fix(deploy): don't fail a successful publish when the app URL lookup is refused

CHANGELOG.md

@@ -29,6 +29,7 @@
 
 ### Fixed
 
+- `base44 deploy --git-hash` (and `site deploy --publish`) no longer fails after a successful publish when the app's URL can't be looked up, as happened with a workspace API key (`BASE44_API_KEY`). It reports the deploy and leaves out the URL.
 - An app id passed with `--app-id` or `BASE44_APP_ID` no longer discards the project the command runs in. Commands that need a project — `site dev`, `dev`, `connectors pull`/`push` — refused as if there were none. A checkout with `base44/config.jsonc` but no `.app.jsonc`, such as a hosted sandbox, can now run them.
 - The `backend-and-client` template names its entity file `Task.jsonc`, matching the entity's `name`; the Base44 platform derives the entity from the filename, so `task.jsonc` read as a second entity.
 - `base44 link` now lists editor-created apps; previously only apps created by the CLI could be linked.

packages/cli/src/cli/commands/site/deploy.ts

@@ -130,11 +130,11 @@ async function deployToDeploymentsApi(
       )
     : undefined;
 
-  if (published) {
+  if (published?.appUrl) {
     log.message(
       `${theme.styles.header("App URL")}: ${theme.colors.links(published.appUrl)}`,
     );
-  } else {
+  } else if (!published) {
     log.info(
       "Not published: production still serves its previous build. Run again with --publish to serve this one.",
     );

packages/cli/src/core/site/api.ts

@@ -181,5 +181,8 @@ export async function publishDeployment(
     throw await ApiError.fromHttpError(error, "publishing deployment");
   }
 
-  return { gitHash, appUrl: await getSiteUrl() };
+  // Best effort: the publish already went through, and the URL lookup is a
+  // platform route a workspace API key is refused on.
+  const appUrl = await getSiteUrl().catch(() => undefined);
+  return { gitHash, appUrl };
 }

packages/cli/src/core/site/schema.ts

@@ -203,8 +203,8 @@ export type FinalizeDeploymentResponse = z.infer<
   typeof FinalizeDeploymentResponseSchema
 >;
 
-/** A commit's build now serving production, and where. */
+/** A commit's build now serving production, and where when it could be looked up. */
 export interface PublishedDeployment {
   gitHash: string;
-  appUrl: string;
+  appUrl?: string;
 }

packages/cli/tests/cli/deploy.spec.ts

@@ -342,6 +342,27 @@ describe("deploy command (unified)", () => {
       t.expectResult(result).toContain("published from the Base44 builder");
     });
 
+    it("still succeeds when the app URL can't be looked up after publishing", async () => {
+      // A workspace API key is refused on the published-url route.
+      await t.givenLoggedInWithProject(fixture("full-project"));
+      mockProjectResources();
+      mockDeployment();
+      t.api.mockError(
+        "get",
+        `/api/apps/platform/${t.api.appId}/published-url`,
+        {
+          status: 401,
+          body: { message: "Unauthorized", detail: "Object not found" },
+        },
+      );
+      t.api.mockDeploymentPublish();
+
+      const result = await t.run("deploy", "-y", "--git-hash", GIT_HASH);
+
+      t.expectResult(result).toSucceed();
+      expect(t.api.publishedCommits).toEqual([GIT_HASH]);
+    });
+
     it("fails when the publish itself fails", async () => {
       await t.givenLoggedInWithProject(fixture("full-project"));
       mockProjectResources();