployed in HubSpot';
+}
+async function hubSpotDirectDeployCommand(input) {
+    try {
+        return await executeHubSpotDirectDeployCommand(input);
+    }
+    catch (cause) {
+        if (!(cause instanceof HubSpotProjectArchiveSourceError))
+            throw cause;
+        return inputValidationError({
+            argv: input.argv,
+            command: 'deploy',
+            json: input.json,
+            code: cause.code,
+            message: cause.message,
+            hint: cause.hint,
+            detail: 'No archive was retained and no upload or deploy request was made.',
+        });
+    }
+}
+async function executeHubSpotDirectDeployCommand({ argv, root, json, }) {
+    const reporter = createReporter({ command: 'deploy', argv, entry: !json });
+    const machineOutput = json || reporter.mode === 'ndjson';
+    const unsupported = [
+        '--account-id',
+        '--project-id',
+        '--control-plane-url',
+        '--build-only',
+        '--cloudflare-deploy',
+        '--cloudflare-dry-run',
+        '--local-control-plane',
+        '--record-local',
+        '--promote-when-healthy',
+        '--no-record',
+        '--heartbeat',
+        '--no-heartbeat',
+        '--apply-schema',
+        '--portal-schema-live',
+        '--portal-schema-fixture',
+        '--local-hubspot-schema',
+    ].find((flag) => includesCliFlag(argv, flag));
+    if (unsupported) {
+        return inputValidationError({
+            argv,
+            command: 'deploy',
+            json,
+            code: 'HSX_E_INPUT_INVALID',
+            message: `${unsupported} is an HS-X project feature.`,
+            hint: 'Remove the flag to deploy this native HubSpot project directly to HubSpot.',
+            detail: 'HubSpot-direct mode never contacts the HS-X control plane or Cloudflare.',
+        });
+    }
+    const preparationFingerprint = await fingerprintHubSpotArchiveSource(root, false);
+    const [descriptor, validation, projectName, intermediateRepresentation] = await Promise.all([
+        readHubSpotProjectDescriptor(root),
+        validateHubSpotProject({ root }),
+        resolveHubSpotProjectName(argv, root),
+        readHubSpotProjectIntermediateRepresentation(root),
+    ]);
+    const appUid = readAppUidFromIntermediateRepresentation(intermediateRepresentation) ??
+        (await readAppUidFromProjectSource(root));
+    const sourceFingerprint = validation.ok
+        ? await fingerprintHubSpotArchiveSource(root, intermediateRepresentation !== undefined)
+        : preparationFingerprint;
+    // Enclose every source-derived preparation read (validation, descriptor,
+    // IR, app uid, and scoped fingerprint) in one full-tree stability check.
+    // A later edit is still caught against sourceFingerprint in the staged copy.
+    if ((await fingerprintHubSpotArchiveSource(root, false)) !== preparationFingerprint) {
+        return inputValidationError({
+            argv,
+            command: 'deploy',
+            json,
+            code: 'HSX_E_INPUT_INVALID',
+            message: 'HubSpot project sources changed while preparing the deploy plan.',
+            hint: 'Wait for local edits or generators to settle, then review a fresh plan.',
+            detail: 'No upload or deploy request was made.',
+        });
+    }
+    const uploadOnly = argv.includes('--hubspot-upload-only') || argv.includes('--skip-deploy');
+    const planOnly = argv.includes('--plan') || argv.includes('--dry-run');
+    const localHubSpotAdapter = argv.includes('--local-hubspot-upload');
+    const platformVersion = resolveFlag(argv, '--platform-version') ?? descriptor.platformVersion ?? '2026.03';
+    const buildMessage = resolveFlag(argv, '--message') ?? 'HS-X HubSpot-direct deploy';
+    const buildTimeoutMs = Number(resolveFlag(argv, '--hubspot-build-timeout-ms') ?? '60000');
+    const force = argv.includes('--force');
+    let account;
+    let accountFailure;
+    let preparedUpload;
+    if (localHubSpotAdapter) {
+        account = {
+            id: resolveFlag(argv, '--developer-account-id') ?? 'local',
+            name: 'local HubSpot adapter',
+            source: 'local-adapter',
+            selectedBy: 'local-adapter',
+            authReady: true,
+        };
+        preparedUpload = {
+            projectName,
+            intermediateRepresentation,
+            appUid,
+            developerAccountId: resolveFlag(argv, '--developer-account-id') ?? process.env.HSX_HUBSPOT_DEVELOPER_ACCOUNT_ID,
+            platformVersion,
+            buildMessage,
+            buildTimeoutMs,
+            force,
+            sourceFingerprint,
+            createClient: () => createDeployHubSpotDeveloperClient({
+                argv,
+                local: true,
+                allowedOperations: ['hubspot-project-upload'],
+                cwd: root,
+            }),
+        };
+    }
+    else {
+        try {
+            const context = await resolveDirectHubSpotContext({ argv, cwd: root });
+            account = directDeployAccountView(context.account);
+            if (!account.authReady) {
+                accountFailure = {
+                    reasonCode: 'HSX_E_DIRECT_HUBSPOT_AUTH_REQUIRED',
+                    message: `HubSpot account ${directDeployAccountLabel(account)} does not have deploy authentication available.`,
+                    hint: 'Run `hs account auth` for that account, or pass --pak for this run.',
+                };
+            }
+            else {
+                preparedUpload = {
+                    projectName,
+                    intermediateRepresentation,
+                    appUid,
+                    developerAccountId: context.account.id,
+                    platformVersion,
+                    buildMessage,
+                    buildTimeoutMs,
+                    force,
+                    sourceFingerprint,
+                    createClient: async () => context.createClient(),
+                };
+            }
+        }
+        catch (cause) {
+            accountFailure = directDeployAccountFailure(cause);
+        }
+    }
+    const ready = validation.ok &&
+        account !== undefined &&
+        accountFailure === undefined &&
+        preparedUpload !== undefined;
+    const plan = {
+        schema_version: 1,
+        ok: ready,
+        command: 'deploy',
+        mode: 'hubspot-direct',
+        root,
+        project: {
+            name: projectName,
+            ...(projectName !== descriptor.name ? { configuredName: descriptor.name } : {}),
+            platformVersion,
+            srcDir: descriptor.srcDir,
+            sourceFingerprint,
+            ...(descriptor.appUid ? { appUid: descriptor.appUid } : {}),
+        },
+        account: account
+            ? { ...account, ...(accountFailure ? { error: accountFailure } : {}) }
+            : {
+                authReady: false,
+                error: accountFailure,
+            },
+        targets: { hubspot: true, cloudflare: false, controlPlane: false },
+        action: uploadOnly ? 'upload-and-build' : 'upload-build-and-deploy',
+        options: {
+            force,
+            buildMessage,
+            buildTimeoutMs,
+            skipAutoDeploy: uploadOnly,
+        },
+        validation,
+    };
+    const rows = [
+        { key: 'mode', value: 'HubSpot direct' },
+        { key: 'source', value: root },
+        { key: 'project', value: projectName },
+        ...(account
+            ? [
+                {
+                    key: 'account',
+                    value: directDeployAccountLabel(account),
+                    status: account.authReady ? 'ok' : 'fail',
+                    detail: account.configSource ?? account.selectedBy,
+                    ...(account.authReady
+                        ? {}
+                        : { hint: 'Run `hs account auth` for this account, then retry.' }),
+                },
+            ]
+            : [
+                {
+                    key: 'account',
+                    value: 'not ready',
+                    status: 'fail',
+                    ...(accountFailure?.reasonCode ? { detail: accountFailure.reasonCode } : {}),
+                    ...(accountFailure?.hint ? { hint: accountFailure.hint } : {}),
+                },
+            ]),
+        { key: 'platform', value: platformVersion },
+        { key: 'build message', value: buildMessage },
+        { key: 'build timeout', value: `${buildTimeoutMs}ms` },
+        {
+            key: 'HubSpot',
+            value: uploadOnly ? 'upload + build only' : 'upload + build + deploy',
+            status: 'ok',
+        },
+        { key: 'auto-deploy', value: uploadOnly ? 'explicitly skipped' : 'project setting' },
+        { key: 'force', value: force ? 'yes' : 'no', ...(force ? { status: 'warn' } : {}) },
+        { key: 'Cloudflare', value: 'not used' },
+        { key: 'HS-X control plane', value: 'not used' },
+        {
+            key: 'validation',
+            value: validation.ok ? 'pass' : 'fail',
+            status: validation.ok ? 'ok' : 'fail',
+        },
+        ...validation.diagnostics.map((diagnostic) => ({
+            key: diagnostic.code,
+            value: diagnostic.message,
+            status: diagnostic.severity === 'error' ? 'fail' : 'warn',
+            ...(diagnostic.file ? { detail: diagnostic.file } : {}),
+        })),
+    ];
+    if (planOnly || !ready) {
+        if (json) {
+            write(`${JSON.stringify(plan, null, 2)}\n`);
+        }
+        else if (reporter.mode === 'ndjson') {
+            reporter.data(plan);
+            reporter.done(ready ? 'Plan ready' : 'Plan not ready', ready ? 0 : 10);
+        }
+        else {
+            reporter.header(projectName);
+            reporter.rows(rows);
+            reporter.done(ready ? 'Plan ready' : 'Plan not ready', ready ? 0 : 10);
+        }
+        return { exitCode: ready ? 0 : validation.ok ? 10 : 1 };
+    }
+    const summary = [
+        'HubSpot-direct deploy plan',
+        `Project: ${projectName}`,
+        `Account: ${directDeployAccountLabel(account)}`,
+        `Source: ${root}`,
+        `Action: ${uploadOnly ? 'upload and build only (skip auto-deploy)' : 'upload, wait for build, and deploy'}`,
+        `Platform: ${platformVersion}`,
+        `Force: ${force ? 'yes' : 'no'}`,
+        `Build message: ${buildMessage}`,
+        `Build timeout: ${buildTimeoutMs}ms`,
+        'Cloudflare: not used',
+        'HS-X control plane: not used',
+    ].join('\n');
+    // MutationConsent requires the exact read-only preview to be visible before
+    // it asks. In machine modes the same plan is available via --plan; --yes is
+    // mandatory and no interactive output is emitted.
+    if (!machineOutput) {
+        reporter.header(projectName);
+        reporter.rows(rows);
+    }
+    const consent = await requestMutationConsent({
+        yes: argv.includes('--yes') || argv.includes('-y'),
+        machineOutput,
+        interactive: isInteractive(),
+        message: `Deploy ${projectName} to ${directDeployAccountLabel(account)}?`,
+        confirm: promptConfirm,
+    });
+    if (consent === 'require-yes') {
+        return inputValidationError({
+            argv,
+            command: 'deploy',
+            json,
+            code: 'HSX_E_INPUT_INVALID',
+            message: 'Deploy requires explicit consent in machine or non-interactive mode.',
+            hint: 'Review with `hs-x deploy --plan`, then re-run with --yes.',
+            detail: summary,
+        });
+    }
+    if (consent === 'cancelled')
+        return cancelledResult(argv, 'deploy');
+    if (!preparedUpload) {
+        return inputValidationError({
+            argv,
+            command: 'deploy',
+            json,
+            code: 'HSX_E_DIRECT_HUBSPOT_ACCOUNT_CONFIG',
+            message: 'The HubSpot deploy target changed while preparing the execution plan.',
+            hint: 'Review a fresh plan and retry.',
+            detail: 'No upload or deploy request was made.',
+        });
+    }
+    try {
+        const step = machineOutput ? undefined : reporter.step('Uploading to HubSpot');
+        const uploaded = await executeHubSpotOnlyUpload({
+            argv,
+            root,
+            local: localHubSpotAdapter,
+            persistBinding: false,
+            uploadOnly,
+            prepared: preparedUpload,
+        });
+        const buildState = readStatus(uploaded.buildStatus) ?? 'UNKNOWN';
+        const deployState = uploaded.deployStatus
+            ? (readStatus(uploaded.deployStatus) ?? 'UNKNOWN')
+            : undefined;
+        const deployUnverified = uploaded.autoDeployExpected && deployState === undefined;
+        const ok = buildState === 'SUCCESS' && !deployUnverified && (!deployState || deployState === 'SUCCESS');
+        step?.[ok ? 'ok' : 'fail'](`build #${uploaded.buildId} ${buildState}${deployState ? ` · deploy ${deployState}` : deployUnverified ? ' · deploy unverified' : ''}`);
+        const result = {
+            schema_version: 1,
+            ok,
+            command: 'deploy',
+            mode: 'hubspot-direct',
+            account,
+            projectName: uploaded.projectName,
+            appId: uploaded.appId || undefined,
+            buildId: uploaded.buildId,
+            buildStatus: buildState,
+            ...(uploaded.deployId !== undefined ? { deployId: uploaded.deployId } : {}),
+            ...(deployState ? { deployStatus: deployState } : {}),
+            deploySkipped: uploaded.deploySkipped,
+            deployVerification: deployUnverified ? 'unverified' : deployState ? 'verified' : 'skipped',
+            controlPlaneUsed: false,
+            cloudflareUsed: false,
+        };
+        if (json) {
+            write(`${JSON.stringify(result, null, 2)}\n`);
+        }
+        else if (reporter.mode === 'ndjson') {
+            reporter.data(result);
+            reporter.done(ok ? directDeployDoneMessage(uploaded) : 'HubSpot deploy failed', ok ? 0 : 1);
+        }
+        else {
+            streamHubSpotUploadOutcome(reporter, uploaded);
+            if (deployUnverified) {
+                reporter.error('HSX_E_DEPLOY_HUBSPOT', 'HubSpot auto-deploy could not be verified before the timeout.', { hint: 'Check the project deploy status in HubSpot, then retry if it did not ship.' });
+            }
+            reporter.done(ok ? directDeployDoneMessage(uploaded) : 'HubSpot deploy failed', ok ? 0 : 1);
+        }
+        return { exitCode: ok ? 0 : 1 };
+    }
+    catch (cause) {
+        if (cause instanceof HubSpotProjectArchiveSourceError)
+            throw cause;
+        const code = cause instanceof DirectHubSpotAccountResolutionError
+            ? 'HSX_E_DEPLOY_HUBSPOT_AUTH'
+            : 'HSX_E_DEPLOY_HUBSPOT';
+        const message = describeHubSpotDeployFailure(cause);
+        const hint = cause instanceof DirectHubSpotAccountResolutionError
+            ? cause.hint
+            : 'Review the HubSpot status and correlation id above, fix the reported issue, and retry.';
+        if (json) {
+            write(`${JSON.stringify({
+                schema_version: 1,
+                command: 'deploy',
+                ok: false,
+                error: { code, message, hint },
+            }, null, 2)}\n`);
+        }
+        else if (reporter.mode === 'ndjson') {
+            reporter.error(code, message, { hint });
+            reporter.done('HubSpot deploy failed', 1);
+        }
+        else {
+            reporter.error(code, message, {
+                hint,
+                docs_url: `https://hs-x.dev/errors/${code}`,
+            });
+            reporter.done('HubSpot deploy failed', 1);
+        }
+        return { exitCode: 1 };
+    }
+}
 export async function deployCommand({ argv, root, json, }) {
     // Stamp the whole invocation up front: the human summary reporter is created
     // late (render time), so without this "Deployed … in 1ms" measured only the
@@ -560,6 +1009,9 @@ export async function deployCommand({ argv, root, json, }) {
             throw error;
         }
     }
+    if ((await detectLocalProjectMode(root)) === 'hubspot-direct') {
+        return hubSpotDirectDeployCommand({ argv, root, json });
+    }
     // bun only auto-loads .env/.env.local from the CWD; when deploying from a
     // nested app dir, pull in a repo-root .env.local (CLOUDFLARE_ACCOUNT_ID, etc.)
     // so the deploy doesn't fail for vars that are set at the root.
@@ -591,7 +1043,6 @@ export async function deployCommand({ argv, root, json, }) {
     const explicitControlPlaneUrl = resolveFlag(argv, '--control-plane-url');
     const controlPlaneUrl = explicitControlPlaneUrl ?? (planOnly ? undefined : process.env.HSX_CONTROL_PLANE_URL);
     const linked = await isLinked();
-    const machineId = await getMachineId();
     const userId = resolveFlag(argv, '--user-id') ?? process.env.HSX_USER_ID ?? 'local-cli-user';
     const resolvedAcct = await resolveAccountIdOrPrompt({
         argv,
@@ -610,10 +1061,6 @@ export async function deployCommand({ argv, root, json, }) {
             // One-off --account-id override: warn but leave the recorded binding intact.
             progress?.reporter.warn('HSX_W_DEPLOY_ACCOUNT_OVERRIDE', `This project is bound to ${resolvedAcct.overrodeBinding}; deploying under ${accountId} for this run only (binding unchanged).`);
         }
-        else {
-            // Sticky binding: remember which HS-X account this project deploys under.
-            await writeProjectBinding(root, accountId).catch(() => { });
-        }
     }
     const explicitProjectId = resolveFlag(argv, '--project-id') ?? process.env.HSX_PROJECT_ID;
     let projectId = explicitProjectId;
@@ -647,9 +1094,16 @@ export async function deployCommand({ argv, root, json, }) {
     }
     const needsRuntime = workers.some((worker) => worker.capabilities.some((capability) => capability.runtimeNeeds.some((need) => need !== 'hubspot-only')));
     const needsHubSpotBundle = needsRuntime || app.mcpServers.length > 0;
-    const cloudflareDeployRequested = !buildOnly &&
-        (explicitCloudflareDeployRequested || (!planOnly && needsRuntime && !explicitHubspotUpload));
-    const hubspotUploadRequested = !buildOnly && (explicitHubspotUpload || (!planOnly && !cloudflareDryRun && Boolean(projectId)));
+    const { deploymentMode, cloudflareDeployRequested, hubspotUploadRequested } = resolveDeployTargets({
+        buildOnly,
+        planOnly,
+        needsRuntime,
+        hasProjectId: Boolean(projectId),
+        hubspotOnly,
+        explicitHubspotUpload,
+        explicitCloudflareDeploy: explicitCloudflareDeployRequested,
+        cloudflareDryRun,
+    });
     if (echo) {
         echo.info(`Runtime: ${needsRuntime ? 'Cloudflare Worker required' : 'HubSpot-only compatible'}`);
         if (hubspotOnly && needsRuntime) {
@@ -724,15 +1178,11 @@ export async function deployCommand({ argv, root, json, }) {
             projectId = answer;
         }
     }
-    if (projectId && accountId && !resolvedAcct.overrodeBinding) {
-        // Sticky binding, project half: project-scoped reads (status/logs/routes/
-        // drift) resolve their project id from here when no flag is passed.
-        await writeProjectBinding(root, accountId, projectId).catch(() => { });
-    }
-    if (!json && willChangeAnything && !flagYes && isInteractive()) {
+    if (willChangeAnything) {
         const summary = buildDeployPlanSummary({
             accountId,
             projectId,
+            deploymentMode,
             workers,
             portalSchemaPlan,
             applySchema,
@@ -743,14 +1193,37 @@ export async function deployCommand({ argv, root, json, }) {
             shouldRecordControlPlane,
             promoteWhenHealthy,
         });
-        progress?.reporter.block(summary);
-        const confirm = await promptConfirm({
+        const machineOutput = json || progress?.reporter.mode === 'ndjson';
+        if (!machineOutput && !flagYes)
+            progress?.reporter.block(summary);
+        const consent = await requestMutationConsent({
+            yes: flagYes,
+            machineOutput,
+            interactive: isInteractive(),
             message: 'Apply this plan?',
-            default: false,
+            confirm: promptConfirm,
         });
-        if (confirm === undefined || confirm === false) {
-            return cancelledResult(argv, 'deploy');
+        if (consent === 'require-yes') {
+            return inputValidationError({
+                argv,
+                command: 'deploy',
+                json,
+                code: 'HSX_E_INPUT_INVALID',
+                message: 'Deploy requires explicit consent in machine or non-interactive mode.',
+                hint: 'Review with `hs-x deploy --plan`, then re-run the mutating command with --yes.',
+                detail: summary,
+            });
         }
+        if (consent === 'cancelled')
+            return cancelledResult(argv, 'deploy');
+    }
+    // Consent is the boundary for durable command state too. A declined deploy,
+    // JSON/non-TTY invocation without --yes, or --plan must not create a machine
+    // id or rewrite the project's sticky account/project binding.
+    const machineId = willChangeAnything ? await getMachineId() : await previewMachineId();
+    const machineSecret = willChangeAnything && !linked ? await getMachineSecret() : undefined;
+    if (willChangeAnything && accountId && !resolvedAcct.overrodeBinding) {
+        await writeProjectBinding(root, accountId, projectId).catch(() => { });
     }
     // `--apply-schema` writes property definitions to the live portal, but
     // `--plan`/`--dry-run` promise to change nothing. Honoring both would let a
@@ -1018,6 +1491,7 @@ export async function deployCommand({ argv, root, json, }) {
                     controlPlanePlan,
                     userId,
                     machineId,
+                    ...(machineSecret ? { machineSecret } : {}),
                     heartbeatEnabled: noHeartbeat
                         ? false
                         : controlPlaneBackedPlan
@@ -1040,8 +1514,8 @@ export async function deployCommand({ argv, root, json, }) {
     }
     if (echo && cloudflareDeployResult) {
         for (const worker of cloudflareDeployResult.workers) {
-            if (worker.unauthenticatedInvoke) {
-                echo.warn('HSX_W_DEPLOY_UNAUTHENTICATED_INVOKE', `${worker.workerName}: workflow-action invoke endpoints accept unsigned requests until the app's OAuth client secret is configured (redeploy with HSX_HUBSPOT_CLIENT_SECRET / --hubspot-client-secret after the OAuth install).`);
+            if (worker.signatureVerificationUnavailable) {
+                echo.warn('HSX_W_DEPLOY_SIGNATURE_UNAVAILABLE', `${worker.workerName}: HubSpot workflow-action and trigger requests will fail closed until the app's OAuth client secret is configured (redeploy with HSX_HUBSPOT_CLIENT_SECRET / --hubspot-client-secret after the OAuth install).`);
             }
         }
     }
@@ -1209,6 +1683,16 @@ export async function deployCommand({ argv, root, json, }) {
                             : planOnly
                                 ? 'plan'
                                 : 'local-artifacts',
+        deploymentMode,
+        targets: {
+            cloudflare: {
+                requested: cloudflareDeployRequested,
+                dryRun: cloudflareDryRun,
+            },
+            hubspot: {
+                uploadRequested: hubspotUploadRequested,
+            },
+        },
         root,
         hubspotOnly,
         needsRuntime,
@@ -1254,6 +1738,7 @@ export async function deployCommand({ argv, root, json, }) {
             hubspotUploadResult,
             linked,
             machineId,
+            machineSecret,
         });
     }
     // Record tenant state + emit the deploy event whenever the worker is actually
@@ -1268,14 +1753,17 @@ export async function deployCommand({ argv, root, json, }) {
             plan: controlPlanePlan,
             environment: resolveFlag(argv, '--env') ?? resolveFlag(argv, '--environment') ?? 'production',
         });
-        await emitAnonymousDeployEvent({
-            argv,
-            machineId,
-            projectId: controlPlanePlan?.projectId ?? projectId,
-            deployId: cloudflareDeployResult.deployId,
-            workerUrl: cloudflareDeployResult.workers.find((worker) => worker.url)?.url,
-            environment: resolveFlag(argv, '--env') ?? resolveFlag(argv, '--environment') ?? 'production',
-        });
+        if (machineSecret) {
+            await emitAnonymousDeployEvent({
+                argv,
+                machineId,
+                machineSecret,
+                projectId: controlPlanePlan?.projectId ?? projectId,
+                deployId: cloudflareDeployResult.deployId,
+                workerUrl: cloudflareDeployResult.workers.find((worker) => worker.url)?.url,
+                environment: resolveFlag(argv, '--env') ?? resolveFlag(argv, '--environment') ?? 'production',
+            });
+        }
     }
     // 0 = clean, 20 = partial (worker live, HubSpot upload failed — distinct so
     // automation doesn't treat a serving worker as a total failure), 1 = failure.
@@ -1288,6 +1776,7 @@ function buildDeployPlanSummary(input) {
         lines.push(`  account:        ${input.accountId}`);
     if (input.projectId)
         lines.push(`  project:        ${input.projectId}`);
+    lines.push(`  deploy mode:    ${input.deploymentMode}`);
     lines.push(`  workers:        ${input.workers.length} (${capCount} capabilities)`);
     if (input.applySchema && input.portalSchemaPlan) {
         const adds = input.portalSchemaPlan.actions.filter((item) => item.kind === 'will-create-object' || item.kind === 'will-create-property').length;
@@ -1306,8 +1795,7 @@ function buildDeployPlanSummary(input) {
     if (input.cloudflareDeployRequested) {
         lines.push(`  cloudflare:     ${input.cloudflareDryRun ? 'dry-run' : 'deploy'}`);
     }
-    if (input.hubspotUpload)
-        lines.push('  hubspot upload: yes');
+    lines.push(`  hubspot upload: ${input.hubspotUpload ? 'yes' : 'no'}`);
     return lines.join('\n');
 }
 function createUnlinkedDeployPlan(input) {
@@ -1351,6 +1839,7 @@ async function emitAnonymousDeployEvent(input) {
             headers: {
                 'content-type': 'application/json',
                 accept: 'application/json',
+                authorization: `Bearer ${input.machineSecret}`,
             },
             body: JSON.stringify({
                 schema_version: 1,
@@ -1446,7 +1935,12 @@ function deployDoneMessage(input, firstWorkerUrl) {
 }
 /** The railed key/value facts of what this deploy produced (human/plain). */
 function buildDeploySummaryRows(input) {
-    const rows = [];
+    const rows = [
+        {
+            key: 'deploy mode',
+            value: input.plan.deploymentMode,
+        },
+    ];
     if (input.controlPlanePlan) {
         rows.push({
             key: 'deploy',
@@ -1524,7 +2018,10 @@ function buildDeploySummaryRows(input) {
         }
     }
     if (!input.linked && input.cloudflareDeployResult) {
-        rows.push({ key: 'history', value: machineDashboardUrl(input.machineId) });
+        rows.push({
+            key: 'history',
+            value: machineDashboardUrl(input.machineId, input.machineSecret),
+        });
     }
     return rows;
 }
@@ -1623,13 +2120,13 @@ function renderDeployNdjsonSummary(input) {
             .join(', ');
         reporter.info(`Cloudflare deploy: ${deployed}`);
         for (const worker of input.cloudflareDeployResult.workers) {
-            if (worker.unauthenticatedInvoke) {
-                reporter.warn('HSX_W_DEPLOY_UNAUTHENTICATED_INVOKE', `${worker.workerName}: workflow-action invoke endpoints accept unsigned requests until the app's OAuth client secret is configured (redeploy with HSX_HUBSPOT_CLIENT_SECRET / --hubspot-client-secret after the OAuth install).`);
+            if (worker.signatureVerificationUnavailable) {
+                reporter.warn('HSX_W_DEPLOY_SIGNATURE_UNAVAILABLE', `${worker.workerName}: HubSpot workflow-action and trigger requests will fail closed until the app's OAuth client secret is configured (redeploy with HSX_HUBSPOT_CLIENT_SECRET / --hubspot-client-secret after the OAuth install).`);
             }
         }
     }
     if (!input.linked && input.cloudflareDeployResult) {
-        reporter.info(`Deploy history for this machine: ${machineDashboardUrl(input.machineId)}`);
+        reporter.info(`Deploy history for this machine: ${machineDashboardUrl(input.machineId, input.machineSecret)}`);
     }
     if (input.hubspotUploadResult) {
         const upload = input.hubspotUploadResult;
@@ -1679,9 +2176,12 @@ function renderDeployNdjsonSummary(input) {
     }
     reporter.done(deployDoneMessage(input, firstWorkerUrl), input.plan.ok ? 0 : input.plan.partial ? 20 : 1);
 }
-function machineDashboardUrl(machineId) {
+function machineDashboardUrl(machineId, machineSecret) {
     const base = process.env.HSX_DASHBOARD_URL ?? 'https://app.hs-x.dev';
-    return `${base.replace(/\/$/, '')}/m/${encodeURIComponent(machineId)}`;
+    const url = new URL(`/m/${encodeURIComponent(machineId)}`, `${base.replace(/\/$/, '')}/`);
+    if (machineSecret)
+        url.hash = new URLSearchParams({ access: machineSecret }).toString();
+    return url.toString();
 }
 /**
  * The HubSpot developer-console URL for an uploaded app's auth tab, where a
@@ -2129,7 +2629,7 @@ function defaultHubSpotFieldType(type) {
             return 'text';
     }
 }
-async function executeCloudflareDeploy({ argv, root, workers, controlPlanePlan, controlPlaneUrl, userId, machineId, heartbeatEnabled, dryRun, note, }) {
+async function executeCloudflareDeploy({ argv, root, workers, controlPlanePlan, controlPlaneUrl, userId, machineId, machineSecret, heartbeatEnabled, dryRun, note, }) {
     // Fail fast on missing Cloudflare credentials BEFORE deploying any Worker, so
     // an unlinked deploy can't leave a Worker live and then error on the
     // tenant-state write for a missing account id.
@@ -2172,6 +2672,17 @@ async function executeCloudflareDeploy({ argv, root, workers, controlPlanePlan,
         });
     }
     const sourcePaths = await discoverWorkerSourcePaths(root);
+    // Provision once per tenant trust domain, then let every Worker continue its
+    // deploy in parallel with the exact same resources and verifier secret.
+    const tenantDataPlaneProvisioning = createTenantDataPlaneProvisioningCoordinator(controlPlaneUrl && !dryRun
+        ? {
+            authority: createControlPlaneTenantProvisioningAuthority({
+                controlPlaneUrl,
+                authorizationHeaders: () => controlPlaneAuthHeaders(userId),
+                http: hostedHttp,
+            }),
+        }
+        : {});
     const concurrency = Math.max(1, Math.min(4, workers.length));
     const results = await Effect.runPromise(Effect.forEach(workers.map((worker, index) => ({ worker, index })), ({ worker, index }) => Effect.promise(() => executeCloudflareWorkerDeploy({
         argv,
@@ -2183,8 +2694,10 @@ async function executeCloudflareDeploy({ argv, root, workers, controlPlanePlan,
         controlPlanePlan,
         userId,
         machineId,
+        ...(machineSecret ? { machineSecret } : {}),
         heartbeatEnabled,
         dryRun,
+        tenantDataPlaneProvisioning,
         ...(controlPlaneUrl ? { controlPlaneUrl } : {}),
         ...(note ? { note } : {}),
     })), { concurrency }));
@@ -2193,7 +2706,7 @@ async function executeCloudflareDeploy({ argv, root, workers, controlPlanePlan,
         workers: results,
     };
 }
-async function executeCloudflareWorkerDeploy({ argv, root, worker, index, allowCredentialPrompt, sourcePaths, controlPlanePlan, controlPlaneUrl, userId, machineId, heartbeatEnabled, dryRun, note, }) {
+async function executeCloudflareWorkerDeploy({ argv, root, worker, index, allowCredentialPrompt, sourcePaths, controlPlanePlan, controlPlaneUrl, userId, machineId, machineSecret, heartbeatEnabled, dryRun, tenantDataPlaneProvisioning, note, }) {
     const emitNote = note ??
         ((line) => {
             process.stderr.write(line);
@@ -2217,10 +2730,24 @@ async function executeCloudflareWorkerDeploy({ argv, root, worker, index, allowC
     const environment = resolveFlag(argv, '--env') ?? resolveFlag(argv, '--environment') ?? 'production';
     const deployCliConfig = loadCliConfig(argv);
     const runtimeControlPlaneUrl = formatConfigUrl(deployCliConfig.runtimeControlPlaneUrl ?? new URL(DEFAULT_CONTROL_PLANE_URL));
+    const exactTenantScope = {
+        accountId: controlPlanePlan.accountId,
+        projectId: controlPlanePlan.projectId,
+        environment,
+    };
     await writeFile(entrypointPath, renderCloudflareWorkerEntrypoint({
         workerImportPath: relativeImportPath(dirname(entrypointPath), workerSourcePath),
         requireActiveCardInstall: appConfig.auth === 'oauth',
-        ...(cronPlan.dispatch.length > 0 ? { syncCron: cronPlan } : {}),
+        // Tenant D1/KV and the grant secret are shared across the linked app's
+        // Workers. Wire the matching routes on every linked Worker even though
+        // revision-bound heartbeat/attestation remains primary-only below.
+        ...(controlPlaneUrl ? { tenantDataPlaneScope: exactTenantScope } : {}),
+        ...(cronPlan.dispatch.length > 0
+            ? {
+                syncCron: cronPlan,
+                syncRunScope: exactTenantScope,
+            }
+            : {}),
         ...(appConfig.appEventBatching !== undefined
             ? { appEventBatching: appConfig.appEventBatching }
             : {}),
@@ -2236,7 +2763,10 @@ async function executeCloudflareWorkerDeploy({ argv, root, worker, index, allowC
                 },
             }
             : {}),
-        ...(heartbeatEnabled
+        // A linked deploy records the primary Worker's Cloudflare revision on
+        // the deploy record, so only that Worker may attest against it. Anonymous
+        // telemetry remains per Worker because it has no revision trust binding.
+        ...(heartbeatEnabled && (!controlPlaneUrl || index === 0)
             ? {
                 heartbeat: controlPlaneUrl
                     ? {
@@ -2254,6 +2784,7 @@ async function executeCloudflareWorkerDeploy({ argv, root, worker, index, allowC
                         controlPlaneUrl: formatConfigUrl(loadCliConfig(argv).runtimeControlPlaneUrl ??
                             new URL(DEFAULT_CONTROL_PLANE_URL)),
                         machineId,
+                        machineSecretBinding: 'HSX_MACHINE_SECRET',
                         projectId: controlPlanePlan.projectId,
                         deployId: controlPlanePlan.deployId,
                         environment,
@@ -2295,7 +2826,12 @@ async function executeCloudflareWorkerDeploy({ argv, root, worker, index, allowC
     // flags KV + grant secret, persisting the scope + secret to local state so the
     // leaveable `hs-x flags` CLI can sign without the control plane.
     const tenantDataPlane = installRuntimeBinding && controlPlaneUrl && hubspotAppId && !dryRun
-        ? await ensureTenantDataPlane({
+        ? await tenantDataPlaneProvisioning.resolve({
+            accountId: controlPlanePlan.accountId,
+            projectId: controlPlanePlan.projectId,
+            environment,
+            hubSpotAppId: hubspotAppId,
+        }, (claim) => ensureTenantDataPlane({
             argv,
             root,
             accountId: controlPlanePlan.accountId,
@@ -2303,9 +2839,14 @@ async function executeCloudflareWorkerDeploy({ argv, root, worker, index, allowC
             environment,
             hubSpotAppId: hubspotAppId,
             install: installRuntimeBinding,
-            controlPlaneUrl,
-            userId,
-            ...(note ? { note } : {}),
+            ...(claim ? { canonicalSyncGrantSecretValue: claim.syncGrantSecretValue } : {}),
+        }), async () => {
+            const { stateStore } = await ensureTenantStateStore({ argv, root });
+            return (await stateStore.getBinding({
+                projectId: controlPlanePlan.projectId,
+                environment,
+                hubSpotAppId: hubspotAppId,
+            }))?.syncGrantSecretValue;
         })
         : undefined;
     const hubSpotOAuthSecret = hubspotAppId && controlPlaneUrl
@@ -2377,6 +2918,7 @@ async function executeCloudflareWorkerDeploy({ argv, root, worker, index, allowC
             ? { installKvNamespaceId: installRuntimeBinding.installKvNamespaceId }
             : {}),
         ...(controlPlaneUrl ? { checkpointDataset: 'hsx_checkpoint', observability: true } : {}),
+        ...(controlPlaneUrl ? { versionMetadataBinding: 'CF_VERSION_METADATA' } : {}),
         ...(tenantDataPlane
             ? {
                 flagsKvNamespaceId: tenantDataPlane.flagsKvNamespaceId,
@@ -2452,10 +2994,10 @@ async function executeCloudflareWorkerDeploy({ argv, root, worker, index, allowC
         ...(dryRun ? ['--dry-run'] : []),
     ];
     const deployEnv = cloudflareDeployEnv(argv);
-    const output = await runCloudflareCommand(command, {
+    const output = await withTransientDeployRetry(() => runCloudflareCommand(command, {
         cwd: root,
         env: deployEnv,
-    });
+    }));
     if (installRuntimeBinding?.tokenKeySecretValue && !dryRun) {
         await runCloudflareCommand([
             'bun',
@@ -2472,6 +3014,13 @@ async function executeCloudflareWorkerDeploy({ argv, root, worker, index, allowC
             stdin: installRuntimeBinding.tokenKeySecretValue,
         });
     }
+    if (!controlPlaneUrl && heartbeatEnabled && machineSecret && !dryRun) {
+        await runCloudflareCommand(['bun', 'x', 'wrangler', 'secret', 'put', 'HSX_MACHINE_SECRET', '--name', workerName], {
+            cwd: root,
+            env: deployEnv,
+            stdin: machineSecret,
+        });
+    }
     if (resolvedHubSpotClientSecret && !dryRun) {
         await runCloudflareCommand([
             'bun',
@@ -2495,9 +3044,10 @@ async function executeCloudflareWorkerDeploy({ argv, root, worker, index, allowC
             stdin: billingRuntimeToken.runtimeToken,
         });
     }
-    // ADR-015 grant-verifier secret — only set when freshly generated (a re-deploy
-    // reuses the value already on the Worker + in local state).
-    if (tenantDataPlane?.syncGrantSecretValue && !dryRun) {
+    // ADR-015 grant-verifier secret. Cloudflare Worker secrets are write-only and
+    // per Worker, so install the canonical stored value on EVERY deployed Worker
+    // (including one added after the trust domain was first provisioned).
+    if (tenantDataPlane && !dryRun) {
         await runCloudflareCommand([
             'bun',
             'x',
@@ -2553,10 +3103,10 @@ async function executeCloudflareWorkerDeploy({ argv, root, worker, index, allowC
             emitNote(`warning: could not register the tenant Worker URL with the control plane: ${error instanceof Error ? error.message : String(error)}\n`);
         }
     }
-    // Without the client secret on the Worker, the runtime accepts UNSIGNED
-    // workflow-action invokes (HubSpot must still be able to call them pre-OAuth)
-    // — surface that as a one-line warning instead of leaving it silent.
-    const hasWorkflowActions = worker.capabilities.some((capability) => capability.kind === 'tool');
+    // Without the client secret, all HubSpot-authored request surfaces fail
+    // closed. Surface the unavailable state instead of leaving bootstrap deploys
+    // live but mysteriously non-functional.
+    const hasHubSpotAuthoredIngress = worker.capabilities.some((capability) => capability.kind === 'tool' || capability.kind === 'trigger');
     return {
         workerName,
         workerSourcePath: relative(root, workerSourcePath),
@@ -2567,8 +3117,8 @@ async function executeCloudflareWorkerDeploy({ argv, root, worker, index, allowC
         dryRun,
         stdout: output.stdout,
         stderr: output.stderr,
-        ...(hasWorkflowActions && !resolvedHubSpotClientSecret && !dryRun
-            ? { unauthenticatedInvoke: true }
+        ...(hasHubSpotAuthoredIngress && !resolvedHubSpotClientSecret && !dryRun
+            ? { signatureVerificationUnavailable: true }
             : {}),
     };
 }
@@ -2621,49 +3171,68 @@ async function ensureTenantDeployInstallRuntimeBinding(input) {
             installKvNamespaceName: existing.installKvNamespaceName,
             tokenKeySecretName: existing.tokenKeySecretName,
             tokenKeyCustody: existing.tokenKeyCustody,
+            ...(existing.tenantD1DatabaseId ? { tenantD1DatabaseId: existing.tenantD1DatabaseId } : {}),
+            ...(existing.tenantD1DatabaseName
+                ? { tenantD1DatabaseName: existing.tenantD1DatabaseName }
+                : {}),
+            ...(existing.flagsKvNamespaceId ? { flagsKvNamespaceId: existing.flagsKvNamespaceId } : {}),
+            ...(existing.flagsKvNamespaceName
+                ? { flagsKvNamespaceName: existing.flagsKvNamespaceName }
+                : {}),
         };
     }
     if (input.dryRun)
         return undefined;
-    // ADR-022: generate the token key and escrow it BEFORE creating any
-    // Cloudflare resource — if custody is unavailable, the deploy stops with
-    // zero mutations instead of minting a key that exists nowhere durable.
     const tokenKeySecretName = 'HSX_TOKEN_KEY';
-    const tokenKeySecretValue = randomBytes(32).toString('base64url');
-    const tokenKeyCustody = await escrowTokenKey({
-        adapter: defaultTokenKeyCustodyAdapter(),
-        custodyId: tokenKeyCustodyIdFor({
-            ownerId: pointer.ownerId,
+    const installResource = await resolveOrProvisionCloudflareScopedResource({
+        identity: {
+            accountId: input.ownerId,
             projectId: input.projectId,
             environment: input.environment,
             hubSpotAppId: input.hubSpotAppId,
-        }),
-        tokenKeySecretValue,
-    });
-    const installKvNamespaceName = installKvNamespaceNameFor({
-        accountId: input.ownerId,
-        projectId: input.projectId,
-        environment: input.environment,
-        hubSpotAppId: input.hubSpotAppId,
-    });
-    const namespaceOutput = await runCloudflareCommand([
-        'bun',
-        'x',
-        'wrangler',
-        'kv',
-        'namespace',
-        'create',
-        installKvNamespaceName,
-        '--binding',
-        'INSTALL_KV',
-    ], {
-        cwd: input.root,
-        env: cloudflareDeployEnv(input.argv),
+        },
+        kind: 'install-kv',
+        async provisionByName(installKvNamespaceName) {
+            // ADR-022: generate and escrow the token key before creating Cloudflare
+            // state, but only after long ambiguous names have already failed closed.
+            const tokenKeySecretValue = randomBytes(32).toString('base64url');
+            const tokenKeyCustody = await escrowTokenKey({
+                adapter: defaultTokenKeyCustodyAdapter(),
+                custodyId: tokenKeyCustodyIdFor({
+                    ownerId: pointer.ownerId,
+                    projectId: input.projectId,
+                    environment: input.environment,
+                    hubSpotAppId: input.hubSpotAppId,
+                }),
+                tokenKeySecretValue,
+            });
+            const namespaceOutput = await runCloudflareCommand([
+                'bun',
+                'x',
+                'wrangler',
+                'kv',
+                'namespace',
+                'create',
+                installKvNamespaceName,
+                '--binding',
+                'INSTALL_KV',
+            ], {
+                cwd: input.root,
+                env: cloudflareDeployEnv(input.argv),
+            });
+            const resourceId = extractKvNamespaceId(`${namespaceOutput.stdout}\n${namespaceOutput.stderr}`);
+            if (!resourceId) {
+                throw new Error('Could not read Cloudflare KV namespace id from wrangler output.');
+            }
+            return { resourceId, value: { tokenKeySecretValue, tokenKeyCustody } };
+        },
     });
-    const installKvNamespaceId = extractKvNamespaceId(`${namespaceOutput.stdout}\n${namespaceOutput.stderr}`);
-    if (!installKvNamespaceId) {
-        throw new Error('Could not read Cloudflare KV namespace id from wrangler output.');
+    if (!installResource.value) {
+        throw new Error('Install KV provisioning did not return token-key custody.');
     }
+    const installKvNamespaceId = installResource.resourceId;
+    const installKvNamespaceName = installResource.resourceName;
+    const { tokenKeySecretValue, tokenKeyCustody } = installResource.value;
     await stateStore.putBinding(Schema.decodeUnknownSync(schemas.LocalAppRuntimeBinding)({
         schemaVersion: 2,
         ownerId: pointer.ownerId,
@@ -2693,49 +3262,68 @@ async function ensureDeployInstallRuntimeBinding(input) {
             installKvNamespaceId: existing.installKvNamespaceId,
             installKvNamespaceName: existing.installKvNamespaceName,
             tokenKeySecretName: existing.tokenKeySecretName,
+            ...(existing.tenantD1DatabaseId ? { tenantD1DatabaseId: existing.tenantD1DatabaseId } : {}),
+            ...(existing.tenantD1DatabaseName
+                ? { tenantD1DatabaseName: existing.tenantD1DatabaseName }
+                : {}),
+            ...(existing.flagsKvNamespaceId ? { flagsKvNamespaceId: existing.flagsKvNamespaceId } : {}),
+            ...(existing.flagsKvNamespaceName
+                ? { flagsKvNamespaceName: existing.flagsKvNamespaceName }
+                : {}),
         };
     }
     if (input.dryRun) {
         return undefined;
     }
-    // ADR-022: the linked path generates the token key at the same seam, so it
-    // gets the same escrow — before any Cloudflare mutation. Only the custody
-    // REFERENCE lands in local state; the control plane never sees key bytes.
-    const tokenKeySecretValue = randomBytes(32).toString('base64url');
-    const tokenKeyCustody = await escrowTokenKey({
-        adapter: defaultTokenKeyCustodyAdapter(),
-        custodyId: tokenKeyCustodyIdFor({
-            ownerId: input.accountId,
+    const installResource = await resolveOrProvisionCloudflareScopedResource({
+        identity: {
+            accountId: input.accountId,
             projectId: input.projectId,
             environment: input.environment,
             hubSpotAppId: input.hubSpotAppId,
-        }),
-        tokenKeySecretValue,
-    });
-    const installKvNamespaceName = installKvNamespaceNameFor({
-        accountId: input.accountId,
-        projectId: input.projectId,
-        environment: input.environment,
-        hubSpotAppId: input.hubSpotAppId,
-    });
-    const namespaceOutput = await runCloudflareCommand([
-        'bun',
-        'x',
-        'wrangler',
-        'kv',
-        'namespace',
-        'create',
-        installKvNamespaceName,
-        '--binding',
-        'INSTALL_KV',
-    ], {
-        cwd: input.root,
-        env: cloudflareDeployEnv(input.argv),
+        },
+        kind: 'install-kv',
+        async provisionByName(installKvNamespaceName) {
+            // ADR-022: escrow precedes Cloudflare mutation, while the ambiguity
+            // guard precedes both. The control plane never receives key bytes.
+            const tokenKeySecretValue = randomBytes(32).toString('base64url');
+            const tokenKeyCustody = await escrowTokenKey({
+                adapter: defaultTokenKeyCustodyAdapter(),
+                custodyId: tokenKeyCustodyIdFor({
+                    ownerId: input.accountId,
+                    projectId: input.projectId,
+                    environment: input.environment,
+                    hubSpotAppId: input.hubSpotAppId,
+                }),
+                tokenKeySecretValue,
+            });
+            const namespaceOutput = await runCloudflareCommand([
+                'bun',
+                'x',
+                'wrangler',
+                'kv',
+                'namespace',
+                'create',
+                installKvNamespaceName,
+                '--binding',
+                'INSTALL_KV',
+            ], {
+                cwd: input.root,
+                env: cloudflareDeployEnv(input.argv),
+            });
+            const resourceId = extractKvNamespaceId(`${namespaceOutput.stdout}\n${namespaceOutput.stderr}`);
+            if (!resourceId) {
+                throw new Error('Could not read Cloudflare KV namespace id from wrangler output.');
+            }
+            return { resourceId, value: { tokenKeySecretValue, tokenKeyCustody } };
+        },
     });
-    const installKvNamespaceId = extractKvNamespaceId(`${namespaceOutput.stdout}\n${namespaceOutput.stderr}`);
-    if (!installKvNamespaceId) {
-        throw new Error('Could not read Cloudflare KV namespace id from wrangler output.');
+    if (!installResource.value) {
+        throw new Error('Install KV provisioning did not return token-key custody.');
     }
+    const installKvNamespaceId = installResource.resourceId;
+    const installKvNamespaceName = installResource.resourceName;
+    const { tokenKeySecretValue, tokenKeyCustody } = installResource.value;
     const tokenKeySecretName = 'HSX_TOKEN_KEY';
     await putDeployInstallRuntimeBinding({
         ...input,
@@ -2820,31 +3408,11 @@ async function requestDeployBillingRuntimeToken(input) {
         binding: body.binding,
     };
 }
-function installKvNamespaceNameFor(input) {
-    return truncateCloudflareResourceName(`hsx-${cloudflareNameSlug(input.accountId)}-${cloudflareNameSlug(input.projectId)}-${cloudflareNameSlug(input.environment)}-${cloudflareNameSlug(String(input.hubSpotAppId))}-install`);
-}
-function cloudflareNameSlug(value) {
-    return (value
-        .toLowerCase()
-        .replace(/[^a-z0-9]+/g, '-')
-        .replace(/^-+|-+$/g, '') || 'x');
-}
-function truncateCloudflareResourceName(value) {
-    return value.length <= 63 ? value : value.slice(0, 63).replace(/-+$/g, '');
-}
 function extractKvNamespaceId(output) {
     return (/"id"\s*:\s*"([^"]+)"/.exec(output)?.[1] ??
         /id\s*=\s*"([^"]+)"/.exec(output)?.[1] ??
         /id[:\s]+([a-f0-9]{16,})/i.exec(output)?.[1]);
 }
-// ADR-015/ADR-014 tenant data plane: one project-scoped D1 (flag config +
-// installer PII + platform events) and one flags-snapshot KV per install.
-function tenantD1DatabaseNameFor(input) {
-    return truncateCloudflareResourceName(`hsx-${cloudflareNameSlug(input.accountId)}-${cloudflareNameSlug(input.projectId)}-${cloudflareNameSlug(input.environment)}-${cloudflareNameSlug(String(input.hubSpotAppId))}-tenant`);
-}
-function flagsKvNamespaceNameFor(input) {
-    return truncateCloudflareResourceName(`hsx-${cloudflareNameSlug(input.accountId)}-${cloudflareNameSlug(input.projectId)}-${cloudflareNameSlug(input.environment)}-${cloudflareNameSlug(String(input.hubSpotAppId))}-flags`);
-}
 function extractD1DatabaseId(output) {
     return (/"database_id"\s*:\s*"([^"]+)"/.exec(output)?.[1] ??
         /database_id\s*=\s*"([^"]+)"/.exec(output)?.[1] ??
@@ -2859,10 +3427,12 @@ function extractD1DatabaseId(output) {
  *
  * Idempotent: re-uses already-provisioned ids + an already-generated secret from
  * local state (so a re-deploy keeps the same secret the Worker already holds).
- * Returns `syncGrantSecretValue` only when freshly generated — the caller does
- * a `wrangler secret put` only then. Tenant-data-plane activation is
- * linked-only (codegen emits the options solely for heartbeat.mode==='linked'),
- * so this is never called for unlinked direct-to-HubSpot deploys.
+ * Returns the canonical `syncGrantSecretValue` on every call — including when
+ * it came from the durable binding — because a newly-added Worker does not yet
+ * have the write-only Cloudflare secret even though sibling Workers do.
+ * Tenant-data-plane activation is linked-only. Codegen receives the exact
+ * tenant scope for every linked Worker independently of primary-only heartbeat
+ * ownership, so this is never called for unlinked direct-to-HubSpot deploys.
  */
 async function ensureTenantDataPlane(input) {
     const { pointer, stateStore } = await ensureTenantStateStore({
@@ -2875,69 +3445,86 @@ async function ensureTenantDataPlane(input) {
         hubSpotAppId: input.hubSpotAppId,
     });
     const env = cloudflareDeployEnv(input.argv);
-    const tenantD1DatabaseName = existing?.tenantD1DatabaseName ?? tenantD1DatabaseNameFor(input);
-    let tenantD1DatabaseId = existing?.tenantD1DatabaseId;
-    if (!tenantD1DatabaseId) {
-        // Create, or ADOPT on a name conflict: resource names are deterministic,
-        // so a database that already exists is this project's own tenant D1 from
-        // an earlier deploy whose local state was lost — failing here would brick
-        // every redeploy while the data-holding database sits one lookup away.
-        const created = await runCloudflareCommand(['bun', 'x', 'wrangler', 'd1', 'create', tenantD1DatabaseName], { cwd: input.root, env }).catch((error) => {
-            if (!/already exists/i.test(String(error)))
-                throw error;
-            return undefined;
-        });
-        if (created) {
-            tenantD1DatabaseId = extractD1DatabaseId(`${created.stdout}\n${created.stderr}`);
-        }
-        else {
-            const info = await runCloudflareCommand(['bun', 'x', 'wrangler', 'd1', 'info', tenantD1DatabaseName, '--json'], { cwd: input.root, env });
-            tenantD1DatabaseId =
-                extractD1DatabaseId(info.stdout) ?? /"uuid"\s*:\s*"([^"]+)"/.exec(info.stdout)?.[1];
-        }
-        if (!tenantD1DatabaseId) {
-            throw new Error('Could not read tenant D1 database id from wrangler output.');
-        }
-    }
-    const flagsKvNamespaceName = existing?.flagsKvNamespaceName ?? flagsKvNamespaceNameFor(input);
-    let flagsKvNamespaceId = existing?.flagsKvNamespaceId;
-    if (!flagsKvNamespaceId) {
-        // Same create-or-adopt posture as the tenant D1 above.
-        const created = await runCloudflareCommand([
-            'bun',
-            'x',
-            'wrangler',
-            'kv',
-            'namespace',
-            'create',
-            flagsKvNamespaceName,
-            '--binding',
-            'FLAGS_KV',
-        ], { cwd: input.root, env }).catch((error) => {
-            if (!/already exists/i.test(String(error)))
-                throw error;
-            return undefined;
-        });
-        if (created) {
-            flagsKvNamespaceId = extractKvNamespaceId(`${created.stdout}\n${created.stderr}`);
-        }
-        else {
-            const listed = await runCloudflareCommand(['bun', 'x', 'wrangler', 'kv', 'namespace', 'list'], { cwd: input.root, env });
-            try {
-                const namespaces = JSON.parse(listed.stdout);
-                flagsKvNamespaceId = namespaces.find((namespace) => namespace.title === flagsKvNamespaceName)?.id;
+    // Exact local state wins; exact control-plane refs recover a linked deploy
+    // when its tenant-state binding was lost. Name-only create/adopt remains
+    // available for short legacy-compatible names only.
+    const exactTenantD1DatabaseId = existing?.tenantD1DatabaseId ?? input.install.tenantD1DatabaseId;
+    const exactTenantD1DatabaseName = existing?.tenantD1DatabaseName ?? input.install.tenantD1DatabaseName;
+    const tenantD1 = await resolveOrProvisionCloudflareScopedResource({
+        identity: input,
+        kind: 'tenant-d1',
+        ...(exactTenantD1DatabaseId ? { exactResourceId: exactTenantD1DatabaseId } : {}),
+        ...(exactTenantD1DatabaseName ? { exactResourceName: exactTenantD1DatabaseName } : {}),
+        async provisionByName(tenantD1DatabaseName) {
+            const created = await runCloudflareCommand(['bun', 'x', 'wrangler', 'd1', 'create', tenantD1DatabaseName], { cwd: input.root, env }).catch((error) => {
+                if (!/already exists/i.test(String(error)))
+                    throw error;
+                return undefined;
+            });
+            let resourceId = created
+                ? extractD1DatabaseId(`${created.stdout}\n${created.stderr}`)
+                : undefined;
+            if (!created) {
+                const info = await runCloudflareCommand(['bun', 'x', 'wrangler', 'd1', 'info', tenantD1DatabaseName, '--json'], { cwd: input.root, env });
+                resourceId =
+                    extractD1DatabaseId(info.stdout) ?? /"uuid"\s*:\s*"([^"]+)"/.exec(info.stdout)?.[1];
             }
-            catch {
-                flagsKvNamespaceId = undefined;
+            if (!resourceId) {
+                throw new Error('Could not read tenant D1 database id from wrangler output.');
             }
-        }
-        if (!flagsKvNamespaceId) {
-            throw new Error('Could not read flags KV namespace id from wrangler output.');
-        }
-    }
+            return { resourceId };
+        },
+    });
+    const tenantD1DatabaseId = tenantD1.resourceId;
+    const tenantD1DatabaseName = tenantD1.resourceName;
+    const exactFlagsKvNamespaceId = existing?.flagsKvNamespaceId ?? input.install.flagsKvNamespaceId;
+    const exactFlagsKvNamespaceName = existing?.flagsKvNamespaceName ?? input.install.flagsKvNamespaceName;
+    const flagsKv = await resolveOrProvisionCloudflareScopedResource({
+        identity: input,
+        kind: 'flags-kv',
+        ...(exactFlagsKvNamespaceId ? { exactResourceId: exactFlagsKvNamespaceId } : {}),
+        ...(exactFlagsKvNamespaceName ? { exactResourceName: exactFlagsKvNamespaceName } : {}),
+        async provisionByName(flagsKvNamespaceName) {
+            const created = await runCloudflareCommand([
+                'bun',
+                'x',
+                'wrangler',
+                'kv',
+                'namespace',
+                'create',
+                flagsKvNamespaceName,
+                '--binding',
+                'FLAGS_KV',
+            ], { cwd: input.root, env }).catch((error) => {
+                if (!/already exists/i.test(String(error)))
+                    throw error;
+                return undefined;
+            });
+            let resourceId = created
+                ? extractKvNamespaceId(`${created.stdout}\n${created.stderr}`)
+                : undefined;
+            if (!created) {
+                const listed = await runCloudflareCommand(['bun', 'x', 'wrangler', 'kv', 'namespace', 'list'], { cwd: input.root, env });
+                try {
+                    const namespaces = JSON.parse(listed.stdout);
+                    resourceId = namespaces.find((namespace) => namespace.title === flagsKvNamespaceName)?.id;
+                }
+                catch {
+                    resourceId = undefined;
+                }
+            }
+            if (!resourceId) {
+                throw new Error('Could not read flags KV namespace id from wrangler output.');
+            }
+            return { resourceId };
+        },
+    });
+    const flagsKvNamespaceId = flagsKv.resourceId;
+    const flagsKvNamespaceName = flagsKv.resourceName;
     const syncGrantSecretName = 'HSX_SYNC_GRANT_KEY';
-    const reusedSecret = existing?.syncGrantSecretValue;
-    const syncGrantSecretValue = reusedSecret ?? randomBytes(32).toString('base64url');
+    const syncGrantSecretValue = input.canonicalSyncGrantSecretValue ??
+        existing?.syncGrantSecretValue ??
+        randomBytes(32).toString('base64url');
     await stateStore.putBinding(Schema.decodeUnknownSync(schemas.LocalAppRuntimeBinding)({
         schemaVersion: 2,
         ownerId: pointer.ownerId,
@@ -2965,58 +3552,15 @@ async function ensureTenantDataPlane(input) {
         syncGrantSecretValue,
         updatedAt: new Date().toISOString(),
     }));
-    // ADR-015 §5 "Both": register the secret control-plane-side for the (gated)
-    // dashboard/agent/sync consumers. Best-effort — the leaveable CLI-direct path
-    // reads the value from local state and needs no control plane.
-    if (input.controlPlaneUrl && input.userId) {
-        try {
-            await registerDeploySyncGrantSecret({
-                controlPlaneUrl: input.controlPlaneUrl,
-                userId: input.userId,
-                accountId: input.accountId,
-                projectId: input.projectId,
-                environment: input.environment,
-                hubSpotAppId: input.hubSpotAppId,
-                syncGrantSecret: syncGrantSecretValue,
-            });
-        }
-        catch (error) {
-            const warning = `warning: could not register the sync grant secret with the control plane: ${error instanceof Error ? error.message : String(error)}\n`;
-            if (input.note) {
-                input.note(warning);
-            }
-            else {
-                process.stderr.write(warning);
-            }
-        }
-    }
     return {
         tenantD1DatabaseId,
         tenantD1DatabaseName,
         flagsKvNamespaceId,
         flagsKvNamespaceName,
         syncGrantSecretName,
-        ...(reusedSecret ? {} : { syncGrantSecretValue }),
+        syncGrantSecretValue,
     };
 }
-async function registerDeploySyncGrantSecret(input) {
-    const response = await hostedHttp({
-        url: new URL(`/v1/accounts/${encodeURIComponent(input.accountId)}/projects/${encodeURIComponent(input.projectId)}/hubspot-apps/${encodeURIComponent(input.hubSpotAppId)}/sync-grant-secret`, input.controlPlaneUrl),
-        method: 'PUT',
-        headers: await controlPlaneAuthHeaders(input.userId),
-        body: {
-            environment: input.environment,
-            syncGrantSecret: input.syncGrantSecret,
-        },
-    });
-    const body = await response.json();
-    if (!response.ok) {
-        const message = isRecord(body) && typeof body.message === 'string'
-            ? body.message
-            : `Control plane returned ${response.status}.`;
-        throw new Error(`Could not register the sync grant secret: ${message}`);
-    }
-}
 export function renderWranglerConfig(input) {
     const lines = [
         '# Generated by hs-x. Do not edit by hand.',
@@ -3032,12 +3576,19 @@ export function renderWranglerConfig(input) {
         // when --compatibility-date is set to an older date.
         'compatibility_flags = [ "nodejs_compat", "nodejs_compat_populate_process_env" ]',
     ];
+    if (input.versionMetadataBinding) {
+        lines.push('', '[version_metadata]', `binding = "${tomlString(input.versionMetadataBinding)}"`);
+    }
     if (input.installKvNamespaceId) {
         lines.push('', '[[kv_namespaces]]', 'binding = "INSTALL_KV"', `id = "${tomlString(input.installKvNamespaceId)}"`);
     }
     // ADR-015 flag-snapshot KV (the eval-path hot replica).
     if (input.flagsKvNamespaceId) {
         lines.push('', '[[kv_namespaces]]', 'binding = "FLAGS_KV"', `id = "${tomlString(input.flagsKvNamespaceId)}"`);
+        // Route-level abuse protection for the public flag evaluate + authoring
+        // surfaces. The request key includes deployment identity + exact route, so
+        // a namespace collision cannot merge counters between generated Workers.
+        lines.push('', '[[ratelimits]]', 'name = "HSX_FLAGS_RATE_LIMITER"', `namespace_id = "${flagsRateLimitNamespaceId(input.workerName)}"`, '', '  [ratelimits.simple]', '  limit = 120', '  period = 60');
     }
     // ADR-015/ADR-014 project-scoped tenant D1 (flag config + installer PII +
     // platform events). migrations_dir lets wrangler auto-apply the tenant
@@ -3069,6 +3620,14 @@ export function renderWranglerConfig(input) {
     }
     return `${lines.join('\n')}\n`;
 }
+function flagsRateLimitNamespaceId(workerName) {
+    let hash = 2_166_136_261;
+    for (const character of `${workerName}:HSX_FLAGS_RATE_LIMITER`) {
+        hash ^= character.codePointAt(0) ?? 0;
+        hash = Math.imul(hash, 16_777_619) >>> 0;
+    }
+    return String(hash || 1);
+}
 function tomlString(value) {
     return value.replaceAll('\\', '\\\\').replaceAll('"', '\\"');
 }
@@ -3659,44 +4218,56 @@ function runCloudflareCommand(command, options) {
         },
     })));
 }
-async function executeHubSpotOnlyUpload({ argv, root, local, uploadOnly, }) {
+async function executeHubSpotOnlyUpload({ argv, root, local, persistBinding = true, uploadOnly, prepared, }) {
     // The HubSpot project name must match the name baked into the generated
     // bundle (hsproject.json + app-hsmeta uid), not the on-disk directory name.
     // Using basename(root) breaks when the project lives in a generic dir (e.g.
     // `app/`): the upload targets a project named "app" while the bundle declares
     // the real project id, and HubSpot rejects the mismatch with an opaque 400.
-    const projectName = await resolveHubSpotProjectName(argv, root);
-    const intermediateRepresentation = await readHubSpotProjectIntermediateRepresentation(root);
-    const appUid = readAppUidFromIntermediateRepresentation(intermediateRepresentation) ??
+    const projectName = prepared?.projectName ?? (await resolveHubSpotProjectName(argv, root));
+    const intermediateRepresentation = prepared?.intermediateRepresentation ??
+        (await readHubSpotProjectIntermediateRepresentation(root));
+    const appUid = prepared?.appUid ??
+        readAppUidFromIntermediateRepresentation(intermediateRepresentation) ??
         (await readAppUidFromProjectSource(root));
     // For the post-deploy app Auth URL (unlinked installs). Resolved from
     // flag/env here so the URL is correct on the unlinked path; on a
     // control-plane lease path it stays undefined and the URL is skipped.
-    const developerAccountId = resolveFlag(argv, '--developer-account-id') ?? process.env.HSX_HUBSPOT_DEVELOPER_ACCOUNT_ID;
+    const developerAccountId = prepared?.developerAccountId ??
+        resolveFlag(argv, '--developer-account-id') ??
+        process.env.HSX_HUBSPOT_DEVELOPER_ACCOUNT_ID;
     const archivePath = await writeLocalHubSpotProjectArchive(root, projectName, {
         sourceOnly: intermediateRepresentation !== undefined,
+        ...(prepared ? { expectedSourceFingerprint: prepared.sourceFingerprint } : {}),
     });
-    const client = await createDeployHubSpotDeveloperClient({
-        argv,
-        local,
-        allowedOperations: ['hubspot-project-upload'],
-        cwd: root,
-    });
+    const client = prepared
+        ? await prepared.createClient()
+        : await createDeployHubSpotDeveloperClient({
+            argv,
+            local,
+            allowedOperations: ['hubspot-project-upload'],
+            cwd: root,
+        });
     await client.projects.ensureProject({ projectName });
     const hsproject = await readHubSpotProjectConfig(root);
     const configuredPlatformVersion = typeof hsproject.platformVersion === 'string' ? hsproject.platformVersion : undefined;
     const upload = await client.projects.upload({
         projectName,
         archivePath,
-        message: resolveFlag(argv, '--message') ?? 'HS-X HubSpot-only deploy',
-        platformVersion: resolveFlag(argv, '--platform-version') ?? configuredPlatformVersion ?? '2026.03',
+        message: prepared?.buildMessage ?? resolveFlag(argv, '--message') ?? 'HS-X HubSpot-only deploy',
+        platformVersion: prepared?.platformVersion ??
+            resolveFlag(argv, '--platform-version') ??
+            configuredPlatformVersion ??
+            '2026.03',
         intermediateRepresentation,
+        skipAutoDeploy: uploadOnly,
     });
+    const timeoutMs = prepared?.buildTimeoutMs ?? Number(resolveFlag(argv, '--hubspot-build-timeout-ms') ?? '60000');
     const buildStatus = await waitForHubSpotBuildStatus({
         client,
         projectName,
         buildId: upload.buildId,
-        timeoutMs: Number(resolveFlag(argv, '--hubspot-build-timeout-ms') ?? '60000'),
+        timeoutMs,
         intervalMs: 1000,
     });
     const autoDeployEnabled = readBooleanProperty(buildStatus, 'isAutoDeployEnabled');
@@ -3704,7 +4275,7 @@ async function executeHubSpotOnlyUpload({ argv, root, local, uploadOnly, }) {
         const appId = readStatus(buildStatus) === 'SUCCESS'
             ? await optionalHubSpotAppId(client, projectName, appUid)
             : 0;
-        if (appId)
+        if (persistBinding && appId)
             await persistHubSpotAppBinding(root, {
                 appId,
                 projectName,
@@ -3713,10 +4284,17 @@ async function executeHubSpotOnlyUpload({ argv, root, local, uploadOnly, }) {
         // Build SUCCESS does NOT mean the app shipped: HubSpot's auto-deploy can
         // still fail (found live: "Apps are not allowed to have 0 redirect URLs"
         // failed deploy #4 while the CLI reported green). Verify the deploy too.
-        // Auto-deploy fires on uploads too — verify it regardless of uploadOnly
-        // (the f1-data 0-redirect failure rode exactly this path).
-        const autoDeployStatus = autoDeployEnabled && readStatus(buildStatus) === 'SUCCESS'
-            ? await waitForHubSpotAutoDeploy({ client, projectName, buildStatus })
+        // Normal uploads can auto-deploy; uploadOnly sends skipAutoDeploy and is
+        // therefore a strict build-only result.
+        const autoDeployExpected = !uploadOnly && autoDeployEnabled === true && readStatus(buildStatus) === 'SUCCESS';
+        const autoDeployStatus = autoDeployExpected
+            ? await waitForHubSpotAutoDeploy({
+                client,
+                projectName,
+                buildId: upload.buildId,
+                buildStatus,
+                timeoutMs,
+            })
             : undefined;
         return {
             projectName,
@@ -3729,27 +4307,37 @@ async function executeHubSpotOnlyUpload({ argv, root, local, uploadOnly, }) {
             buildStatus,
             deployStatus: autoDeployStatus,
             deploySkipped: Boolean(uploadOnly || autoDeployEnabled),
+            autoDeployExpected,
             local,
         };
     }
-    const deploy = await client.projects.deployBuild({
+    const deploy = await withTransientDeployRetry(() => client.projects.deployBuild({
         projectName,
         buildId: upload.buildId,
-        force: argv.includes('--force'),
+        force: prepared?.force ?? argv.includes('--force'),
+    }));
+    const deployResultType = readStringProperty(deploy, 'buildResultType');
+    if (deployResultType === 'DEPLOY_BLOCKED') {
+        throw new Error(describeBlockedHubSpotDeploy(deploy));
+    }
+    const deployId = readNumericProperty(deploy, 'deployId') ?? readNumericProperty(deploy, 'id');
+    if (deployId === undefined) {
+        throw new Error(`HubSpot returned ${deployResultType ?? 'an unrecognized response'} without a deploy id.`);
+    }
+    const deployStatus = await waitForHubSpotDeployStatus({
+        client,
+        projectName,
+        deployId,
+        timeoutMs,
     });
-    const deployId = readNumericProperty(deploy, 'deployId');
-    const deployStatus = deployId === undefined
-        ? deploy
-        : await client.projects.getDeployStatus({
+    const appId = await optionalHubSpotAppId(client, projectName, appUid);
+    if (persistBinding) {
+        await persistHubSpotAppBinding(root, {
+            appId,
             projectName,
-            deployId,
+            developerAccountId,
         });
-    const appId = await optionalHubSpotAppId(client, projectName, appUid);
-    await persistHubSpotAppBinding(root, {
-        appId,
-        projectName,
-        developerAccountId,
-    });
+    }
     return {
         projectName,
         archivePath,
@@ -3761,6 +4349,7 @@ async function executeHubSpotOnlyUpload({ argv, root, local, uploadOnly, }) {
         buildStatus,
         deployStatus,
         deploySkipped: false,
+        autoDeployExpected: false,
         local,
     };
 }
@@ -3778,20 +4367,26 @@ async function optionalHubSpotAppId(client, projectName, appUid) {
  * (deployStatusTaskLocator.id); absent/transient lookups resolve undefined —
  * the caller treats that as "could not verify", never as success.
  */
-async function waitForHubSpotAutoDeploy({ client, projectName, buildStatus, timeoutMs = 60_000, intervalMs = 2_000, }) {
-    const locator = buildStatus && typeof buildStatus === 'object'
-        ? buildStatus.deployStatusTaskLocator
-        : undefined;
-    const deployId = locator && typeof locator.id === 'number'
-        ? locator.id
-        : locator && typeof locator.id === 'string'
-            ? Number.parseInt(locator.id, 10)
-            : undefined;
-    if (deployId === undefined || Number.isNaN(deployId))
-        return undefined;
+async function waitForHubSpotAutoDeploy({ client, projectName, buildId, buildStatus, timeoutMs = 60_000, intervalMs = 2_000, }) {
     const deadline = Date.now() + timeoutMs;
+    let latestBuildStatus = buildStatus;
+    let deployId = readHubSpotDeployLocator(latestBuildStatus);
     let last;
     while (Date.now() < deadline) {
+        if (deployId === undefined) {
+            try {
+                latestBuildStatus = await client.projects.getBuildStatus({ projectName, buildId });
+                deployId = readHubSpotDeployLocator(latestBuildStatus);
+            }
+            catch {
+                // The build may be visible before its auto-deploy locator. Keep trying
+                // until the same bounded timeout instead of declaring success.
+            }
+            if (deployId === undefined) {
+                await sleep(intervalMs);
+                continue;
+            }
+        }
         try {
             last = await client.projects.getDeployStatus({ projectName, deployId });
         }
@@ -3799,13 +4394,47 @@ async function waitForHubSpotAutoDeploy({ client, projectName, buildStatus, time
             last = undefined;
         }
         const status = readStatus(last);
-        if (status && status !== 'PENDING' && status !== 'BUILDING' && status !== 'DEPLOYING') {
+        if (status && !isHubSpotDeployInProgress(status)) {
             return last;
         }
         await new Promise((resolve) => setTimeout(resolve, intervalMs));
     }
     return last;
 }
+async function waitForHubSpotDeployStatus({ client, projectName, deployId, timeoutMs, intervalMs = 1_000, }) {
+    const deadline = Date.now() + timeoutMs;
+    let latest;
+    do {
+        latest = await client.projects.getDeployStatus({ projectName, deployId });
+        const status = readStatus(latest);
+        if (status && !isHubSpotDeployInProgress(status))
+            return latest;
+        await sleep(intervalMs);
+    } while (Date.now() < deadline);
+    return latest;
+}
+function isHubSpotDeployInProgress(status) {
+    return new Set([
+        'PENDING',
+        'QUEUED',
+        'BUILDING',
+        'DEPLOYING',
+        'PROCESSING',
+        'STARTED',
+        'IN_PROGRESS',
+    ]).has(status.toUpperCase());
+}
+function readHubSpotDeployLocator(value) {
+    if (!isRecord(value) || !isRecord(value.deployStatusTaskLocator))
+        return undefined;
+    const id = value.deployStatusTaskLocator.id;
+    if (typeof id === 'number')
+        return id;
+    if (typeof id !== 'string')
+        return undefined;
+    const parsed = Number.parseInt(id, 10);
+    return Number.isNaN(parsed) ? undefined : parsed;
+}
 async function waitForHubSpotBuildStatus({ client, projectName, buildId, timeoutMs, intervalMs, }) {
     const startedAt = Date.now();
     let latest;
@@ -3822,38 +4451,6 @@ async function waitForHubSpotBuildStatus({ client, projectName, buildId, timeout
 function sleep(ms) {
     return new Promise((resolve) => setTimeout(resolve, ms));
 }
-async function writeLocalHubSpotProjectArchive(root, projectName, options = { sourceOnly: false }) {
-    const outDir = await mkdtemp(join(tmpdir(), 'hs-x-hubspot-project-'));
-    const archivePath = join(outDir, `${projectName.replace(/[^a-zA-Z0-9._-]+/g, '-')}-hubspot-project.zip`);
-    const stageDir = join(outDir, 'project');
-    await cp(root, stageDir, {
-        recursive: true,
-        filter(source) {
-            return (!source.includes(`${join(root, 'node_modules')}/`) &&
-                !source.includes(`${join(root, '.hs-x')}/`));
-        },
-    });
-    await patchHubSpotProjectName(stageDir, projectName);
-    await runZip(options.sourceOnly ? await hubSpotProjectSourceRoot(stageDir) : stageDir, archivePath);
-    return archivePath;
-}
-async function hubSpotProjectSourceRoot(root) {
-    const hsproject = await readHubSpotProjectConfig(root);
-    const srcDir = typeof hsproject.srcDir === 'string' ? hsproject.srcDir : 'src';
-    return join(root, srcDir);
-}
-async function patchHubSpotProjectName(root, projectName) {
-    const path = join(root, 'hsproject.json');
-    const raw = await readFile(path, 'utf8').catch(() => undefined);
-    if (!raw) {
-        return;
-    }
-    const parsed = JSON.parse(raw);
-    if (!isRecord(parsed)) {
-        return;
-    }
-    await writeFile(path, `${JSON.stringify({ ...parsed, name: projectName }, null, 2)}\n`);
-}
 async function readHubSpotProjectIntermediateRepresentation(root) {
     const hsproject = await readHubSpotProjectConfig(root);
     const srcDir = typeof hsproject.srcDir === 'string' ? hsproject.srcDir : 'src';
@@ -3964,30 +4561,40 @@ async function collectHubSpotMetaFiles(root) {
     await walk(root);
     return files.sort();
 }
-function runZip(root, archivePath) {
-    return new Promise((resolve, reject) => {
-        const child = spawn('zip', ['-qr', archivePath, '.', '-x', 'node_modules/*', '*/node_modules/*', '.hs-x/*'], {
-            cwd: root,
-            stdio: ['ignore', 'ignore', 'pipe'],
-        });
-        let stderr = '';
-        child.stderr?.setEncoding('utf8');
-        child.stderr?.on('data', (chunk) => {
-            stderr += chunk;
-        });
-        child.on('error', reject);
-        child.on('close', (code) => {
-            if (code === 0) {
-                resolve();
-            }
-            else {
-                reject(new Error(`Unable to create HubSpot project zip archive: ${stderr.trim()}`));
-            }
+function readNumericProperty(value, key) {
+    if (!isRecord(value))
+        return undefined;
+    const property = value[key];
+    if (typeof property === 'number')
+        return property;
+    if (typeof property !== 'string')
+        return undefined;
+    const parsed = Number.parseInt(property, 10);
+    return Number.isNaN(parsed) ? undefined : parsed;
+}
+function readStringProperty(value, key) {
+    return isRecord(value) && typeof value[key] === 'string' ? value[key] : undefined;
+}
+function describeBlockedHubSpotDeploy(value) {
+    if (!isRecord(value))
+        return 'HubSpot blocked the deploy.';
+    const candidates = [value.issues, value.blockingIssues, value.errors, value.message];
+    const details = candidates.flatMap((candidate) => {
+        if (typeof candidate === 'string')
+            return [candidate];
+        if (!Array.isArray(candidate))
+            return [];
+        return candidate.map((item) => {
+            if (typeof item === 'string')
+                return item;
+            if (!isRecord(item))
+                return String(item);
+            return String(item.message ?? item.reason ?? item.description ?? JSON.stringify(item));
         });
     });
-}
-function readNumericProperty(value, key) {
-    return isRecord(value) && typeof value[key] === 'number' ? value[key] : undefined;
+    return details.length > 0
+        ? `HubSpot blocked the deploy: ${details.join('; ')}`
+        : 'HubSpot blocked the deploy. Re-run with --force only after reviewing its removal warnings.';
 }
 function readBooleanProperty(value, key) {
     return isRecord(value) && typeof value[key] === 'boolean' ? value[key] : undefined;
@@ -4162,8 +4769,28 @@ async function requestHostedControlPlaneDeployPlan({ request, controlPlaneUrl, u
     return Schema.decodeUnknownSync(schemas.DeployPlanResponse)(body);
 }
 async function requestLocalControlPlaneDeployRecordAndMaybePromote({ request, plan, promoteWhenHealthy, revision, }) {
+    const localAttestationAuth = revision
+        ? { grantSecret: randomBytes(32).toString('base64url'), hubSpotAppId: 1 }
+        : undefined;
     const controlPlane = (await loadCreateControlPlane())({
         now: () => new Date('2026-05-18T14:00:00.000Z'),
+        ...(localAttestationAuth
+            ? {
+                secretsKv: {
+                    async get() {
+                        return JSON.stringify({
+                            accountId: request.accountId,
+                            projectId: request.projectId,
+                            environment: 'dev',
+                            hubSpotAppId: localAttestationAuth.hubSpotAppId,
+                            syncGrantSecret: localAttestationAuth.grantSecret,
+                            updatedAt: '2026-05-18T14:00:00.000Z',
+                        });
+                    },
+                    async put() { },
+                },
+            }
+            : {}),
     });
     const headers = {
         'content-type': 'application/json',
@@ -4200,20 +4827,37 @@ async function requestLocalControlPlaneDeployRecordAndMaybePromote({ request, pl
     if (!promoteWhenHealthy) {
         return { record };
     }
+    if (!localAttestationAuth || !revision) {
+        throw new Error('Local promotion requires a scoped runtime grant secret, HubSpot app id, and captured Cloudflare revision.');
+    }
+    const attestationBody = JSON.stringify({
+        manifestHash: plan.manifestHash,
+        bindingFingerprint: `bindings:${plan.deployId}`,
+        sdkVersion: CLI_VERSION,
+        taggedResourceCount: Math.max(1, plan.resources.workerNames.length),
+        hsXAccountId: request.accountId,
+        projectId: request.projectId,
+        environment: 'dev',
+        hubSpotAppId: localAttestationAuth.hubSpotAppId,
+        deployId: plan.deployId,
+        revisionId: revision.versionId,
+        timestamp: '2026-05-18T14:00:00.000Z',
+    });
+    const attestationGrant = await signDeploymentAttestationGrant({
+        secret: localAttestationAuth.grantSecret,
+        body: attestationBody,
+        accountId: request.accountId,
+        projectId: request.projectId,
+        environment: 'dev',
+        hubSpotAppId: localAttestationAuth.hubSpotAppId,
+        deployId: plan.deployId,
+        revisionId: revision.versionId,
+        now: new Date('2026-05-18T14:00:00.000Z'),
+    });
     const driftResponse = await controlPlane.fetch(new Request(`https://api.hs-x.dev/v1/projects/${request.projectId}/attestation`, {
         method: 'POST',
-        headers,
-        body: JSON.stringify({
-            manifestHash: plan.manifestHash,
-            bindingFingerprint: `bindings:${plan.deployId}`,
-            sdkVersion: CLI_VERSION,
-            taggedResourceCount: Math.max(1, plan.resources.workerNames.length),
-            hsXAccountId: request.accountId,
-            projectId: request.projectId,
-            environment: 'dev',
-            deployId: plan.deployId,
-            timestamp: '2026-05-18T14:00:00.000Z',
-        }),
+        headers: { ...headers, authorization: `Bearer ${attestationGrant}` },
+        body: attestationBody,
     }));
     const driftBody = await driftResponse.json();
     if (!driftResponse.ok) {
@@ -4693,8 +5337,12 @@ const deployOptions = {
     hubspotClientId: Options.text('hubspot-client-id').pipe(Options.optional), // --hubspot-client-id
     hubspotClientSecret: Options.text('hubspot-client-secret').pipe(Options.optional), // --hubspot-client-secret
     developerAccountId: Options.text('developer-account-id').pipe(Options.optional), // --developer-account-id
+    developerApiKey: Options.text('developer-api-key').pipe(Options.optional), // --developer-api-key
+    pak: Options.text('pak').pipe(Options.optional), // --pak
+    account: Options.text('account').pipe(Options.withAlias('a'), Options.optional), // --account / -a
+    config: Options.text('config').pipe(Options.withAlias('c'), Options.optional), // --config / -c
     hubspotBuildTimeoutMs: Options.text('hubspot-build-timeout-ms').pipe(Options.optional), // --hubspot-build-timeout-ms
-    message: Options.text('message').pipe(Options.optional), // --message
+    message: Options.text('message').pipe(Options.withAlias('m'), Options.optional), // --message / -m
     platformVersion: Options.text('platform-version').pipe(Options.optional), // --platform-version
     hubspotProjectName: Options.text('hubspot-project-name').pipe(Options.optional), // --hubspot-project-name
     // ── boolean flags (argv.includes) ──
@@ -4715,13 +5363,14 @@ const deployOptions = {
     applySchema: Options.boolean('apply-schema').pipe(Options.withDefault(false)), // --apply-schema
     heartbeat: Options.boolean('heartbeat').pipe(Options.withDefault(false)), // --heartbeat
     noHeartbeat: Options.boolean('no-heartbeat').pipe(Options.withDefault(false)), // --no-heartbeat
+    useEnv: Options.boolean('use-env').pipe(Options.withDefault(false)), // --use-env
     // Declared explicitly: without it @effect/cli treats `--no-record` as the
     // negation of an undeclared `record` boolean and fails routing with a
     // confusing root-level "Invalid subcommand" error (the flag is documented).
     noRecord: Options.boolean('no-record').pipe(Options.withDefault(false)), // --no-record
     portalSchemaLive: Options.boolean('portal-schema-live').pipe(Options.withDefault(false)), // --portal-schema-live
     localHubspotSchema: Options.boolean('local-hubspot-schema').pipe(Options.withDefault(false)), // --local-hubspot-schema
-    force: Options.boolean('force').pipe(Options.withDefault(false)), // --force
+    force: Options.boolean('force').pipe(Options.withAlias('f'), Options.withDefault(false)), // --force / -f
     yes: Options.boolean('yes').pipe(Options.withAlias('y'), Options.withDefault(false)), // --yes / -y
 };
 const deployBaseCmd = Command.make('deploy', deployOptions, (opts) => runHandler('deploy', { json: opts.json }, Effect.gen(function* () {
@@ -4753,6 +5402,10 @@ const deployBaseCmd = Command.make('deploy', deployOptions, (opts) => runHandler
     push('--hubspot-client-id', opts.hubspotClientId);
     push('--hubspot-client-secret', opts.hubspotClientSecret);
     push('--developer-account-id', opts.developerAccountId);
+    push('--developer-api-key', opts.developerApiKey);
+    push('--pak', opts.pak);
+    push('--account', opts.account);
+    push('--config', opts.config);
     push('--hubspot-build-timeout-ms', opts.hubspotBuildTimeoutMs);
     push('--message', opts.message);
     push('--platform-version', opts.platformVersion);
@@ -4774,6 +5427,7 @@ const deployBaseCmd = Command.make('deploy', deployOptions, (opts) => runHandler
     flag('--apply-schema', opts.applySchema);
     flag('--heartbeat', opts.heartbeat);
     flag('--no-heartbeat', opts.noHeartbeat);
+    flag('--use-env', opts.useEnv);
     flag('--no-record', opts.noRecord);
     flag('--portal-schema-live', opts.portalSchemaLive);
     flag('--local-hubspot-schema', opts.localHubspotSchema);