@hs-x/cli 0.4.6 → 0.4.8

package/dist/commands/deploy.js

@@ -16,9 +16,9 @@ import { isLinked } from '../account-store.js';
 import { exitWith } from '../cli-error.js';
 import { accountIdOption, controlPlaneUrlOption, cwdOption, deployIdOption, forceOption, jsonOption, projectIdOption, runHandler, runQuarantined, userIdOption, yesOption, } from '../cli/kit.js';
 import { classifyCloudflareCommandFailure, preflightCloudflareAnalyticsEngine, validateCloudflareResourceForAccount, } from '../cloudflare-account-preflight.js';
-import { resolveCloudflareCredentials } from '../cloudflare-kv.js';
+import { applyLeasedCloudflareCredentials, resolveCloudflareCredentials, } from '../cloudflare-kv.js';
 import { loadCloudflarePointer } from '../cloudflare-pointer.js';
-import { resolveOrProvisionCloudflareScopedResource } from '../cloudflare-scoped-resource.js';
+import { parseWranglerJsonArray, resolveOrProvisionCloudflareScopedResource, } from '../cloudflare-scoped-resource.js';
 import { DEFAULT_CONTROL_PLANE_URL, formatConfigUrl, loadCliConfig, resolveControlPlaneUrl, } from '../config.js';
 import { CLI_VERSION } from '../constants.js';
 import { controlPlaneAuthHeaders } from '../control-plane-fetch.js';
@@ -27,10 +27,12 @@ import { createControlPlaneTenantProvisioningAuthority, } from '../control-plane
 import { captureDeployRevision } from '../deploy-revision-capture.js';
 import { resolveDeployTargets } from '../deploy-targets.js';
 import { executeCliHttp } from '../effect-http.js';
+import { discoverHubSpotAccounts } from '../hubspot-auth.js';
 import { DirectHubSpotAccountResolutionError, createDeployHubSpotDeveloperClient, resolveDirectHubSpotContext, } from '../hubspot-developer-client.js';
 import { HubSpotProjectArchiveSourceError, fingerprintHubSpotArchiveSource, writeLocalHubSpotProjectArchive, } from '../hubspot-project-archive.js';
 import { deployHubSpotProjectBuild, readHubSpotSubbuildStatuses, waitForHubSpotAutoDeploy, waitForHubSpotBuildStatus, } from '../hubspot-project-lifecycle.js';
 import { detectLocalProjectMode, readHubSpotProjectDescriptor, validateHubSpotProject, } from '../hubspot-project.js';
+import { linkMigrationJournalId, loadLinkMigrationJournal } from '../link-migration-journal.js';
 import { hydrateAncestorEnv } from '../load-env.js';
 import { LocalProjectPickerCancelled, resolveLocalProject } from '../local-project-picker.js';
 import { getMachineId, getMachineSecret, previewMachineId } from '../machine-id.js';
@@ -42,7 +44,7 @@ import { createReporter } from '../reporter/index.js';
 import { Cwd } from '../services/cwd.js';
 import { createTenantDataPlaneProvisioningCoordinator, } from '../tenant-data-plane-provisioning.js';
 import { ensureTenantStateStore, preflightTenantStateCredentials, } from '../tenant-state.js';
-import { defaultTokenKeyCustodyAdapter, escrowTokenKey, resolveEscrowedTokenKey, tokenKeyCustodyIdFor, } from '../token-key-custody.js';
+import { defaultTokenKeyCustodyAdapter, escrowTokenKey, resolveEscrowedTokenKey, sealTokenKeyCanary, tokenKeyCustodyAdapterFor, tokenKeyCustodyIdFor, } from '../token-key-custody.js';
 import { deployPromoteCommand, requestControlPlaneDeployPromotion } from './deploy-promote.js';
 import { withTransientDeployRetry } from './deploy-retry.js';
 async function hostedHttp(input) {
@@ -494,11 +496,13 @@ async function hydrateCloudflareTokenFromControlPlane(input) {
     const lease = await leaseCloudflareViaSession(input.argv, input.root);
     if (!lease)
         return false;
-    process.env.CLOUDFLARE_API_TOKEN = lease.apiToken;
-    process.env.CLOUDFLARE_ACCOUNT_ID = lease.cloudflareAccountId;
+    applyLeasedCloudflareCredentials({
+        apiToken: lease.apiToken,
+        accountId: lease.cloudflareAccountId,
+    });
     return true;
 }
-async function waitForHealthyControlPlaneDrift({ controlPlaneUrl, projectId, deployId, userId, timeoutMs, workerUrl, }) {
+async function waitForHealthyControlPlaneDrift({ controlPlaneUrl, accountId, projectId, deployId, userId, timeoutMs, workerUrl, }) {
     const startedAt = Date.now();
     let lastState = 'unknown';
     let lastReason;
@@ -508,7 +512,7 @@ async function waitForHealthyControlPlaneDrift({ controlPlaneUrl, projectId, dep
         }
         const response = await hostedHttp({
             url: new URL(`/v1/projects/${encodeURIComponent(projectId)}/drift`, controlPlaneUrl),
-            headers: await controlPlaneAuthHeaders(userId),
+            headers: await controlPlaneAuthHeaders(userId, undefined, accountId),
         });
         const body = await response.json().catch(() => undefined);
         if (response.ok) {
@@ -976,7 +980,7 @@ async function executeHubSpotDirectDeployCommand({ argv, root, json, }) {
             ? (readStatus(uploaded.deployStatus) ?? 'UNKNOWN')
             : undefined;
         const deployUnverified = uploaded.autoDeployExpected && deployState === undefined;
-        const ok = buildState === 'SUCCESS' && !deployUnverified && (!deployState || deployState === 'SUCCESS');
+        const ok = hubSpotUploadSucceeded(uploaded);
         const result = {
             schema_version: 1,
             ok,
@@ -1101,8 +1105,14 @@ export async function deployCommand({ argv, root, json, }) {
     const noHeartbeat = argv.includes('--no-heartbeat');
     const noRecord = argv.includes('--no-record');
     const explicitControlPlaneUrl = resolveFlag(argv, '--control-plane-url');
-    const controlPlaneUrl = explicitControlPlaneUrl ?? (planOnly ? undefined : process.env.HSX_CONTROL_PLANE_URL);
     const linked = await isLinked();
+    const controlPlaneUrl = resolveDeployControlPlaneUrl({
+        explicitControlPlaneUrl,
+        environmentControlPlaneUrl: process.env.HSX_CONTROL_PLANE_URL,
+        platformControlPlaneUrl: resolveControlPlaneUrl(argv),
+        linked,
+        planOnly,
+    });
     const userId = resolveFlag(argv, '--user-id') ?? process.env.HSX_USER_ID ?? 'local-cli-user';
     const resolvedAcct = await resolveAccountIdOrPrompt({
         argv,
@@ -1156,7 +1166,6 @@ export async function deployCommand({ argv, root, json, }) {
     const needsHubSpotBundle = needsRuntime || app.mcpServers.length > 0;
     const { deploymentMode, cloudflareDeployRequested, hubspotUploadRequested } = resolveDeployTargets({
         buildOnly,
-        planOnly,
         needsRuntime,
         hasProjectId: Boolean(projectId),
         hubspotOnly,
@@ -1468,7 +1477,17 @@ export async function deployCommand({ argv, root, json, }) {
     // Worker origin is resolvable up front, upload BEFORE the Cloudflare deploy so
     // the minted app id binds in a single pass. Falls back to the original
     // deploy-then-upload order whenever the origin can't be resolved.
-    const appIdKnownBeforeDeploy = readOptionalHubSpotAppId(resolveFlag(argv, '--hubspot-app-id') ?? process.env.HSX_HUBSPOT_APP_ID) ?? (await readPersistedHubSpotAppId(root, await resolveHubSpotProjectName(argv, root)));
+    const appIdKnownBeforeDeploy = controlPlanePlan && controlPlaneBackedPlan && controlPlaneUrl
+        ? await resolveHubSpotAppIdForDeploy({
+            argv,
+            root,
+            controlPlaneUrl,
+            userId,
+            accountId: controlPlanePlan.accountId,
+            projectId: controlPlanePlan.projectId,
+            environment: resolveFlag(argv, '--env') ?? resolveFlag(argv, '--environment') ?? 'production',
+        })
+        : (readOptionalHubSpotAppId(resolveFlag(argv, '--hubspot-app-id') ?? process.env.HSX_HUBSPOT_APP_ID) ?? (await readPersistedHubSpotAppIdForDeploy(argv, root)));
     const uploadFirstOrigin = cloudflareDeployRequested &&
         !cloudflareDryRun &&
         !planOnly &&
@@ -1617,6 +1636,10 @@ export async function deployCommand({ argv, root, json, }) {
                         plan: controlPlanePlan,
                         promoteWhenHealthy,
                         ...(capturedRevision ? { revision: capturedRevision } : {}),
+                        ...(() => {
+                            const deployedWorkerUrl = cloudflareDeployResult?.workers.find((worker) => worker.url)?.url;
+                            return deployedWorkerUrl ? { workerUrl: deployedWorkerUrl } : {};
+                        })(),
                     })
                     : controlPlaneUrl
                         ? await requestHostedControlPlaneDeployRecordAndMaybePromote({
@@ -1715,7 +1738,7 @@ export async function deployCommand({ argv, root, json, }) {
     // run-008 build #2's failure mode. Only a SUCCESS status counts.
     const hubspotUploadFailed = !planOnly &&
         hubspotUploadRequested &&
-        (!hubspotUploadResult || readStatus(hubspotUploadResult.buildStatus) !== 'SUCCESS');
+        (!hubspotUploadResult || !hubSpotUploadSucceeded(hubspotUploadResult));
     const cloudflareDeployed = !planOnly && cloudflareDeployRequested && Boolean(cloudflareDeployResult);
     // A live worker with only the HubSpot upload failing: not a clean success,
     // but distinct from total failure so callers don't tear down a good worker.
@@ -1831,6 +1854,16 @@ export async function deployCommand({ argv, root, json, }) {
     // automation doesn't treat a serving worker as a total failure), 1 = failure.
     return { exitCode: plan.ok ? 0 : plan.partial ? 20 : 1 };
 }
+/** @internal Exported for the linked-default deploy regression suite. */
+export function resolveDeployControlPlaneUrl(input) {
+    if (input.explicitControlPlaneUrl)
+        return input.explicitControlPlaneUrl;
+    if (input.planOnly)
+        return undefined;
+    if (input.linked)
+        return input.platformControlPlaneUrl;
+    return input.environmentControlPlaneUrl;
+}
 function buildDeployPlanSummary(input) {
     const lines = ['', 'Planned changes:'];
     const capCount = input.workers.reduce((c, w) => c + w.capabilities.length, 0);
@@ -2701,6 +2734,14 @@ function defaultHubSpotFieldType(type) {
             return 'text';
     }
 }
+/** @internal Exported for deterministic deploy-outcome regression tests. */
+export function hubSpotUploadSucceeded(upload) {
+    if (readStatus(upload.buildStatus) !== 'SUCCESS')
+        return false;
+    if (upload.deployStatus !== undefined)
+        return readStatus(upload.deployStatus) === 'SUCCESS';
+    return !upload.autoDeployExpected;
+}
 async function executeCloudflareDeploy({ argv, root, workers, controlPlanePlan, controlPlaneUrl, userId, machineId, machineSecret, heartbeatEnabled, dryRun, note, }) {
     // Fail fast on missing Cloudflare credentials BEFORE deploying any Worker, so
     // an unlinked deploy can't leave a Worker live and then error on the
@@ -2733,7 +2774,15 @@ async function executeCloudflareDeploy({ argv, root, workers, controlPlanePlan,
         const appConfig = await readHsxAppConfig(root);
         const environment = resolveFlag(argv, '--env') ?? resolveFlag(argv, '--environment') ?? 'production';
         const authUrl = await resolveHubSpotAppAuthUrl(argv, root);
-        const hubspotAppId = requireHubSpotCardAppId(readOptionalHubSpotAppId(resolveFlag(argv, '--hubspot-app-id') ?? process.env.HSX_HUBSPOT_APP_ID) ?? (await readPersistedHubSpotAppId(root, await resolveHubSpotProjectName(argv, root))), authUrl);
+        const hubspotAppId = requireHubSpotCardAppId(await resolveHubSpotAppIdForDeploy({
+            argv,
+            root,
+            ...(controlPlaneUrl ? { controlPlaneUrl } : {}),
+            userId,
+            accountId: controlPlanePlan.accountId,
+            projectId: controlPlanePlan.projectId,
+            environment,
+        }), authUrl);
         const stored = controlPlaneUrl
             ? await readDeployHubSpotOAuthSecret({
                 controlPlaneUrl,
@@ -2770,7 +2819,7 @@ async function executeCloudflareDeploy({ argv, root, workers, controlPlanePlan,
         ? {
             authority: createControlPlaneTenantProvisioningAuthority({
                 controlPlaneUrl,
-                authorizationHeaders: () => controlPlaneAuthHeaders(userId),
+                authorizationHeaders: () => controlPlaneAuthHeaders(userId, undefined, controlPlanePlan.accountId),
                 http: hostedHttp,
                 validateCompleteResources: (resources) => validateTenantDataPlaneResourcesForActiveAccount(argv, root, resources),
             }),
@@ -2892,7 +2941,7 @@ async function executeCloudflareWorkerDeploy({ argv, root, worker, index, allowC
     // Resolution: flag → env → the binding persisted by the last successful
     // upload (.hs-x/hubspot.json). Users should never have to replay an app id
     // the CLI already learned (owner directive, run-008).
-    const hubspotAppId = readOptionalHubSpotAppId(resolveFlag(argv, '--hubspot-app-id') ?? process.env.HSX_HUBSPOT_APP_ID) ?? (await readPersistedHubSpotAppId(root, await resolveHubSpotProjectName(argv, root)));
+    const hubspotAppId = readOptionalHubSpotAppId(resolveFlag(argv, '--hubspot-app-id') ?? process.env.HSX_HUBSPOT_APP_ID) ?? (await readPersistedHubSpotAppIdForDeploy(argv, root));
     const installRuntimeBinding = hubspotAppId
         ? controlPlaneUrl
             ? await ensureDeployInstallRuntimeBinding({
@@ -3021,7 +3070,10 @@ async function executeCloudflareWorkerDeploy({ argv, root, worker, index, allowC
         ...(installRuntimeBinding
             ? { installKvNamespaceId: installRuntimeBinding.installKvNamespaceId }
             : {}),
-        ...(controlPlaneUrl ? { checkpointDataset: 'hsx_checkpoint', observability: true } : {}),
+        // Workers Logs is the observability source for both deployment modes.
+        // Checkpoint remains linked-only and is added separately below.
+        observability: true,
+        ...(controlPlaneUrl ? { checkpointDataset: 'hsx_checkpoint' } : {}),
         ...(controlPlaneUrl ? { versionMetadataBinding: 'CF_VERSION_METADATA' } : {}),
         ...(tenantDataPlane
             ? {
@@ -3294,9 +3346,15 @@ async function ensureTenantDeployInstallRuntimeBinding(input) {
             hubSpotAppId: input.hubSpotAppId,
         },
         kind: 'install-kv',
+        legacyResourceNameExists: (resourceName) => cloudflareResourceNameExists({
+            argv: input.argv,
+            root: input.root,
+            kind: 'install-kv',
+            resourceName,
+        }),
         async provisionByName(installKvNamespaceName) {
             // ADR-022: generate and escrow the token key before creating Cloudflare
-            // state, but only after long ambiguous names have already failed closed.
+            // state, after long-name recovery ambiguity has already been ruled out.
             const tokenKeySecretValue = randomBytes(32).toString('base64url');
             const tokenKeyCustody = await escrowTokenKey({
                 adapter: defaultTokenKeyCustodyAdapter(),
@@ -3332,7 +3390,7 @@ async function ensureTenantDeployInstallRuntimeBinding(input) {
             if (!namespaceOutput) {
                 const listed = await runCloudflareCommand(['bun', 'x', 'wrangler', 'kv', 'namespace', 'list'], { cwd: input.root, env: cloudflareDeployEnv(input.argv) });
                 try {
-                    const namespaces = JSON.parse(listed.stdout);
+                    const namespaces = parseWranglerJsonArray(listed.stdout);
                     resourceId = namespaces.find((namespace) => namespace.title === installKvNamespaceName)?.id;
                 }
                 catch {
@@ -3372,6 +3430,9 @@ async function ensureTenantDeployInstallRuntimeBinding(input) {
     };
 }
 async function ensureDeployInstallRuntimeBinding(input) {
+    const preserved = await recoverCompletedLinkInstallRuntimeBinding(input);
+    if (preserved)
+        return preserved;
     const existing = await readDeployInstallRuntimeBinding(input);
     if (existing) {
         const credentials = resolveCloudflareCredentials(input.argv);
@@ -3413,9 +3474,15 @@ async function ensureDeployInstallRuntimeBinding(input) {
             hubSpotAppId: input.hubSpotAppId,
         },
         kind: 'install-kv',
+        legacyResourceNameExists: (resourceName) => cloudflareResourceNameExists({
+            argv: input.argv,
+            root: input.root,
+            kind: 'install-kv',
+            resourceName,
+        }),
         async provisionByName(installKvNamespaceName) {
-            // ADR-022: escrow precedes Cloudflare mutation, while the ambiguity
-            // guard precedes both. The control plane never receives key bytes.
+            // ADR-022: escrow precedes Cloudflare mutation, while the legacy-name
+            // ambiguity guard precedes both. The control plane never receives key bytes.
             const tokenKeySecretValue = randomBytes(32).toString('base64url');
             const tokenKeyCustody = await escrowTokenKey({
                 adapter: defaultTokenKeyCustodyAdapter(),
@@ -3451,7 +3518,7 @@ async function ensureDeployInstallRuntimeBinding(input) {
             if (!namespaceOutput) {
                 const listed = await runCloudflareCommand(['bun', 'x', 'wrangler', 'kv', 'namespace', 'list'], { cwd: input.root, env: cloudflareDeployEnv(input.argv) });
                 try {
-                    const namespaces = JSON.parse(listed.stdout);
+                    const namespaces = parseWranglerJsonArray(listed.stdout);
                     resourceId = namespaces.find((namespace) => namespace.title === installKvNamespaceName)?.id;
                 }
                 catch {
@@ -3485,10 +3552,106 @@ async function ensureDeployInstallRuntimeBinding(input) {
         tokenKeyCustody,
     };
 }
+/**
+ * A completed ADR-022 link journal is the authoritative preserve-set for the
+ * first linked redeploy. Rehydrate its exact INSTALL_KV and re-keyed token-key
+ * custody before consulting account-scoped control-plane metadata, which may
+ * not have been backfilled yet. This prevents link from silently provisioning
+ * a replacement namespace or key.
+ */
+async function recoverCompletedLinkInstallRuntimeBinding(input) {
+    const pointer = await loadCloudflarePointer(input.root);
+    if (!pointer || !pointer.ownerId.startsWith('acct_'))
+        return undefined;
+    const journal = await loadLinkMigrationJournal(linkMigrationJournalId({
+        cloudflareAccountId: pointer.cloudflareAccountId,
+        stateKvNamespaceId: pointer.stateKvNamespaceId,
+        newOwnerId: pointer.ownerId,
+    }));
+    if (!journal || journal.status !== 'done')
+        return undefined;
+    const binding = journal.bindings.find((candidate) => candidate.projectId === input.projectId &&
+        candidate.environment === input.environment &&
+        candidate.hubSpotAppId === input.hubSpotAppId);
+    if (!binding)
+        return undefined;
+    if (input.dryRun) {
+        return {
+            installKvNamespaceId: binding.installKvNamespaceId,
+            installKvNamespaceName: binding.installKvNamespaceName,
+            tokenKeySecretName: binding.tokenKeySecretName,
+        };
+    }
+    const valid = await validateCloudflareResourceForDeploy({
+        argv: input.argv,
+        root: input.root,
+        kind: 'install-kv',
+        resourceId: binding.installKvNamespaceId,
+    });
+    if (!valid) {
+        throw new Error(`The completed link journal's preserved install KV ${binding.installKvNamespaceId} is no longer present in the connected Cloudflare account.`);
+    }
+    const custodyMechanism = Schema.decodeUnknownSync(schemas.TokenKeyCustodyMechanism)(binding.custodyMechanism);
+    const adapter = tokenKeyCustodyAdapterFor(custodyMechanism);
+    const tokenKeySecretValue = await adapter.retrieve(binding.newCustodyId);
+    if (!tokenKeySecretValue) {
+        throw new Error(`The completed link journal's re-keyed token custody ${binding.newCustodyId} is unavailable.`);
+    }
+    const tokenKeyCustody = Schema.decodeUnknownSync(schemas.EscrowedTokenKeyCustody)({
+        kind: 'escrowed',
+        mechanism: custodyMechanism,
+        custodyId: binding.newCustodyId,
+        escrowedAt: journal.updatedAt,
+        canary: await sealTokenKeyCanary(tokenKeySecretValue),
+    });
+    await putDeployInstallRuntimeBinding({
+        ...input,
+        installKvNamespaceId: binding.installKvNamespaceId,
+        installKvNamespaceName: binding.installKvNamespaceName,
+        tokenKeySecretName: binding.tokenKeySecretName,
+    });
+    const { pointer: currentPointer, stateStore } = await ensureTenantStateStore({
+        argv: input.argv,
+        root: input.root,
+    });
+    const existing = await stateStore.getBinding({
+        projectId: input.projectId,
+        environment: input.environment,
+        hubSpotAppId: input.hubSpotAppId,
+    });
+    await stateStore.putBinding(Schema.decodeUnknownSync(schemas.LocalAppRuntimeBinding)({
+        ...(existing ?? {}),
+        schemaVersion: 2,
+        ownerId: currentPointer.ownerId,
+        projectId: input.projectId,
+        environment: input.environment,
+        hubSpotAppId: input.hubSpotAppId,
+        installKvNamespaceId: binding.installKvNamespaceId,
+        installKvNamespaceName: binding.installKvNamespaceName,
+        tokenKeySecretName: binding.tokenKeySecretName,
+        tokenKeyCustody,
+        updatedAt: new Date().toISOString(),
+    }));
+    return {
+        installKvNamespaceId: binding.installKvNamespaceId,
+        installKvNamespaceName: binding.installKvNamespaceName,
+        tokenKeySecretName: binding.tokenKeySecretName,
+        tokenKeySecretValue,
+        tokenKeyCustody,
+        ...(existing?.tenantD1DatabaseId ? { tenantD1DatabaseId: existing.tenantD1DatabaseId } : {}),
+        ...(existing?.tenantD1DatabaseName
+            ? { tenantD1DatabaseName: existing.tenantD1DatabaseName }
+            : {}),
+        ...(existing?.flagsKvNamespaceId ? { flagsKvNamespaceId: existing.flagsKvNamespaceId } : {}),
+        ...(existing?.flagsKvNamespaceName
+            ? { flagsKvNamespaceName: existing.flagsKvNamespaceName }
+            : {}),
+    };
+}
 async function readDeployInstallRuntimeBinding(input) {
     const response = await hostedHttp({
         url: new URL(`/v1/accounts/${encodeURIComponent(input.accountId)}/projects/${encodeURIComponent(input.projectId)}/hubspot-apps/${encodeURIComponent(input.hubSpotAppId)}/install-runtime?environment=${encodeURIComponent(input.environment)}`, input.controlPlaneUrl),
-        headers: await controlPlaneAuthHeaders(input.userId),
+        headers: await controlPlaneAuthHeaders(input.userId, undefined, input.accountId),
     });
     if (response.status === 404) {
         return undefined;
@@ -3506,7 +3669,7 @@ async function putDeployInstallRuntimeBinding(input) {
     const response = await hostedHttp({
         url: new URL(`/v1/accounts/${encodeURIComponent(input.accountId)}/projects/${encodeURIComponent(input.projectId)}/hubspot-apps/${encodeURIComponent(input.hubSpotAppId)}/install-runtime`, input.controlPlaneUrl),
         method: 'PUT',
-        headers: await controlPlaneAuthHeaders(input.userId),
+        headers: await controlPlaneAuthHeaders(input.userId, undefined, input.accountId),
         body: {
             environment: input.environment,
             installKvNamespaceId: input.installKvNamespaceId,
@@ -3532,7 +3695,7 @@ async function ensureHostedProjectRegistration(input) {
     const response = await hostedHttp({
         url: new URL(`/v1/accounts/${encodeURIComponent(input.accountId)}/projects`, input.controlPlaneUrl),
         method: 'POST',
-        headers: await controlPlaneAuthHeaders(input.userId),
+        headers: await controlPlaneAuthHeaders(input.userId, undefined, input.accountId),
         body: { projectId: input.projectId, displayName: input.projectId },
     });
     if (response.ok || response.status === 409)
@@ -3551,7 +3714,7 @@ async function requestDeployBillingRuntimeToken(input) {
     const response = await hostedHttp({
         url: new URL(`/v1/accounts/${encodeURIComponent(input.accountId)}/projects/${encodeURIComponent(input.projectId)}/billing/runtime-token`, input.controlPlaneUrl),
         method: 'POST',
-        headers: await controlPlaneAuthHeaders(input.userId),
+        headers: await controlPlaneAuthHeaders(input.userId, undefined, input.accountId),
         body: {
             environment: input.environment,
         },
@@ -3624,6 +3787,12 @@ async function ensureTenantDataPlane(input) {
         kind: 'tenant-d1',
         ...(exactTenantD1DatabaseId ? { exactResourceId: exactTenantD1DatabaseId } : {}),
         ...(exactTenantD1DatabaseName ? { exactResourceName: exactTenantD1DatabaseName } : {}),
+        legacyResourceNameExists: (resourceName) => cloudflareResourceNameExists({
+            argv: input.argv,
+            root: input.root,
+            kind: 'tenant-d1',
+            resourceName,
+        }),
         validateExactResource: (resourceId) => {
             const credentials = resolveCloudflareCredentials(input.argv);
             if (!credentials.accountId || !credentials.apiToken) {
@@ -3665,6 +3834,12 @@ async function ensureTenantDataPlane(input) {
         kind: 'flags-kv',
         ...(exactFlagsKvNamespaceId ? { exactResourceId: exactFlagsKvNamespaceId } : {}),
         ...(exactFlagsKvNamespaceName ? { exactResourceName: exactFlagsKvNamespaceName } : {}),
+        legacyResourceNameExists: (resourceName) => cloudflareResourceNameExists({
+            argv: input.argv,
+            root: input.root,
+            kind: 'flags-kv',
+            resourceName,
+        }),
         validateExactResource: (resourceId) => {
             const credentials = resolveCloudflareCredentials(input.argv);
             if (!credentials.accountId || !credentials.apiToken) {
@@ -3699,7 +3874,7 @@ async function ensureTenantDataPlane(input) {
             if (!created) {
                 const listed = await runCloudflareCommand(['bun', 'x', 'wrangler', 'kv', 'namespace', 'list'], { cwd: input.root, env });
                 try {
-                    const namespaces = JSON.parse(listed.stdout);
+                    const namespaces = parseWranglerJsonArray(listed.stdout);
                     resourceId = namespaces.find((namespace) => namespace.title === flagsKvNamespaceName)?.id;
                 }
                 catch {
@@ -3804,13 +3979,29 @@ async function validateCloudflareResourceForDeploy(input) {
         env: cloudflareDeployEnv(input.argv),
     });
     try {
-        const rows = JSON.parse(listed.stdout);
+        const rows = parseWranglerJsonArray(listed.stdout);
         return rows.some((row) => row.id === input.resourceId || row.uuid === input.resourceId);
     }
     catch {
         throw new Error(`HSX_E_CLOUDFLARE_RESOURCE_VALIDATION_FAILED: Wrangler returned malformed ${input.kind} list output.`);
     }
 }
+async function cloudflareResourceNameExists(input) {
+    const command = input.kind === 'tenant-d1'
+        ? ['bun', 'x', 'wrangler', 'd1', 'list', '--json']
+        : ['bun', 'x', 'wrangler', 'kv', 'namespace', 'list'];
+    const listed = await runCloudflareCommand(command, {
+        cwd: input.root,
+        env: cloudflareDeployEnv(input.argv),
+    });
+    try {
+        const rows = parseWranglerJsonArray(listed.stdout);
+        return rows.some((row) => row.name === input.resourceName || row.title === input.resourceName);
+    }
+    catch {
+        throw new Error(`HSX_E_CLOUDFLARE_RESOURCE_VALIDATION_FAILED: Wrangler returned malformed ${input.kind} list output.`);
+    }
+}
 export function renderWranglerConfig(input) {
     const lines = [
         '# Generated by hs-x. Do not edit by hand.',
@@ -3884,7 +4075,7 @@ function tomlString(value) {
 async function readDeployHubSpotOAuthSecret(input) {
     const response = await hostedHttp({
         url: new URL(`/v1/accounts/${encodeURIComponent(input.accountId)}/projects/${encodeURIComponent(input.projectId)}/hubspot-apps/${encodeURIComponent(input.hubSpotAppId)}/oauth-secret?environment=${encodeURIComponent(input.environment)}`, input.controlPlaneUrl),
-        headers: await controlPlaneAuthHeaders(input.userId),
+        headers: await controlPlaneAuthHeaders(input.userId, undefined, input.accountId),
     });
     if (response.status === 404) {
         return undefined;
@@ -4597,6 +4788,14 @@ async function executeHubSpotOnlyUpload({ argv, root, local, persistBinding = tr
         throw error;
     }
     const buildState = readStatus(buildStatus) ?? 'UNKNOWN';
+    // Legacy ~/.hscli/config.yml accounts can authenticate and upload without
+    // exposing their developer-account id through the selected account object.
+    // HubSpot's build response is authoritative for that same id; retain it so
+    // the app-auth handoff and later zero-selector log reads do not disappear.
+    const resolvedDeveloperAccountId = resolveHubSpotDeveloperAccountIdFromBuild({
+        developerAccountId,
+        buildStatus,
+    });
     buildStep?.[buildState === 'SUCCESS' ? 'ok' : 'fail'](`${buildState} · ${elapsedSince(buildStartedAt)}`);
     const autoDeployEnabled = readBooleanProperty(buildStatus, 'isAutoDeployEnabled');
     if (uploadOnly || readStatus(buildStatus) !== 'SUCCESS' || autoDeployEnabled) {
@@ -4607,7 +4806,7 @@ async function executeHubSpotOnlyUpload({ argv, root, local, persistBinding = tr
             await persistHubSpotAppBinding(root, {
                 appId,
                 projectName,
-                developerAccountId,
+                developerAccountId: resolvedDeveloperAccountId,
             });
         // Build SUCCESS does NOT mean the app shipped: HubSpot's auto-deploy can
         // still fail (found live: "Apps are not allowed to have 0 redirect URLs"
@@ -4646,7 +4845,7 @@ async function executeHubSpotOnlyUpload({ argv, root, local, persistBinding = tr
             archivePath,
             appId,
             appUid,
-            developerAccountId,
+            developerAccountId: resolvedDeveloperAccountId,
             buildId: upload.buildId,
             deployId: undefined,
             buildStatus,
@@ -4688,7 +4887,7 @@ async function executeHubSpotOnlyUpload({ argv, root, local, persistBinding = tr
         await persistHubSpotAppBinding(root, {
             appId,
             projectName,
-            developerAccountId,
+            developerAccountId: resolvedDeveloperAccountId,
         });
     }
     return {
@@ -4696,7 +4895,7 @@ async function executeHubSpotOnlyUpload({ argv, root, local, persistBinding = tr
         archivePath,
         appId,
         appUid,
-        developerAccountId,
+        developerAccountId: resolvedDeveloperAccountId,
         buildId: upload.buildId,
         deployId,
         buildStatus,
@@ -4707,12 +4906,27 @@ async function executeHubSpotOnlyUpload({ argv, root, local, persistBinding = tr
     };
 }
 async function optionalHubSpotAppId(client, projectName, appUid) {
-    try {
-        return await client.projects.resolveAppId(appUid === undefined ? { projectName } : { projectName, appUid });
-    }
-    catch {
-        return 0;
+    return resolveHubSpotAppIdWithRetry({
+        resolve: () => client.projects.resolveAppId(appUid === undefined ? { projectName } : { projectName, appUid }),
+    });
+}
+/** @internal Exported for deterministic eventual-consistency regressions. */
+export async function resolveHubSpotAppIdWithRetry(input) {
+    const attempts = Math.max(1, input.attempts ?? 4);
+    const retryDelayMs = Math.max(0, input.retryDelayMs ?? 500);
+    for (let attempt = 1; attempt <= attempts; attempt += 1) {
+        try {
+            const appId = await input.resolve();
+            if (appId > 0)
+                return appId;
+        }
+        catch {
+            // A newly-created app can lag its successful build/deploy metadata.
+        }
+        if (attempt < attempts && retryDelayMs > 0)
+            await sleep(retryDelayMs);
     }
+    return 0;
 }
 async function readHubSpotProjectIntermediateRepresentation(root) {
     const hsproject = await readHubSpotProjectConfig(root);
@@ -4877,8 +5091,71 @@ async function readPersistedHubSpotAppBinding(root, expectedProjectName) {
         return undefined;
     }
 }
-async function readPersistedHubSpotAppId(root, expectedProjectName) {
-    return (await readPersistedHubSpotAppBinding(root, expectedProjectName))?.appId;
+async function readPersistedHubSpotAppId(root, expectedProjectName, expectedDeveloperAccountId) {
+    const binding = await readPersistedHubSpotAppBinding(root, expectedProjectName);
+    if (!binding)
+        return undefined;
+    return hubSpotAppBindingMatchesDeveloperAccount(binding.developerAccountId, expectedDeveloperAccountId)
+        ? binding.appId
+        : undefined;
+}
+/** @internal Exported for deterministic account-switch regressions. */
+export function hubSpotAppBindingMatchesDeveloperAccount(persistedDeveloperAccountId, selectedDeveloperAccountId) {
+    if (!selectedDeveloperAccountId)
+        return true;
+    return persistedDeveloperAccountId === selectedDeveloperAccountId;
+}
+async function resolveHubSpotDeployDeveloperAccountId(argv, root) {
+    const explicit = resolveFlag(argv, '--developer-account-id') ?? process.env.HSX_HUBSPOT_DEVELOPER_ACCOUNT_ID;
+    if (explicit?.trim())
+        return explicit.trim();
+    const configPath = resolveFlag(argv, '--config');
+    const discovered = await discoverHubSpotAccounts(root, configPath ? { configPath } : {});
+    const selected = discovered?.accounts.find((account) => account.isDefault) ??
+        (discovered?.accounts.length === 1 ? discovered.accounts[0] : undefined);
+    return selected ? String(selected.portalId) : undefined;
+}
+async function readPersistedHubSpotAppIdForDeploy(argv, root) {
+    return readPersistedHubSpotAppId(root, await resolveHubSpotProjectName(argv, root), await resolveHubSpotDeployDeveloperAccountId(argv, root));
+}
+/**
+ * Resolve the one HubSpot app a linked project already registered. The common
+ * path remains implicit: a first combined deploy persists the app id, while a
+ * checkout missing that advisory file can recover an unambiguous binding from
+ * the control plane. Explicit ids remain the advanced override.
+ */
+async function resolveHubSpotAppIdForDeploy(input) {
+    const explicit = readOptionalHubSpotAppId(resolveFlag(input.argv, '--hubspot-app-id') ?? process.env.HSX_HUBSPOT_APP_ID);
+    const projectName = await resolveHubSpotProjectName(input.argv, input.root);
+    const persisted = await readPersistedHubSpotAppIdForDeploy(input.argv, input.root);
+    const selected = explicit ?? persisted;
+    if (selected || !input.controlPlaneUrl)
+        return selected;
+    const response = await hostedHttp({
+        url: new URL(`/v1/accounts/${encodeURIComponent(input.accountId)}/projects/${encodeURIComponent(input.projectId)}/runtime-bindings`, input.controlPlaneUrl),
+        headers: await controlPlaneAuthHeaders(input.userId, undefined, input.accountId),
+    });
+    if (!response.ok)
+        return undefined;
+    const body = await response.json();
+    const bindings = Schema.decodeUnknownSync(schemas.ListProjectRuntimeBindingsResponse)(body).bindings;
+    const appIds = [
+        ...new Set(bindings
+            .filter((binding) => binding.environment === input.environment)
+            .map((binding) => binding.hubSpotAppId)),
+    ];
+    if (appIds.length === 0)
+        return undefined;
+    if (appIds.length > 1) {
+        throw new Error(`Project ${input.projectId} has multiple HubSpot apps in ${input.environment} (${appIds.join(', ')}). Pass --hubspot-app-id once to choose one.`);
+    }
+    const appId = appIds[0];
+    await persistHubSpotAppBinding(input.root, {
+        appId,
+        projectName,
+        developerAccountId: undefined,
+    });
+    return appId;
 }
 async function resolveHubSpotAppAuthUrl(argv, root) {
     const projectName = await resolveHubSpotProjectName(argv, root);
@@ -4894,6 +5171,18 @@ async function resolveHubSpotAppAuthUrl(argv, root) {
 function readStatus(value) {
     return isRecord(value) && typeof value.status === 'string' ? value.status : undefined;
 }
+/** @internal Exported for deterministic legacy-account deploy regressions. */
+export function resolveHubSpotDeveloperAccountIdFromBuild(input) {
+    if (input.developerAccountId?.trim())
+        return input.developerAccountId.trim();
+    if (!isRecord(input.buildStatus))
+        return undefined;
+    const portalId = input.buildStatus.portalId;
+    if (typeof portalId === 'number' && Number.isInteger(portalId) && portalId > 0) {
+        return String(portalId);
+    }
+    return typeof portalId === 'string' && portalId.trim().length > 0 ? portalId.trim() : undefined;
+}
 const readSubbuildStatuses = readHubSpotSubbuildStatuses;
 const HUBSPOT_COMPONENT_TERMINAL_STATES = new Set(['SUCCESS', 'FAILURE', 'ERROR', 'CANCELLED']);
 /** Emit each HubSpot component once, when it reaches a terminal build state. */
@@ -4997,7 +5286,7 @@ async function requestHostedControlPlaneDeployPlan({ request, controlPlaneUrl, u
     const response = await hostedHttp({
         url: new URL('/v1/deploys/plan', controlPlaneUrl),
         method: 'POST',
-        headers: await controlPlaneAuthHeaders(userId),
+        headers: await controlPlaneAuthHeaders(userId, undefined, request.accountId),
         body: request,
     });
     const body = await response.json();
@@ -5008,7 +5297,7 @@ async function requestHostedControlPlaneDeployPlan({ request, controlPlaneUrl, u
     }
     return Schema.decodeUnknownSync(schemas.DeployPlanResponse)(body);
 }
-async function requestLocalControlPlaneDeployRecordAndMaybePromote({ request, plan, promoteWhenHealthy, revision, }) {
+async function requestLocalControlPlaneDeployRecordAndMaybePromote({ request, plan, promoteWhenHealthy, workerUrl, revision, }) {
     const localAttestationAuth = revision
         ? { grantSecret: randomBytes(32).toString('base64url'), hubSpotAppId: 1 }
         : undefined;
@@ -5051,6 +5340,7 @@ async function requestLocalControlPlaneDeployRecordAndMaybePromote({ request, pl
             manifestHash: plan.manifestHash,
             signedManifest: request.manifest,
             signature: `sig_${plan.deployId}`,
+            ...(workerUrl ? { workerUrl } : {}),
             // ADR-021 R03: the real Cloudflare Worker version identity captured
             // back from the confirmed active deployment. Absent only when capture
             // was skipped/failed (best-effort) — then this deploy is history-only.
@@ -5133,13 +5423,14 @@ async function requestHostedControlPlaneDeployRecordAndMaybePromote({ request, p
     const response = await hostedHttp({
         url: new URL(`/v1/deploys/${encodeURIComponent(plan.deployId)}/record`, controlPlaneUrl),
         method: 'POST',
-        headers: await controlPlaneAuthHeaders(userId),
+        headers: await controlPlaneAuthHeaders(userId, undefined, request.accountId),
         body: {
             accountId: request.accountId,
             projectId: request.projectId,
             manifestHash: plan.manifestHash,
             signedManifest: request.manifest,
             signature: `sig_${plan.deployId}`,
+            ...(workerUrl ? { workerUrl } : {}),
             // ADR-021 R03: the real Cloudflare Worker version identity captured back
             // from the confirmed active deployment. Absent only when capture was
             // skipped/failed (best-effort) — then this deploy is history-only.
@@ -5159,6 +5450,7 @@ async function requestHostedControlPlaneDeployRecordAndMaybePromote({ request, p
     }
     const drift = await waitForHealthyControlPlaneDrift({
         controlPlaneUrl,
+        accountId: request.accountId,
         projectId: request.projectId,
         deployId: plan.deployId,
         userId,
@@ -5461,7 +5753,7 @@ function discoverManageSchemaMode(definition) {
 }
 function discoverSourceDefinitions(source) {
     const definitions = new Map();
-    for (const match of source.matchAll(/(?:const|let|var)\s+([A-Za-z_$][\w$]*)\s*=\s*defineSource(\.push)?\s*\(\s*\{([\s\S]*?)\}\s*\)/g)) {
+    for (const match of source.matchAll(/(?:const|let|var)\s+([A-Za-z_$][\w$]*)\s*=\s*defineSource(\.push)?\s*(?:<[\s\S]*?>)?\s*\(\s*\{([\s\S]*?)\}\s*\)/g)) {
         const variableName = match[1];
         const body = match[3] ?? '';
         if (!variableName) {
@@ -5585,6 +5877,9 @@ const deployOptions = {
     message: Options.text('message').pipe(Options.withAlias('m'), Options.optional), // --message / -m
     platformVersion: Options.text('platform-version').pipe(Options.optional), // --platform-version
     hubspotProjectName: Options.text('hubspot-project-name').pipe(Options.optional), // --hubspot-project-name
+    cloudflareAccountId: Options.text('cloudflare-account-id').pipe(Options.optional), // --cloudflare-account-id
+    cloudflareApiToken: Options.text('cloudflare-api-token').pipe(Options.optional), // --cloudflare-api-token
+    apiToken: Options.text('api-token').pipe(Options.optional), // --api-token
     // ── boolean flags (argv.includes) ──
     plan: Options.boolean('plan').pipe(Options.withDefault(false)), // --plan
     dryRun: Options.boolean('dry-run').pipe(Options.withDefault(false)), // --dry-run
@@ -5651,6 +5946,9 @@ const deployBaseCmd = Command.make('deploy', deployOptions, (opts) => runHandler
     push('--message', opts.message);
     push('--platform-version', opts.platformVersion);
     push('--hubspot-project-name', opts.hubspotProjectName);
+    push('--cloudflare-account-id', opts.cloudflareAccountId);
+    push('--cloudflare-api-token', opts.cloudflareApiToken);
+    push('--api-token', opts.apiToken);
     flag('--plan', opts.plan);
     flag('--dry-run', opts.dryRun);
     flag('--build-only', opts.buildOnly);