@specific.dev/cli 0.1.221 → 0.1.223

package/dist/cli.js

@@ -367566,6 +367566,7 @@ function progressStreamFromBuffer(buffer, onProgress) {
 var FEEDBACK_NOT_ENABLED_CODE = "FEEDBACK_NOT_ENABLED";
 var CLI_DEPLOYMENTS_DISABLED_CODE = "CLI_DEPLOYMENTS_DISABLED";
 var PROJECT_PAUSED_CODE = "PROJECT_PAUSED";
+var QUOTA_EXCEEDED_CODE = "QUOTA_EXCEEDED";
 var ApiError = class extends Error {
   code;
   httpStatus;
@@ -374716,6 +374717,52 @@ function findEnvironmentByNameOrId(environments, flag) {
   return environments.find((e) => e.id === flag) ?? environments.find((e) => e.name === flag);
 }
 
+// src/lib/deployments/format.ts
+var DASHBOARD_URL = "https://dashboard.specific.dev";
+function dashboardBillingUrl(projectId) {
+  return `${DASHBOARD_URL}/projects/${encodeURIComponent(projectId)}/organization-settings/billing`;
+}
+function dashboardDeploymentUrl(projectId, environmentId, deploymentId) {
+  return `${DASHBOARD_URL}/projects/${encodeURIComponent(projectId)}/env/${encodeURIComponent(environmentId)}/deployments/${encodeURIComponent(deploymentId)}`;
+}
+var PLAN_LIMIT_LABELS = {
+  service: ["service", "services"],
+  cron: ["cron", "crons"],
+  postgres: ["postgres database", "postgres databases"],
+  storage: ["storage bucket", "storage buckets"],
+  redis: ["redis instance", "redis instances"],
+  temporal: ["temporal namespace", "temporal namespaces"],
+  mail: ["mail block", "mail blocks"]
+};
+function formatPlanLimitViolations(violations) {
+  return violations.map((v) => {
+    const [singular, plural] = PLAN_LIMIT_LABELS[v.resource] ?? [v.resource, v.resource];
+    return `${v.declared} ${v.declared === 1 ? singular : plural} (limit ${v.limit})`;
+  }).join(", ");
+}
+function formatErrorCode(code) {
+  const labels = {
+    build_failed: "Build failed",
+    pre_deploy_failed: "Pre-deploy hook failed",
+    deploy_failed: "Service failed to deploy",
+    provisioning_failed: "Resource provisioning failed",
+    health_check_failed: "Health check failed",
+    post_deploy_failed: "Post-deploy hook failed",
+    volume_reset_failed: "Volume reset failed",
+    internal_error: "Internal error"
+  };
+  return labels[code] || code;
+}
+
+// src/lib/project/quota.ts
+function formatProjectQuotaError(err) {
+  if (!(err instanceof ApiError) || err.code !== QUOTA_EXCEEDED_CODE) return null;
+  if (!err.apiError.includes("maxProjects")) return null;
+  const limit = /limit:\s*(\d+)/.exec(err.apiError)?.[1];
+  if (limit === void 0) return err.apiError;
+  return `Your plan allows ${limit} project${limit === "1" ? "" : "s"}. Upgrade at ${DASHBOARD_URL} or delete a project.`;
+}
+
 // src/lib/auth/freebuff.ts
 import { createHash as createHash2 } from "node:crypto";
 import { mkdirSync as mkdirSync12, readFileSync as readFileSync9, rmSync as rmSync4, writeFileSync as writeFileSync8 } from "node:fs";
@@ -375415,7 +375462,7 @@ function trackEvent(event, properties) {
     event,
     properties: {
       ...properties,
-      cli_version: "0.1.221",
+      cli_version: "0.1.223",
       platform: process.platform,
       node_version: process.version,
       project_id: getProjectId()
@@ -377603,19 +377650,160 @@ import Spinner4 from "ink-spinner";
 import * as fs23 from "fs";
 import * as path21 from "path";
 
-// src/lib/deployments/format.ts
-function formatErrorCode(code) {
-  const labels = {
-    build_failed: "Build failed",
-    pre_deploy_failed: "Pre-deploy hook failed",
-    deploy_failed: "Service failed to deploy",
-    provisioning_failed: "Resource provisioning failed",
-    health_check_failed: "Health check failed",
-    post_deploy_failed: "Post-deploy hook failed",
-    volume_reset_failed: "Volume reset failed",
-    internal_error: "Internal error"
+// src/lib/auth/agent-login.ts
+function formatDeadline(date) {
+  return date.toISOString().replace(/\.\d{3}Z$/, "Z");
+}
+async function performAgentLogin() {
+  writeLog("auth", "Registering anonymous agent identity with AuthKit");
+  const registration = await registerAgentIdentity();
+  writeLog("auth", `Agent registration received: ${registration.id}`);
+  const base = {
+    kind: "agent",
+    registrationId: registration.id,
+    assertion: registration.identity.assertion,
+    assertionExpiresAt: Date.parse(registration.identity.expires_at) || Date.now() + 36e5,
+    refreshToken: registration.identity.refresh_token?.value,
+    claimToken: registration.claim?.token,
+    claimTokenExpiresAt: registration.claim ? Date.parse(registration.claim.expires_at) : void 0,
+    claimed: false,
+    userId: ""
   };
-  return labels[code] || code;
+  const accessToken = await getAgentAccessToken(base);
+  const client2 = new SpecificClient({ accessToken, ...freebuffAttributionOptions() });
+  const me = await client2.getMe();
+  const info = await client2.getAgentRegistration();
+  writeUserCredentials({ ...readAgentCredentials() ?? base, userId: me.id });
+  writeLog("auth", `Agent credentials written for user ${me.id}`);
+  return { registrationId: registration.id, claimDeadlineAt: new Date(info.claimDeadlineAt) };
+}
+function printAgentLoginSummary(result) {
+  console.log("Registered this CLI as an agent. No login needed to deploy.");
+  console.log("");
+  printUnclaimedNotice(result.claimDeadlineAt);
+}
+function printUnclaimedNotice(claimDeadlineAt) {
+  console.log("This account is UNCLAIMED:");
+  console.log("  - it can hold one project on the free tier");
+  console.log(
+    claimDeadlineAt ? `  - it and everything deployed to it are deleted at ${formatDeadline(claimDeadlineAt)}` : "  - it and everything deployed to it are deleted 48 hours after registration"
+  );
+  console.log("    unless a person claims it before then");
+  console.log("");
+  console.log("To hand the account to its owner, run (with their email):");
+  console.log("  specific claim --email <email>");
+}
+function isExpiredRegistrationError(err) {
+  return err instanceof AgentRegistrationExpiredError || err instanceof ApiError && err.code === "AGENT_REGISTRATION_EXPIRED";
+}
+async function describeAgentAccount(credentials) {
+  const client2 = new SpecificClient({ tokenProvider: getValidAccessToken, ...freebuffAttributionOptions() });
+  try {
+    const info = await client2.getAgentRegistration();
+    if (info.status === "expired") return { status: "expired" };
+    if (info.status === "unclaimed") {
+      return { status: "unclaimed", claimDeadlineAt: new Date(info.claimDeadlineAt) };
+    }
+    const me = await client2.getMe();
+    const current = readAgentCredentials() ?? credentials;
+    if (!current.claimed) {
+      writeUserCredentials({ ...current, claimVerified: void 0, claimed: true, userId: me.id });
+    }
+    return { status: "claimed", email: me.email };
+  } catch (err) {
+    if (isExpiredRegistrationError(err)) return { status: "expired" };
+    writeLog(
+      "auth",
+      `Agent registration lookup failed, using stored state: ${err instanceof Error ? err.message : String(err)}`
+    );
+    return credentials.claimed ? { status: "claimed", email: null } : { status: "unclaimed", claimDeadlineAt: null };
+  }
+}
+async function printUnclaimedDeployReminder() {
+  const credentials = readAgentCredentials();
+  if (!credentials || credentials.claimed) return;
+  const state = await describeAgentAccount(credentials);
+  if (state.status !== "unclaimed") return;
+  const when = state.claimDeadlineAt ? `at ${formatDeadline(state.claimDeadlineAt)}` : "when the claim window closes";
+  console.log("");
+  console.log(`This account is UNCLAIMED: it and this deployment are deleted ${when}`);
+  console.log("unless a person claims it before then. To hand it over, run (with the owner's email):");
+  console.log("  specific claim --email <email>");
+}
+function requireAgentCredentials() {
+  const stored = readStoredCredentials();
+  if (!stored) {
+    throw new Error("Not registered as an agent. Run 'specific login --agent' first.");
+  }
+  if (stored.kind !== "agent") {
+    throw new Error(
+      "Claiming only applies to agent registrations. This CLI is logged in as a person already."
+    );
+  }
+  return stored;
+}
+async function startClaim(email) {
+  const credentials = requireAgentCredentials();
+  if (credentials.claimed) {
+    const client2 = new SpecificClient({ tokenProvider: getValidAccessToken, ...freebuffAttributionOptions() });
+    const me = await client2.getMe();
+    return { phase: "completed", email: me.email, alreadyClaimed: true };
+  }
+  if (credentials.claimVerified) {
+    return await handOverToPlatform(credentials);
+  }
+  if (!credentials.claimToken) {
+    throw new Error("This registration has no claim token; run 'specific login --agent' again.");
+  }
+  await new SpecificClient({ tokenProvider: getValidAccessToken, ...freebuffAttributionOptions() }).getAgentRegistration();
+  writeLog("auth", `Starting agent claim for ${email}`);
+  const { verificationUri } = await startAgentClaim(credentials.claimToken, email);
+  return { phase: "started", verificationUri };
+}
+async function completeClaim(userCode) {
+  let credentials = requireAgentCredentials();
+  if (credentials.claimed) {
+    const client2 = new SpecificClient({ tokenProvider: getValidAccessToken, ...freebuffAttributionOptions() });
+    const me = await client2.getMe();
+    return { phase: "completed", email: me.email, alreadyClaimed: true };
+  }
+  if (credentials.claimVerified) {
+    return await handOverToPlatform(credentials);
+  }
+  if (!credentials.claimToken) {
+    throw new Error("This registration has no claim token; run 'specific login --agent' again.");
+  }
+  writeLog("auth", "Completing agent claim");
+  const verified = await completeAgentClaim(credentials.claimToken, userCode.trim());
+  credentials = applyAgentIdentity(credentials, verified.identity, { claimVerified: true });
+  return await handOverToPlatform(credentials);
+}
+async function handOverToPlatform(credentials) {
+  const client2 = new SpecificClient({ tokenProvider: getValidAccessToken, ...freebuffAttributionOptions() });
+  const result = await client2.claimAgentRegistration();
+  writeUserCredentials({ ...credentials, claimVerified: void 0, claimed: true, userId: result.user.id });
+  writeLog("auth", `Agent registration claimed by ${result.user.email}`);
+  return { phase: "completed", email: result.user.email, alreadyClaimed: false };
+}
+function describeClaimError(err) {
+  if (err instanceof AgentAuthError) {
+    switch (err.code) {
+      case "claim_not_confirmed":
+        return "The user hasn't finished on the claim page yet. Ask them to complete it, then retry.";
+      case "invalid_user_code":
+        return "That code was not accepted. Ask the user to read it again from the claim page.";
+      case "user_code_expired":
+        return "The code expired. Run 'specific claim --email <email>' again for a fresh link.";
+      case "claim_expired":
+      case "claim_revoked":
+      case "already_claimed":
+      case "invalid_claim_token":
+        return `${err.message}. Run 'specific login --agent' to register again.`;
+      default:
+        return err.message;
+    }
+  }
+  return err instanceof Error ? err.message : String(err);
 }
 
 // src/lib/deployments/inputs.ts
@@ -377692,6 +377880,12 @@ function formatCliDeploymentsDisabledError(projectId, environmentId, detail) {
     "Once they have, run this command again."
   ].join("\n");
 }
+function formatPlanLimitExceededError(projectId, environmentId, deploymentId, action) {
+  return `This deployment exceeds the ${action.planName} plan's limits: ${formatPlanLimitViolations(action.violations)}. Upgrade at ${dashboardBillingUrl(projectId)}, then start it from ${dashboardDeploymentUrl(projectId, environmentId, deploymentId)}, or remove the extra resources from specific.hcl and deploy again.`;
+}
+function formatUnknownPendingActionError(projectId, environmentId, deploymentId, type) {
+  return `This deployment is waiting on "${type}", which this CLI version doesn't understand. Update the CLI or continue from ${dashboardDeploymentUrl(projectId, environmentId, deploymentId)}.`;
+}
 function formatBytes2(bytes) {
   if (bytes < 1024) return `${bytes} B`;
   if (bytes < 1024 * 1024) return `${(bytes / 1024).toFixed(1)} KB`;
@@ -377870,6 +378064,23 @@ function getFailedBuild(pendingActions) {
   if (!pendingActions) return void 0;
   return pendingActions.find((a) => a.type === "build_failed");
 }
+function getPlanLimitAction(pendingActions) {
+  if (!pendingActions) return void 0;
+  return pendingActions.find(
+    (a) => a.type === "plan_limit_exceeded"
+  );
+}
+var KNOWN_PENDING_ACTION_TYPES = /* @__PURE__ */ new Set([
+  "build_in_progress",
+  "build_failed",
+  "missing_secrets",
+  "missing_configs",
+  "plan_limit_exceeded"
+]);
+function getUnknownPendingAction(pendingActions) {
+  if (!pendingActions) return void 0;
+  return pendingActions.find((a) => !KNOWN_PENDING_ACTION_TYPES.has(a.type));
+}
 function StructuredError({ error }) {
   return /* @__PURE__ */ React7.createElement(Box7, { flexDirection: "column" }, /* @__PURE__ */ React7.createElement(Text7, { color: "red", bold: true }, formatErrorCode(error.code), ": ", error.message), error.resource && /* @__PURE__ */ React7.createElement(Text7, { dimColor: true }, "Resource: ", error.resource), error.output && /* @__PURE__ */ React7.createElement(Box7, { flexDirection: "column", marginTop: 1 }, /* @__PURE__ */ React7.createElement(Text7, { bold: true }, "Output:"), /* @__PURE__ */ React7.createElement(Text7, null, error.output)));
 }
@@ -378033,7 +378244,7 @@ function DeployUI({ envFlag, preview, config }) {
         if (cancelled) return;
         setState({
           phase: "error",
-          error: err instanceof Error ? err.message : String(err)
+          error: formatProjectQuotaError(err) ?? (err instanceof Error ? err.message : String(err))
         });
       }
     }
@@ -378523,6 +378734,24 @@ function DeployUI({ envFlag, preview, config }) {
           }));
           return;
         }
+        const planLimit = getPlanLimitAction(status.pendingActions);
+        if (planLimit) {
+          if (pollInterval) clearInterval(pollInterval);
+          const message = formatPlanLimitExceededError(
+            state.projectId,
+            state.environmentId,
+            status.id,
+            planLimit
+          );
+          writeLog("deploy:error", message);
+          setState((s) => ({
+            ...s,
+            phase: "error",
+            deployment: status,
+            error: message
+          }));
+          return;
+        }
         const missingSecrets2 = getMissingSecrets(status.pendingActions);
         if (missingSecrets2.length > 0) {
           if (pollInterval) clearInterval(pollInterval);
@@ -378565,6 +378794,24 @@ function DeployUI({ envFlag, preview, config }) {
           }));
           return;
         }
+        const unknownAction = getUnknownPendingAction(status.pendingActions);
+        if (unknownAction) {
+          if (pollInterval) clearInterval(pollInterval);
+          const message = formatUnknownPendingActionError(
+            state.projectId,
+            state.environmentId,
+            status.id,
+            unknownAction.type
+          );
+          writeLog("deploy:error", message);
+          setState((s) => ({
+            ...s,
+            phase: "error",
+            deployment: status,
+            error: message
+          }));
+          return;
+        }
         if (!status.pendingActions || status.pendingActions.length === 0) {
           if (pollInterval) clearInterval(pollInterval);
           pollInterval = void 0;
@@ -379106,6 +379353,13 @@ ${failedBuild.output}`);
       }
       process.exit(1);
     }
+    const planLimit = getPlanLimitAction(status.pendingActions);
+    if (planLimit) {
+      console.error(
+        `Error: ${formatPlanLimitExceededError(projectId, environmentId, deployment.id, planLimit)}`
+      );
+      process.exit(1);
+    }
     const missingSecrets = getMissingSecrets(status.pendingActions);
     if (missingSecrets.length > 0) {
       const secretsToSubmit = {};
@@ -379151,6 +379405,13 @@ ${failedBuild.output}`);
     if (hasBuildsInProgress(status.pendingActions)) {
       continue;
     }
+    const unknownAction = getUnknownPendingAction(status.pendingActions);
+    if (unknownAction) {
+      console.error(
+        `Error: ${formatUnknownPendingActionError(projectId, environmentId, deployment.id, unknownAction.type)}`
+      );
+      process.exit(1);
+    }
     if (!status.pendingActions || status.pendingActions.length === 0) {
       break;
     }
@@ -379222,6 +379483,7 @@ ${status.error.output}`);
       console.log(`    ${name}: ${url}`);
     }
   }
+  await printUnclaimedDeployReminder();
 }
 async function deployCommand(options2) {
   try {
@@ -380009,120 +380271,6 @@ function cleanCommand(instanceKey) {
   }
 }
 
-// src/lib/auth/agent-login.ts
-function formatDeadline(date) {
-  return date.toISOString().replace(/\.\d{3}Z$/, "Z");
-}
-async function performAgentLogin() {
-  writeLog("auth", "Registering anonymous agent identity with AuthKit");
-  const registration = await registerAgentIdentity();
-  writeLog("auth", `Agent registration received: ${registration.id}`);
-  const base = {
-    kind: "agent",
-    registrationId: registration.id,
-    assertion: registration.identity.assertion,
-    assertionExpiresAt: Date.parse(registration.identity.expires_at) || Date.now() + 36e5,
-    refreshToken: registration.identity.refresh_token?.value,
-    claimToken: registration.claim?.token,
-    claimTokenExpiresAt: registration.claim ? Date.parse(registration.claim.expires_at) : void 0,
-    claimed: false,
-    userId: ""
-  };
-  const accessToken = await getAgentAccessToken(base);
-  const client2 = new SpecificClient({ accessToken, ...freebuffAttributionOptions() });
-  const me = await client2.getMe();
-  const info = await client2.getAgentRegistration();
-  writeUserCredentials({ ...readAgentCredentials() ?? base, userId: me.id });
-  writeLog("auth", `Agent credentials written for user ${me.id}`);
-  return { registrationId: registration.id, claimDeadlineAt: new Date(info.claimDeadlineAt) };
-}
-function printAgentLoginSummary(result) {
-  console.log("Registered this CLI as an agent. No login needed to deploy.");
-  console.log("");
-  console.log("This account is UNCLAIMED:");
-  console.log("  - it can hold one project on the free tier");
-  console.log(`  - it and everything deployed to it are deleted at ${formatDeadline(result.claimDeadlineAt)}`);
-  console.log("    unless a person claims it before then");
-  console.log("");
-  console.log("To hand the account to its owner, run (with their email):");
-  console.log("  specific claim --email <email>");
-}
-function requireAgentCredentials() {
-  const stored = readStoredCredentials();
-  if (!stored) {
-    throw new Error("Not registered as an agent. Run 'specific login --agent' first.");
-  }
-  if (stored.kind !== "agent") {
-    throw new Error(
-      "Claiming only applies to agent registrations. This CLI is logged in as a person already."
-    );
-  }
-  return stored;
-}
-async function startClaim(email) {
-  const credentials = requireAgentCredentials();
-  if (credentials.claimed) {
-    const client2 = new SpecificClient({ tokenProvider: getValidAccessToken, ...freebuffAttributionOptions() });
-    const me = await client2.getMe();
-    return { phase: "completed", email: me.email, alreadyClaimed: true };
-  }
-  if (credentials.claimVerified) {
-    return await handOverToPlatform(credentials);
-  }
-  if (!credentials.claimToken) {
-    throw new Error("This registration has no claim token; run 'specific login --agent' again.");
-  }
-  await new SpecificClient({ tokenProvider: getValidAccessToken, ...freebuffAttributionOptions() }).getAgentRegistration();
-  writeLog("auth", `Starting agent claim for ${email}`);
-  const { verificationUri } = await startAgentClaim(credentials.claimToken, email);
-  return { phase: "started", verificationUri };
-}
-async function completeClaim(userCode) {
-  let credentials = requireAgentCredentials();
-  if (credentials.claimed) {
-    const client2 = new SpecificClient({ tokenProvider: getValidAccessToken, ...freebuffAttributionOptions() });
-    const me = await client2.getMe();
-    return { phase: "completed", email: me.email, alreadyClaimed: true };
-  }
-  if (credentials.claimVerified) {
-    return await handOverToPlatform(credentials);
-  }
-  if (!credentials.claimToken) {
-    throw new Error("This registration has no claim token; run 'specific login --agent' again.");
-  }
-  writeLog("auth", "Completing agent claim");
-  const verified = await completeAgentClaim(credentials.claimToken, userCode.trim());
-  credentials = applyAgentIdentity(credentials, verified.identity, { claimVerified: true });
-  return await handOverToPlatform(credentials);
-}
-async function handOverToPlatform(credentials) {
-  const client2 = new SpecificClient({ tokenProvider: getValidAccessToken, ...freebuffAttributionOptions() });
-  const result = await client2.claimAgentRegistration();
-  writeUserCredentials({ ...credentials, claimVerified: void 0, claimed: true, userId: result.user.id });
-  writeLog("auth", `Agent registration claimed by ${result.user.email}`);
-  return { phase: "completed", email: result.user.email, alreadyClaimed: false };
-}
-function describeClaimError(err) {
-  if (err instanceof AgentAuthError) {
-    switch (err.code) {
-      case "claim_not_confirmed":
-        return "The user hasn't finished on the claim page yet. Ask them to complete it, then retry.";
-      case "invalid_user_code":
-        return "That code was not accepted. Ask the user to read it again from the claim page.";
-      case "user_code_expired":
-        return "The code expired. Run 'specific claim --email <email>' again for a fresh link.";
-      case "claim_expired":
-      case "claim_revoked":
-      case "already_claimed":
-      case "invalid_claim_token":
-        return `${err.message}. Run 'specific login --agent' to register again.`;
-      default:
-        return err.message;
-    }
-  }
-  return err instanceof Error ? err.message : String(err);
-}
-
 // src/commands/login.tsx
 async function loginCommand(options2 = {}) {
   if (getEnvApiKey()) {
@@ -380130,8 +380278,25 @@ async function loginCommand(options2 = {}) {
     return;
   }
   if (isLoggedIn()) {
-    console.log("Already logged in.");
-    return;
+    const agent = readAgentCredentials();
+    if (!agent) {
+      console.log("Already logged in.");
+      return;
+    }
+    const state = await describeAgentAccount(agent);
+    if (state.status === "unclaimed") {
+      console.log("Already registered as an agent. No login needed to deploy.");
+      console.log("");
+      printUnclaimedNotice(state.claimDeadlineAt);
+      return;
+    }
+    if (state.status === "claimed") {
+      console.log(
+        state.email ? `Already logged in as an agent claimed by ${state.email}.` : "Already logged in as a claimed agent."
+      );
+      return;
+    }
+    console.log("The agent registration on this machine has expired.");
   }
   if (options2.agent) {
     try {
@@ -380353,7 +380518,7 @@ function compareVersions(a, b) {
   return 0;
 }
 async function checkForUpdate() {
-  const currentVersion = "0.1.221";
+  const currentVersion = "0.1.223";
   const response = await fetch(`${BINARIES_BASE_URL}/latest?t=${Date.now()}`);
   if (!response.ok) {
     throw new Error(`Failed to check for updates: HTTP ${response.status}`);
@@ -380577,8 +380742,13 @@ async function projectNewCommand(name, options2) {
     const project = await client2.createProject(name, orgId);
     console.log(`Project created: ${project.id}`);
   } catch (error) {
+    const quotaMessage = formatProjectQuotaError(error);
+    if (quotaMessage) {
+      console.error(quotaMessage);
+      process.exit(1);
+    }
     const message = error instanceof Error ? error.message : "Unknown error occurred";
-    console.error(`Failed to create project: ${message}`);
+    console.error(`Error: ${message}`);
     process.exit(1);
   }
 }
@@ -381040,10 +381210,10 @@ async function deploymentShowCommand(idArg, options2) {
     const client2 = new SpecificClient({ tokenProvider: getValidAccessToken });
     let deploymentId = idArg;
     if (!deploymentId) {
-      const projectId = readProjectId();
+      const projectId2 = readProjectId();
       const env2 = await resolveEnvironmentStatus(
         client2,
-        projectId,
+        projectId2,
         options2.environment
       );
       const latest = env2.latestDeployment ?? env2.inProgressDeployment ?? env2.activeDeployment;
@@ -381060,7 +381230,12 @@ async function deploymentShowCommand(idArg, options2) {
       process.stdout.write(JSON.stringify(payload, null, 2) + "\n");
       return;
     }
-    process.stdout.write(renderDeployment(deployment, includeOutput));
+    let projectId = null;
+    try {
+      projectId = readProjectId();
+    } catch {
+    }
+    process.stdout.write(renderDeployment(deployment, includeOutput, projectId));
   } catch (err) {
     const message = err instanceof Error ? err.message : "Unknown error occurred";
     console.error(`Error: ${message}`);
@@ -381159,7 +381334,7 @@ function formatBytes3(bytes) {
   if (bytes < 1024) return `${bytes} B`;
   return `${(bytes / 1024).toFixed(1)} KB`;
 }
-function renderDeployment(deployment, includeOutput) {
+function renderDeployment(deployment, includeOutput, projectId) {
   const lines = [];
   lines.push(
     `${ANSI2.bold}Deployment ${deployment.id}${ANSI2.reset} ${ANSI2.dim}(${deployment.environment})${ANSI2.reset}`
@@ -381223,15 +381398,26 @@ function renderDeployment(deployment, includeOutput) {
     }
   }
   const pendingActions = deployment.pendingActions ?? [];
+  const planLimit = pendingActions.find(
+    (a) => a.type === "plan_limit_exceeded"
+  );
   const missingSecrets = pendingActions.flatMap(
     (a) => a.type === "missing_secrets" ? a.secrets : []
   );
   const missingConfigs = pendingActions.flatMap(
     (a) => a.type === "missing_configs" ? a.configs : []
   );
-  if (missingSecrets.length > 0 || missingConfigs.length > 0) {
+  if (planLimit || missingSecrets.length > 0 || missingConfigs.length > 0) {
     lines.push("");
     lines.push(colored(ANSI2.yellow, `${ANSI2.bold}Action required${ANSI2.reset}`));
+    if (planLimit) {
+      lines.push(
+        `  This deployment exceeds the ${planLimit.planName} plan's limits: ${formatPlanLimitViolations(planLimit.violations)}.`
+      );
+      lines.push(
+        `  Upgrade at ${projectId ? dashboardBillingUrl(projectId) : DASHBOARD_URL}, or remove the extra resources from specific.hcl and deploy again.`
+      );
+    }
     if (missingSecrets.length > 0) {
       lines.push(`  Missing secrets: ${missingSecrets.join(", ")}`);
     }
@@ -381389,7 +381575,7 @@ async function feedbackCommand(message) {
     await client2.submitFeedback({
       message: trimmed,
       projectId,
-      cliVersion: "0.1.221"
+      cliVersion: "0.1.223"
     });
     trackEvent("feedback_submitted", { hasProject: !!projectId });
     console.log("Thanks! We will take a look at your feedback shortly.");
@@ -381408,7 +381594,7 @@ async function feedbackCommand(message) {
 var program = new Command();
 var env = "production";
 var envLabel = env !== "production" ? `[${env.toUpperCase()}] ` : "";
-program.name("specific").description(`${envLabel}Infrastructure-as-code for coding agents`).version("0.1.221").enablePositionalOptions();
+program.name("specific").description(`${envLabel}Infrastructure-as-code for coding agents`).version("0.1.223").enablePositionalOptions();
 program.command("init").description("Initialize project for use with a coding agent").option("--agent <name...>", "Agents to configure (cursor, claude, codex, other)").addHelpText("after", `
 Examples:
   $ specific init

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@specific.dev/cli",
-  "version": "0.1.221",
+  "version": "0.1.223",
   "description": "CLI for Specific infrastructure-as-code",
   "type": "module",
   "main": "dist/cli.js",