@hasna/uptime 0.1.21 → 0.1.22

package/CHANGELOG.md

@@ -6,6 +6,15 @@ project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 ## [Unreleased]
 
+## [0.1.22] - 2026-06-28
+
+### Fixed
+
+- Clarified production hosted-token errors and docs to cover both explicit
+  hosted auth production mode and `NODE_ENV=production`.
+- Added built CLI entrypoint regression coverage for packaged hosted startup
+  rejecting raw hosted tokens under `NODE_ENV=production`.
+
 ## [0.1.21] - 2026-06-28
 
 ### Fixed

package/README.md

@@ -107,7 +107,8 @@ Hosted tokens can be provided as a single legacy token through
 ```
 
 Use scoped JSON for hosted deployments. A single raw hosted token is kept only
-for local compatibility and expands to broad read/write/probe/report scopes.
+for local compatibility and expands to broad read/write/probe/report scopes;
+it is rejected when hosted auth mode or `NODE_ENV` is `production`.
 Endpoints that accept request bodies require `content-type: application/json`.
 
 ## Uptime Semantics

package/dist/api.js

@@ -4286,7 +4286,7 @@ function parseHostedTokenValue(value, defaultWorkspaceId, source) {
     return parseHostedTokensConfig(trimmed, defaultWorkspaceId, source);
   }
   if (isHostedProductionMode()) {
-    throw new ApiError(`${source} must be scoped hosted token JSON when HASNA_UPTIME_HOSTED_AUTH_MODE=production`, 500);
+    throw new ApiError(`${source} must be scoped hosted token JSON when hosted auth mode or NODE_ENV is production`, 500);
   }
   return [{
     token: trimmed,

package/dist/cli/index.js

@@ -6880,7 +6880,7 @@ function parseHostedTokenValue(value, defaultWorkspaceId, source) {
     return parseHostedTokensConfig(trimmed, defaultWorkspaceId, source);
   }
   if (isHostedProductionMode()) {
-    throw new ApiError(`${source} must be scoped hosted token JSON when HASNA_UPTIME_HOSTED_AUTH_MODE=production`, 500);
+    throw new ApiError(`${source} must be scoped hosted token JSON when hosted auth mode or NODE_ENV is production`, 500);
   }
   return [{
     token: trimmed,
@@ -7014,7 +7014,7 @@ function buildAwsDeploymentPlan(options = {}) {
   const image = clean(options.image, `${imageRepositoryUri}@sha256:<image-digest>`);
   const evidenceBucket = clean(options.evidenceBucket, `hasna-${stage}-${prefix}-evidence`);
   const hostedSqliteDbPath = clean(options.hostedSqliteDbPath, DEFAULT_HOSTED_SQLITE_DB);
-  const runtimePackageVersion = clean(options.runtimePackageVersion, "0.1.21");
+  const runtimePackageVersion = clean(options.runtimePackageVersion, "0.1.22");
   const protectedAccessMode = options.protectedAccessMode ?? DEFAULT_PROTECTED_ACCESS_MODE;
   const protectedAccessUrl = protectedAccessMode === "cloudfront_default_domain" ? "https://<cloudfront-domain>" : `https://${hostname}`;
   const cluster = `${prefix}-${stage}`;

package/dist/cloud-plan.js

@@ -21,7 +21,7 @@ function buildAwsDeploymentPlan(options = {}) {
   const image = clean(options.image, `${imageRepositoryUri}@sha256:<image-digest>`);
   const evidenceBucket = clean(options.evidenceBucket, `hasna-${stage}-${prefix}-evidence`);
   const hostedSqliteDbPath = clean(options.hostedSqliteDbPath, DEFAULT_HOSTED_SQLITE_DB);
-  const runtimePackageVersion = clean(options.runtimePackageVersion, "0.1.21");
+  const runtimePackageVersion = clean(options.runtimePackageVersion, "0.1.22");
   const protectedAccessMode = options.protectedAccessMode ?? DEFAULT_PROTECTED_ACCESS_MODE;
   const protectedAccessUrl = protectedAccessMode === "cloudfront_default_domain" ? "https://<cloudfront-domain>" : `https://${hostname}`;
   const cluster = `${prefix}-${stage}`;

package/dist/index.js

@@ -4286,7 +4286,7 @@ function parseHostedTokenValue(value, defaultWorkspaceId, source) {
     return parseHostedTokensConfig(trimmed, defaultWorkspaceId, source);
   }
   if (isHostedProductionMode()) {
-    throw new ApiError(`${source} must be scoped hosted token JSON when HASNA_UPTIME_HOSTED_AUTH_MODE=production`, 500);
+    throw new ApiError(`${source} must be scoped hosted token JSON when hosted auth mode or NODE_ENV is production`, 500);
   }
   return [{
     token: trimmed,
@@ -4420,7 +4420,7 @@ function buildAwsDeploymentPlan(options = {}) {
   const image = clean(options.image, `${imageRepositoryUri}@sha256:<image-digest>`);
   const evidenceBucket = clean(options.evidenceBucket, `hasna-${stage}-${prefix}-evidence`);
   const hostedSqliteDbPath = clean(options.hostedSqliteDbPath, DEFAULT_HOSTED_SQLITE_DB);
-  const runtimePackageVersion = clean(options.runtimePackageVersion, "0.1.21");
+  const runtimePackageVersion = clean(options.runtimePackageVersion, "0.1.22");
   const protectedAccessMode = options.protectedAccessMode ?? DEFAULT_PROTECTED_ACCESS_MODE;
   const protectedAccessUrl = protectedAccessMode === "cloudfront_default_domain" ? "https://<cloudfront-domain>" : `https://${hostname}`;
   const cluster = `${prefix}-${stage}`;

package/docs/deployment-metadata.example.json

@@ -1,7 +1,7 @@
 {
   "service": "open-uptime",
   "package": "@hasna/uptime",
-  "intendedVersion": "0.1.21",
+  "intendedVersion": "0.1.22",
   "accountProfile": "<aws-profile>",
   "accountId": "<aws-account-id>",
   "region": "us-east-1",

package/infra/aws/terraform.tfvars.example

@@ -19,7 +19,7 @@ alb_ingress_cidr_blocks = []
 private_subnet_ids       = ["subnet-replace-private-a", "subnet-replace-private-b"]
 private_route_table_ids  = ["rtb-replace-private"]
 container_image          = "123456789012.dkr.ecr.us-east-1.amazonaws.com/open-uptime@sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
-runtime_package_version  = "0.1.21"
+runtime_package_version  = "0.1.22"
 certificate_arn          = null
 hosted_zone_id           = null
 app_env_secret_arn       = "arn:aws:secretsmanager:us-east-1:123456789012:secret:open-uptime/prod/app/env"

package/infra/aws/variables.tf

@@ -201,7 +201,7 @@ variable "container_image" {
 variable "runtime_package_version" {
   description = "Published @hasna/uptime package version that CodeBuild should build into the ECR image."
   type        = string
-  default     = "0.1.21"
+  default     = "0.1.22"
 
   validation {
     condition     = can(regex("^[0-9]+\\.[0-9]+\\.[0-9]+(-[0-9A-Za-z.-]+)?$", var.runtime_package_version))

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hasna/uptime",
-  "version": "0.1.21",
+  "version": "0.1.22",
   "description": "Local-first uptime and downtime monitoring service with CLI, MCP, SDK, SQLite persistence, and a dashboard.",
   "license": "Apache-2.0",
   "type": "module",