Document CLI dry run

tools/cli.mdx

@@ -151,6 +151,27 @@ powersync pull instance --instance-id=<instance-id>
 
 Then edit `service.yaml` and `sync-config.yaml` as needed, run `powersync validate`, and `powersync deploy`. Run `powersync pull instance` again (no IDs if already linked) to refresh from the cloud.
 
+A repeat pull does not overwrite your local files by default. If `service.yaml` or `sync-config.yaml` already exists, the CLI warns you and writes that file's fetched version alongside it as `service-fetched.yaml` or `sync-fetched.yaml`, so your local edits survive and you can merge in the changes you want. Add `--overwrite` to replace the local files instead.
+
+### Preview a Deploy
+
+Add `--dry-run` to `powersync deploy`, `powersync deploy service-config`, or `powersync deploy sync-config` to see what a deploy would do without changing the instance:
+
+```bash
+powersync deploy --dry-run
+```
+
+The command prints the target instance, runs the deploy validations, and then summarizes what would change: the `service.yaml` sections that differ from the deployed config, and a diff of the Sync Config. Nothing is deployed.
+
+If the instance is not provisioned yet, the dry run skips Sync Config validation, because that check runs against a running instance. The summary reports that a real deploy would provision the instance first, then validate and deploy the Sync Config.
+
+The service config summary lists section names only, because `service.yaml` holds connection strings and other secrets. To compare the full file, run `powersync pull instance` and diff the resulting `service-fetched.yaml` against your `service.yaml`.
+
+<Note>
+  Connections that pass a password with `secret` always show `replication` as
+  changed, because the value is sent again on every deploy.
+</Note>
+
 ### Run Commands Without Local Config
 
 To run commands (e.g. `powersync generate schema`, `powersync status`) against an instance managed elsewhere (e.g. Dashboard):
@@ -159,10 +180,10 @@ To run commands (e.g. `powersync generate schema`, `powersync status`) against a
 - **Or pass each time:** `--instance-id`, or set `INSTANCE_ID` in the environment.
 
 <Info>
-  The CLI resolves instance and linking context in a fixed order: flags take
-  precedence, then environment variables, then values in `cli.yaml`. For the
-  full resolution order and how to set up multiple instances (e.g. dev, staging,
-  prod), see [supplying linking information for Cloud and self-hosted
+  The CLI resolves the instance in a fixed order: flags first, then
+  `cli.yaml`, then environment variables. For the full resolution order and
+  how to set up multiple instances (e.g. dev, staging, prod), see [supplying
+  linking information for Cloud and self-hosted
   commands](https://github.com/powersync-ja/powersync-cli/blob/main/docs/usage.md#supplying-linking-information-for-cloud-and-self-hosted-commands)
   in the CLI usage docs.
 </Info>
@@ -254,6 +275,7 @@ Then use the same commands as any self-hosted instance (`powersync status`, `pow
 | `powersync deploy`                                              | Deploy full config to linked Cloud instance                                        |
 | `powersync deploy service-config`                               | [Cloud] Deploy only service config                                                 |
 | `powersync deploy sync-config`                                  | [Cloud] Deploy only Sync Config                                                    |
+| `powersync deploy --dry-run`                                    | [Cloud] Validate and preview what a deploy would change, without deploying         |
 | `powersync validate`                                            | Validate config and Sync Streams/Rules                                             |
 | `powersync edit config`                                         | Open Config Studio (Monaco editor)                                                 |
 | `powersync status`                                              | Instance diagnostics (Cloud and self-hosted)                                       |
@@ -274,6 +296,8 @@ You can automate Sync Config (and full config) deployments using the CLI in CI.
 
 **Secrets:** Set `PS_ADMIN_TOKEN` to your PowerSync personal access token. If the workflow does not use a linked directory, also set `INSTANCE_ID`. For self-hosted, `API_URL` can specify the PowerSync API base URL.
 
+The CLI prints the target instance name and IDs before a deploy starts, so the job log shows which instance changed. For pull request checks, run `powersync deploy --dry-run` to validate the config and preview the changes without deploying.
+
 <Card
   title="GitHub Actions Demo"
   icon="github"
@@ -312,7 +336,7 @@ More information is available in the [PowerSync CLI repository](https://github.c
 | Resource                                                                                                   | Description                                                                                                                                                                                                         |
 | ---------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
 | [CLI README](https://github.com/powersync-ja/powersync-cli/blob/main/cli/README.md)                        | Getting started, Cloud and self-hosted overview, and full **command reference** with all flags.                                                                                                                     |
-| [General usage](https://github.com/powersync-ja/powersync-cli/blob/main/docs/usage.md)                     | **How the CLI works**: local config vs linking, resolution order (flags → env vars → `cli.yaml`), and **configuring multiple instances** (e.g. dev/staging/prod with separate directories or `!env` in `cli.yaml`). |
+| [General usage](https://github.com/powersync-ja/powersync-cli/blob/main/docs/usage.md)                     | **How the CLI works**: local config vs linking, resolution order (flags → `cli.yaml` → env vars), and **configuring multiple instances** (e.g. dev/staging/prod with separate directories or `!env` in `cli.yaml`). |
 | [Docker (local development)](https://github.com/powersync-ja/powersync-cli/blob/main/docs/usage-docker.md) | Self-hosted Docker workflow, configure/start/stop/reset, database and storage modules, and template layout.                                                                                                         |
 | [Config Studio (editor)](https://github.com/powersync-ja/powersync-cli/tree/main/packages/editor)          | Built-in Monaco-powered editor for `service.yaml` and `sync-config.yaml` (`powersync edit config`), schema validation, and local development.                                                                       |
 | [Examples](https://github.com/powersync-ja/powersync-cli/blob/main/examples/README.md)                     | Sample projects initialized with the CLI (e.g. Cloud pull, self-hosted Postgres, self-hosted Supabase).                                                                                                             |