@hs-x/cli 0.4.6 → 0.4.7

package/dist/commands/deploy.js

@@ -16,9 +16,9 @@ import { isLinked } from '../account-store.js';
 import { exitWith } from '../cli-error.js';
 import { accountIdOption, controlPlaneUrlOption, cwdOption, deployIdOption, forceOption, jsonOption, projectIdOption, runHandler, runQuarantined, userIdOption, yesOption, } from '../cli/kit.js';
 import { classifyCloudflareCommandFailure, preflightCloudflareAnalyticsEngine, validateCloudflareResourceForAccount, } from '../cloudflare-account-preflight.js';
-import { resolveCloudflareCredentials } from '../cloudflare-kv.js';
+import { applyLeasedCloudflareCredentials, resolveCloudflareCredentials, } from '../cloudflare-kv.js';
 import { loadCloudflarePointer } from '../cloudflare-pointer.js';
-import { resolveOrProvisionCloudflareScopedResource } from '../cloudflare-scoped-resource.js';
+import { parseWranglerJsonArray, resolveOrProvisionCloudflareScopedResource, } from '../cloudflare-scoped-resource.js';
 import { DEFAULT_CONTROL_PLANE_URL, formatConfigUrl, loadCliConfig, resolveControlPlaneUrl, } from '../config.js';
 import { CLI_VERSION } from '../constants.js';
 import { controlPlaneAuthHeaders } from '../control-plane-fetch.js';
@@ -31,6 +31,7 @@ import { DirectHubSpotAccountResolutionError, createDeployHubSpotDeveloperClient
 import { HubSpotProjectArchiveSourceError, fingerprintHubSpotArchiveSource, writeLocalHubSpotProjectArchive, } from '../hubspot-project-archive.js';
 import { deployHubSpotProjectBuild, readHubSpotSubbuildStatuses, waitForHubSpotAutoDeploy, waitForHubSpotBuildStatus, } from '../hubspot-project-lifecycle.js';
 import { detectLocalProjectMode, readHubSpotProjectDescriptor, validateHubSpotProject, } from '../hubspot-project.js';
+import { linkMigrationJournalId, loadLinkMigrationJournal } from '../link-migration-journal.js';
 import { hydrateAncestorEnv } from '../load-env.js';
 import { LocalProjectPickerCancelled, resolveLocalProject } from '../local-project-picker.js';
 import { getMachineId, getMachineSecret, previewMachineId } from '../machine-id.js';
@@ -42,7 +43,7 @@ import { createReporter } from '../reporter/index.js';
 import { Cwd } from '../services/cwd.js';
 import { createTenantDataPlaneProvisioningCoordinator, } from '../tenant-data-plane-provisioning.js';
 import { ensureTenantStateStore, preflightTenantStateCredentials, } from '../tenant-state.js';
-import { defaultTokenKeyCustodyAdapter, escrowTokenKey, resolveEscrowedTokenKey, tokenKeyCustodyIdFor, } from '../token-key-custody.js';
+import { defaultTokenKeyCustodyAdapter, escrowTokenKey, resolveEscrowedTokenKey, sealTokenKeyCanary, tokenKeyCustodyAdapterFor, tokenKeyCustodyIdFor, } from '../token-key-custody.js';
 import { deployPromoteCommand, requestControlPlaneDeployPromotion } from './deploy-promote.js';
 import { withTransientDeployRetry } from './deploy-retry.js';
 async function hostedHttp(input) {
@@ -494,11 +495,13 @@ async function hydrateCloudflareTokenFromControlPlane(input) {
     const lease = await leaseCloudflareViaSession(input.argv, input.root);
     if (!lease)
         return false;
-    process.env.CLOUDFLARE_API_TOKEN = lease.apiToken;
-    process.env.CLOUDFLARE_ACCOUNT_ID = lease.cloudflareAccountId;
+    applyLeasedCloudflareCredentials({
+        apiToken: lease.apiToken,
+        accountId: lease.cloudflareAccountId,
+    });
     return true;
 }
-async function waitForHealthyControlPlaneDrift({ controlPlaneUrl, projectId, deployId, userId, timeoutMs, workerUrl, }) {
+async function waitForHealthyControlPlaneDrift({ controlPlaneUrl, accountId, projectId, deployId, userId, timeoutMs, workerUrl, }) {
     const startedAt = Date.now();
     let lastState = 'unknown';
     let lastReason;
@@ -508,7 +511,7 @@ async function waitForHealthyControlPlaneDrift({ controlPlaneUrl, projectId, dep
         }
         const response = await hostedHttp({
             url: new URL(`/v1/projects/${encodeURIComponent(projectId)}/drift`, controlPlaneUrl),
-            headers: await controlPlaneAuthHeaders(userId),
+            headers: await controlPlaneAuthHeaders(userId, undefined, accountId),
         });
         const body = await response.json().catch(() => undefined);
         if (response.ok) {
@@ -976,7 +979,7 @@ async function executeHubSpotDirectDeployCommand({ argv, root, json, }) {
             ? (readStatus(uploaded.deployStatus) ?? 'UNKNOWN')
             : undefined;
         const deployUnverified = uploaded.autoDeployExpected && deployState === undefined;
-        const ok = buildState === 'SUCCESS' && !deployUnverified && (!deployState || deployState === 'SUCCESS');
+        const ok = hubSpotUploadSucceeded(uploaded);
         const result = {
             schema_version: 1,
             ok,
@@ -1101,8 +1104,14 @@ export async function deployCommand({ argv, root, json, }) {
     const noHeartbeat = argv.includes('--no-heartbeat');
     const noRecord = argv.includes('--no-record');
     const explicitControlPlaneUrl = resolveFlag(argv, '--control-plane-url');
-    const controlPlaneUrl = explicitControlPlaneUrl ?? (planOnly ? undefined : process.env.HSX_CONTROL_PLANE_URL);
     const linked = await isLinked();
+    const controlPlaneUrl = resolveDeployControlPlaneUrl({
+        explicitControlPlaneUrl,
+        environmentControlPlaneUrl: process.env.HSX_CONTROL_PLANE_URL,
+        platformControlPlaneUrl: resolveControlPlaneUrl(argv),
+        linked,
+        planOnly,
+    });
     const userId = resolveFlag(argv, '--user-id') ?? process.env.HSX_USER_ID ?? 'local-cli-user';
     const resolvedAcct = await resolveAccountIdOrPrompt({
         argv,
@@ -1156,7 +1165,6 @@ export async function deployCommand({ argv, root, json, }) {
     const needsHubSpotBundle = needsRuntime || app.mcpServers.length > 0;
     const { deploymentMode, cloudflareDeployRequested, hubspotUploadRequested } = resolveDeployTargets({
         buildOnly,
-        planOnly,
         needsRuntime,
         hasProjectId: Boolean(projectId),
         hubspotOnly,
@@ -1468,7 +1476,17 @@ export async function deployCommand({ argv, root, json, }) {
     // Worker origin is resolvable up front, upload BEFORE the Cloudflare deploy so
     // the minted app id binds in a single pass. Falls back to the original
     // deploy-then-upload order whenever the origin can't be resolved.
-    const appIdKnownBeforeDeploy = readOptionalHubSpotAppId(resolveFlag(argv, '--hubspot-app-id') ?? process.env.HSX_HUBSPOT_APP_ID) ?? (await readPersistedHubSpotAppId(root, await resolveHubSpotProjectName(argv, root)));
+    const appIdKnownBeforeDeploy = controlPlanePlan && controlPlaneBackedPlan && controlPlaneUrl
+        ? await resolveHubSpotAppIdForDeploy({
+            argv,
+            root,
+            controlPlaneUrl,
+            userId,
+            accountId: controlPlanePlan.accountId,
+            projectId: controlPlanePlan.projectId,
+            environment: resolveFlag(argv, '--env') ?? resolveFlag(argv, '--environment') ?? 'production',
+        })
+        : (readOptionalHubSpotAppId(resolveFlag(argv, '--hubspot-app-id') ?? process.env.HSX_HUBSPOT_APP_ID) ?? (await readPersistedHubSpotAppId(root, await resolveHubSpotProjectName(argv, root))));
     const uploadFirstOrigin = cloudflareDeployRequested &&
         !cloudflareDryRun &&
         !planOnly &&
@@ -1617,6 +1635,10 @@ export async function deployCommand({ argv, root, json, }) {
                         plan: controlPlanePlan,
                         promoteWhenHealthy,
                         ...(capturedRevision ? { revision: capturedRevision } : {}),
+                        ...(() => {
+                            const deployedWorkerUrl = cloudflareDeployResult?.workers.find((worker) => worker.url)?.url;
+                            return deployedWorkerUrl ? { workerUrl: deployedWorkerUrl } : {};
+                        })(),
                     })
                     : controlPlaneUrl
                         ? await requestHostedControlPlaneDeployRecordAndMaybePromote({
@@ -1715,7 +1737,7 @@ export async function deployCommand({ argv, root, json, }) {
     // run-008 build #2's failure mode. Only a SUCCESS status counts.
     const hubspotUploadFailed = !planOnly &&
         hubspotUploadRequested &&
-        (!hubspotUploadResult || readStatus(hubspotUploadResult.buildStatus) !== 'SUCCESS');
+        (!hubspotUploadResult || !hubSpotUploadSucceeded(hubspotUploadResult));
     const cloudflareDeployed = !planOnly && cloudflareDeployRequested && Boolean(cloudflareDeployResult);
     // A live worker with only the HubSpot upload failing: not a clean success,
     // but distinct from total failure so callers don't tear down a good worker.
@@ -1831,6 +1853,16 @@ export async function deployCommand({ argv, root, json, }) {
     // automation doesn't treat a serving worker as a total failure), 1 = failure.
     return { exitCode: plan.ok ? 0 : plan.partial ? 20 : 1 };
 }
+/** @internal Exported for the linked-default deploy regression suite. */
+export function resolveDeployControlPlaneUrl(input) {
+    if (input.explicitControlPlaneUrl)
+        return input.explicitControlPlaneUrl;
+    if (input.planOnly)
+        return undefined;
+    if (input.linked)
+        return input.platformControlPlaneUrl;
+    return input.environmentControlPlaneUrl;
+}
 function buildDeployPlanSummary(input) {
     const lines = ['', 'Planned changes:'];
     const capCount = input.workers.reduce((c, w) => c + w.capabilities.length, 0);
@@ -2701,6 +2733,14 @@ function defaultHubSpotFieldType(type) {
             return 'text';
     }
 }
+/** @internal Exported for deterministic deploy-outcome regression tests. */
+export function hubSpotUploadSucceeded(upload) {
+    if (readStatus(upload.buildStatus) !== 'SUCCESS')
+        return false;
+    if (upload.deployStatus !== undefined)
+        return readStatus(upload.deployStatus) === 'SUCCESS';
+    return !upload.autoDeployExpected;
+}
 async function executeCloudflareDeploy({ argv, root, workers, controlPlanePlan, controlPlaneUrl, userId, machineId, machineSecret, heartbeatEnabled, dryRun, note, }) {
     // Fail fast on missing Cloudflare credentials BEFORE deploying any Worker, so
     // an unlinked deploy can't leave a Worker live and then error on the
@@ -2733,7 +2773,15 @@ async function executeCloudflareDeploy({ argv, root, workers, controlPlanePlan,
         const appConfig = await readHsxAppConfig(root);
         const environment = resolveFlag(argv, '--env') ?? resolveFlag(argv, '--environment') ?? 'production';
         const authUrl = await resolveHubSpotAppAuthUrl(argv, root);
-        const hubspotAppId = requireHubSpotCardAppId(readOptionalHubSpotAppId(resolveFlag(argv, '--hubspot-app-id') ?? process.env.HSX_HUBSPOT_APP_ID) ?? (await readPersistedHubSpotAppId(root, await resolveHubSpotProjectName(argv, root))), authUrl);
+        const hubspotAppId = requireHubSpotCardAppId(await resolveHubSpotAppIdForDeploy({
+            argv,
+            root,
+            ...(controlPlaneUrl ? { controlPlaneUrl } : {}),
+            userId,
+            accountId: controlPlanePlan.accountId,
+            projectId: controlPlanePlan.projectId,
+            environment,
+        }), authUrl);
         const stored = controlPlaneUrl
             ? await readDeployHubSpotOAuthSecret({
                 controlPlaneUrl,
@@ -2770,7 +2818,7 @@ async function executeCloudflareDeploy({ argv, root, workers, controlPlanePlan,
         ? {
             authority: createControlPlaneTenantProvisioningAuthority({
                 controlPlaneUrl,
-                authorizationHeaders: () => controlPlaneAuthHeaders(userId),
+                authorizationHeaders: () => controlPlaneAuthHeaders(userId, undefined, controlPlanePlan.accountId),
                 http: hostedHttp,
                 validateCompleteResources: (resources) => validateTenantDataPlaneResourcesForActiveAccount(argv, root, resources),
             }),
@@ -3294,9 +3342,15 @@ async function ensureTenantDeployInstallRuntimeBinding(input) {
             hubSpotAppId: input.hubSpotAppId,
         },
         kind: 'install-kv',
+        legacyResourceNameExists: (resourceName) => cloudflareResourceNameExists({
+            argv: input.argv,
+            root: input.root,
+            kind: 'install-kv',
+            resourceName,
+        }),
         async provisionByName(installKvNamespaceName) {
             // ADR-022: generate and escrow the token key before creating Cloudflare
-            // state, but only after long ambiguous names have already failed closed.
+            // state, after long-name recovery ambiguity has already been ruled out.
             const tokenKeySecretValue = randomBytes(32).toString('base64url');
             const tokenKeyCustody = await escrowTokenKey({
                 adapter: defaultTokenKeyCustodyAdapter(),
@@ -3332,7 +3386,7 @@ async function ensureTenantDeployInstallRuntimeBinding(input) {
             if (!namespaceOutput) {
                 const listed = await runCloudflareCommand(['bun', 'x', 'wrangler', 'kv', 'namespace', 'list'], { cwd: input.root, env: cloudflareDeployEnv(input.argv) });
                 try {
-                    const namespaces = JSON.parse(listed.stdout);
+                    const namespaces = parseWranglerJsonArray(listed.stdout);
                     resourceId = namespaces.find((namespace) => namespace.title === installKvNamespaceName)?.id;
                 }
                 catch {
@@ -3372,6 +3426,9 @@ async function ensureTenantDeployInstallRuntimeBinding(input) {
     };
 }
 async function ensureDeployInstallRuntimeBinding(input) {
+    const preserved = await recoverCompletedLinkInstallRuntimeBinding(input);
+    if (preserved)
+        return preserved;
     const existing = await readDeployInstallRuntimeBinding(input);
     if (existing) {
         const credentials = resolveCloudflareCredentials(input.argv);
@@ -3413,9 +3470,15 @@ async function ensureDeployInstallRuntimeBinding(input) {
             hubSpotAppId: input.hubSpotAppId,
         },
         kind: 'install-kv',
+        legacyResourceNameExists: (resourceName) => cloudflareResourceNameExists({
+            argv: input.argv,
+            root: input.root,
+            kind: 'install-kv',
+            resourceName,
+        }),
         async provisionByName(installKvNamespaceName) {
-            // ADR-022: escrow precedes Cloudflare mutation, while the ambiguity
-            // guard precedes both. The control plane never receives key bytes.
+            // ADR-022: escrow precedes Cloudflare mutation, while the legacy-name
+            // ambiguity guard precedes both. The control plane never receives key bytes.
             const tokenKeySecretValue = randomBytes(32).toString('base64url');
             const tokenKeyCustody = await escrowTokenKey({
                 adapter: defaultTokenKeyCustodyAdapter(),
@@ -3451,7 +3514,7 @@ async function ensureDeployInstallRuntimeBinding(input) {
             if (!namespaceOutput) {
                 const listed = await runCloudflareCommand(['bun', 'x', 'wrangler', 'kv', 'namespace', 'list'], { cwd: input.root, env: cloudflareDeployEnv(input.argv) });
                 try {
-                    const namespaces = JSON.parse(listed.stdout);
+                    const namespaces = parseWranglerJsonArray(listed.stdout);
                     resourceId = namespaces.find((namespace) => namespace.title === installKvNamespaceName)?.id;
                 }
                 catch {
@@ -3485,10 +3548,106 @@ async function ensureDeployInstallRuntimeBinding(input) {
         tokenKeyCustody,
     };
 }
+/**
+ * A completed ADR-022 link journal is the authoritative preserve-set for the
+ * first linked redeploy. Rehydrate its exact INSTALL_KV and re-keyed token-key
+ * custody before consulting account-scoped control-plane metadata, which may
+ * not have been backfilled yet. This prevents link from silently provisioning
+ * a replacement namespace or key.
+ */
+async function recoverCompletedLinkInstallRuntimeBinding(input) {
+    const pointer = await loadCloudflarePointer(input.root);
+    if (!pointer || !pointer.ownerId.startsWith('acct_'))
+        return undefined;
+    const journal = await loadLinkMigrationJournal(linkMigrationJournalId({
+        cloudflareAccountId: pointer.cloudflareAccountId,
+        stateKvNamespaceId: pointer.stateKvNamespaceId,
+        newOwnerId: pointer.ownerId,
+    }));
+    if (!journal || journal.status !== 'done')
+        return undefined;
+    const binding = journal.bindings.find((candidate) => candidate.projectId === input.projectId &&
+        candidate.environment === input.environment &&
+        candidate.hubSpotAppId === input.hubSpotAppId);
+    if (!binding)
+        return undefined;
+    if (input.dryRun) {
+        return {
+            installKvNamespaceId: binding.installKvNamespaceId,
+            installKvNamespaceName: binding.installKvNamespaceName,
+            tokenKeySecretName: binding.tokenKeySecretName,
+        };
+    }
+    const valid = await validateCloudflareResourceForDeploy({
+        argv: input.argv,
+        root: input.root,
+        kind: 'install-kv',
+        resourceId: binding.installKvNamespaceId,
+    });
+    if (!valid) {
+        throw new Error(`The completed link journal's preserved install KV ${binding.installKvNamespaceId} is no longer present in the connected Cloudflare account.`);
+    }
+    const custodyMechanism = Schema.decodeUnknownSync(schemas.TokenKeyCustodyMechanism)(binding.custodyMechanism);
+    const adapter = tokenKeyCustodyAdapterFor(custodyMechanism);
+    const tokenKeySecretValue = await adapter.retrieve(binding.newCustodyId);
+    if (!tokenKeySecretValue) {
+        throw new Error(`The completed link journal's re-keyed token custody ${binding.newCustodyId} is unavailable.`);
+    }
+    const tokenKeyCustody = Schema.decodeUnknownSync(schemas.EscrowedTokenKeyCustody)({
+        kind: 'escrowed',
+        mechanism: custodyMechanism,
+        custodyId: binding.newCustodyId,
+        escrowedAt: journal.updatedAt,
+        canary: await sealTokenKeyCanary(tokenKeySecretValue),
+    });
+    await putDeployInstallRuntimeBinding({
+        ...input,
+        installKvNamespaceId: binding.installKvNamespaceId,
+        installKvNamespaceName: binding.installKvNamespaceName,
+        tokenKeySecretName: binding.tokenKeySecretName,
+    });
+    const { pointer: currentPointer, stateStore } = await ensureTenantStateStore({
+        argv: input.argv,
+        root: input.root,
+    });
+    const existing = await stateStore.getBinding({
+        projectId: input.projectId,
+        environment: input.environment,
+        hubSpotAppId: input.hubSpotAppId,
+    });
+    await stateStore.putBinding(Schema.decodeUnknownSync(schemas.LocalAppRuntimeBinding)({
+        ...(existing ?? {}),
+        schemaVersion: 2,
+        ownerId: currentPointer.ownerId,
+        projectId: input.projectId,
+        environment: input.environment,
+        hubSpotAppId: input.hubSpotAppId,
+        installKvNamespaceId: binding.installKvNamespaceId,
+        installKvNamespaceName: binding.installKvNamespaceName,
+        tokenKeySecretName: binding.tokenKeySecretName,
+        tokenKeyCustody,
+        updatedAt: new Date().toISOString(),
+    }));
+    return {
+        installKvNamespaceId: binding.installKvNamespaceId,
+        installKvNamespaceName: binding.installKvNamespaceName,
+        tokenKeySecretName: binding.tokenKeySecretName,
+        tokenKeySecretValue,
+        tokenKeyCustody,
+        ...(existing?.tenantD1DatabaseId ? { tenantD1DatabaseId: existing.tenantD1DatabaseId } : {}),
+        ...(existing?.tenantD1DatabaseName
+            ? { tenantD1DatabaseName: existing.tenantD1DatabaseName }
+            : {}),
+        ...(existing?.flagsKvNamespaceId ? { flagsKvNamespaceId: existing.flagsKvNamespaceId } : {}),
+        ...(existing?.flagsKvNamespaceName
+            ? { flagsKvNamespaceName: existing.flagsKvNamespaceName }
+            : {}),
+    };
+}
 async function readDeployInstallRuntimeBinding(input) {
     const response = await hostedHttp({
         url: new URL(`/v1/accounts/${encodeURIComponent(input.accountId)}/projects/${encodeURIComponent(input.projectId)}/hubspot-apps/${encodeURIComponent(input.hubSpotAppId)}/install-runtime?environment=${encodeURIComponent(input.environment)}`, input.controlPlaneUrl),
-        headers: await controlPlaneAuthHeaders(input.userId),
+        headers: await controlPlaneAuthHeaders(input.userId, undefined, input.accountId),
     });
     if (response.status === 404) {
         return undefined;
@@ -3506,7 +3665,7 @@ async function putDeployInstallRuntimeBinding(input) {
     const response = await hostedHttp({
         url: new URL(`/v1/accounts/${encodeURIComponent(input.accountId)}/projects/${encodeURIComponent(input.projectId)}/hubspot-apps/${encodeURIComponent(input.hubSpotAppId)}/install-runtime`, input.controlPlaneUrl),
         method: 'PUT',
-        headers: await controlPlaneAuthHeaders(input.userId),
+        headers: await controlPlaneAuthHeaders(input.userId, undefined, input.accountId),
         body: {
             environment: input.environment,
             installKvNamespaceId: input.installKvNamespaceId,
@@ -3532,7 +3691,7 @@ async function ensureHostedProjectRegistration(input) {
     const response = await hostedHttp({
         url: new URL(`/v1/accounts/${encodeURIComponent(input.accountId)}/projects`, input.controlPlaneUrl),
         method: 'POST',
-        headers: await controlPlaneAuthHeaders(input.userId),
+        headers: await controlPlaneAuthHeaders(input.userId, undefined, input.accountId),
         body: { projectId: input.projectId, displayName: input.projectId },
     });
     if (response.ok || response.status === 409)
@@ -3551,7 +3710,7 @@ async function requestDeployBillingRuntimeToken(input) {
     const response = await hostedHttp({
         url: new URL(`/v1/accounts/${encodeURIComponent(input.accountId)}/projects/${encodeURIComponent(input.projectId)}/billing/runtime-token`, input.controlPlaneUrl),
         method: 'POST',
-        headers: await controlPlaneAuthHeaders(input.userId),
+        headers: await controlPlaneAuthHeaders(input.userId, undefined, input.accountId),
         body: {
             environment: input.environment,
         },
@@ -3624,6 +3783,12 @@ async function ensureTenantDataPlane(input) {
         kind: 'tenant-d1',
         ...(exactTenantD1DatabaseId ? { exactResourceId: exactTenantD1DatabaseId } : {}),
         ...(exactTenantD1DatabaseName ? { exactResourceName: exactTenantD1DatabaseName } : {}),
+        legacyResourceNameExists: (resourceName) => cloudflareResourceNameExists({
+            argv: input.argv,
+            root: input.root,
+            kind: 'tenant-d1',
+            resourceName,
+        }),
         validateExactResource: (resourceId) => {
             const credentials = resolveCloudflareCredentials(input.argv);
             if (!credentials.accountId || !credentials.apiToken) {
@@ -3665,6 +3830,12 @@ async function ensureTenantDataPlane(input) {
         kind: 'flags-kv',
         ...(exactFlagsKvNamespaceId ? { exactResourceId: exactFlagsKvNamespaceId } : {}),
         ...(exactFlagsKvNamespaceName ? { exactResourceName: exactFlagsKvNamespaceName } : {}),
+        legacyResourceNameExists: (resourceName) => cloudflareResourceNameExists({
+            argv: input.argv,
+            root: input.root,
+            kind: 'flags-kv',
+            resourceName,
+        }),
         validateExactResource: (resourceId) => {
             const credentials = resolveCloudflareCredentials(input.argv);
             if (!credentials.accountId || !credentials.apiToken) {
@@ -3699,7 +3870,7 @@ async function ensureTenantDataPlane(input) {
             if (!created) {
                 const listed = await runCloudflareCommand(['bun', 'x', 'wrangler', 'kv', 'namespace', 'list'], { cwd: input.root, env });
                 try {
-                    const namespaces = JSON.parse(listed.stdout);
+                    const namespaces = parseWranglerJsonArray(listed.stdout);
                     resourceId = namespaces.find((namespace) => namespace.title === flagsKvNamespaceName)?.id;
                 }
                 catch {
@@ -3804,13 +3975,29 @@ async function validateCloudflareResourceForDeploy(input) {
         env: cloudflareDeployEnv(input.argv),
     });
     try {
-        const rows = JSON.parse(listed.stdout);
+        const rows = parseWranglerJsonArray(listed.stdout);
         return rows.some((row) => row.id === input.resourceId || row.uuid === input.resourceId);
     }
     catch {
         throw new Error(`HSX_E_CLOUDFLARE_RESOURCE_VALIDATION_FAILED: Wrangler returned malformed ${input.kind} list output.`);
     }
 }
+async function cloudflareResourceNameExists(input) {
+    const command = input.kind === 'tenant-d1'
+        ? ['bun', 'x', 'wrangler', 'd1', 'list', '--json']
+        : ['bun', 'x', 'wrangler', 'kv', 'namespace', 'list'];
+    const listed = await runCloudflareCommand(command, {
+        cwd: input.root,
+        env: cloudflareDeployEnv(input.argv),
+    });
+    try {
+        const rows = parseWranglerJsonArray(listed.stdout);
+        return rows.some((row) => row.name === input.resourceName || row.title === input.resourceName);
+    }
+    catch {
+        throw new Error(`HSX_E_CLOUDFLARE_RESOURCE_VALIDATION_FAILED: Wrangler returned malformed ${input.kind} list output.`);
+    }
+}
 export function renderWranglerConfig(input) {
     const lines = [
         '# Generated by hs-x. Do not edit by hand.',
@@ -3884,7 +4071,7 @@ function tomlString(value) {
 async function readDeployHubSpotOAuthSecret(input) {
     const response = await hostedHttp({
         url: new URL(`/v1/accounts/${encodeURIComponent(input.accountId)}/projects/${encodeURIComponent(input.projectId)}/hubspot-apps/${encodeURIComponent(input.hubSpotAppId)}/oauth-secret?environment=${encodeURIComponent(input.environment)}`, input.controlPlaneUrl),
-        headers: await controlPlaneAuthHeaders(input.userId),
+        headers: await controlPlaneAuthHeaders(input.userId, undefined, input.accountId),
     });
     if (response.status === 404) {
         return undefined;
@@ -4880,6 +5067,45 @@ async function readPersistedHubSpotAppBinding(root, expectedProjectName) {
 async function readPersistedHubSpotAppId(root, expectedProjectName) {
     return (await readPersistedHubSpotAppBinding(root, expectedProjectName))?.appId;
 }
+/**
+ * Resolve the one HubSpot app a linked project already registered. The common
+ * path remains implicit: a first combined deploy persists the app id, while a
+ * checkout missing that advisory file can recover an unambiguous binding from
+ * the control plane. Explicit ids remain the advanced override.
+ */
+async function resolveHubSpotAppIdForDeploy(input) {
+    const explicit = readOptionalHubSpotAppId(resolveFlag(input.argv, '--hubspot-app-id') ?? process.env.HSX_HUBSPOT_APP_ID);
+    const projectName = await resolveHubSpotProjectName(input.argv, input.root);
+    const persisted = await readPersistedHubSpotAppId(input.root, projectName);
+    const selected = explicit ?? persisted;
+    if (selected || !input.controlPlaneUrl)
+        return selected;
+    const response = await hostedHttp({
+        url: new URL(`/v1/accounts/${encodeURIComponent(input.accountId)}/projects/${encodeURIComponent(input.projectId)}/runtime-bindings`, input.controlPlaneUrl),
+        headers: await controlPlaneAuthHeaders(input.userId, undefined, input.accountId),
+    });
+    if (!response.ok)
+        return undefined;
+    const body = await response.json();
+    const bindings = Schema.decodeUnknownSync(schemas.ListProjectRuntimeBindingsResponse)(body).bindings;
+    const appIds = [
+        ...new Set(bindings
+            .filter((binding) => binding.environment === input.environment)
+            .map((binding) => binding.hubSpotAppId)),
+    ];
+    if (appIds.length === 0)
+        return undefined;
+    if (appIds.length > 1) {
+        throw new Error(`Project ${input.projectId} has multiple HubSpot apps in ${input.environment} (${appIds.join(', ')}). Pass --hubspot-app-id once to choose one.`);
+    }
+    const appId = appIds[0];
+    await persistHubSpotAppBinding(input.root, {
+        appId,
+        projectName,
+        developerAccountId: undefined,
+    });
+    return appId;
+}
 async function resolveHubSpotAppAuthUrl(argv, root) {
     const projectName = await resolveHubSpotProjectName(argv, root);
     const persisted = await readPersistedHubSpotAppBinding(root, projectName);
@@ -4997,7 +5223,7 @@ async function requestHostedControlPlaneDeployPlan({ request, controlPlaneUrl, u
     const response = await hostedHttp({
         url: new URL('/v1/deploys/plan', controlPlaneUrl),
         method: 'POST',
-        headers: await controlPlaneAuthHeaders(userId),
+        headers: await controlPlaneAuthHeaders(userId, undefined, request.accountId),
         body: request,
     });
     const body = await response.json();
@@ -5008,7 +5234,7 @@ async function requestHostedControlPlaneDeployPlan({ request, controlPlaneUrl, u
     }
     return Schema.decodeUnknownSync(schemas.DeployPlanResponse)(body);
 }
-async function requestLocalControlPlaneDeployRecordAndMaybePromote({ request, plan, promoteWhenHealthy, revision, }) {
+async function requestLocalControlPlaneDeployRecordAndMaybePromote({ request, plan, promoteWhenHealthy, workerUrl, revision, }) {
     const localAttestationAuth = revision
         ? { grantSecret: randomBytes(32).toString('base64url'), hubSpotAppId: 1 }
         : undefined;
@@ -5051,6 +5277,7 @@ async function requestLocalControlPlaneDeployRecordAndMaybePromote({ request, pl
             manifestHash: plan.manifestHash,
             signedManifest: request.manifest,
             signature: `sig_${plan.deployId}`,
+            ...(workerUrl ? { workerUrl } : {}),
             // ADR-021 R03: the real Cloudflare Worker version identity captured
             // back from the confirmed active deployment. Absent only when capture
             // was skipped/failed (best-effort) — then this deploy is history-only.
@@ -5133,13 +5360,14 @@ async function requestHostedControlPlaneDeployRecordAndMaybePromote({ request, p
     const response = await hostedHttp({
         url: new URL(`/v1/deploys/${encodeURIComponent(plan.deployId)}/record`, controlPlaneUrl),
         method: 'POST',
-        headers: await controlPlaneAuthHeaders(userId),
+        headers: await controlPlaneAuthHeaders(userId, undefined, request.accountId),
         body: {
             accountId: request.accountId,
             projectId: request.projectId,
             manifestHash: plan.manifestHash,
             signedManifest: request.manifest,
             signature: `sig_${plan.deployId}`,
+            ...(workerUrl ? { workerUrl } : {}),
             // ADR-021 R03: the real Cloudflare Worker version identity captured back
             // from the confirmed active deployment. Absent only when capture was
             // skipped/failed (best-effort) — then this deploy is history-only.
@@ -5159,6 +5387,7 @@ async function requestHostedControlPlaneDeployRecordAndMaybePromote({ request, p
     }
     const drift = await waitForHealthyControlPlaneDrift({
         controlPlaneUrl,
+        accountId: request.accountId,
         projectId: request.projectId,
         deployId: plan.deployId,
         userId,
@@ -5461,7 +5690,7 @@ function discoverManageSchemaMode(definition) {
 }
 function discoverSourceDefinitions(source) {
     const definitions = new Map();
-    for (const match of source.matchAll(/(?:const|let|var)\s+([A-Za-z_$][\w$]*)\s*=\s*defineSource(\.push)?\s*\(\s*\{([\s\S]*?)\}\s*\)/g)) {
+    for (const match of source.matchAll(/(?:const|let|var)\s+([A-Za-z_$][\w$]*)\s*=\s*defineSource(\.push)?\s*(?:<[\s\S]*?>)?\s*\(\s*\{([\s\S]*?)\}\s*\)/g)) {
         const variableName = match[1];
         const body = match[3] ?? '';
         if (!variableName) {
@@ -5585,6 +5814,9 @@ const deployOptions = {
     message: Options.text('message').pipe(Options.withAlias('m'), Options.optional), // --message / -m
     platformVersion: Options.text('platform-version').pipe(Options.optional), // --platform-version
     hubspotProjectName: Options.text('hubspot-project-name').pipe(Options.optional), // --hubspot-project-name
+    cloudflareAccountId: Options.text('cloudflare-account-id').pipe(Options.optional), // --cloudflare-account-id
+    cloudflareApiToken: Options.text('cloudflare-api-token').pipe(Options.optional), // --cloudflare-api-token
+    apiToken: Options.text('api-token').pipe(Options.optional), // --api-token
     // ── boolean flags (argv.includes) ──
     plan: Options.boolean('plan').pipe(Options.withDefault(false)), // --plan
     dryRun: Options.boolean('dry-run').pipe(Options.withDefault(false)), // --dry-run
@@ -5651,6 +5883,9 @@ const deployBaseCmd = Command.make('deploy', deployOptions, (opts) => runHandler
     push('--message', opts.message);
     push('--platform-version', opts.platformVersion);
     push('--hubspot-project-name', opts.hubspotProjectName);
+    push('--cloudflare-account-id', opts.cloudflareAccountId);
+    push('--cloudflare-api-token', opts.cloudflareApiToken);
+    push('--api-token', opts.apiToken);
     flag('--plan', opts.plan);
     flag('--dry-run', opts.dryRun);
     flag('--build-only', opts.buildOnly);