@hs-x/cli 0.4.1 → 0.4.2-next.1

package/dist/commands/deploy.js

@@ -9,6 +9,7 @@ import * as Options from '@effect/cli/Options';
 import { cloudflareResourceName, generateHubSpotRuntimeProject, generateProjectArtifacts, planPortalSchemaManagement, planWorkerCronTriggers, renderAlchemyProgram, renderCloudflareWorkerEntrypoint, stampMigratedRunServerlessShimOrigin, } from '@hs-x/codegen';
 import { HttpClientRequest, Schema, schemas, signDeploymentAttestationGrant } from '@hs-x/types';
 import { validateProject } from '@hs-x/validator';
+import { isLegacyProject } from '@hubspot/project-parsing-lib/projects';
 import { Effect, Option } from 'effect';
 import { isLinked } from '../account-store.js';
 import { exitWith } from '../cli-error.js';
@@ -26,6 +27,7 @@ import { resolveDeployTargets } from '../deploy-targets.js';
 import { executeCliHttp } from '../effect-http.js';
 import { DirectHubSpotAccountResolutionError, createDeployHubSpotDeveloperClient, resolveDirectHubSpotContext, } from '../hubspot-developer-client.js';
 import { HubSpotProjectArchiveSourceError, fingerprintHubSpotArchiveSource, writeLocalHubSpotProjectArchive, } from '../hubspot-project-archive.js';
+import { deployHubSpotProjectBuild, waitForHubSpotAutoDeploy, waitForHubSpotBuildStatus, } from '../hubspot-project-lifecycle.js';
 import { detectLocalProjectMode, readHubSpotProjectDescriptor, validateHubSpotProject, } from '../hubspot-project.js';
 import { hydrateAncestorEnv } from '../load-env.js';
 import { LocalProjectPickerCancelled, resolveLocalProject } from '../local-project-picker.js';
@@ -487,6 +489,9 @@ async function waitForHealthyControlPlaneDrift({ controlPlaneUrl, projectId, dep
     } while (Date.now() - startedAt < timeoutMs);
     throw new Error(`Timed out waiting for deploy ${deployId} to become healthy; latest drift state was ${lastState}${lastReason ? `: ${lastReason}` : ''}.`);
 }
+function sleep(ms) {
+    return new Promise((resolve) => setTimeout(resolve, ms));
+}
 function isRecord(value) {
     return typeof value === 'object' && value !== null;
 }
@@ -648,6 +653,7 @@ async function executeHubSpotDirectDeployCommand({ argv, root, json, }) {
         '--portal-schema-live',
         '--portal-schema-fixture',
         '--local-hubspot-schema',
+        '--diagnostic-card-signature-capture',
     ].find((flag) => includesCliFlag(argv, flag));
     if (unsupported) {
         return inputValidationError({
@@ -1032,6 +1038,7 @@ export async function deployCommand({ argv, root, json, }) {
     const cloudflareDeploy = argv.includes('--cloudflare-deploy');
     const cloudflareDryRun = argv.includes('--cloudflare-dry-run');
     const explicitCloudflareDeployRequested = cloudflareDeploy || cloudflareDryRun;
+    const diagnosticCardSignatureCapture = argv.includes('--diagnostic-card-signature-capture');
     const noManageSchema = argv.includes('--no-manage-schema');
     const localControlPlane = argv.includes('--local-control-plane');
     const recordLocal = argv.includes('--record-local');
@@ -1684,6 +1691,7 @@ export async function deployCommand({ argv, root, json, }) {
                                 ? 'plan'
                                 : 'local-artifacts',
         deploymentMode,
+        diagnosticCardSignatureCapture,
         targets: {
             cloudflare: {
                 requested: cloudflareDeployRequested,
@@ -1941,6 +1949,15 @@ function buildDeploySummaryRows(input) {
             value: input.plan.deploymentMode,
         },
     ];
+    if (input.plan.diagnosticCardSignatureCapture) {
+        rows.push({
+            key: 'card signature capture',
+            value: 'enabled for this deploy',
+            status: 'warn',
+            detail: 'exact signed card requests will be written to Worker logs',
+            hint: 'Capture one test request, then immediately redeploy without --diagnostic-card-signature-capture.',
+        });
+    }
     if (input.controlPlanePlan) {
         rows.push({
             key: 'deploy',
@@ -2738,6 +2755,8 @@ async function executeCloudflareWorkerDeploy({ argv, root, worker, index, allowC
     await writeFile(entrypointPath, renderCloudflareWorkerEntrypoint({
         workerImportPath: relativeImportPath(dirname(entrypointPath), workerSourcePath),
         requireActiveCardInstall: appConfig.auth === 'oauth',
+        ...(appConfig.install ? { installSuccessUrl: appConfig.install.successUrl } : {}),
+        diagnosticCardSignatureCapture: argv.includes('--diagnostic-card-signature-capture'),
         // Tenant D1/KV and the grant secret are shared across the linked app's
         // Workers. Wire the matching routes on every linked Worker even though
         // revision-bound heartbeat/attestation remains primary-only below.
@@ -3886,6 +3905,8 @@ export async function readHsxAppConfig(root) {
             }
         }
     }
+    if (loaded?.install)
+        assertInstallSuccessUrl(loaded.install.successUrl);
     return {
         appName: loaded?.name ?? /name\s*:\s*["'`]([^"'`]+)["'`]/.exec(raw)?.[1] ?? basename(root),
         // No regex fallback for description: a raw-text match could pick up a
@@ -3907,6 +3928,7 @@ export async function readHsxAppConfig(root) {
         ...(loaded?.rateLimits !== undefined ? { rateLimits: loaded.rateLimits } : {}),
         ...(loaded?.alerts !== undefined ? { alerts: loaded.alerts } : {}),
         ...(loaded?.redaction !== undefined ? { redaction: loaded.redaction } : {}),
+        ...(loaded?.install !== undefined ? { install: loaded.install } : {}),
         // Helper-based declarations are only recoverable from the loaded module
         // (the literal parser cannot evaluate card(...) or mcpServer(...) calls).
         cards: loaded?.cards ?? [],
@@ -3969,6 +3991,20 @@ async function loadHsxAppConfigModule(root) {
         ? app
         : undefined;
 }
+function assertInstallSuccessUrl(value) {
+    let url;
+    try {
+        url = new URL(value);
+    }
+    catch {
+        throw new Error('install.successUrl must be an absolute HTTPS URL.');
+    }
+    const localHttp = url.protocol === 'http:' &&
+        (url.hostname === 'localhost' || url.hostname === '127.0.0.1' || url.hostname === '[::1]');
+    if ((url.protocol !== 'https:' && !localHttp) || url.username || url.password) {
+        throw new Error('install.successUrl must use HTTPS without embedded credentials (localhost HTTP is allowed for development).');
+    }
+}
 function readStringArrayProperty(source, propertyName) {
     const body = new RegExp(`${propertyName}\\s*:\\s*\\[([\\s\\S]*?)\\]`).exec(source)?.[1];
     if (!body) {
@@ -4251,14 +4287,15 @@ async function executeHubSpotOnlyUpload({ argv, root, local, persistBinding = tr
     await client.projects.ensureProject({ projectName });
     const hsproject = await readHubSpotProjectConfig(root);
     const configuredPlatformVersion = typeof hsproject.platformVersion === 'string' ? hsproject.platformVersion : undefined;
+    const platformVersion = prepared?.platformVersion ??
+        resolveFlag(argv, '--platform-version') ??
+        configuredPlatformVersion ??
+        '2026.03';
     const upload = await client.projects.upload({
         projectName,
         archivePath,
         message: prepared?.buildMessage ?? resolveFlag(argv, '--message') ?? 'HS-X HubSpot-only deploy',
-        platformVersion: prepared?.platformVersion ??
-            resolveFlag(argv, '--platform-version') ??
-            configuredPlatformVersion ??
-            '2026.03',
+        platformVersion,
         intermediateRepresentation,
         skipAutoDeploy: uploadOnly,
     });
@@ -4288,13 +4325,13 @@ async function executeHubSpotOnlyUpload({ argv, root, local, persistBinding = tr
         // therefore a strict build-only result.
         const autoDeployExpected = !uploadOnly && autoDeployEnabled === true && readStatus(buildStatus) === 'SUCCESS';
         const autoDeployStatus = autoDeployExpected
-            ? await waitForHubSpotAutoDeploy({
+            ? (await waitForHubSpotAutoDeploy({
                 client,
                 projectName,
                 buildId: upload.buildId,
                 buildStatus,
                 timeoutMs,
-            })
+            })).status
             : undefined;
         return {
             projectName,
@@ -4311,25 +4348,17 @@ async function executeHubSpotOnlyUpload({ argv, root, local, persistBinding = tr
             local,
         };
     }
-    const deploy = await withTransientDeployRetry(() => client.projects.deployBuild({
+    const deployed = await deployHubSpotProjectBuild({
+        client,
         projectName,
         buildId: upload.buildId,
         force: prepared?.force ?? argv.includes('--force'),
-    }));
-    const deployResultType = readStringProperty(deploy, 'buildResultType');
-    if (deployResultType === 'DEPLOY_BLOCKED') {
-        throw new Error(describeBlockedHubSpotDeploy(deploy));
-    }
-    const deployId = readNumericProperty(deploy, 'deployId') ?? readNumericProperty(deploy, 'id');
-    if (deployId === undefined) {
-        throw new Error(`HubSpot returned ${deployResultType ?? 'an unrecognized response'} without a deploy id.`);
-    }
-    const deployStatus = await waitForHubSpotDeployStatus({
-        client,
-        projectName,
-        deployId,
+        legacy: isLegacyProject(platformVersion),
         timeoutMs,
+        executeDeploy: (request) => withTransientDeployRetry(() => client.projects.deployBuild(request)),
     });
+    const deployId = deployed.deployId;
+    const deployStatus = deployed.status;
     const appId = await optionalHubSpotAppId(client, projectName, appUid);
     if (persistBinding) {
         await persistHubSpotAppBinding(root, {
@@ -4361,96 +4390,6 @@ async function optionalHubSpotAppId(client, projectName, appUid) {
         return 0;
     }
 }
-/**
- * Poll the auto-deploy triggered by a successful build until it reaches a
- * terminal state. The build status carries the deploy task locator
- * (deployStatusTaskLocator.id); absent/transient lookups resolve undefined —
- * the caller treats that as "could not verify", never as success.
- */
-async function waitForHubSpotAutoDeploy({ client, projectName, buildId, buildStatus, timeoutMs = 60_000, intervalMs = 2_000, }) {
-    const deadline = Date.now() + timeoutMs;
-    let latestBuildStatus = buildStatus;
-    let deployId = readHubSpotDeployLocator(latestBuildStatus);
-    let last;
-    while (Date.now() < deadline) {
-        if (deployId === undefined) {
-            try {
-                latestBuildStatus = await client.projects.getBuildStatus({ projectName, buildId });
-                deployId = readHubSpotDeployLocator(latestBuildStatus);
-            }
-            catch {
-                // The build may be visible before its auto-deploy locator. Keep trying
-                // until the same bounded timeout instead of declaring success.
-            }
-            if (deployId === undefined) {
-                await sleep(intervalMs);
-                continue;
-            }
-        }
-        try {
-            last = await client.projects.getDeployStatus({ projectName, deployId });
-        }
-        catch {
-            last = undefined;
-        }
-        const status = readStatus(last);
-        if (status && !isHubSpotDeployInProgress(status)) {
-            return last;
-        }
-        await new Promise((resolve) => setTimeout(resolve, intervalMs));
-    }
-    return last;
-}
-async function waitForHubSpotDeployStatus({ client, projectName, deployId, timeoutMs, intervalMs = 1_000, }) {
-    const deadline = Date.now() + timeoutMs;
-    let latest;
-    do {
-        latest = await client.projects.getDeployStatus({ projectName, deployId });
-        const status = readStatus(latest);
-        if (status && !isHubSpotDeployInProgress(status))
-            return latest;
-        await sleep(intervalMs);
-    } while (Date.now() < deadline);
-    return latest;
-}
-function isHubSpotDeployInProgress(status) {
-    return new Set([
-        'PENDING',
-        'QUEUED',
-        'BUILDING',
-        'DEPLOYING',
-        'PROCESSING',
-        'STARTED',
-        'IN_PROGRESS',
-    ]).has(status.toUpperCase());
-}
-function readHubSpotDeployLocator(value) {
-    if (!isRecord(value) || !isRecord(value.deployStatusTaskLocator))
-        return undefined;
-    const id = value.deployStatusTaskLocator.id;
-    if (typeof id === 'number')
-        return id;
-    if (typeof id !== 'string')
-        return undefined;
-    const parsed = Number.parseInt(id, 10);
-    return Number.isNaN(parsed) ? undefined : parsed;
-}
-async function waitForHubSpotBuildStatus({ client, projectName, buildId, timeoutMs, intervalMs, }) {
-    const startedAt = Date.now();
-    let latest;
-    do {
-        latest = await client.projects.getBuildStatus({ projectName, buildId });
-        const status = readStatus(latest);
-        if (status === 'SUCCESS' || status === 'FAILURE') {
-            return latest;
-        }
-        await sleep(intervalMs);
-    } while (Date.now() - startedAt < timeoutMs);
-    return latest;
-}
-function sleep(ms) {
-    return new Promise((resolve) => setTimeout(resolve, ms));
-}
 async function readHubSpotProjectIntermediateRepresentation(root) {
     const hsproject = await readHubSpotProjectConfig(root);
     const srcDir = typeof hsproject.srcDir === 'string' ? hsproject.srcDir : 'src';
@@ -4561,41 +4500,6 @@ async function collectHubSpotMetaFiles(root) {
     await walk(root);
     return files.sort();
 }
-function readNumericProperty(value, key) {
-    if (!isRecord(value))
-        return undefined;
-    const property = value[key];
-    if (typeof property === 'number')
-        return property;
-    if (typeof property !== 'string')
-        return undefined;
-    const parsed = Number.parseInt(property, 10);
-    return Number.isNaN(parsed) ? undefined : parsed;
-}
-function readStringProperty(value, key) {
-    return isRecord(value) && typeof value[key] === 'string' ? value[key] : undefined;
-}
-function describeBlockedHubSpotDeploy(value) {
-    if (!isRecord(value))
-        return 'HubSpot blocked the deploy.';
-    const candidates = [value.issues, value.blockingIssues, value.errors, value.message];
-    const details = candidates.flatMap((candidate) => {
-        if (typeof candidate === 'string')
-            return [candidate];
-        if (!Array.isArray(candidate))
-            return [];
-        return candidate.map((item) => {
-            if (typeof item === 'string')
-                return item;
-            if (!isRecord(item))
-                return String(item);
-            return String(item.message ?? item.reason ?? item.description ?? JSON.stringify(item));
-        });
-    });
-    return details.length > 0
-        ? `HubSpot blocked the deploy: ${details.join('; ')}`
-        : 'HubSpot blocked the deploy. Re-run with --force only after reviewing its removal warnings.';
-}
 function readBooleanProperty(value, key) {
     return isRecord(value) && typeof value[key] === 'boolean' ? value[key] : undefined;
 }
@@ -5364,6 +5268,7 @@ const deployOptions = {
     heartbeat: Options.boolean('heartbeat').pipe(Options.withDefault(false)), // --heartbeat
     noHeartbeat: Options.boolean('no-heartbeat').pipe(Options.withDefault(false)), // --no-heartbeat
     useEnv: Options.boolean('use-env').pipe(Options.withDefault(false)), // --use-env
+    diagnosticCardSignatureCapture: Options.boolean('diagnostic-card-signature-capture').pipe(Options.withDefault(false)),
     // Declared explicitly: without it @effect/cli treats `--no-record` as the
     // negation of an undeclared `record` boolean and fails routing with a
     // confusing root-level "Invalid subcommand" error (the flag is documented).
@@ -5428,6 +5333,7 @@ const deployBaseCmd = Command.make('deploy', deployOptions, (opts) => runHandler
     flag('--heartbeat', opts.heartbeat);
     flag('--no-heartbeat', opts.noHeartbeat);
     flag('--use-env', opts.useEnv);
+    flag('--diagnostic-card-signature-capture', opts.diagnosticCardSignatureCapture);
     flag('--no-record', opts.noRecord);
     flag('--portal-schema-live', opts.portalSchemaLive);
     flag('--local-hubspot-schema', opts.localHubspotSchema);