@newly/cli 0.1.0 → 0.1.2

package/README.md

@@ -18,6 +18,8 @@ newly pull <project-id>  # download project code + link this directory
 # edit code…
 newly deploy             # deploy to dev
 newly deploy --env prod  # ship to prod
+newly services list      # inspect backend services
+newly email status       # inspect Newly Email setup
 ```
 
 ## Auth
@@ -47,7 +49,7 @@ Most commands target the project linked to the current directory, so you don't p
 
 Prod actions prompt for confirmation. Pass `--yes` to skip it in scripts.
 
-> Only **newly-backend-stack** projects (Python api-service + Node auth-service) are CLI-deployable. Run `newly stack` to check. Specular-stack projects must be deployed from the Newly web app.
+> Only projects on the Newly backend stack are CLI-deployable. Run `newly stack` to check. Other projects must be deployed from the Newly web app.
 
 ## Commands
 
@@ -73,19 +75,20 @@ Show dev and prod status, service URLs, deployed SHA, and last error.
 Show which backend stack the project uses and whether it's CLI-deployable.
 - `--project <id>`
 
-### `newly up`
-Provision the backend (if not already) and deploy.
-- `--env <dev|prod>` (default `dev`)
-- `--region <region>` — region for dev provisioning (default `us-central1`)
-- `--project <id>`
-- `--yes` — skip the prod confirmation prompt
-
 ### `newly deploy`
-Deploy the backend.
+Provision the backend if needed, then deploy.
 - `--env <dev|prod>` (default `dev`)
+- `--region <region>` — region for first-time dev provisioning (default `auto`)
 - `--project <id>`
+- `--service <names>` — comma-separated service names from `backend/newly.services.json`
+- `--git-sha <sha>` — prod git revision to deploy (default `HEAD`)
 - `--yes` — skip the prod confirmation prompt
 
+### `newly services list`
+List backend services from `backend/newly.services.json`.
+- `--env <dev|prod>` (default `dev`) — used for rendered public URLs
+- `--project <id>` — include expected public URLs for this project
+
 ### `newly logs`
 Tail backend service logs. **Dev only.**
 - `--service <api|auth>` (default `api`)
@@ -105,10 +108,66 @@ Set a backend secret. **Dev only.** Redeploy to apply.
 - `--project <id>`
 
 ### `newly db url`
-Print a readonly Postgres URL for the backend database. **Dev only.**
+Print a readonly URL for the Newly DB. **Dev only.**
+- `--project <id>`
+
+### `newly email status`
+Show Newly Email configuration for the API service. **Dev only.**
 - `--project <id>`
 
+### `newly email test`
+Send a test email through the deployed API service. **Dev only.**
+- `--to <email>` — recipient address
+- `--from <email>` — optional sender; defaults to the backend sender setting
+- `--subject <subject>`
+- `--text <text>`
+- `--html <html>`
+- `--project <id>`
+
+## Dev mode
+
+`newly-dev` is a convenience wrapper that points credentials at `~/.newly-dev` so dev and prod credentials never collide. The prod `newly` binary still defaults to `https://newly.app` and `~/.newly/credentials`, untouched.
+
+### Headless login
+
+For CI and dev modal-backend deploys where no web app is running to mint a CLI token, skip the browser entirely:
+
+```bash
+newly-dev login \
+  --api-url https://your-dev-modal.modal.run/api \
+  --token <jwt> \
+  --expires-in 86400
+```
+
+`--expires-in` is seconds. The same flags work on the prod `newly` binary.
+
+### Env vars
+
+| Var | Effect |
+|---|---|
+| `NEWLY_HOME` | Credentials directory. Explicit value always wins. |
+| `NEWLY_DEV_HOME` | Credentials directory used by `newly-dev` (default: `~/.newly-dev`). |
+| `NEWLY_APP_URL` | Default for `--app-url` at module load. |
+| `NEWLY_DEV_APP_URL` | When set, `newly-dev` surfaces this as `NEWLY_APP_URL`. |
+
+### Typical dev workflow
+
+```bash
+# 1. Deploy a personal dev modal-backend.
+cd modal-backend
+uv run ./deploy.sh --terminate
+
+# 2. Grab the deployed URL, then log the dev CLI in headlessly.
+newly-dev login --api-url https://your-dev-modal.modal.run/api --token <jwt>
+
+# 3. Use newly-dev the same way as newly.
+newly-dev create my-test
+newly-dev status
+newly-dev deploy
+```
+
 ## Files
 
 - `~/.newly/credentials` — session token (mode `600`). Override the directory with `NEWLY_HOME`.
+- `~/.newly-dev/credentials` — `newly-dev` session token. Override the directory with `NEWLY_DEV_HOME`.
 - `.newly/project.json` — per-directory project link.

package/dist/api.js

@@ -41,6 +41,12 @@ export class ApiClient {
     post(path, body) {
         return this.request('POST', path, body);
     }
+    patch(path, body) {
+        return this.request('PATCH', path, body);
+    }
+    delete(path, body) {
+        return this.request('DELETE', path, body);
+    }
     async upload(path, body, contentType) {
         const res = await fetch(`${this.baseUrl}${path}`, {
             method: 'POST',
@@ -62,6 +68,26 @@ export class ApiClient {
         const contentType_ = res.headers.get('content-type') ?? '';
         return contentType_.includes('application/json') ? res.json() : res;
     }
+    async uploadForm(path, form) {
+        const res = await fetch(`${this.baseUrl}${path}`, {
+            method: 'POST',
+            headers: {
+                Authorization: `Bearer ${this.token}`,
+            },
+            body: form,
+        });
+        if (!res.ok) {
+            let detail = await res.text();
+            try {
+                detail = JSON.parse(detail).detail ?? detail;
+            }
+            catch {
+            }
+            throw new ApiError(res.status, detail);
+        }
+        const contentType = res.headers.get('content-type') ?? '';
+        return contentType.includes('application/json') ? res.json() : res;
+    }
     async getBinary(path) {
         const res = await fetch(`${this.baseUrl}${path}`, {
             method: 'GET',

package/dist/commands/build.js

@@ -0,0 +1,250 @@
+import { existsSync, statSync } from 'node:fs';
+import { basename, resolve } from 'node:path';
+import { ApiClient, ApiError } from '../api.js';
+import { createSnapshot } from '../archive.js';
+import { readProjectLink, requireCredentials, resolveProject, writeProjectLink } from '../config.js';
+export function buildPlaceholderMessage(platform) {
+    return (`In-house ${platform} builds are coming in an upcoming release.\n` +
+        'Set up iOS signing first with `newly creds apple` (check readiness with `newly creds apple status`).');
+}
+function makeClient() {
+    const creds = requireCredentials();
+    return {
+        client: new ApiClient(creds.apiUrl, creds.token),
+    };
+}
+function assertDirectory(path, label) {
+    if (!existsSync(path))
+        throw new Error(`${label} does not exist: ${path}`);
+    if (!statSync(path).isDirectory())
+        throw new Error(`${label} is not a directory: ${path}`);
+}
+function archiveKib(size) {
+    return size < 1024 ? '<1' : Math.round(size / 1024).toString();
+}
+async function ensureRemoteSourceProject(client, sourceDir, explicitProject, log) {
+    if (explicitProject)
+        return explicitProject;
+    const linked = readProjectLink(sourceDir);
+    if (linked?.projectId)
+        return linked.projectId;
+    const name = basename(resolve(sourceDir)) || 'iOS simulator build';
+    log('No Newly project link found; creating a build-only project for this local source...');
+    const created = (await client.post('/newly_backend/create_project', {
+        name,
+        provision: false,
+    }));
+    const projectId = typeof created.project_id === 'string' ? created.project_id : '';
+    if (!projectId)
+        throw new Error('Backend did not return project_id for build-only project.');
+    writeProjectLink(sourceDir, {
+        projectId,
+        pulledSha: null,
+        pulledAt: new Date().toISOString(),
+    });
+    log(`Linked local source to Newly project ${projectId} for remote simulator builds.`);
+    return projectId;
+}
+function parseSseData(frame) {
+    const out = [];
+    for (const part of frame.split(/\n\n+/)) {
+        const data = part
+            .split(/\n/)
+            .filter((line) => line.startsWith('data:'))
+            .map((line) => line.slice(5).trimStart())
+            .join('\n');
+        if (!data)
+            continue;
+        try {
+            out.push(JSON.parse(data));
+        }
+        catch {
+        }
+    }
+    return out;
+}
+async function waitForBuild(client, buildId, log) {
+    let status = 'queued';
+    const answeredPrompts = new Set();
+    for await (const chunk of client.stream(`/builds/${buildId}/stream`)) {
+        for (const event of parseSseData(chunk)) {
+            const promptId = typeof event.id === 'string' ? event.id : '';
+            if (promptId === 'jenkins-fallback-choice' && !answeredPrompts.has(promptId)) {
+                answeredPrompts.add(promptId);
+                if (typeof event.message === 'string')
+                    log(event.message);
+                log('Default build system failed; leaving this remote simulator build failed.');
+                await client.post(`/builds/${buildId}/respond`, {
+                    promptId,
+                    value: 'keep_failed',
+                });
+                status = 'failed';
+                continue;
+            }
+            if (Array.isArray(event.new_logs)) {
+                for (const line of event.new_logs)
+                    log(String(line));
+            }
+            if (typeof event.message === 'string')
+                log(event.message);
+            if (typeof event.status === 'string')
+                status = event.status;
+        }
+    }
+    return status;
+}
+function serveSimPrepareUrl(session) {
+    if (typeof session.base_url !== 'string' || typeof session.install_url !== 'string')
+        return null;
+    const installUrl = new URL(session.install_url);
+    const prepareUrl = new URL(`${session.base_url.replace(/\/+$/, '')}/api/integration/prepare`);
+    const device = installUrl.searchParams.get('device');
+    if (device)
+        prepareUrl.searchParams.set('device', device);
+    prepareUrl.searchParams.set('async', '1');
+    return prepareUrl.toString();
+}
+async function prepareServeSimBuildFromCli(session, launchUrl) {
+    if (typeof session.token !== 'string') {
+        throw new Error('Backend returned a serve-sim session without a token.');
+    }
+    const prepareUrl = serveSimPrepareUrl(session);
+    if (!prepareUrl) {
+        throw new Error('Backend returned a serve-sim session without a prepare target.');
+    }
+    const controller = new AbortController();
+    const timeout = setTimeout(() => controller.abort(), 20_000);
+    try {
+        const res = await fetch(prepareUrl, {
+            method: 'POST',
+            headers: {
+                Authorization: `Bearer ${session.token}`,
+                'Content-Type': 'application/json',
+            },
+            body: JSON.stringify({
+                artifactUrl: typeof session.artifact_url === 'string' ? session.artifact_url : undefined,
+                launchUrl,
+            }),
+            signal: controller.signal,
+        });
+        if (!res.ok) {
+            const body = await res.text().catch(() => '');
+            throw new Error(`serve-sim prepare failed: HTTP ${res.status}${body ? ` ${body}` : ''}`);
+        }
+    }
+    catch (error) {
+        if (error instanceof DOMException && error.name === 'AbortError') {
+            throw new Error('serve-sim prepare timed out after 20000ms');
+        }
+        throw error;
+    }
+    finally {
+        clearTimeout(timeout);
+    }
+}
+export async function runIosSimulatorBuild(client, projectId, opts = {}, log = console.log) {
+    let build;
+    const metroUrl = opts.metroUrl?.trim() || null;
+    if (opts.remoteSource) {
+        const sourceDir = opts.sourcePath ?? '.';
+        assertDirectory(sourceDir, 'iOS build source directory');
+        projectId = await ensureRemoteSourceProject(client, sourceDir, projectId, log);
+        log('Packaging iOS source...');
+        const archive = await createSnapshot(sourceDir);
+        log(`Uploading source snapshot (${archiveKib(archive.length)} KiB) for remote iOS simulator build...`);
+        const form = new FormData();
+        form.set('request', JSON.stringify({
+            project_id: projectId,
+            platform: 'ios',
+            mode: 'automatic',
+            build_profile: 'development-simulator',
+        }));
+        form.set('source', new Blob([new Uint8Array(archive)], { type: 'application/gzip' }), 'source.tar.gz');
+        build = (await client.uploadForm('/builds/source-upload', form));
+    }
+    else {
+        projectId = resolveProject(process.cwd(), projectId);
+        build = (await client.post('/builds', {
+            projectId,
+            platform: 'ios',
+            mode: 'automatic',
+            buildProfile: 'development-simulator',
+        }));
+    }
+    log(`Build ${build.id} queued (${build.status})`);
+    if (opts.wait) {
+        const status = await waitForBuild(client, build.id, log);
+        log(`Build ${build.id} ${status}`);
+        if (status !== 'completed')
+            throw new Error(`iOS simulator build ${status}`);
+    }
+    if (opts.loadToSimulator) {
+        const load = (provider) => {
+            const params = new URLSearchParams();
+            if (provider)
+                params.set('provider', provider);
+            if (provider === 'serve-sim' && metroUrl)
+                params.set('expo_url', metroUrl);
+            const qs = params.size ? `?${params.toString()}` : '';
+            return client.post(`/builds/${build.id}/load-to-simulator${qs}`, {});
+        };
+        let loaded;
+        try {
+            loaded = await load(opts.provider);
+        }
+        catch (e) {
+            if (opts.provider === 'serve-sim' && e instanceof ApiError && (e.status === 503 || e.status === 500)) {
+                log('Cloud iOS simulator unavailable; falling back to Appetize...');
+                loaded = await load();
+            }
+            else {
+                throw e;
+            }
+        }
+        if (typeof loaded.appetize_public_key === 'string') {
+            log(`Appetize iOS key: ${loaded.appetize_public_key}`);
+        }
+        else if (loaded.serve_sim && typeof loaded.serve_sim === 'object') {
+            const session = loaded.serve_sim;
+            await prepareServeSimBuildFromCli(session, metroUrl);
+            const url = typeof session.url === 'string' ? session.url : session.base_url;
+            log(`Cloud simulator prepared on ${typeof url === 'string' ? url : 'ready'}`);
+        }
+        else {
+            log('Simulator load requested.');
+        }
+    }
+}
+export function registerBuild(program) {
+    program
+        .command('build [platform]')
+        .description('Build the mobile app')
+        .option('--project <id>', 'project id (defaults to the linked directory)')
+        .option('--source-path <path>', 'local source directory to upload for --remote-source', '.')
+        .option('--simulator', 'build an iOS simulator artifact', false)
+        .option('--remote-source', 'upload local source files and build in Newly cloud', false)
+        .option('--wait', 'stream logs until the build finishes', false)
+        .option('--load-to-simulator', 'load a completed simulator build into a cloud simulator', false)
+        .option('--provider <provider>', 'simulator provider for --load-to-simulator (serve-sim or appetize)')
+        .option('--metro-url <url>', 'reachable Metro bundle URL for remote simulator source builds')
+        .action(async (platform = 'ios', opts) => {
+        try {
+            if (platform !== 'ios' || !opts.simulator) {
+                console.log(buildPlaceholderMessage(platform));
+                return;
+            }
+            if (opts.provider && !opts.loadToSimulator) {
+                throw new Error('--provider requires --load-to-simulator.');
+            }
+            const { client } = makeClient();
+            const projectId = opts.remoteSource
+                ? opts.project || readProjectLink(opts.sourcePath ?? '.')?.projectId
+                : resolveProject(process.cwd(), opts.project);
+            await runIosSimulatorBuild(client, projectId, opts);
+        }
+        catch (e) {
+            console.error(e instanceof Error ? e.message : String(e));
+            process.exitCode = 1;
+        }
+    });
+}

package/dist/commands/create.js

@@ -30,7 +30,7 @@ export async function runCreate(client, dir, opts) {
     }
     else {
         console.log(`Created backend project ${project_id} and scaffolded backend/ here ` +
-            `(not provisioned — run \`newly up\` when ready). Edit, then \`newly deploy\`.`);
+            `(not provisioned — run \`newly deploy\` when ready).`);
     }
     return project_id;
 }

package/dist/commands/creds.js

@@ -0,0 +1,103 @@
+import { readFileSync } from 'node:fs';
+import { ApiClient, friendlyApiError } from '../api.js';
+import { requireCredentials, resolveProject } from '../config.js';
+const TEAM_BUNDLE_CMD = 'newly creds apple --team-id <TEAM_ID> --bundle-id <BUNDLE_ID>';
+const ASC_KEY_CMD = 'newly creds apple --asc-key <key.p8> --key-id <KEY_ID> --issuer-id <ISSUER_ID>';
+export function buildReadiness(s) {
+    const missing = [];
+    const remediations = [];
+    if (!s.team_id)
+        missing.push('team id');
+    if (!s.bundle_id)
+        missing.push('bundle id');
+    if (!s.team_id || !s.bundle_id)
+        remediations.push(TEAM_BUNDLE_CMD);
+    if (!s.asc_api_key?.has_private_key) {
+        missing.push('ASC API key');
+        remediations.push(ASC_KEY_CMD);
+    }
+    return { ready: missing.length === 0, missing, remediations };
+}
+export function renderAppleStatus(s) {
+    const r = buildReadiness(s);
+    const lines = [
+        `team id:     ${s.team_id ?? '— not set'}`,
+        `bundle id:   ${s.bundle_id ?? '— not set'}`,
+        `ASC API key: ${s.asc_api_key?.has_private_key ? 'configured' : '— not set'}`,
+    ];
+    if (r.ready) {
+        lines.push('', '✓ iOS build-ready.');
+    }
+    else {
+        lines.push('', `Missing: ${r.missing.join(', ')}. To fix:`);
+        for (const cmd of r.remediations)
+            lines.push(`  ${cmd}`);
+    }
+    return lines.join('\n');
+}
+export function planAppleCreds(opts) {
+    const setTeamInfo = Boolean(opts.teamId || opts.bundleId);
+    if (setTeamInfo && !(opts.teamId && opts.bundleId)) {
+        throw new Error('--team-id and --bundle-id must be provided together.');
+    }
+    const uploadAscKey = Boolean(opts.ascKey);
+    if (uploadAscKey && !opts.keyId) {
+        throw new Error('--asc-key requires --key-id.');
+    }
+    if (!setTeamInfo && !uploadAscKey) {
+        throw new Error('Nothing to do. Pass --team-id/--bundle-id and/or --asc-key. See `newly creds apple status`.');
+    }
+    return { setTeamInfo, uploadAscKey };
+}
+export async function runAppleCreds(opts, client, projectId, log = console.log) {
+    const plan = planAppleCreds(opts);
+    if (plan.setTeamInfo) {
+        await client.post(`/newly_backend/apple/team_info/${projectId}`, {
+            team_id: opts.teamId,
+            bundle_id: opts.bundleId,
+        });
+        log(`Set team id ${opts.teamId} and bundle id ${opts.bundleId}.`);
+    }
+    if (plan.uploadAscKey) {
+        const privateKeyBase64 = readFileSync(opts.ascKey).toString('base64');
+        await client.post(`/newly_backend/apple/asc_key/${projectId}`, {
+            key_id: opts.keyId,
+            issuer_id: opts.issuerId ?? '',
+            private_key_base64: privateKeyBase64,
+        });
+        log('Uploaded ASC API key.');
+    }
+}
+export function registerCreds(program) {
+    const creds = program.command('creds').description('Manage project credentials');
+    const apple = creds
+        .command('apple')
+        .argument('[action]', 'use "status" to show Apple credential readiness')
+        .description('Set Apple iOS build credentials (project owner only)')
+        .option('--team-id <id>', 'Apple Developer team ID')
+        .option('--bundle-id <id>', 'iOS bundle identifier')
+        .option('--asc-key <file>', 'path to an App Store Connect API key (.p8)')
+        .option('--key-id <id>', 'ASC API key ID (required with --asc-key)')
+        .option('--issuer-id <id>', 'ASC API issuer ID')
+        .option('--project <id>', 'project id (defaults to the linked directory)');
+    apple.action(async (action, opts) => {
+        try {
+            const creds = requireCredentials();
+            const projectId = resolveProject(process.cwd(), opts.project);
+            const client = new ApiClient(creds.apiUrl, creds.token);
+            if (action === 'status') {
+                const status = await client.get(`/newly_backend/apple/status/${projectId}`);
+                console.log(renderAppleStatus(status));
+                return;
+            }
+            if (action) {
+                throw new Error(`Unknown creds apple action "${action}". Use "status" or pass credential options.`);
+            }
+            await runAppleCreds(opts, client, projectId);
+        }
+        catch (e) {
+            console.error(friendlyApiError(e));
+            process.exitCode = 1;
+        }
+    });
+}

package/dist/commands/deploy.js

@@ -4,6 +4,7 @@ import { ApiClient, ApiError, friendlyApiError } from '../api.js';
 import { requireCredentials, resolveProject } from '../config.js';
 import { createSnapshot } from '../archive.js';
 import { parseSseFrames } from '../sse.js';
+import { assertKnownServices, parseServiceFilter, readBackendServices } from '../services-manifest.js';
 const POLL_INTERVAL_MS = 5_000;
 const POLL_TIMEOUT_MS = 20 * 60 * 1000;
 export async function pollRun(client, runId, opts = {}) {
@@ -61,52 +62,90 @@ export function finishOrThrow(run, label) {
         return;
     }
     if (run.failure_reason === 'no_backend_code') {
-        throw new Error('No backend code to deploy (backend/api-service missing).');
+        throw new Error('No backend code to deploy (backend/ missing).');
     }
     throw new Error(`${label} deploy failed (${run.failure_reason ?? 'unknown'}):\n${run.output_tail ?? ''}`);
 }
-export async function runDevDeploy(projectId, client, dir) {
-    if (!existsSync(join(dir, 'backend', 'api-service'))) {
-        throw new Error('No backend/api-service in this directory. Run `newly pull <project-id>` first, ' +
+export async function runDevDeploy(projectId, client, dir, services = []) {
+    if (!existsSync(join(dir, 'backend'))) {
+        throw new Error('No backend/ in this directory. Run `newly pull <project-id>` first, ' +
             'or cd into a pulled project.');
     }
     console.log('Packaging local backend…');
     const snapshot = await createSnapshot(dir);
     const kib = snapshot.length < 1024 ? '<1' : Math.round(snapshot.length / 1024).toString();
     console.log(`Uploading snapshot (${kib} KiB) and deploying server-side…`);
-    const { run_id } = await client.upload(`/newly_backend/deploy/${projectId}?env=dev`, snapshot, 'application/gzip');
+    const params = new URLSearchParams({ env: 'dev' });
+    for (const service of services)
+        params.append('services', service);
+    const { run_id } = await client.upload(`/newly_backend/deploy/${projectId}?${params}`, snapshot, 'application/gzip');
     const run = await streamRun(client, run_id);
     finishOrThrow(run, 'dev');
 }
-export async function runProdDeploy(projectId, client) {
-    console.log('Deploying prod from the canonical project code (repo HEAD)…');
-    const { run_id } = await client.post(`/newly_backend/deploy/${projectId}`, { env: 'prod' });
+export async function runProdDeploy(projectId, client, gitSha = 'HEAD', services = []) {
+    const label = gitSha === 'HEAD' ? 'repo HEAD' : gitSha;
+    console.log(`Deploying prod from the canonical project code (${label})…`);
+    const { run_id } = await client.post(`/newly_backend/deploy/${projectId}`, {
+        env: 'prod',
+        git_sha: gitSha,
+        services,
+    });
     const run = await streamRun(client, run_id);
     finishOrThrow(run, 'prod');
 }
+export async function ensureBackendProvisioned(client, projectId, env, opts = {}) {
+    const print = opts.print ?? console.log;
+    const status = await client.get(`/newly_backend/status/${projectId}`);
+    if (status[env])
+        return;
+    print(`Provisioning ${env} backend…`);
+    if (env === 'dev') {
+        await client.post(`/newly_backend/provision_dev/${projectId}`, {
+            dev_region: opts.region ?? 'auto',
+        });
+    }
+    else {
+        await client.post(`/newly_backend/provision_prod/${projectId}`);
+    }
+    print(`Provisioned ${env} backend.`);
+}
 export function registerDeploy(program) {
     program
         .command('deploy')
-        .description('Deploy the backend server-side from your local code (dev only; prod ships via Promote in the web app)')
-        .option('--env <env>', 'dev (prod is not supported via the CLI yet)', 'dev')
+        .description('Provision if needed, then deploy the backend server-side')
+        .option('--env <env>', 'dev or prod', 'dev')
+        .option('--region <region>', "Newly server region hint for first-time dev provisioning (defaults to 'auto')", 'auto')
         .option('--project <id>', 'project id (defaults to the linked directory)')
+        .option('--service <names>', 'comma-separated service names from backend/newly.services.json')
+        .option('--git-sha <sha>', 'prod git revision to deploy from canonical project code', 'HEAD')
         .option('--yes', 'skip the prod confirmation prompt', false)
         .action(async (opts) => {
         try {
             if (opts.env !== 'dev' && opts.env !== 'prod')
                 throw new Error('--env must be dev or prod');
-            if (opts.env === 'prod') {
-                throw new Error('Prod deploys are not supported via the CLI yet — use Promote in the Newly web app.');
-            }
             const creds = requireCredentials();
             const projectId = resolveProject(process.cwd(), opts.project);
             const client = new ApiClient(creds.apiUrl, creds.token);
+            const services = parseServiceFilter(opts.service);
+            assertKnownServices(readBackendServices(process.cwd()), services);
             const stackInfo = await client.get(`/newly_backend/stack/${projectId}`);
             if (!stackInfo.cli_deployable) {
-                throw new Error('This project is on the Specular stack (a single Node/drizzle backend), which `newly deploy` does not support. ' +
-                    'Only newly-backend-stack projects (Python api-service + Node auth-service) are CLI-deployable.');
+                throw new Error('This project does not support CLI deploys yet. Use the Newly web app to deploy it.');
+            }
+            if (opts.env === 'dev' && !existsSync(join(process.cwd(), 'backend'))) {
+                throw new Error('No backend/ in this directory. Run `newly pull <project-id>` first, ' +
+                    'or cd into a pulled project.');
+            }
+            await ensureBackendProvisioned(client, projectId, opts.env, {
+                region: opts.region,
+                print: console.log,
+            });
+            if (opts.env === 'prod') {
+                await runProdDeploy(projectId, client, opts.gitSha, services);
+            }
+            else {
+                await runDevDeploy(projectId, client, process.cwd(), services);
             }
-            await runDevDeploy(projectId, client, process.cwd());
         }
         catch (e) {
             console.error(e instanceof ApiError ? friendlyApiError(e) : String(e instanceof Error ? e.message : e));