@hs-x/cli 0.4.5 → 0.4.6

package/dist/commands/deploy.js

@@ -15,6 +15,7 @@ import { Effect, Option } from 'effect';
 import { isLinked } from '../account-store.js';
 import { exitWith } from '../cli-error.js';
 import { accountIdOption, controlPlaneUrlOption, cwdOption, deployIdOption, forceOption, jsonOption, projectIdOption, runHandler, runQuarantined, userIdOption, yesOption, } from '../cli/kit.js';
+import { classifyCloudflareCommandFailure, preflightCloudflareAnalyticsEngine, validateCloudflareResourceForAccount, } from '../cloudflare-account-preflight.js';
 import { resolveCloudflareCredentials } from '../cloudflare-kv.js';
 import { loadCloudflarePointer } from '../cloudflare-pointer.js';
 import { resolveOrProvisionCloudflareScopedResource } from '../cloudflare-scoped-resource.js';
@@ -475,6 +476,28 @@ async function hydrateCloudflareTokenFromStoredOAuth(input) {
         return false;
     }
 }
+/**
+ * Prefer the account-scoped Cloudflare connection held by the control plane.
+ * This keeps an explicit `--account-id` deploy from being redirected by a
+ * stale local `.hs-x/cloudflare.json` pointer or an unrelated stored OAuth
+ * connection on a machine that works across several HS-X accounts.
+ */
+async function hydrateCloudflareTokenFromControlPlane(input) {
+    // A command-line credential is an intentional one-run override. Ambient
+    // env credentials are not: on a multi-account machine they commonly point
+    // at a different Cloudflare account, so a linked deploy must replace them
+    // with the selected HS-X account's leased credential pair.
+    if (resolveFlag(input.argv, '--cloudflare-api-token') || resolveFlag(input.argv, '--api-token')) {
+        return false;
+    }
+    const { leaseCloudflareViaSession } = await import('../tenant-state.js');
+    const lease = await leaseCloudflareViaSession(input.argv, input.root);
+    if (!lease)
+        return false;
+    process.env.CLOUDFLARE_API_TOKEN = lease.apiToken;
+    process.env.CLOUDFLARE_ACCOUNT_ID = lease.cloudflareAccountId;
+    return true;
+}
 async function waitForHealthyControlPlaneDrift({ controlPlaneUrl, projectId, deployId, userId, timeoutMs, workerUrl, }) {
     const startedAt = Date.now();
     let lastState = 'unknown';
@@ -1417,10 +1440,8 @@ export async function deployCommand({ argv, root, json, }) {
     // (`--yes`) preflight succeed instead of demanding a token connect says
     // doesn't exist (cold-stranger run 2026-07-22-001, finding #1).
     if (cloudflareDeployRequested && !planOnly && !cloudflareDryRun) {
-        const hydrated = await hydrateCloudflareTokenFromStoredOAuth({
-            argv,
-            root,
-        });
+        const hydrated = (controlPlaneUrl ? await hydrateCloudflareTokenFromControlPlane({ argv, root }) : false) ||
+            (await hydrateCloudflareTokenFromStoredOAuth({ argv, root }));
         if (hydrated && echo) {
             echo.info('Using the Cloudflare connection from `hs-x connect cloudflare`.');
         }
@@ -2687,6 +2708,26 @@ async function executeCloudflareDeploy({ argv, root, workers, controlPlanePlan,
     if (!controlPlaneUrl && !dryRun) {
         await preflightTenantStateCredentials({ argv, root });
     }
+    if (controlPlaneUrl && !dryRun) {
+        const credentials = resolveCloudflareCredentials(argv);
+        if (!credentials.accountId || !credentials.apiToken) {
+            throw new Error('Linked Cloudflare deploy requires an account id and API token from the connected credential lease.');
+        }
+        // Read-only and intentionally first: a fresh Cloudflare account otherwise
+        // fails only at Worker upload, after KV/D1 provisioning has already run.
+        await preflightCloudflareAnalyticsEngine({
+            accountId: credentials.accountId,
+            apiToken: credentials.apiToken,
+        });
+        // Tenant provisioning authorizes only registered projects. Register the
+        // plan scope before any Worker enters that authority, not after recordDeploy.
+        await ensureHostedProjectRegistration({
+            controlPlaneUrl,
+            userId,
+            accountId: controlPlanePlan.accountId,
+            projectId: controlPlanePlan.projectId,
+        });
+    }
     const hasCardBackends = workers.some((worker) => worker.capabilities.some((capability) => capability.kind === 'card-backend'));
     if (hasCardBackends && !dryRun) {
         const appConfig = await readHsxAppConfig(root);
@@ -2731,6 +2772,7 @@ async function executeCloudflareDeploy({ argv, root, workers, controlPlanePlan,
                 controlPlaneUrl,
                 authorizationHeaders: () => controlPlaneAuthHeaders(userId),
                 http: hostedHttp,
+                validateCompleteResources: (resources) => validateTenantDataPlaneResourcesForActiveAccount(argv, root, resources),
             }),
         }
         : {});
@@ -2952,7 +2994,13 @@ async function executeCloudflareWorkerDeploy({ argv, root, worker, index, allowC
             `${resolvedHubSpotClientSecret ? '' : ' — no client secret; card verification will fail closed'}\n`);
     }
     const hubSpotScopesForRuntime = await readHsxAppScopesForDeploy(root);
-    const billingRuntimeToken = controlPlaneUrl && appConfig.billing && !dryRun
+    // The same scoped runtime bearer authenticates both hosted billing and the
+    // redacted install-lifecycle telemetry emitted by linked OAuth Workers.
+    // Provision it whenever either consumer is present. Gating this solely on
+    // `appConfig.billing` leaves ordinary OAuth apps with generated telemetry
+    // code but no HSX_RUNTIME_TOKEN binding, making every emit a silent no-op.
+    const needsRuntimeControlPlaneToken = appConfig.billing !== undefined || appConfig.auth === 'oauth';
+    const billingRuntimeToken = controlPlaneUrl && needsRuntimeControlPlaneToken && !dryRun
         ? await requestDeployBillingRuntimeToken({
             controlPlaneUrl,
             userId,
@@ -3273,8 +3321,24 @@ async function ensureTenantDeployInstallRuntimeBinding(input) {
             ], {
                 cwd: input.root,
                 env: cloudflareDeployEnv(input.argv),
+            }).catch((error) => {
+                if (!/already exists/i.test(String(error)))
+                    throw error;
+                return undefined;
             });
-            const resourceId = extractKvNamespaceId(`${namespaceOutput.stdout}\n${namespaceOutput.stderr}`);
+            let resourceId = namespaceOutput
+                ? extractKvNamespaceId(`${namespaceOutput.stdout}\n${namespaceOutput.stderr}`)
+                : undefined;
+            if (!namespaceOutput) {
+                const listed = await runCloudflareCommand(['bun', 'x', 'wrangler', 'kv', 'namespace', 'list'], { cwd: input.root, env: cloudflareDeployEnv(input.argv) });
+                try {
+                    const namespaces = JSON.parse(listed.stdout);
+                    resourceId = namespaces.find((namespace) => namespace.title === installKvNamespaceName)?.id;
+                }
+                catch {
+                    resourceId = undefined;
+                }
+            }
             if (!resourceId) {
                 throw new Error('Could not read Cloudflare KV namespace id from wrangler output.');
             }
@@ -3310,21 +3374,33 @@ async function ensureTenantDeployInstallRuntimeBinding(input) {
 async function ensureDeployInstallRuntimeBinding(input) {
     const existing = await readDeployInstallRuntimeBinding(input);
     if (existing) {
-        // Control-plane metadata carries no key custody (and never key bytes) —
-        // on a machine that never generated the key this is worker-secret-only.
-        return {
-            installKvNamespaceId: existing.installKvNamespaceId,
-            installKvNamespaceName: existing.installKvNamespaceName,
-            tokenKeySecretName: existing.tokenKeySecretName,
-            ...(existing.tenantD1DatabaseId ? { tenantD1DatabaseId: existing.tenantD1DatabaseId } : {}),
-            ...(existing.tenantD1DatabaseName
-                ? { tenantD1DatabaseName: existing.tenantD1DatabaseName }
-                : {}),
-            ...(existing.flagsKvNamespaceId ? { flagsKvNamespaceId: existing.flagsKvNamespaceId } : {}),
-            ...(existing.flagsKvNamespaceName
-                ? { flagsKvNamespaceName: existing.flagsKvNamespaceName }
-                : {}),
-        };
+        const credentials = resolveCloudflareCredentials(input.argv);
+        if (!credentials.accountId || !credentials.apiToken) {
+            throw new Error('Could not validate the stored install KV without Cloudflare credentials.');
+        }
+        const valid = await validateCloudflareResourceForDeploy({
+            argv: input.argv,
+            root: input.root,
+            kind: 'install-kv',
+            resourceId: existing.installKvNamespaceId,
+        });
+        if (valid) {
+            // Control-plane metadata carries no key custody (and never key bytes) —
+            // on a machine that never generated the key this is worker-secret-only.
+            return {
+                installKvNamespaceId: existing.installKvNamespaceId,
+                installKvNamespaceName: existing.installKvNamespaceName,
+                tokenKeySecretName: existing.tokenKeySecretName,
+                ...(existing.tenantD1DatabaseId ? { tenantD1DatabaseId: existing.tenantD1DatabaseId } : {}),
+                ...(existing.tenantD1DatabaseName
+                    ? { tenantD1DatabaseName: existing.tenantD1DatabaseName }
+                    : {}),
+                ...(existing.flagsKvNamespaceId ? { flagsKvNamespaceId: existing.flagsKvNamespaceId } : {}),
+                ...(existing.flagsKvNamespaceName
+                    ? { flagsKvNamespaceName: existing.flagsKvNamespaceName }
+                    : {}),
+            };
+        }
     }
     if (input.dryRun) {
         return undefined;
@@ -3364,8 +3440,24 @@ async function ensureDeployInstallRuntimeBinding(input) {
             ], {
                 cwd: input.root,
                 env: cloudflareDeployEnv(input.argv),
+            }).catch((error) => {
+                if (!/already exists/i.test(String(error)))
+                    throw error;
+                return undefined;
             });
-            const resourceId = extractKvNamespaceId(`${namespaceOutput.stdout}\n${namespaceOutput.stderr}`);
+            let resourceId = namespaceOutput
+                ? extractKvNamespaceId(`${namespaceOutput.stdout}\n${namespaceOutput.stderr}`)
+                : undefined;
+            if (!namespaceOutput) {
+                const listed = await runCloudflareCommand(['bun', 'x', 'wrangler', 'kv', 'namespace', 'list'], { cwd: input.root, env: cloudflareDeployEnv(input.argv) });
+                try {
+                    const namespaces = JSON.parse(listed.stdout);
+                    resourceId = namespaces.find((namespace) => namespace.title === installKvNamespaceName)?.id;
+                }
+                catch {
+                    resourceId = undefined;
+                }
+            }
             if (!resourceId) {
                 throw new Error('Could not read Cloudflare KV namespace id from wrangler output.');
             }
@@ -3436,6 +3528,25 @@ async function putDeployInstallRuntimeBinding(input) {
         throw new Error(`Could not store scoped install runtime binding: ${message}`);
     }
 }
+async function ensureHostedProjectRegistration(input) {
+    const response = await hostedHttp({
+        url: new URL(`/v1/accounts/${encodeURIComponent(input.accountId)}/projects`, input.controlPlaneUrl),
+        method: 'POST',
+        headers: await controlPlaneAuthHeaders(input.userId),
+        body: { projectId: input.projectId, displayName: input.projectId },
+    });
+    if (response.ok || response.status === 409)
+        return;
+    // The in-process legacy control-plane test adapter predates the extracted
+    // project router. Production exposes this route; tolerate only absence.
+    if (response.status === 404 || response.status === 405)
+        return;
+    const body = await response.json().catch(() => undefined);
+    const message = isRecord(body) && typeof body.message === 'string'
+        ? body.message
+        : `Control plane returned ${response.status}.`;
+    throw new Error(`Could not register project before tenant provisioning: ${message}`);
+}
 async function requestDeployBillingRuntimeToken(input) {
     const response = await hostedHttp({
         url: new URL(`/v1/accounts/${encodeURIComponent(input.accountId)}/projects/${encodeURIComponent(input.projectId)}/billing/runtime-token`, input.controlPlaneUrl),
@@ -3499,6 +3610,10 @@ async function ensureTenantDataPlane(input) {
         hubSpotAppId: input.hubSpotAppId,
     });
     const env = cloudflareDeployEnv(input.argv);
+    const cloudflareCredentials = resolveCloudflareCredentials(input.argv);
+    if (!cloudflareCredentials.accountId || !cloudflareCredentials.apiToken) {
+        throw new Error('Tenant data-plane provisioning requires Cloudflare credentials.');
+    }
     // Exact local state wins; exact control-plane refs recover a linked deploy
     // when its tenant-state binding was lost. Name-only create/adopt remains
     // available for short legacy-compatible names only.
@@ -3509,6 +3624,18 @@ async function ensureTenantDataPlane(input) {
         kind: 'tenant-d1',
         ...(exactTenantD1DatabaseId ? { exactResourceId: exactTenantD1DatabaseId } : {}),
         ...(exactTenantD1DatabaseName ? { exactResourceName: exactTenantD1DatabaseName } : {}),
+        validateExactResource: (resourceId) => {
+            const credentials = resolveCloudflareCredentials(input.argv);
+            if (!credentials.accountId || !credentials.apiToken) {
+                throw new Error('Could not validate the stored tenant D1 without Cloudflare credentials.');
+            }
+            return validateCloudflareResourceForDeploy({
+                argv: input.argv,
+                root: input.root,
+                kind: 'tenant-d1',
+                resourceId,
+            });
+        },
         async provisionByName(tenantD1DatabaseName) {
             const created = await runCloudflareCommand(['bun', 'x', 'wrangler', 'd1', 'create', tenantD1DatabaseName], { cwd: input.root, env }).catch((error) => {
                 if (!/already exists/i.test(String(error)))
@@ -3538,6 +3665,18 @@ async function ensureTenantDataPlane(input) {
         kind: 'flags-kv',
         ...(exactFlagsKvNamespaceId ? { exactResourceId: exactFlagsKvNamespaceId } : {}),
         ...(exactFlagsKvNamespaceName ? { exactResourceName: exactFlagsKvNamespaceName } : {}),
+        validateExactResource: (resourceId) => {
+            const credentials = resolveCloudflareCredentials(input.argv);
+            if (!credentials.accountId || !credentials.apiToken) {
+                throw new Error('Could not validate the stored flags KV without Cloudflare credentials.');
+            }
+            return validateCloudflareResourceForDeploy({
+                argv: input.argv,
+                root: input.root,
+                kind: 'flags-kv',
+                resourceId,
+            });
+        },
         async provisionByName(flagsKvNamespaceName) {
             const created = await runCloudflareCommand([
                 'bun',
@@ -3607,6 +3746,7 @@ async function ensureTenantDataPlane(input) {
         updatedAt: new Date().toISOString(),
     }));
     return {
+        cloudflareAccountId: cloudflareCredentials.accountId,
         tenantD1DatabaseId,
         tenantD1DatabaseName,
         flagsKvNamespaceId,
@@ -3615,6 +3755,62 @@ async function ensureTenantDataPlane(input) {
         syncGrantSecretValue,
     };
 }
+async function validateTenantDataPlaneResourcesForActiveAccount(argv, root, resources) {
+    const credentials = resolveCloudflareCredentials(argv);
+    if (!credentials.accountId || !credentials.apiToken) {
+        throw new Error('Could not validate tenant resources without Cloudflare credentials.');
+    }
+    if (resources.cloudflareAccountId && resources.cloudflareAccountId !== credentials.accountId) {
+        return false;
+    }
+    const [tenantD1Valid, flagsKvValid] = await Promise.all([
+        validateCloudflareResourceForDeploy({
+            argv,
+            root,
+            kind: 'tenant-d1',
+            resourceId: resources.tenantD1DatabaseId,
+        }),
+        validateCloudflareResourceForDeploy({
+            argv,
+            root,
+            kind: 'flags-kv',
+            resourceId: resources.flagsKvNamespaceId,
+        }),
+    ]);
+    return tenantD1Valid && flagsKvValid;
+}
+async function validateCloudflareResourceForDeploy(input) {
+    const credentials = resolveCloudflareCredentials(input.argv);
+    if (!credentials.accountId || !credentials.apiToken) {
+        throw new Error('Could not validate Cloudflare resources without connected credentials.');
+    }
+    try {
+        return await validateCloudflareResourceForAccount({
+            accountId: credentials.accountId,
+            apiToken: credentials.apiToken,
+            kind: input.kind,
+            resourceId: input.resourceId,
+        });
+    }
+    catch (error) {
+        if (!/\((?:401|403)\)/.test(String(error)))
+            throw error;
+    }
+    const command = input.kind === 'tenant-d1'
+        ? ['bun', 'x', 'wrangler', 'd1', 'list', '--json']
+        : ['bun', 'x', 'wrangler', 'kv', 'namespace', 'list'];
+    const listed = await runCloudflareCommand(command, {
+        cwd: input.root,
+        env: cloudflareDeployEnv(input.argv),
+    });
+    try {
+        const rows = JSON.parse(listed.stdout);
+        return rows.some((row) => row.id === input.resourceId || row.uuid === input.resourceId);
+    }
+    catch {
+        throw new Error(`HSX_E_CLOUDFLARE_RESOURCE_VALIDATION_FAILED: Wrangler returned malformed ${input.kind} list output.`);
+    }
+}
 export function renderWranglerConfig(input) {
     const lines = [
         '# Generated by hs-x. Do not edit by hand.',
@@ -4279,7 +4475,14 @@ function runCloudflareCommand(command, options) {
                 resolvePromise({ stdout, stderr });
             }
             else {
-                rejectPromise(new Error(`Cloudflare deploy failed with exit code ${code ?? 'unknown'}.\n${stderr || stdout}`));
+                rejectPromise(classifyCloudflareCommandFailure({
+                    ...(options.env.CLOUDFLARE_ACCOUNT_ID
+                        ? { accountId: options.env.CLOUDFLARE_ACCOUNT_ID }
+                        : {}),
+                    stdout,
+                    stderr,
+                    exitCode: code,
+                }));
             }
         });
     })).pipe(Effect.withSpan('cli.deploy.cloudflare_command', {