@hs-x/cli 0.3.7 → 0.4.1

package/dist/commands/completion.js

@@ -78,7 +78,7 @@ export function completionCommand({ argv, json, }) {
     }
     return { exitCode: 0 };
 }
-const COMPLETION_FLAGS = [
+const GLOBAL_COMPLETION_FLAGS = [
     '--help',
     '--help-all',
     '--json',
@@ -90,25 +90,201 @@ const COMPLETION_FLAGS = [
     '--no-color',
     '--no-telemetry',
     '--no-update-check',
+    '--format-output-as-json',
+    '--json-schema',
+    '--version',
+];
+// Preserve useful coverage for commands that do not yet have a dedicated path
+// spec. Context-specific dev/deploy metadata below is the source of truth for
+// their newer subcommands and flags.
+const SHARED_COMMAND_FLAGS = [
     '--project',
+    '--account',
+    '--config',
+    '--use-env',
     '--account-id',
     '--project-id',
     '--env',
     '--yes',
     '--force',
-    '--version',
+    '--detach',
+    '--session',
+    '--follow',
+    '--cursor',
+    '--lane',
+    '--level',
+    '--search',
+    '--since',
+    '--limit',
+    '--profile',
+    '--function',
+    '--latest',
+    '--compact',
+];
+const DEV_SUBCOMMANDS = [
+    'start',
+    'logs',
+    'status',
+    'restart',
+    'stop',
+    'invoke',
+    'cleanup',
+];
+const PUBLIC_DEV_FLAGS = [
+    '--port',
+    '--target-origin',
+    '--project-id',
+    '--account-id',
+    '--ttl-seconds',
+    '--project-account',
+    '--testing-account',
+    '--component',
+    '--pick',
+    '--only',
+    '--hsx-log-port',
+    '--no-hubspot',
+    '--no-ui-extensions',
+    '--profile',
+    '--account',
+    '--portal',
+];
+const PUBLIC_DIRECT_DEPLOY_FLAGS = [
+    '--account',
+    '--config',
+    '--use-env',
+    '--plan',
+    '--dry-run',
+    '--yes',
+    '--hubspot-upload-only',
+    '--skip-deploy',
+    '--pak',
+    '--message',
+    '--force',
+];
+const PUBLIC_HSX_DEPLOY_FLAGS = [
+    '--account-id',
+    '--project-id',
+    '--env',
+    '--environment',
+    '--hubspot-upload',
+    '--cloudflare-deploy',
+    '--build-only',
+    '--portal-schema-live',
+    '--apply-schema',
+    '--record-local',
+    '--promote-when-healthy',
+    '--no-record',
+    '--heartbeat',
+    '--no-heartbeat',
+    '--hubspot-only',
+    '--cloudflare-dry-run',
+    '--no-manage-schema',
+    '--user-id',
+];
+function flags(...groups) {
+    return [...new Set(groups.flat())];
+}
+// One path-aware catalog drives bash, zsh, and fish. Alias paths share the same
+// spec instead of copying independent command/flag lists.
+const COMPLETION_SPECS = [
+    {
+        paths: [''],
+        subcommands: ROOT_COMMANDS,
+        flags: flags(GLOBAL_COMPLETION_FLAGS, SHARED_COMMAND_FLAGS),
+    },
+    {
+        paths: ['project'],
+        subcommands: ['dev', 'info', 'list-builds', 'logs', 'validate'],
+        flags: flags(GLOBAL_COMPLETION_FLAGS, ['--account', '--profile', '--format-output-as-json']),
+    },
+    {
+        paths: ['dev', 'project dev'],
+        subcommands: DEV_SUBCOMMANDS,
+        flags: flags(GLOBAL_COMPLETION_FLAGS, PUBLIC_DEV_FLAGS, ['--detach', '--yes']),
+    },
+    {
+        paths: ['dev start', 'project dev start'],
+        subcommands: [],
+        flags: flags(GLOBAL_COMPLETION_FLAGS, PUBLIC_DEV_FLAGS, ['--wait-seconds', '--yes']),
+    },
+    {
+        paths: ['dev logs', 'project dev logs'],
+        subcommands: [],
+        flags: flags(GLOBAL_COMPLETION_FLAGS, [
+            '--session',
+            '--follow',
+            '--cursor',
+            '--lane',
+            '--level',
+            '--search',
+            '--since',
+            '--limit',
+        ]),
+    },
+    {
+        paths: ['dev status', 'project dev status'],
+        subcommands: [],
+        flags: flags(GLOBAL_COMPLETION_FLAGS, [
+            '--session',
+            '--control-plane-url',
+            '--account-id',
+            '--user-id',
+        ]),
+    },
+    {
+        paths: ['dev restart', 'project dev restart'],
+        subcommands: [],
+        flags: flags(GLOBAL_COMPLETION_FLAGS, ['--session', '--wait-seconds', '--yes', '--force']),
+    },
+    {
+        paths: ['dev stop', 'project dev stop'],
+        subcommands: [],
+        flags: flags(GLOBAL_COMPLETION_FLAGS, ['--session', '--yes', '--force']),
+    },
+    {
+        paths: ['dev invoke', 'project dev invoke'],
+        subcommands: [],
+        flags: flags(GLOBAL_COMPLETION_FLAGS, [
+            '--input',
+            '--object',
+            '--install',
+            '--last',
+            '--remote',
+            '--url',
+        ]),
+    },
+    {
+        paths: ['dev cleanup', 'project dev cleanup'],
+        subcommands: [],
+        flags: flags(GLOBAL_COMPLETION_FLAGS, [
+            '--control-plane-url',
+            '--account-id',
+            '--session-id',
+            '--yes',
+        ]),
+    },
+    {
+        paths: ['deploy'],
+        subcommands: ['promote'],
+        flags: flags(GLOBAL_COMPLETION_FLAGS, PUBLIC_DIRECT_DEPLOY_FLAGS, PUBLIC_HSX_DEPLOY_FLAGS),
+    },
 ];
 function renderCompletion(shell) {
-    const commands = ROOT_COMMANDS.join(' ');
-    const flags = COMPLETION_FLAGS.join(' ');
     switch (shell) {
         case 'bash':
-            return `_hs_x_completion() {
+            return `${renderBashContextFunction()}
+_hs_x_completion() {
   local cur="\${COMP_WORDS[COMP_CWORD]}"
+  local context="$(_hs_x_context)"
+  local commands flags
+  case "$context" in
+${renderBashSpecCases()}
+    *) commands=""; flags="${GLOBAL_COMPLETION_FLAGS.join(' ')}" ;;
+  esac
   if [[ "\${cur}" == -* ]]; then
-    COMPREPLY=( $(compgen -W "${flags}" -- "\${cur}") )
+    COMPREPLY=( $(compgen -W "\${flags}" -- "\${cur}") )
   else
-    COMPREPLY=( $(compgen -W "${commands}" -- "\${cur}") )
+    COMPREPLY=( $(compgen -W "\${commands}" -- "\${cur}") )
   fi
 }
 complete -F _hs_x_completion hs-x hsx
@@ -116,27 +292,103 @@ complete -F _hs_x_completion hs-x hsx
         case 'zsh':
             return `#compdef hs-x hsx
 _hs_x() {
+  local context="" token
+  local -i index
   local -a commands flags
-  commands=(${commands})
-  flags=(${flags})
+  for ((index = 2; index < CURRENT; index++)); do
+    token="$words[index]"
+    [[ "$token" == -* ]] && continue
+    case "$context:$token" in
+${renderContextTransitions('      ')}
+    esac
+  done
+  case "$context" in
+${renderZshSpecCases()}
+    *) commands=(); flags=(${GLOBAL_COMPLETION_FLAGS.join(' ')}) ;;
+  esac
   if [[ "$words[CURRENT]" == -* ]]; then
     _describe 'flags' flags
-  else
+  elif (( \${#commands[@]} > 0 )); then
     _describe 'commands' commands
   fi
 }
 compdef _hs_x hs-x hsx
 `;
         case 'fish':
-            return `${['hs-x', 'hsx']
-                .flatMap((binary) => ROOT_COMMANDS.map((command) => `complete -c ${binary} -f -n "__fish_use_subcommand" -a ${command}`))
-                .join('\n')}
-${['hs-x', 'hsx']
-                .flatMap((binary) => COMPLETION_FLAGS.map((flag) => `complete -c ${binary} -f -l ${flag.slice(2)}`))
-                .join('\n')}
+            return `${renderFishContextFunction()}
+${renderFishCompletions()}
 `;
     }
 }
+function renderBashContextFunction() {
+    return `_hs_x_context() {
+  local context="" token
+  local -i index
+  for ((index = 1; index < COMP_CWORD; index++)); do
+    token="\${COMP_WORDS[index]}"
+    [[ "$token" == -* ]] && continue
+    case "$context:$token" in
+${renderContextTransitions('      ')}
+    esac
+  done
+  printf '%s' "$context"
+}`;
+}
+function renderContextTransitions(indent) {
+    return completionTransitions()
+        .map(({ from, token, to }) => `${indent}"${from}:${token}") context="${to}" ;;`)
+        .join('\n');
+}
+function completionTransitions() {
+    const transitions = new Map();
+    for (const spec of COMPLETION_SPECS) {
+        for (const from of spec.paths) {
+            for (const token of spec.subcommands) {
+                const transition = { from, token, to: from ? `${from} ${token}` : token };
+                transitions.set(`${from}\0${token}`, transition);
+            }
+        }
+    }
+    return [...transitions.values()];
+}
+function renderBashSpecCases() {
+    return COMPLETION_SPECS.map((spec) => `    ${spec.paths.map((path) => `"${path}"`).join('|')}) commands="${spec.subcommands.join(' ')}"; flags="${spec.flags.join(' ')}" ;;`).join('\n');
+}
+function renderZshSpecCases() {
+    return COMPLETION_SPECS.map((spec) => `    ${spec.paths.map((path) => `"${path}"`).join('|')}) commands=(${spec.subcommands.join(' ')}); flags=(${spec.flags.join(' ')}) ;;`).join('\n');
+}
+function renderFishContextFunction() {
+    return `function __hs_x_context
+  set -l context ''
+  set -l tokens (commandline -opc)
+  for token in $tokens[2..-1]
+    if string match -q -- '-*' $token
+      continue
+    end
+    switch "$context:$token"
+${completionTransitions()
+        .map(({ from, token, to }) => `      case '${from}:${token}'\n        set context '${to}'`)
+        .join('\n')}
+    end
+  end
+  if test -z "$context"
+    printf '%s' '__root__'
+  else
+    printf '%s' "$context"
+  end
+end`;
+}
+function renderFishCompletions() {
+    return ['hs-x', 'hsx']
+        .flatMap((binary) => COMPLETION_SPECS.flatMap((spec) => spec.paths.flatMap((path) => {
+        const condition = `test (__hs_x_context) = "${path || '__root__'}"`;
+        return [
+            ...spec.subcommands.map((subcommand) => `complete -c ${binary} -f -n '${condition}' -a ${subcommand}`),
+            ...spec.flags.map((flag) => `complete -c ${binary} -f -n '${condition}' -l ${flag.slice(2)}`),
+        ];
+    })))
+        .join('\n');
+}
 export function completionHelpText() {
     return `hs-x completion <shell>
 

package/dist/commands/completion.js.map

@@ -1 +1 @@
-{"version":3,"file":"completion.js","sourceRoot":"","sources":["../../src/commands/completion.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,IAAI,MAAM,kBAAkB,CAAC;AACzC,OAAO,KAAK,OAAO,MAAM,qBAAqB,CAAC;AAC/C,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAChC,OAAO,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAE3C,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AACvD,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AACtD,OAAO,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AACtC,OAAO,EAAE,wBAAwB,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAChF,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAEtD,OAAO,EAAE,QAAQ,EAAE,MAAM,yBAAyB,CAAC;AAEnD,+EAA+E;AAC/E,8EAA8E;AAC9E,+EAA+E;AAC/E,iFAAiF;AACjF,6EAA6E;AAC7E,kEAAkE;AAElE,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;AAE9C,MAAM,CAAC,MAAM,aAAa,GAAG,OAAO,CAAC,IAAI,CACvC,YAAY,EACZ,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,EAAE,EACrC,CAAC,IAAI,EAAE,EAAE,CAAC,UAAU,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CACpF,CAAC;AAEF,SAAS,cAAc,CAAC,KAAa;IACnC,OAAO,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QACzB,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,QAAQ,CAAC;QACjC,IAAI,KAAK,KAAK,MAAM,IAAI,KAAK,KAAK,KAAK,IAAI,KAAK,KAAK,MAAM,EAAE,CAAC;YAC5D,uEAAuE;YACvE,oEAAoE;YACpE,0EAA0E;YAC1E,uEAAuE;YACvE,yEAAyE;YACzE,wEAAwE;YACxE,+BAA+B;YAC/B,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CACvB,QAAQ,CAAC,uBAAuB,EAAE,+BAA+B,EAAE;gBACjE,OAAO,EAAE,EAAE,IAAI,EAAE,wCAAwC,EAAE;gBAC3D,QAAQ,EAAE,EAAE;aACb,CAAC,CACH,CAAC;QACJ,CAAC;QACD,MAAM,MAAM,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;QACvC,IAAI,QAAQ,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;YAC7B,KAAK,CAAC,CAAC,wBAAwB,CAC7B,QAAQ,EACR,YAAY,CAAC,kBAAkB,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,CAAC,CACpD,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,KAAK,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC9B,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,EAChC,IAAI,EACJ,IAAI,GAIL;IACC,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACtB,IAAI,KAAK,KAAK,MAAM,IAAI,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QACxF,QAAQ,CAAC,kBAAkB,EAAE,EAAE,IAAI,CAAC,CAAC;QACrC,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;IACzB,CAAC;IACD,MAAM,QAAQ,GAAG,cAAc,CAAC,EAAE,OAAO,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC;IACjE,IAAI,KAAK,KAAK,MAAM,IAAI,KAAK,KAAK,KAAK,IAAI,KAAK,KAAK,MAAM,EAAE,CAAC;QAC5D,MAAM,IAAI,GAAG,uBAAuB,CAAC;QACrC,MAAM,OAAO,GAAG,+BAA+B,CAAC;QAChD,MAAM,IAAI,GAAG,wCAAwC,CAAC;QACtD,IAAI,IAAI,EAAE,CAAC;YACT,QAAQ,CAAC,GAAG,CACV,GAAG,IAAI,CAAC,SAAS,CAAC;gBAChB,cAAc,EAAE,CAAC;gBACjB,OAAO,EAAE,YAAY;gBACrB,EAAE,EAAE,KAAK;gBACT,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE;aAC/B,CAAC,IAAI,CACP,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,2BAA2B,IAAI,EAAE,EAAE,CAAC,CAAC;YACrF,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;QAC/B,CAAC;QACD,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;IAC1B,CAAC;IACD,MAAM,MAAM,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;IACvC,IAAI,QAAQ,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QAC7B,QAAQ,CAAC,IAAI,CAAC,YAAY,CAAC,kBAAkB,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;QACnE,QAAQ,CAAC,IAAI,EAAE,CAAC;IAClB,CAAC;SAAM,CAAC;QACN,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACrB,IAAI,QAAQ,CAAC,IAAI,KAAK,QAAQ;YAAE,QAAQ,CAAC,IAAI,EAAE,CAAC;IAClD,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;AACzB,CAAC;AAED,MAAM,gBAAgB,GAAG;IACvB,QAAQ;IACR,YAAY;IACZ,QAAQ;IACR,eAAe;IACf,SAAS;IACT,WAAW;IACX,SAAS;IACT,OAAO;IACP,YAAY;IACZ,gBAAgB;IAChB,mBAAmB;IACnB,WAAW;IACX,cAAc;IACd,cAAc;IACd,OAAO;IACP,OAAO;IACP,SAAS;IACT,WAAW;CACH,CAAC;AAEX,SAAS,gBAAgB,CAAC,KAA8B;IACtD,MAAM,QAAQ,GAAG,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACzC,MAAM,KAAK,GAAG,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACzC,QAAQ,KAAK,EAAE,CAAC;QACd,KAAK,MAAM;YACT,OAAO;;;gCAGmB,KAAK;;gCAEL,QAAQ;;;;CAIvC,CAAC;QACE,KAAK,KAAK;YACR,OAAO;;;cAGC,QAAQ;WACX,KAAK;;;;;;;;CAQf,CAAC;QACE,KAAK,MAAM;YACT,OAAO,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC;iBACtB,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE,CAClB,aAAa,CAAC,GAAG,CACf,CAAC,OAAO,EAAE,EAAE,CAAC,eAAe,MAAM,qCAAqC,OAAO,EAAE,CACjF,CACF;iBACA,IAAI,CAAC,IAAI,CAAC;EACjB,CAAC,MAAM,EAAE,KAAK,CAAC;iBACd,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE,CAClB,gBAAgB,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,eAAe,MAAM,UAAU,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAC/E;iBACA,IAAI,CAAC,IAAI,CAAC;CACZ,CAAC;IACA,CAAC;AACH,CAAC;AAED,MAAM,UAAU,kBAAkB;IAChC,OAAO;;;;;;;;CAQR,CAAC;AACF,CAAC"}
+{"version":3,"file":"completion.js","sourceRoot":"","sources":["../../src/commands/completion.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,IAAI,MAAM,kBAAkB,CAAC;AACzC,OAAO,KAAK,OAAO,MAAM,qBAAqB,CAAC;AAC/C,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAChC,OAAO,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAE3C,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AACvD,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AACtD,OAAO,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AACtC,OAAO,EAAE,wBAAwB,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAChF,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAEtD,OAAO,EAAE,QAAQ,EAAE,MAAM,yBAAyB,CAAC;AAEnD,+EAA+E;AAC/E,8EAA8E;AAC9E,+EAA+E;AAC/E,iFAAiF;AACjF,6EAA6E;AAC7E,kEAAkE;AAElE,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;AAE9C,MAAM,CAAC,MAAM,aAAa,GAAG,OAAO,CAAC,IAAI,CACvC,YAAY,EACZ,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,EAAE,EACrC,CAAC,IAAI,EAAE,EAAE,CAAC,UAAU,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CACpF,CAAC;AAEF,SAAS,cAAc,CAAC,KAAa;IACnC,OAAO,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QACzB,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,QAAQ,CAAC;QACjC,IAAI,KAAK,KAAK,MAAM,IAAI,KAAK,KAAK,KAAK,IAAI,KAAK,KAAK,MAAM,EAAE,CAAC;YAC5D,uEAAuE;YACvE,oEAAoE;YACpE,0EAA0E;YAC1E,uEAAuE;YACvE,yEAAyE;YACzE,wEAAwE;YACxE,+BAA+B;YAC/B,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CACvB,QAAQ,CAAC,uBAAuB,EAAE,+BAA+B,EAAE;gBACjE,OAAO,EAAE,EAAE,IAAI,EAAE,wCAAwC,EAAE;gBAC3D,QAAQ,EAAE,EAAE;aACb,CAAC,CACH,CAAC;QACJ,CAAC;QACD,MAAM,MAAM,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;QACvC,IAAI,QAAQ,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;YAC7B,KAAK,CAAC,CAAC,wBAAwB,CAC7B,QAAQ,EACR,YAAY,CAAC,kBAAkB,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,CAAC,CACpD,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,KAAK,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC9B,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,EAChC,IAAI,EACJ,IAAI,GAIL;IACC,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACtB,IAAI,KAAK,KAAK,MAAM,IAAI,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QACxF,QAAQ,CAAC,kBAAkB,EAAE,EAAE,IAAI,CAAC,CAAC;QACrC,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;IACzB,CAAC;IACD,MAAM,QAAQ,GAAG,cAAc,CAAC,EAAE,OAAO,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC;IACjE,IAAI,KAAK,KAAK,MAAM,IAAI,KAAK,KAAK,KAAK,IAAI,KAAK,KAAK,MAAM,EAAE,CAAC;QAC5D,MAAM,IAAI,GAAG,uBAAuB,CAAC;QACrC,MAAM,OAAO,GAAG,+BAA+B,CAAC;QAChD,MAAM,IAAI,GAAG,wCAAwC,CAAC;QACtD,IAAI,IAAI,EAAE,CAAC;YACT,QAAQ,CAAC,GAAG,CACV,GAAG,IAAI,CAAC,SAAS,CAAC;gBAChB,cAAc,EAAE,CAAC;gBACjB,OAAO,EAAE,YAAY;gBACrB,EAAE,EAAE,KAAK;gBACT,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE;aAC/B,CAAC,IAAI,CACP,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,2BAA2B,IAAI,EAAE,EAAE,CAAC,CAAC;YACrF,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;QAC/B,CAAC;QACD,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;IAC1B,CAAC;IACD,MAAM,MAAM,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;IACvC,IAAI,QAAQ,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QAC7B,QAAQ,CAAC,IAAI,CAAC,YAAY,CAAC,kBAAkB,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;QACnE,QAAQ,CAAC,IAAI,EAAE,CAAC;IAClB,CAAC;SAAM,CAAC;QACN,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACrB,IAAI,QAAQ,CAAC,IAAI,KAAK,QAAQ;YAAE,QAAQ,CAAC,IAAI,EAAE,CAAC;IAClD,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;AACzB,CAAC;AAQD,MAAM,uBAAuB,GAAG;IAC9B,QAAQ;IACR,YAAY;IACZ,QAAQ;IACR,eAAe;IACf,SAAS;IACT,WAAW;IACX,SAAS;IACT,OAAO;IACP,YAAY;IACZ,gBAAgB;IAChB,mBAAmB;IACnB,yBAAyB;IACzB,eAAe;IACf,WAAW;CACH,CAAC;AAEX,8EAA8E;AAC9E,8EAA8E;AAC9E,qCAAqC;AACrC,MAAM,oBAAoB,GAAG;IAC3B,WAAW;IACX,WAAW;IACX,UAAU;IACV,WAAW;IACX,cAAc;IACd,cAAc;IACd,OAAO;IACP,OAAO;IACP,SAAS;IACT,UAAU;IACV,WAAW;IACX,UAAU;IACV,UAAU;IACV,QAAQ;IACR,SAAS;IACT,UAAU;IACV,SAAS;IACT,SAAS;IACT,WAAW;IACX,YAAY;IACZ,UAAU;IACV,WAAW;CACH,CAAC;AAEX,MAAM,eAAe,GAAG;IACtB,OAAO;IACP,MAAM;IACN,QAAQ;IACR,SAAS;IACT,MAAM;IACN,QAAQ;IACR,SAAS;CACD,CAAC;AACX,MAAM,gBAAgB,GAAG;IACvB,QAAQ;IACR,iBAAiB;IACjB,cAAc;IACd,cAAc;IACd,eAAe;IACf,mBAAmB;IACnB,mBAAmB;IACnB,aAAa;IACb,QAAQ;IACR,QAAQ;IACR,gBAAgB;IAChB,cAAc;IACd,oBAAoB;IACpB,WAAW;IACX,WAAW;IACX,UAAU;CACF,CAAC;AACX,MAAM,0BAA0B,GAAG;IACjC,WAAW;IACX,UAAU;IACV,WAAW;IACX,QAAQ;IACR,WAAW;IACX,OAAO;IACP,uBAAuB;IACvB,eAAe;IACf,OAAO;IACP,WAAW;IACX,SAAS;CACD,CAAC;AACX,MAAM,uBAAuB,GAAG;IAC9B,cAAc;IACd,cAAc;IACd,OAAO;IACP,eAAe;IACf,kBAAkB;IAClB,qBAAqB;IACrB,cAAc;IACd,sBAAsB;IACtB,gBAAgB;IAChB,gBAAgB;IAChB,wBAAwB;IACxB,aAAa;IACb,aAAa;IACb,gBAAgB;IAChB,gBAAgB;IAChB,sBAAsB;IACtB,oBAAoB;IACpB,WAAW;CACH,CAAC;AAEX,SAAS,KAAK,CAAC,GAAG,MAAsC;IACtD,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;AACrC,CAAC;AAED,gFAAgF;AAChF,0DAA0D;AAC1D,MAAM,gBAAgB,GAA8B;IAClD;QACE,KAAK,EAAE,CAAC,EAAE,CAAC;QACX,WAAW,EAAE,aAAa;QAC1B,KAAK,EAAE,KAAK,CAAC,uBAAuB,EAAE,oBAAoB,CAAC;KAC5D;IACD;QACE,KAAK,EAAE,CAAC,SAAS,CAAC;QAClB,WAAW,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,UAAU,CAAC;QAC/D,KAAK,EAAE,KAAK,CAAC,uBAAuB,EAAE,CAAC,WAAW,EAAE,WAAW,EAAE,yBAAyB,CAAC,CAAC;KAC7F;IACD;QACE,KAAK,EAAE,CAAC,KAAK,EAAE,aAAa,CAAC;QAC7B,WAAW,EAAE,eAAe;QAC5B,KAAK,EAAE,KAAK,CAAC,uBAAuB,EAAE,gBAAgB,EAAE,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;KAC/E;IACD;QACE,KAAK,EAAE,CAAC,WAAW,EAAE,mBAAmB,CAAC;QACzC,WAAW,EAAE,EAAE;QACf,KAAK,EAAE,KAAK,CAAC,uBAAuB,EAAE,gBAAgB,EAAE,CAAC,gBAAgB,EAAE,OAAO,CAAC,CAAC;KACrF;IACD;QACE,KAAK,EAAE,CAAC,UAAU,EAAE,kBAAkB,CAAC;QACvC,WAAW,EAAE,EAAE;QACf,KAAK,EAAE,KAAK,CAAC,uBAAuB,EAAE;YACpC,WAAW;YACX,UAAU;YACV,UAAU;YACV,QAAQ;YACR,SAAS;YACT,UAAU;YACV,SAAS;YACT,SAAS;SACV,CAAC;KACH;IACD;QACE,KAAK,EAAE,CAAC,YAAY,EAAE,oBAAoB,CAAC;QAC3C,WAAW,EAAE,EAAE;QACf,KAAK,EAAE,KAAK,CAAC,uBAAuB,EAAE;YACpC,WAAW;YACX,qBAAqB;YACrB,cAAc;YACd,WAAW;SACZ,CAAC;KACH;IACD;QACE,KAAK,EAAE,CAAC,aAAa,EAAE,qBAAqB,CAAC;QAC7C,WAAW,EAAE,EAAE;QACf,KAAK,EAAE,KAAK,CAAC,uBAAuB,EAAE,CAAC,WAAW,EAAE,gBAAgB,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;KAC3F;IACD;QACE,KAAK,EAAE,CAAC,UAAU,EAAE,kBAAkB,CAAC;QACvC,WAAW,EAAE,EAAE;QACf,KAAK,EAAE,KAAK,CAAC,uBAAuB,EAAE,CAAC,WAAW,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;KACzE;IACD;QACE,KAAK,EAAE,CAAC,YAAY,EAAE,oBAAoB,CAAC;QAC3C,WAAW,EAAE,EAAE;QACf,KAAK,EAAE,KAAK,CAAC,uBAAuB,EAAE;YACpC,SAAS;YACT,UAAU;YACV,WAAW;YACX,QAAQ;YACR,UAAU;YACV,OAAO;SACR,CAAC;KACH;IACD;QACE,KAAK,EAAE,CAAC,aAAa,EAAE,qBAAqB,CAAC;QAC7C,WAAW,EAAE,EAAE;QACf,KAAK,EAAE,KAAK,CAAC,uBAAuB,EAAE;YACpC,qBAAqB;YACrB,cAAc;YACd,cAAc;YACd,OAAO;SACR,CAAC;KACH;IACD;QACE,KAAK,EAAE,CAAC,QAAQ,CAAC;QACjB,WAAW,EAAE,CAAC,SAAS,CAAC;QACxB,KAAK,EAAE,KAAK,CAAC,uBAAuB,EAAE,0BAA0B,EAAE,uBAAuB,CAAC;KAC3F;CACF,CAAC;AAEF,SAAS,gBAAgB,CAAC,KAA8B;IACtD,QAAQ,KAAK,EAAE,CAAC;QACd,KAAK,MAAM;YACT,OAAO,GAAG,yBAAyB,EAAE;;;;;;EAMzC,mBAAmB,EAAE;6BACM,uBAAuB,CAAC,IAAI,CAAC,GAAG,CAAC;;;;;;;;;CAS7D,CAAC;QACE,KAAK,KAAK;YACR,OAAO;;;;;;;;;EASX,wBAAwB,CAAC,QAAQ,CAAC;;;;EAIlC,kBAAkB,EAAE;6BACO,uBAAuB,CAAC,IAAI,CAAC,GAAG,CAAC;;;;;;;;;CAS7D,CAAC;QACE,KAAK,MAAM;YACT,OAAO,GAAG,yBAAyB,EAAE;EACzC,qBAAqB,EAAE;CACxB,CAAC;IACA,CAAC;AACH,CAAC;AAED,SAAS,yBAAyB;IAChC,OAAO;;;;;;;EAOP,wBAAwB,CAAC,QAAQ,CAAC;;;;EAIlC,CAAC;AACH,CAAC;AAED,SAAS,wBAAwB,CAAC,MAAc;IAC9C,OAAO,qBAAqB,EAAE;SAC3B,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,GAAG,MAAM,IAAI,IAAI,IAAI,KAAK,eAAe,EAAE,MAAM,CAAC;SAC/E,IAAI,CAAC,IAAI,CAAC,CAAC;AAChB,CAAC;AAED,SAAS,qBAAqB;IAK5B,MAAM,WAAW,GAAG,IAAI,GAAG,EAGxB,CAAC;IACJ,KAAK,MAAM,IAAI,IAAI,gBAAgB,EAAE,CAAC;QACpC,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YAC9B,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;gBACrC,MAAM,UAAU,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC;gBAC1E,WAAW,CAAC,GAAG,CAAC,GAAG,IAAI,KAAK,KAAK,EAAE,EAAE,UAAU,CAAC,CAAC;YACnD,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,CAAC,GAAG,WAAW,CAAC,MAAM,EAAE,CAAC,CAAC;AACnC,CAAC;AAED,SAAS,mBAAmB;IAC1B,OAAO,gBAAgB,CAAC,GAAG,CACzB,CAAC,IAAI,EAAE,EAAE,CACP,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,eAAe,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,aAAa,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CACzI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED,SAAS,kBAAkB;IACzB,OAAO,gBAAgB,CAAC,GAAG,CACzB,CAAC,IAAI,EAAE,EAAE,CACP,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,eAAe,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,aAAa,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CACzI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED,SAAS,yBAAyB;IAChC,OAAO;;;;;;;;EAQP,qBAAqB,EAAE;SACtB,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,eAAe,IAAI,IAAI,KAAK,2BAA2B,EAAE,GAAG,CAAC;SAC1F,IAAI,CAAC,IAAI,CAAC;;;;;;;;IAQT,CAAC;AACL,CAAC;AAED,SAAS,qBAAqB;IAC5B,OAAO,CAAC,MAAM,EAAE,KAAK,CAAC;SACnB,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE,CAClB,gBAAgB,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAChC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE;QAC1B,MAAM,SAAS,GAAG,4BAA4B,IAAI,IAAI,UAAU,GAAG,CAAC;QACpE,OAAO;YACL,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CACrB,CAAC,UAAU,EAAE,EAAE,CAAC,eAAe,MAAM,WAAW,SAAS,QAAQ,UAAU,EAAE,CAC9E;YACD,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CACf,CAAC,IAAI,EAAE,EAAE,CAAC,eAAe,MAAM,WAAW,SAAS,QAAQ,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAC3E;SACF,CAAC;IACJ,CAAC,CAAC,CACH,CACF;SACA,IAAI,CAAC,IAAI,CAAC,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,kBAAkB;IAChC,OAAO;;;;;;;;CAQR,CAAC;AACF,CAAC"}

package/dist/commands/connect.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"connect.d.ts","sourceRoot":"","sources":["../../src/commands/connect.ts"],"names":[],"mappings":"AAiBA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AA8B9C,wBAAsB,cAAc,CAAC,EACnC,IAAI,EACJ,GAAG,EACH,IAAI,GACL,EAAE;IACD,QAAQ,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;CACxB,GAAG,OAAO,CAAC,SAAS,CAAC,CAoBrB;AAmvDD,eAAO,MAAM,UAAU;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA4DyD,CAAC;AAIjF,OAAO,KAAK,aAAa,MAAM,qBAAqB,CAAC;AAErD,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAWhC,OAAO,EAAE,GAAG,EAAE,MAAM,oBAAoB,CAAC"}
+{"version":3,"file":"connect.d.ts","sourceRoot":"","sources":["../../src/commands/connect.ts"],"names":[],"mappings":"AAiBA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAwI9C,wBAAsB,cAAc,CAAC,EACnC,IAAI,EACJ,GAAG,EACH,IAAI,GACL,EAAE;IACD,QAAQ,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;CACxB,GAAG,OAAO,CAAC,SAAS,CAAC,CAoBrB;AAs0DD,eAAO,MAAM,UAAU;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA4DyD,CAAC;AAIjF,OAAO,KAAK,aAAa,MAAM,qBAAqB,CAAC;AAErD,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAWhC,OAAO,EAAE,GAAG,EAAE,MAAM,oBAAoB,CAAC"}

package/dist/commands/connect.js

@@ -22,6 +22,87 @@ async function hostedHttp(input) {
 function isRecord(value) {
     return typeof value === 'object' && value !== null;
 }
+/**
+ * A non-2xx from a hosted control-plane credential route, with the status and
+ * the CP's `{ error, message }` body preserved so callers can branch on
+ * authorization failures instead of collapsing everything into one retry
+ * message.
+ */
+class ControlPlaneRequestError extends Error {
+    name = 'ControlPlaneRequestError';
+    status;
+    errorCode;
+    constructor(status, errorCode, message) {
+        super(message);
+        this.status = status;
+        this.errorCode = errorCode;
+    }
+}
+async function toControlPlaneRequestError(response, fallback) {
+    const body = await response.json().catch(() => undefined);
+    const errorCode = isRecord(body) && typeof body.error === 'string' ? body.error : undefined;
+    const message = isRecord(body) && typeof body.message === 'string' ? body.message : fallback;
+    return new ControlPlaneRequestError(response.status, errorCode, message);
+}
+/**
+ * Credential routes (`/v1/accounts/:id/{hubspot,cloudflare}/…`) are admin-class
+ * under the control plane's PAT policy, while ordinary reads only need `read`.
+ * A deploy/read-scope token (the dashboard's create form defaults to deploy)
+ * therefore sails through every preliminary check and 403s only here — an
+ * unfixable-by-retry failure that must be reported as a scope problem, not a
+ * generic exchange error.
+ */
+function credentialAuthorizationDenied(input) {
+    if (input.error.status === 401) {
+        return inputValidationError({
+            argv: input.argv,
+            command: input.command,
+            json: input.json,
+            code: 'HSX_E_API_UNAUTHORIZED',
+            message: 'The control plane rejected the CLI credential.',
+            hint: 'Run `hs-x login` to refresh your CLI session, then retry.',
+            detail: input.error.message,
+        });
+    }
+    return inputValidationError({
+        argv: input.argv,
+        command: input.command,
+        json: input.json,
+        code: 'HSX_E_CREDENTIAL_SCOPE',
+        message: 'This CLI credential is not allowed to manage account credentials (admin scope required).',
+        hint: 'Run `hs-x login` — owners and admins get a full-access CLI session. If you logged in with a pasted API token, it needs admin scope (dashboard → API tokens); deploy and read tokens cannot connect credentials. Account members need an owner/admin to connect.',
+        detail: input.error.message,
+    });
+}
+function isCredentialAuthFailure(error) {
+    return (error instanceof ControlPlaneRequestError && (error.status === 401 || error.status === 403));
+}
+/**
+ * Probe whether the current CLI credential may manage credentials on
+ * `accountId` BEFORE any browser consent or credential prompting. Uses the
+ * credential-connection read (same admin PAT class as the connect/complete
+ * mutations); 404 just means nothing is connected yet, so only 401/403 count
+ * as a refusal. Network errors are swallowed — the real call will surface
+ * them with full context.
+ */
+async function probeCredentialAuthorization(input) {
+    let response;
+    try {
+        response = await hostedHttp({
+            url: new URL(`/v1/accounts/${encodeURIComponent(input.accountId)}/${input.surface}`, input.controlPlaneUrl),
+            headers: {
+                accept: 'application/json',
+                ...(await controlPlaneAuthHeaders(input.userId)),
+            },
+        });
+    }
+    catch {
+        return undefined;
+    }
+    if (response.status !== 401 && response.status !== 403)
+        return undefined;
+    return await toControlPlaneRequestError(response, `Credential authorization probe returned HTTP ${response.status}.`);
+}
 export async function connectCommand({ argv, cwd, json, }) {
     // Only a non-flag token is a subcommand — bare `connect --account-id x`
     // routes to the wizard with the flags passed through, not the help fallback.
@@ -133,6 +214,33 @@ async function connectHubspotCommand({ argv, cwd, json, }) {
             reporter.info(`Binding into HS-X account: ${active.displayName} (${active.id})`);
         }
     }
+    // Linked connects mutate an admin-class credential route. Fail here — before
+    // the PAK browser flow and prompts — when the CLI credential can't manage
+    // credentials at all (e.g. a deploy-scope API token), instead of letting the
+    // user generate and paste a PAK only to be refused at the connect call.
+    if (linked && !localControlPlane && !noControlPlane) {
+        const { activeSession } = await import('../account-store.js');
+        const store = await loadStore();
+        const probeAccountId = resolveFlag(argv, '--account-id') ??
+            activeSession(store)?.accountId?.trim() ??
+            store.defaultAccountId?.trim();
+        if (probeAccountId) {
+            const denied = await probeCredentialAuthorization({
+                controlPlaneUrl: resolveControlPlaneUrl(argv),
+                accountId: probeAccountId,
+                surface: 'hubspot',
+                userId: resolveFlag(argv, '--user-id') ?? process.env.HSX_USER_ID ?? 'local-cli-user',
+            });
+            if (denied) {
+                return credentialAuthorizationDenied({
+                    argv,
+                    command: 'connect hubspot',
+                    json,
+                    error: denied,
+                });
+            }
+        }
+    }
     let accountId = resolveFlag(argv, '--account-id');
     let developerAccountId = resolveFlag(argv, '--developer-account-id');
     let displayName = resolveFlag(argv, '--display-name');
@@ -434,12 +542,21 @@ async function connectHubspotCommand({ argv, cwd, json, }) {
                 throw error;
             }
         }
-        const connection = await requestHostedControlPlaneHubSpotConnect({
-            accountId,
-            request,
-            controlPlaneUrl,
-            userId: resolveFlag(argv, '--user-id') ?? process.env.HSX_USER_ID ?? 'local-cli-user',
-        });
+        let connection;
+        try {
+            connection = await requestHostedControlPlaneHubSpotConnect({
+                accountId,
+                request,
+                controlPlaneUrl,
+                userId: resolveFlag(argv, '--user-id') ?? process.env.HSX_USER_ID ?? 'local-cli-user',
+            });
+        }
+        catch (error) {
+            if (isCredentialAuthFailure(error)) {
+                return credentialAuthorizationDenied({ argv, command: 'connect hubspot', json, error });
+            }
+            throw error;
+        }
         const result = {
             ok: true,
             command: 'connect hubspot',
@@ -772,6 +889,20 @@ async function runCloudflareOAuthFlowBody(input) {
             return { kind: 'success-brokered', connection };
         }
         catch (error) {
+            // An authorization refusal (deploy/read-scope PAT, expired session) can
+            // never be fixed by re-running the OAuth flow — telling the user to
+            // retry sends them through browser consent in a loop.
+            if (isCredentialAuthFailure(error)) {
+                return {
+                    kind: 'error',
+                    result: credentialAuthorizationDenied({
+                        argv: input.argv,
+                        command: 'connect cloudflare',
+                        json: input.json,
+                        error,
+                    }),
+                };
+            }
             const detail = error instanceof Error ? error.message : String(error);
             return {
                 kind: 'error',
@@ -885,8 +1016,7 @@ async function postCloudflareOAuthComplete(input) {
         body: input.body,
     });
     if (!response.ok) {
-        const text = await response.text().catch(() => '');
-        throw new Error(`HTTP ${response.status}: ${text || response.statusText}`);
+        throw await toControlPlaneRequestError(response, `Cloudflare OAuth completion failed with HTTP ${response.status}.`);
     }
     const raw = (await response.json());
     return Schema.decodeUnknownSync(schemas.CloudflareConnection)(raw);
@@ -1043,6 +1173,24 @@ async function connectCloudflareCommand({ argv, json, }) {
                 detail: `Account preflight returned HTTP ${status}.`,
             });
         }
+        // Membership verified — now verify this credential may MANAGE credentials.
+        // The account read above is read-class under PAT policy; the OAuth
+        // completion is admin-class. Without this probe a deploy-scope token
+        // passes preflight, burns a full browser consent, and only then 403s.
+        const denied = await probeCredentialAuthorization({
+            controlPlaneUrl,
+            accountId,
+            surface: 'cloudflare',
+            userId,
+        });
+        if (denied) {
+            return credentialAuthorizationDenied({
+                argv,
+                command: 'connect cloudflare',
+                json,
+                error: denied,
+            });
+        }
     }
     // OAuth (authorization code + PKCE) is the ONLY connection method — owner
     // decision 2026-06-11. No API-token paste path in the CLI or the dashboard:
@@ -1181,16 +1329,25 @@ async function connectCloudflareCommand({ argv, json, }) {
     };
     const controlPlaneUrl = resolveFlag(argv, '--control-plane-url') ?? process.env.HSX_CONTROL_PLANE_URL;
     const userId = resolveFlag(argv, '--user-id') ?? process.env.HSX_USER_ID ?? 'local-cli-user';
-    const connection = controlPlaneUrl
-        ? await requestHostedControlPlaneCloudflareConnect({
-            accountId,
-            request,
-            controlPlaneUrl,
-            userId,
-        })
-        : argv.includes('--local-control-plane')
-            ? await requestLocalControlPlaneCloudflareConnect({ accountId, request, userId })
-            : undefined;
+    let connection;
+    try {
+        connection = controlPlaneUrl
+            ? await requestHostedControlPlaneCloudflareConnect({
+                accountId,
+                request,
+                controlPlaneUrl,
+                userId,
+            })
+            : argv.includes('--local-control-plane')
+                ? await requestLocalControlPlaneCloudflareConnect({ accountId, request, userId })
+                : undefined;
+    }
+    catch (error) {
+        if (isCredentialAuthFailure(error)) {
+            return credentialAuthorizationDenied({ argv, command: 'connect cloudflare', json, error });
+        }
+        throw error;
+    }
     if (!connection) {
         const result = {
             ok: true,
@@ -1277,7 +1434,7 @@ async function requestHostedControlPlaneHubSpotConnect({ accountId, request, con
     });
     const body = await response.json();
     if (!response.ok) {
-        throw new Error(isRecord(body) && typeof body.message === 'string'
+        throw new ControlPlaneRequestError(response.status, isRecord(body) && typeof body.error === 'string' ? body.error : undefined, isRecord(body) && typeof body.message === 'string'
             ? body.message
             : `Control-plane HubSpot connect failed with status ${response.status}`);
     }
@@ -1313,7 +1470,7 @@ async function requestHostedControlPlaneCloudflareConnect({ accountId, request,
     });
     const body = await response.json();
     if (!response.ok) {
-        throw new Error(isRecord(body) && typeof body.message === 'string'
+        throw new ControlPlaneRequestError(response.status, isRecord(body) && typeof body.error === 'string' ? body.error : undefined, isRecord(body) && typeof body.message === 'string'
             ? body.message
             : `Control-plane Cloudflare connect failed with status ${response.status}`);
     }