@hs-x/cli 0.3.7 → 0.4.0

package/dist/commands/deploy.js

@@ -1,8 +1,7 @@
 import { spawn } from 'node:child_process';
 import { createHash, randomBytes } from 'node:crypto';
-import { cp, lstat, mkdir, mkdtemp, readFile, readdir, realpath, rename, rmdir, stat, unlink, writeFile, } from 'node:fs/promises';
+import { lstat, mkdir, readFile, readdir, realpath, rename, rmdir, stat, unlink, writeFile, } from 'node:fs/promises';
 import { createServer } from 'node:http';
-import { tmpdir } from 'node:os';
 import { basename, dirname, isAbsolute, join, relative, resolve } from 'node:path';
 import { pathToFileURL } from 'node:url';
 import * as Command from '@effect/cli/Command';
@@ -25,7 +24,9 @@ import { createControlPlaneTenantProvisioningAuthority, } from '../control-plane
 import { captureDeployRevision } from '../deploy-revision-capture.js';
 import { resolveDeployTargets } from '../deploy-targets.js';
 import { executeCliHttp } from '../effect-http.js';
-import { createDeployHubSpotDeveloperClient } from '../hubspot-developer-client.js';
+import { DirectHubSpotAccountResolutionError, createDeployHubSpotDeveloperClient, resolveDirectHubSpotContext, } from '../hubspot-developer-client.js';
+import { HubSpotProjectArchiveSourceError, fingerprintHubSpotArchiveSource, writeLocalHubSpotProjectArchive, } from '../hubspot-project-archive.js';
+import { detectLocalProjectMode, readHubSpotProjectDescriptor, validateHubSpotProject, } from '../hubspot-project.js';
 import { hydrateAncestorEnv } from '../load-env.js';
 import { LocalProjectPickerCancelled, resolveLocalProject } from '../local-project-picker.js';
 import { getMachineId, getMachineSecret, previewMachineId } from '../machine-id.js';
@@ -541,6 +542,447 @@ function workerSourceSummaries(workers) {
 function workerSyncSchemaModes(workers) {
     return workers.flatMap((worker) => worker.capabilities.flatMap((capability) => capability.kind === 'sync' ? [`${capability.id}: ${capability.manageSchema ?? false}`] : []));
 }
+function includesCliFlag(argv, flag) {
+    return argv.some((argument) => argument === flag || argument.startsWith(`${flag}=`));
+}
+function directDeployAccountView(account) {
+    return {
+        id: account.id,
+        ...(account.name ? { name: account.name } : {}),
+        source: account.source,
+        selectedBy: account.selectedBy,
+        authReady: account.authReady,
+        ...(account.configSource ? { configSource: account.configSource } : {}),
+    };
+}
+function directDeployAccountLabel(account) {
+    if (!account)
+        return 'unresolved HubSpot account';
+    return account.name ? `${account.name} (${account.id})` : account.id;
+}
+function directDeployAccountFailure(cause) {
+    if (cause instanceof DirectHubSpotAccountResolutionError) {
+        const suffix = ` ${cause.hint}`;
+        return {
+            reasonCode: cause.code,
+            message: cause.message.endsWith(suffix)
+                ? cause.message.slice(0, -suffix.length)
+                : cause.message,
+            hint: cause.hint,
+        };
+    }
+    return {
+        reasonCode: 'HSX_E_DIRECT_HUBSPOT_ACCOUNT_CONFIG',
+        message: cause instanceof Error ? cause.message : String(cause),
+        hint: 'Fix the HubSpot CLI account configuration and retry.',
+    };
+}
+function describeHubSpotDeployFailure(cause) {
+    const record = isRecord(cause) ? cause : undefined;
+    const data = isRecord(record?.data) ? record.data : undefined;
+    const body = isRecord(record?.body) ? record.body : undefined;
+    const validationErrors = Array.isArray(record?.validationErrors)
+        ? record.validationErrors.filter((item) => typeof item === 'string')
+        : [];
+    const values = [
+        cause instanceof Error ? cause.message : String(cause),
+        typeof record?.status === 'number' ? `HTTP ${record.status}` : undefined,
+        typeof data?.message === 'string' ? data.message : undefined,
+        typeof body?.message === 'string' ? body.message : undefined,
+        typeof record?.category === 'string' ? record.category : undefined,
+        typeof data?.category === 'string' ? data.category : undefined,
+        ...validationErrors,
+        typeof record?.correlationId === 'string'
+            ? `correlation ${record.correlationId}`
+            : typeof data?.correlationId === 'string'
+                ? `correlation ${data.correlationId}`
+                : typeof body?.correlationId === 'string'
+                    ? `correlation ${body.correlationId}`
+                    : undefined,
+    ].filter((value) => Boolean(value));
+    return [...new Set(values)].join(' · ');
+}
+function directDeployDoneMessage(upload) {
+    if (upload.deploySkipped && !upload.autoDeployExpected) {
+        return 'Uploaded and built in HubSpot; deployment skipped';
+    }
+    if (upload.autoDeployExpected)
+        return 'Uploaded, built, and auto-deployed in HubSpot';
+    return 'Uploaded, built, and deployed in HubSpot';
+}
+async function hubSpotDirectDeployCommand(input) {
+    try {
+        return await executeHubSpotDirectDeployCommand(input);
+    }
+    catch (cause) {
+        if (!(cause instanceof HubSpotProjectArchiveSourceError))
+            throw cause;
+        return inputValidationError({
+            argv: input.argv,
+            command: 'deploy',
+            json: input.json,
+            code: cause.code,
+            message: cause.message,
+            hint: cause.hint,
+            detail: 'No archive was retained and no upload or deploy request was made.',
+        });
+    }
+}
+async function executeHubSpotDirectDeployCommand({ argv, root, json, }) {
+    const reporter = createReporter({ command: 'deploy', argv, entry: !json });
+    const machineOutput = json || reporter.mode === 'ndjson';
+    const unsupported = [
+        '--account-id',
+        '--project-id',
+        '--control-plane-url',
+        '--build-only',
+        '--cloudflare-deploy',
+        '--cloudflare-dry-run',
+        '--local-control-plane',
+        '--record-local',
+        '--promote-when-healthy',
+        '--no-record',
+        '--heartbeat',
+        '--no-heartbeat',
+        '--apply-schema',
+        '--portal-schema-live',
+        '--portal-schema-fixture',
+        '--local-hubspot-schema',
+    ].find((flag) => includesCliFlag(argv, flag));
+    if (unsupported) {
+        return inputValidationError({
+            argv,
+            command: 'deploy',
+            json,
+            code: 'HSX_E_INPUT_INVALID',
+            message: `${unsupported} is an HS-X project feature.`,
+            hint: 'Remove the flag to deploy this native HubSpot project directly to HubSpot.',
+            detail: 'HubSpot-direct mode never contacts the HS-X control plane or Cloudflare.',
+        });
+    }
+    const preparationFingerprint = await fingerprintHubSpotArchiveSource(root, false);
+    const [descriptor, validation, projectName, intermediateRepresentation] = await Promise.all([
+        readHubSpotProjectDescriptor(root),
+        validateHubSpotProject({ root }),
+        resolveHubSpotProjectName(argv, root),
+        readHubSpotProjectIntermediateRepresentation(root),
+    ]);
+    const appUid = readAppUidFromIntermediateRepresentation(intermediateRepresentation) ??
+        (await readAppUidFromProjectSource(root));
+    const sourceFingerprint = validation.ok
+        ? await fingerprintHubSpotArchiveSource(root, intermediateRepresentation !== undefined)
+        : preparationFingerprint;
+    // Enclose every source-derived preparation read (validation, descriptor,
+    // IR, app uid, and scoped fingerprint) in one full-tree stability check.
+    // A later edit is still caught against sourceFingerprint in the staged copy.
+    if ((await fingerprintHubSpotArchiveSource(root, false)) !== preparationFingerprint) {
+        return inputValidationError({
+            argv,
+            command: 'deploy',
+            json,
+            code: 'HSX_E_INPUT_INVALID',
+            message: 'HubSpot project sources changed while preparing the deploy plan.',
+            hint: 'Wait for local edits or generators to settle, then review a fresh plan.',
+            detail: 'No upload or deploy request was made.',
+        });
+    }
+    const uploadOnly = argv.includes('--hubspot-upload-only') || argv.includes('--skip-deploy');
+    const planOnly = argv.includes('--plan') || argv.includes('--dry-run');
+    const localHubSpotAdapter = argv.includes('--local-hubspot-upload');
+    const platformVersion = resolveFlag(argv, '--platform-version') ?? descriptor.platformVersion ?? '2026.03';
+    const buildMessage = resolveFlag(argv, '--message') ?? 'HS-X HubSpot-direct deploy';
+    const buildTimeoutMs = Number(resolveFlag(argv, '--hubspot-build-timeout-ms') ?? '60000');
+    const force = argv.includes('--force');
+    let account;
+    let accountFailure;
+    let preparedUpload;
+    if (localHubSpotAdapter) {
+        account = {
+            id: resolveFlag(argv, '--developer-account-id') ?? 'local',
+            name: 'local HubSpot adapter',
+            source: 'local-adapter',
+            selectedBy: 'local-adapter',
+            authReady: true,
+        };
+        preparedUpload = {
+            projectName,
+            intermediateRepresentation,
+            appUid,
+            developerAccountId: resolveFlag(argv, '--developer-account-id') ?? process.env.HSX_HUBSPOT_DEVELOPER_ACCOUNT_ID,
+            platformVersion,
+            buildMessage,
+            buildTimeoutMs,
+            force,
+            sourceFingerprint,
+            createClient: () => createDeployHubSpotDeveloperClient({
+                argv,
+                local: true,
+                allowedOperations: ['hubspot-project-upload'],
+                cwd: root,
+            }),
+        };
+    }
+    else {
+        try {
+            const context = await resolveDirectHubSpotContext({ argv, cwd: root });
+            account = directDeployAccountView(context.account);
+            if (!account.authReady) {
+                accountFailure = {
+                    reasonCode: 'HSX_E_DIRECT_HUBSPOT_AUTH_REQUIRED',
+                    message: `HubSpot account ${directDeployAccountLabel(account)} does not have deploy authentication available.`,
+                    hint: 'Run `hs account auth` for that account, or pass --pak for this run.',
+                };
+            }
+            else {
+                preparedUpload = {
+                    projectName,
+                    intermediateRepresentation,
+                    appUid,
+                    developerAccountId: context.account.id,
+                    platformVersion,
+                    buildMessage,
+                    buildTimeoutMs,
+                    force,
+                    sourceFingerprint,
+                    createClient: async () => context.createClient(),
+                };
+            }
+        }
+        catch (cause) {
+            accountFailure = directDeployAccountFailure(cause);
+        }
+    }
+    const ready = validation.ok &&
+        account !== undefined &&
+        accountFailure === undefined &&
+        preparedUpload !== undefined;
+    const plan = {
+        schema_version: 1,
+        ok: ready,
+        command: 'deploy',
+        mode: 'hubspot-direct',
+        root,
+        project: {
+            name: projectName,
+            ...(projectName !== descriptor.name ? { configuredName: descriptor.name } : {}),
+            platformVersion,
+            srcDir: descriptor.srcDir,
+            sourceFingerprint,
+            ...(descriptor.appUid ? { appUid: descriptor.appUid } : {}),
+        },
+        account: account
+            ? { ...account, ...(accountFailure ? { error: accountFailure } : {}) }
+            : {
+                authReady: false,
+                error: accountFailure,
+            },
+        targets: { hubspot: true, cloudflare: false, controlPlane: false },
+        action: uploadOnly ? 'upload-and-build' : 'upload-build-and-deploy',
+        options: {
+            force,
+            buildMessage,
+            buildTimeoutMs,
+            skipAutoDeploy: uploadOnly,
+        },
+        validation,
+    };
+    const rows = [
+        { key: 'mode', value: 'HubSpot direct' },
+        { key: 'source', value: root },
+        { key: 'project', value: projectName },
+        ...(account
+            ? [
+                {
+                    key: 'account',
+                    value: directDeployAccountLabel(account),
+                    status: account.authReady ? 'ok' : 'fail',
+                    detail: account.configSource ?? account.selectedBy,
+                    ...(account.authReady
+                        ? {}
+                        : { hint: 'Run `hs account auth` for this account, then retry.' }),
+                },
+            ]
+            : [
+                {
+                    key: 'account',
+                    value: 'not ready',
+                    status: 'fail',
+                    ...(accountFailure?.reasonCode ? { detail: accountFailure.reasonCode } : {}),
+                    ...(accountFailure?.hint ? { hint: accountFailure.hint } : {}),
+                },
+            ]),
+        { key: 'platform', value: platformVersion },
+        { key: 'build message', value: buildMessage },
+        { key: 'build timeout', value: `${buildTimeoutMs}ms` },
+        {
+            key: 'HubSpot',
+            value: uploadOnly ? 'upload + build only' : 'upload + build + deploy',
+            status: 'ok',
+        },
+        { key: 'auto-deploy', value: uploadOnly ? 'explicitly skipped' : 'project setting' },
+        { key: 'force', value: force ? 'yes' : 'no', ...(force ? { status: 'warn' } : {}) },
+        { key: 'Cloudflare', value: 'not used' },
+        { key: 'HS-X control plane', value: 'not used' },
+        {
+            key: 'validation',
+            value: validation.ok ? 'pass' : 'fail',
+            status: validation.ok ? 'ok' : 'fail',
+        },
+        ...validation.diagnostics.map((diagnostic) => ({
+            key: diagnostic.code,
+            value: diagnostic.message,
+            status: diagnostic.severity === 'error' ? 'fail' : 'warn',
+            ...(diagnostic.file ? { detail: diagnostic.file } : {}),
+        })),
+    ];
+    if (planOnly || !ready) {
+        if (json) {
+            write(`${JSON.stringify(plan, null, 2)}\n`);
+        }
+        else if (reporter.mode === 'ndjson') {
+            reporter.data(plan);
+            reporter.done(ready ? 'Plan ready' : 'Plan not ready', ready ? 0 : 10);
+        }
+        else {
+            reporter.header(projectName);
+            reporter.rows(rows);
+            reporter.done(ready ? 'Plan ready' : 'Plan not ready', ready ? 0 : 10);
+        }
+        return { exitCode: ready ? 0 : validation.ok ? 10 : 1 };
+    }
+    const summary = [
+        'HubSpot-direct deploy plan',
+        `Project: ${projectName}`,
+        `Account: ${directDeployAccountLabel(account)}`,
+        `Source: ${root}`,
+        `Action: ${uploadOnly ? 'upload and build only (skip auto-deploy)' : 'upload, wait for build, and deploy'}`,
+        `Platform: ${platformVersion}`,
+        `Force: ${force ? 'yes' : 'no'}`,
+        `Build message: ${buildMessage}`,
+        `Build timeout: ${buildTimeoutMs}ms`,
+        'Cloudflare: not used',
+        'HS-X control plane: not used',
+    ].join('\n');
+    // MutationConsent requires the exact read-only preview to be visible before
+    // it asks. In machine modes the same plan is available via --plan; --yes is
+    // mandatory and no interactive output is emitted.
+    if (!machineOutput) {
+        reporter.header(projectName);
+        reporter.rows(rows);
+    }
+    const consent = await requestMutationConsent({
+        yes: argv.includes('--yes') || argv.includes('-y'),
+        machineOutput,
+        interactive: isInteractive(),
+        message: `Deploy ${projectName} to ${directDeployAccountLabel(account)}?`,
+        confirm: promptConfirm,
+    });
+    if (consent === 'require-yes') {
+        return inputValidationError({
+            argv,
+            command: 'deploy',
+            json,
+            code: 'HSX_E_INPUT_INVALID',
+            message: 'Deploy requires explicit consent in machine or non-interactive mode.',
+            hint: 'Review with `hs-x deploy --plan`, then re-run with --yes.',
+            detail: summary,
+        });
+    }
+    if (consent === 'cancelled')
+        return cancelledResult(argv, 'deploy');
+    if (!preparedUpload) {
+        return inputValidationError({
+            argv,
+            command: 'deploy',
+            json,
+            code: 'HSX_E_DIRECT_HUBSPOT_ACCOUNT_CONFIG',
+            message: 'The HubSpot deploy target changed while preparing the execution plan.',
+            hint: 'Review a fresh plan and retry.',
+            detail: 'No upload or deploy request was made.',
+        });
+    }
+    try {
+        const step = machineOutput ? undefined : reporter.step('Uploading to HubSpot');
+        const uploaded = await executeHubSpotOnlyUpload({
+            argv,
+            root,
+            local: localHubSpotAdapter,
+            persistBinding: false,
+            uploadOnly,
+            prepared: preparedUpload,
+        });
+        const buildState = readStatus(uploaded.buildStatus) ?? 'UNKNOWN';
+        const deployState = uploaded.deployStatus
+            ? (readStatus(uploaded.deployStatus) ?? 'UNKNOWN')
+            : undefined;
+        const deployUnverified = uploaded.autoDeployExpected && deployState === undefined;
+        const ok = buildState === 'SUCCESS' && !deployUnverified && (!deployState || deployState === 'SUCCESS');
+        step?.[ok ? 'ok' : 'fail'](`build #${uploaded.buildId} ${buildState}${deployState ? ` · deploy ${deployState}` : deployUnverified ? ' · deploy unverified' : ''}`);
+        const result = {
+            schema_version: 1,
+            ok,
+            command: 'deploy',
+            mode: 'hubspot-direct',
+            account,
+            projectName: uploaded.projectName,
+            appId: uploaded.appId || undefined,
+            buildId: uploaded.buildId,
+            buildStatus: buildState,
+            ...(uploaded.deployId !== undefined ? { deployId: uploaded.deployId } : {}),
+            ...(deployState ? { deployStatus: deployState } : {}),
+            deploySkipped: uploaded.deploySkipped,
+            deployVerification: deployUnverified ? 'unverified' : deployState ? 'verified' : 'skipped',
+            controlPlaneUsed: false,
+            cloudflareUsed: false,
+        };
+        if (json) {
+            write(`${JSON.stringify(result, null, 2)}\n`);
+        }
+        else if (reporter.mode === 'ndjson') {
+            reporter.data(result);
+            reporter.done(ok ? directDeployDoneMessage(uploaded) : 'HubSpot deploy failed', ok ? 0 : 1);
+        }
+        else {
+            streamHubSpotUploadOutcome(reporter, uploaded);
+            if (deployUnverified) {
+                reporter.error('HSX_E_DEPLOY_HUBSPOT', 'HubSpot auto-deploy could not be verified before the timeout.', { hint: 'Check the project deploy status in HubSpot, then retry if it did not ship.' });
+            }
+            reporter.done(ok ? directDeployDoneMessage(uploaded) : 'HubSpot deploy failed', ok ? 0 : 1);
+        }
+        return { exitCode: ok ? 0 : 1 };
+    }
+    catch (cause) {
+        if (cause instanceof HubSpotProjectArchiveSourceError)
+            throw cause;
+        const code = cause instanceof DirectHubSpotAccountResolutionError
+            ? 'HSX_E_DEPLOY_HUBSPOT_AUTH'
+            : 'HSX_E_DEPLOY_HUBSPOT';
+        const message = describeHubSpotDeployFailure(cause);
+        const hint = cause instanceof DirectHubSpotAccountResolutionError
+            ? cause.hint
+            : 'Review the HubSpot status and correlation id above, fix the reported issue, and retry.';
+        if (json) {
+            write(`${JSON.stringify({
+                schema_version: 1,
+                command: 'deploy',
+                ok: false,
+                error: { code, message, hint },
+            }, null, 2)}\n`);
+        }
+        else if (reporter.mode === 'ndjson') {
+            reporter.error(code, message, { hint });
+            reporter.done('HubSpot deploy failed', 1);
+        }
+        else {
+            reporter.error(code, message, {
+                hint,
+                docs_url: `https://hs-x.dev/errors/${code}`,
+            });
+            reporter.done('HubSpot deploy failed', 1);
+        }
+        return { exitCode: 1 };
+    }
+}
 export async function deployCommand({ argv, root, json, }) {
     // Stamp the whole invocation up front: the human summary reporter is created
     // late (render time), so without this "Deployed … in 1ms" measured only the
@@ -567,6 +1009,9 @@ export async function deployCommand({ argv, root, json, }) {
             throw error;
         }
     }
+    if ((await detectLocalProjectMode(root)) === 'hubspot-direct') {
+        return hubSpotDirectDeployCommand({ argv, root, json });
+    }
     // bun only auto-loads .env/.env.local from the CWD; when deploying from a
     // nested app dir, pull in a repo-root .env.local (CLOUDFLARE_ACCOUNT_ID, etc.)
     // so the deploy doesn't fail for vars that are set at the root.
@@ -3773,44 +4218,56 @@ function runCloudflareCommand(command, options) {
         },
     })));
 }
-async function executeHubSpotOnlyUpload({ argv, root, local, uploadOnly, }) {
+async function executeHubSpotOnlyUpload({ argv, root, local, persistBinding = true, uploadOnly, prepared, }) {
     // The HubSpot project name must match the name baked into the generated
     // bundle (hsproject.json + app-hsmeta uid), not the on-disk directory name.
     // Using basename(root) breaks when the project lives in a generic dir (e.g.
     // `app/`): the upload targets a project named "app" while the bundle declares
     // the real project id, and HubSpot rejects the mismatch with an opaque 400.
-    const projectName = await resolveHubSpotProjectName(argv, root);
-    const intermediateRepresentation = await readHubSpotProjectIntermediateRepresentation(root);
-    const appUid = readAppUidFromIntermediateRepresentation(intermediateRepresentation) ??
+    const projectName = prepared?.projectName ?? (await resolveHubSpotProjectName(argv, root));
+    const intermediateRepresentation = prepared?.intermediateRepresentation ??
+        (await readHubSpotProjectIntermediateRepresentation(root));
+    const appUid = prepared?.appUid ??
+        readAppUidFromIntermediateRepresentation(intermediateRepresentation) ??
         (await readAppUidFromProjectSource(root));
     // For the post-deploy app Auth URL (unlinked installs). Resolved from
     // flag/env here so the URL is correct on the unlinked path; on a
     // control-plane lease path it stays undefined and the URL is skipped.
-    const developerAccountId = resolveFlag(argv, '--developer-account-id') ?? process.env.HSX_HUBSPOT_DEVELOPER_ACCOUNT_ID;
+    const developerAccountId = prepared?.developerAccountId ??
+        resolveFlag(argv, '--developer-account-id') ??
+        process.env.HSX_HUBSPOT_DEVELOPER_ACCOUNT_ID;
     const archivePath = await writeLocalHubSpotProjectArchive(root, projectName, {
         sourceOnly: intermediateRepresentation !== undefined,
+        ...(prepared ? { expectedSourceFingerprint: prepared.sourceFingerprint } : {}),
     });
-    const client = await createDeployHubSpotDeveloperClient({
-        argv,
-        local,
-        allowedOperations: ['hubspot-project-upload'],
-        cwd: root,
-    });
+    const client = prepared
+        ? await prepared.createClient()
+        : await createDeployHubSpotDeveloperClient({
+            argv,
+            local,
+            allowedOperations: ['hubspot-project-upload'],
+            cwd: root,
+        });
     await client.projects.ensureProject({ projectName });
     const hsproject = await readHubSpotProjectConfig(root);
     const configuredPlatformVersion = typeof hsproject.platformVersion === 'string' ? hsproject.platformVersion : undefined;
     const upload = await client.projects.upload({
         projectName,
         archivePath,
-        message: resolveFlag(argv, '--message') ?? 'HS-X HubSpot-only deploy',
-        platformVersion: resolveFlag(argv, '--platform-version') ?? configuredPlatformVersion ?? '2026.03',
+        message: prepared?.buildMessage ?? resolveFlag(argv, '--message') ?? 'HS-X HubSpot-only deploy',
+        platformVersion: prepared?.platformVersion ??
+            resolveFlag(argv, '--platform-version') ??
+            configuredPlatformVersion ??
+            '2026.03',
         intermediateRepresentation,
+        skipAutoDeploy: uploadOnly,
     });
+    const timeoutMs = prepared?.buildTimeoutMs ?? Number(resolveFlag(argv, '--hubspot-build-timeout-ms') ?? '60000');
     const buildStatus = await waitForHubSpotBuildStatus({
         client,
         projectName,
         buildId: upload.buildId,
-        timeoutMs: Number(resolveFlag(argv, '--hubspot-build-timeout-ms') ?? '60000'),
+        timeoutMs,
         intervalMs: 1000,
     });
     const autoDeployEnabled = readBooleanProperty(buildStatus, 'isAutoDeployEnabled');
@@ -3818,7 +4275,7 @@ async function executeHubSpotOnlyUpload({ argv, root, local, uploadOnly, }) {
         const appId = readStatus(buildStatus) === 'SUCCESS'
             ? await optionalHubSpotAppId(client, projectName, appUid)
             : 0;
-        if (appId)
+        if (persistBinding && appId)
             await persistHubSpotAppBinding(root, {
                 appId,
                 projectName,
@@ -3827,10 +4284,17 @@ async function executeHubSpotOnlyUpload({ argv, root, local, uploadOnly, }) {
         // Build SUCCESS does NOT mean the app shipped: HubSpot's auto-deploy can
         // still fail (found live: "Apps are not allowed to have 0 redirect URLs"
         // failed deploy #4 while the CLI reported green). Verify the deploy too.
-        // Auto-deploy fires on uploads too — verify it regardless of uploadOnly
-        // (the f1-data 0-redirect failure rode exactly this path).
-        const autoDeployStatus = autoDeployEnabled && readStatus(buildStatus) === 'SUCCESS'
-            ? await waitForHubSpotAutoDeploy({ client, projectName, buildStatus })
+        // Normal uploads can auto-deploy; uploadOnly sends skipAutoDeploy and is
+        // therefore a strict build-only result.
+        const autoDeployExpected = !uploadOnly && autoDeployEnabled === true && readStatus(buildStatus) === 'SUCCESS';
+        const autoDeployStatus = autoDeployExpected
+            ? await waitForHubSpotAutoDeploy({
+                client,
+                projectName,
+                buildId: upload.buildId,
+                buildStatus,
+                timeoutMs,
+            })
             : undefined;
         return {
             projectName,
@@ -3843,27 +4307,37 @@ async function executeHubSpotOnlyUpload({ argv, root, local, uploadOnly, }) {
             buildStatus,
             deployStatus: autoDeployStatus,
             deploySkipped: Boolean(uploadOnly || autoDeployEnabled),
+            autoDeployExpected,
             local,
         };
     }
     const deploy = await withTransientDeployRetry(() => client.projects.deployBuild({
         projectName,
         buildId: upload.buildId,
-        force: argv.includes('--force'),
+        force: prepared?.force ?? argv.includes('--force'),
     }));
-    const deployId = readNumericProperty(deploy, 'deployId');
-    const deployStatus = deployId === undefined
-        ? deploy
-        : await client.projects.getDeployStatus({
-            projectName,
-            deployId,
-        });
-    const appId = await optionalHubSpotAppId(client, projectName, appUid);
-    await persistHubSpotAppBinding(root, {
-        appId,
+    const deployResultType = readStringProperty(deploy, 'buildResultType');
+    if (deployResultType === 'DEPLOY_BLOCKED') {
+        throw new Error(describeBlockedHubSpotDeploy(deploy));
+    }
+    const deployId = readNumericProperty(deploy, 'deployId') ?? readNumericProperty(deploy, 'id');
+    if (deployId === undefined) {
+        throw new Error(`HubSpot returned ${deployResultType ?? 'an unrecognized response'} without a deploy id.`);
+    }
+    const deployStatus = await waitForHubSpotDeployStatus({
+        client,
         projectName,
-        developerAccountId,
+        deployId,
+        timeoutMs,
     });
+    const appId = await optionalHubSpotAppId(client, projectName, appUid);
+    if (persistBinding) {
+        await persistHubSpotAppBinding(root, {
+            appId,
+            projectName,
+            developerAccountId,
+        });
+    }
     return {
         projectName,
         archivePath,
@@ -3875,6 +4349,7 @@ async function executeHubSpotOnlyUpload({ argv, root, local, uploadOnly, }) {
         buildStatus,
         deployStatus,
         deploySkipped: false,
+        autoDeployExpected: false,
         local,
     };
 }
@@ -3892,20 +4367,26 @@ async function optionalHubSpotAppId(client, projectName, appUid) {
  * (deployStatusTaskLocator.id); absent/transient lookups resolve undefined —
  * the caller treats that as "could not verify", never as success.
  */
-async function waitForHubSpotAutoDeploy({ client, projectName, buildStatus, timeoutMs = 60_000, intervalMs = 2_000, }) {
-    const locator = buildStatus && typeof buildStatus === 'object'
-        ? buildStatus.deployStatusTaskLocator
-        : undefined;
-    const deployId = locator && typeof locator.id === 'number'
-        ? locator.id
-        : locator && typeof locator.id === 'string'
-            ? Number.parseInt(locator.id, 10)
-            : undefined;
-    if (deployId === undefined || Number.isNaN(deployId))
-        return undefined;
+async function waitForHubSpotAutoDeploy({ client, projectName, buildId, buildStatus, timeoutMs = 60_000, intervalMs = 2_000, }) {
     const deadline = Date.now() + timeoutMs;
+    let latestBuildStatus = buildStatus;
+    let deployId = readHubSpotDeployLocator(latestBuildStatus);
     let last;
     while (Date.now() < deadline) {
+        if (deployId === undefined) {
+            try {
+                latestBuildStatus = await client.projects.getBuildStatus({ projectName, buildId });
+                deployId = readHubSpotDeployLocator(latestBuildStatus);
+            }
+            catch {
+                // The build may be visible before its auto-deploy locator. Keep trying
+                // until the same bounded timeout instead of declaring success.
+            }
+            if (deployId === undefined) {
+                await sleep(intervalMs);
+                continue;
+            }
+        }
         try {
             last = await client.projects.getDeployStatus({ projectName, deployId });
         }
@@ -3913,13 +4394,47 @@ async function waitForHubSpotAutoDeploy({ client, projectName, buildStatus, time
             last = undefined;
         }
         const status = readStatus(last);
-        if (status && status !== 'PENDING' && status !== 'BUILDING' && status !== 'DEPLOYING') {
+        if (status && !isHubSpotDeployInProgress(status)) {
             return last;
         }
         await new Promise((resolve) => setTimeout(resolve, intervalMs));
     }
     return last;
 }
+async function waitForHubSpotDeployStatus({ client, projectName, deployId, timeoutMs, intervalMs = 1_000, }) {
+    const deadline = Date.now() + timeoutMs;
+    let latest;
+    do {
+        latest = await client.projects.getDeployStatus({ projectName, deployId });
+        const status = readStatus(latest);
+        if (status && !isHubSpotDeployInProgress(status))
+            return latest;
+        await sleep(intervalMs);
+    } while (Date.now() < deadline);
+    return latest;
+}
+function isHubSpotDeployInProgress(status) {
+    return new Set([
+        'PENDING',
+        'QUEUED',
+        'BUILDING',
+        'DEPLOYING',
+        'PROCESSING',
+        'STARTED',
+        'IN_PROGRESS',
+    ]).has(status.toUpperCase());
+}
+function readHubSpotDeployLocator(value) {
+    if (!isRecord(value) || !isRecord(value.deployStatusTaskLocator))
+        return undefined;
+    const id = value.deployStatusTaskLocator.id;
+    if (typeof id === 'number')
+        return id;
+    if (typeof id !== 'string')
+        return undefined;
+    const parsed = Number.parseInt(id, 10);
+    return Number.isNaN(parsed) ? undefined : parsed;
+}
 async function waitForHubSpotBuildStatus({ client, projectName, buildId, timeoutMs, intervalMs, }) {
     const startedAt = Date.now();
     let latest;
@@ -3936,38 +4451,6 @@ async function waitForHubSpotBuildStatus({ client, projectName, buildId, timeout
 function sleep(ms) {
     return new Promise((resolve) => setTimeout(resolve, ms));
 }
-async function writeLocalHubSpotProjectArchive(root, projectName, options = { sourceOnly: false }) {
-    const outDir = await mkdtemp(join(tmpdir(), 'hs-x-hubspot-project-'));
-    const archivePath = join(outDir, `${projectName.replace(/[^a-zA-Z0-9._-]+/g, '-')}-hubspot-project.zip`);
-    const stageDir = join(outDir, 'project');
-    await cp(root, stageDir, {
-        recursive: true,
-        filter(source) {
-            return (!source.includes(`${join(root, 'node_modules')}/`) &&
-                !source.includes(`${join(root, '.hs-x')}/`));
-        },
-    });
-    await patchHubSpotProjectName(stageDir, projectName);
-    await runZip(options.sourceOnly ? await hubSpotProjectSourceRoot(stageDir) : stageDir, archivePath);
-    return archivePath;
-}
-async function hubSpotProjectSourceRoot(root) {
-    const hsproject = await readHubSpotProjectConfig(root);
-    const srcDir = typeof hsproject.srcDir === 'string' ? hsproject.srcDir : 'src';
-    return join(root, srcDir);
-}
-async function patchHubSpotProjectName(root, projectName) {
-    const path = join(root, 'hsproject.json');
-    const raw = await readFile(path, 'utf8').catch(() => undefined);
-    if (!raw) {
-        return;
-    }
-    const parsed = JSON.parse(raw);
-    if (!isRecord(parsed)) {
-        return;
-    }
-    await writeFile(path, `${JSON.stringify({ ...parsed, name: projectName }, null, 2)}\n`);
-}
 async function readHubSpotProjectIntermediateRepresentation(root) {
     const hsproject = await readHubSpotProjectConfig(root);
     const srcDir = typeof hsproject.srcDir === 'string' ? hsproject.srcDir : 'src';
@@ -4078,30 +4561,40 @@ async function collectHubSpotMetaFiles(root) {
     await walk(root);
     return files.sort();
 }
-function runZip(root, archivePath) {
-    return new Promise((resolve, reject) => {
-        const child = spawn('zip', ['-qr', archivePath, '.', '-x', 'node_modules/*', '*/node_modules/*', '.hs-x/*'], {
-            cwd: root,
-            stdio: ['ignore', 'ignore', 'pipe'],
-        });
-        let stderr = '';
-        child.stderr?.setEncoding('utf8');
-        child.stderr?.on('data', (chunk) => {
-            stderr += chunk;
-        });
-        child.on('error', reject);
-        child.on('close', (code) => {
-            if (code === 0) {
-                resolve();
-            }
-            else {
-                reject(new Error(`Unable to create HubSpot project zip archive: ${stderr.trim()}`));
-            }
+function readNumericProperty(value, key) {
+    if (!isRecord(value))
+        return undefined;
+    const property = value[key];
+    if (typeof property === 'number')
+        return property;
+    if (typeof property !== 'string')
+        return undefined;
+    const parsed = Number.parseInt(property, 10);
+    return Number.isNaN(parsed) ? undefined : parsed;
+}
+function readStringProperty(value, key) {
+    return isRecord(value) && typeof value[key] === 'string' ? value[key] : undefined;
+}
+function describeBlockedHubSpotDeploy(value) {
+    if (!isRecord(value))
+        return 'HubSpot blocked the deploy.';
+    const candidates = [value.issues, value.blockingIssues, value.errors, value.message];
+    const details = candidates.flatMap((candidate) => {
+        if (typeof candidate === 'string')
+            return [candidate];
+        if (!Array.isArray(candidate))
+            return [];
+        return candidate.map((item) => {
+            if (typeof item === 'string')
+                return item;
+            if (!isRecord(item))
+                return String(item);
+            return String(item.message ?? item.reason ?? item.description ?? JSON.stringify(item));
         });
     });
-}
-function readNumericProperty(value, key) {
-    return isRecord(value) && typeof value[key] === 'number' ? value[key] : undefined;
+    return details.length > 0
+        ? `HubSpot blocked the deploy: ${details.join('; ')}`
+        : 'HubSpot blocked the deploy. Re-run with --force only after reviewing its removal warnings.';
 }
 function readBooleanProperty(value, key) {
     return isRecord(value) && typeof value[key] === 'boolean' ? value[key] : undefined;
@@ -4844,8 +5337,12 @@ const deployOptions = {
     hubspotClientId: Options.text('hubspot-client-id').pipe(Options.optional), // --hubspot-client-id
     hubspotClientSecret: Options.text('hubspot-client-secret').pipe(Options.optional), // --hubspot-client-secret
     developerAccountId: Options.text('developer-account-id').pipe(Options.optional), // --developer-account-id
+    developerApiKey: Options.text('developer-api-key').pipe(Options.optional), // --developer-api-key
+    pak: Options.text('pak').pipe(Options.optional), // --pak
+    account: Options.text('account').pipe(Options.withAlias('a'), Options.optional), // --account / -a
+    config: Options.text('config').pipe(Options.withAlias('c'), Options.optional), // --config / -c
     hubspotBuildTimeoutMs: Options.text('hubspot-build-timeout-ms').pipe(Options.optional), // --hubspot-build-timeout-ms
-    message: Options.text('message').pipe(Options.optional), // --message
+    message: Options.text('message').pipe(Options.withAlias('m'), Options.optional), // --message / -m
     platformVersion: Options.text('platform-version').pipe(Options.optional), // --platform-version
     hubspotProjectName: Options.text('hubspot-project-name').pipe(Options.optional), // --hubspot-project-name
     // ── boolean flags (argv.includes) ──
@@ -4866,13 +5363,14 @@ const deployOptions = {
     applySchema: Options.boolean('apply-schema').pipe(Options.withDefault(false)), // --apply-schema
     heartbeat: Options.boolean('heartbeat').pipe(Options.withDefault(false)), // --heartbeat
     noHeartbeat: Options.boolean('no-heartbeat').pipe(Options.withDefault(false)), // --no-heartbeat
+    useEnv: Options.boolean('use-env').pipe(Options.withDefault(false)), // --use-env
     // Declared explicitly: without it @effect/cli treats `--no-record` as the
     // negation of an undeclared `record` boolean and fails routing with a
     // confusing root-level "Invalid subcommand" error (the flag is documented).
     noRecord: Options.boolean('no-record').pipe(Options.withDefault(false)), // --no-record
     portalSchemaLive: Options.boolean('portal-schema-live').pipe(Options.withDefault(false)), // --portal-schema-live
     localHubspotSchema: Options.boolean('local-hubspot-schema').pipe(Options.withDefault(false)), // --local-hubspot-schema
-    force: Options.boolean('force').pipe(Options.withDefault(false)), // --force
+    force: Options.boolean('force').pipe(Options.withAlias('f'), Options.withDefault(false)), // --force / -f
     yes: Options.boolean('yes').pipe(Options.withAlias('y'), Options.withDefault(false)), // --yes / -y
 };
 const deployBaseCmd = Command.make('deploy', deployOptions, (opts) => runHandler('deploy', { json: opts.json }, Effect.gen(function* () {
@@ -4904,6 +5402,10 @@ const deployBaseCmd = Command.make('deploy', deployOptions, (opts) => runHandler
     push('--hubspot-client-id', opts.hubspotClientId);
     push('--hubspot-client-secret', opts.hubspotClientSecret);
     push('--developer-account-id', opts.developerAccountId);
+    push('--developer-api-key', opts.developerApiKey);
+    push('--pak', opts.pak);
+    push('--account', opts.account);
+    push('--config', opts.config);
     push('--hubspot-build-timeout-ms', opts.hubspotBuildTimeoutMs);
     push('--message', opts.message);
     push('--platform-version', opts.platformVersion);
@@ -4925,6 +5427,7 @@ const deployBaseCmd = Command.make('deploy', deployOptions, (opts) => runHandler
     flag('--apply-schema', opts.applySchema);
     flag('--heartbeat', opts.heartbeat);
     flag('--no-heartbeat', opts.noHeartbeat);
+    flag('--use-env', opts.useEnv);
     flag('--no-record', opts.noRecord);
     flag('--portal-schema-live', opts.portalSchemaLive);
     flag('--local-hubspot-schema', opts.localHubspotSchema);