@hypequery/cli 1.10.4 → 1.12.0

package/README.md

@@ -25,6 +25,13 @@ Or install it once:
 npm install -D @hypequery/cli
 ```
 
+Ship it to Hypequery Cloud:
+
+```bash
+npx @hypequery/cli login
+npx @hypequery/cli deploy analytics/api.ts
+```
+
 ## Commands
 
 ### `hypequery init`
@@ -140,7 +147,9 @@ semantic keys such as `dataset:orders`.
 
 Builds a closed deployment bundle for an exported HypeQuery API. The bundle
 contains canonical deployment metadata, every referenced runtime artifact, and
-a manifest that binds their exact bytes and identities.
+a manifest that binds their exact bytes and identities. `hypequery deploy` runs
+this step for you; reach for it directly in CI pipelines that stage artifacts,
+or when you need the runtime options below.
 
 ```bash
 npx hypequery deployment:build analytics/api.ts
@@ -182,11 +191,112 @@ are still accepted for metadata-only validation.
 npx hypequery deployment:validate analytics/hypequery-deployment
 ```
 
+### `hypequery login`
+
+Authorizes the local CLI through your existing Hypequery Cloud browser
+session. The command uses an S256 PKCE loopback flow, then stores the
+target-scoped deployment token in the operating-system credential vault.
+Tokens expire after 12 hours.
+
+```bash
+npx hypequery login
+```
+
+Use `--cloud-url <origin>` or `HYPEQUERY_CLOUD_URL` for a self-hosted or local
+Cloud instance. HTTPS is required except for loopback development origins.
+
+Once logged in, `hypequery deploy` automatically uses the stored endpoint and
+token, and resolves the project and environment from the same stored profile.
+The deployment endpoint is returned by Cloud during the token exchange; it is
+the authenticated upload API, not the browser login endpoint. For
+non-interactive CI usage, set both `HYPEQUERY_API_TOKEN` and
+`HYPEQUERY_DEPLOYMENT_ENDPOINT` (or pass `--endpoint`).
+
+Because the CLI also loads a project `.env`, a `HYPEQUERY_API_TOKEN` left there
+takes precedence over the login flow and is rejected unless it is paired with an
+endpoint. Unset it to use `hypequery login`.
+
+Token storage requires an operating-system credential vault (Keychain,
+Credential Manager, or a Secret Service implementation such as
+gnome-keyring/KWallet). Headless environments without one should use
+`HYPEQUERY_API_TOKEN` instead of `hypequery login`.
+
+### `hypequery logout`
+
+Revokes the current Cloud token and removes it from the operating-system
+credential vault:
+
+```bash
+npx hypequery logout
+```
+
+If the stored profile is unreadable, `logout` still removes the local state and
+reports that the token was not revoked; it expires on its own.
+
+### `hypequery deploy`
+
+Builds a deployment bundle from an API module, prepares a target-bound release,
+and submits both. This is the primary Cloud workflow: sign in once, then deploy
+with one command.
+
+```bash
+npx hypequery login
+npx hypequery deploy analytics/api.ts
+```
+
+The bundle is written to `analytics/hypequery-deployment` and the release to
+`analytics/hypequery-deployment.release.json`. The target comes from the stored
+Cloud profile unless you override it:
+
+```bash
+npx hypequery deploy analytics/api.ts \
+  --project my-project \
+  --environment production
+```
+
+The deployment endpoint and token are resolved before the build, so a missing
+or expired login fails immediately rather than after bundling. The credential
+rules are the same as `hypequery deployment:submit` below.
+
+The three steps remain available individually as `deployment:build`,
+`deployment:release`, and `deployment:submit` for CI pipelines that stage
+artifacts, and for the cases `deploy` does not cover: `deploy` always builds the
+runtime artifact itself, so Python deployments and prebuilt runtime artifacts
+(`--runtime`, `--runtime-artifact`, `--runtime-file`) need `deployment:build`.
+
+Options:
+
+- `--project <project>`: target project identifier; defaults to the logged-in
+  target and must be paired with `--environment`
+- `--environment <environment>`: target environment identifier; defaults to the
+  logged-in target and must be paired with `--project`
+- `--bundle-output <directory>`: bundle directory, default
+  `analytics/hypequery-deployment`
+- `--release-output <path>`: release JSON path, default beside the bundle
+- `--endpoint <url>`: HTTPS submission endpoint; requires `HYPEQUERY_API_TOKEN`
+
+> **Deprecated:** `hypequery deploy <bundle> --release <file>` still submits a
+> prebuilt bundle and prints a deprecation warning. Use
+> `hypequery deployment:submit` instead. `--release` cannot be combined with
+> `--project`, `--environment`, `--bundle-output`, or `--release-output`.
+
 ### `hypequery deployment:release`
 
 Prepares a deterministic release request from a verified deployment bundle and
-an explicit project/environment target. This command does not upload, authorize,
-or execute the release.
+a project/environment target. This command does not upload, authorize, or
+execute the release.
+
+After `hypequery login` the target is read from the stored Cloud profile, and
+the resolved target is printed alongside the release identity:
+
+```bash
+npx hypequery deployment:release analytics/hypequery-deployment
+```
+
+To target something other than the logged-in project and environment, pass both
+flags. A half-specified override is rejected rather than completed from the
+stored profile, so an unset shell variable fails loudly instead of silently
+retargeting the release:
 
 ```bash
 npx hypequery deployment:release analytics/hypequery-deployment \
@@ -200,28 +310,36 @@ invalidate bundle verification.
 
 Options:
 
-- `--project <project>`: required target project identifier
-- `--environment <environment>`: required target environment identifier
+- `--project <project>`: target project identifier; defaults to the logged-in
+  target and must be paired with `--environment`
+- `--environment <environment>`: target environment identifier; defaults to the
+  logged-in target and must be paired with `--project`
 - `--output <path>`: release JSON path, default beside the bundle
 
-### `hypequery deploy`
+### `hypequery deployment:submit`
 
 Submits a verified deployment bundle with an already-prepared target-bound
 release. The command verifies both inputs again, requires their bundle
-identities to match, and streams only the files declared by the bundle.
+identities to match, and streams only the files declared by the bundle. Use it
+when the bundle and release were produced by an earlier pipeline step; for the
+ordinary path, use `hypequery deploy`.
 
 ```bash
-HYPEQUERY_API_TOKEN=<token> \
-npx hypequery deploy analytics/hypequery-deployment \
-  --release analytics/hypequery-deployment.release.json \
-  --endpoint https://deploy.example.com/v1/releases
+npx hypequery deployment:submit analytics/hypequery-deployment \
+  --release analytics/hypequery-deployment.release.json
 ```
 
-The token is accepted only through `HYPEQUERY_API_TOKEN`, keeping it out of
-shell history. The submission endpoint must use HTTPS, may also be supplied by
-`HYPEQUERY_DEPLOYMENT_ENDPOINT`, and must not contain credentials or a URL
-fragment. The release identity is sent as the idempotency key, so an unchanged
-release can be submitted safely again.
+For local development, run `hypequery login` first; the CLI reads the endpoint
+and token from its secure Cloud profile. For CI and manual credentials, set
+`HYPEQUERY_API_TOKEN` together with either `--endpoint` or
+`HYPEQUERY_DEPLOYMENT_ENDPOINT`. The CLI never combines one explicit value with
+the other value from the stored profile. Tokens are never accepted as
+command-line arguments, keeping them out of shell history. The submission
+endpoint must not contain credentials or a URL fragment, and must use HTTPS
+except for `127.0.0.1`/`localhost`, which is permitted for local Cloud
+development and warns that the token is sent in cleartext. The release identity
+is sent as the idempotency key, so an unchanged release can be submitted safely
+again.
 
 This command submits immutable deployment inputs. Activation, status changes,
 promotion, and rollback remain control-plane operations.
@@ -229,7 +347,7 @@ promotion, and rollback remain control-plane operations.
 Options:
 
 - `--release <path>`: required target-bound release JSON
-- `--endpoint <url>`: HTTPS submission endpoint; defaults to `HYPEQUERY_DEPLOYMENT_ENDPOINT`
+- `--endpoint <url>`: HTTPS submission endpoint; requires `HYPEQUERY_API_TOKEN`
 
 ## Non-interactive Setup
 

package/dist/cli.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAkBpC,QAAA,MAAM,OAAO,SAAgB,CAAC;AAa9B,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;;EAKpE;AAgLD,OAAO,EAAE,OAAO,EAAE,CAAC"}
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAyBpC,QAAA,MAAM,OAAO,SAAgB,CAAC;AAa9B,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;;EAKpE;AAsND,OAAO,EAAE,OAAO,EAAE,CAAC"}

package/dist/cli.js

@@ -7,7 +7,8 @@ import { generateCommand } from './commands/generate.js';
 import { generateDatasetsCommand } from './commands/generate-datasets.js';
 import { generateManifestCommand } from './commands/generate-manifest.js';
 import { buildDeploymentCommand, prepareDeploymentReleaseCommand, validateDeploymentCommand, } from './commands/deployment.js';
-import { deployCommand, } from './commands/deploy.js';
+import { deployCommand, submitDeploymentCommand, } from './commands/deploy.js';
+import { loginCommand, logoutCommand, } from './commands/login.js';
 const program = new Command();
 function getCliVersion() {
     try {
@@ -28,6 +29,19 @@ program
     .name('hypequery')
     .description('Type-safe analytics layer for ClickHouse')
     .version(getCliVersion());
+program
+    .command('login')
+    .description('Authorize this machine with Hypequery Cloud')
+    .option('--cloud-url <url>', 'Cloud origin (or HYPEQUERY_CLOUD_URL)')
+    .action(runCommand(async (options) => {
+    await loginCommand(options);
+}));
+program
+    .command('logout')
+    .description('Revoke and remove the local Hypequery Cloud credential')
+    .action(runCommand(async () => {
+    await logoutCommand();
+}));
 function runCommand(action) {
     return async (...args) => {
         try {
@@ -133,19 +147,31 @@ program
 program
     .command('deployment:release <bundle>')
     .description('Prepare a target-bound release from a verified deployment bundle')
-    .requiredOption('--project <project>', 'Target project identifier')
-    .requiredOption('--environment <environment>', 'Target environment identifier')
+    .option('--project <project>', 'Target project identifier (advanced override)')
+    .option('--environment <environment>', 'Target environment identifier (advanced override)')
     .option('-o, --output <path>', 'Release JSON path (default: beside the bundle)')
     .action(runCommand(async (bundle, options) => {
     await prepareDeploymentReleaseCommand(bundle, options);
 }));
 program
-    .command('deploy <bundle>')
-    .description('Submit a verified deployment bundle and release')
+    .command('deployment:submit <bundle>')
+    .description('Submit a prebuilt deployment bundle and release')
     .requiredOption('--release <path>', 'Target-bound release JSON path')
-    .option('--endpoint <url>', 'HTTPS submission endpoint (or HYPEQUERY_DEPLOYMENT_ENDPOINT)')
+    .option('--endpoint <url>', 'HTTPS submission endpoint; requires HYPEQUERY_API_TOKEN')
     .action(runCommand(async (bundle, options) => {
-    await deployCommand(bundle, options);
+    await submitDeploymentCommand(bundle, options);
+}));
+program
+    .command('deploy <source>')
+    .description('Build, prepare, and deploy a Hypequery API module')
+    .option('--bundle-output <directory>', 'Bundle directory (default: analytics/hypequery-deployment)')
+    .option('--release-output <path>', 'Release JSON path (default: beside the bundle)')
+    .option('--project <project>', 'Target project identifier (advanced override)')
+    .option('--environment <environment>', 'Target environment identifier (advanced override)')
+    .option('--release <path>', 'Submit a prebuilt bundle with this release (legacy)')
+    .option('--endpoint <url>', 'HTTPS submission endpoint; requires HYPEQUERY_API_TOKEN')
+    .action(runCommand(async (source, options) => {
+    await deployCommand(source, options);
 }));
 // Help command
 program
@@ -170,6 +196,8 @@ program
 program.on('--help', () => {
     console.log('');
     console.log('Examples:');
+    console.log('  hypequery login');
+    console.log('  hypequery logout');
     console.log('  hypequery init');
     console.log('  hypequery dev');
     console.log('  hypequery dev --port 3000');
@@ -177,10 +205,12 @@ program.on('--help', () => {
     console.log('  hypequery generate:types --output analytics/schema.ts');
     console.log('  hypequery generate:datasets');
     console.log('  hypequery generate:manifest analytics/api.ts --output analytics/hypequery-manifest.json');
+    console.log('  hypequery deploy analytics/api.ts');
+    console.log('  hypequery deploy analytics/api.ts --project my-project --environment production');
     console.log('  hypequery deployment:build analytics/api.ts');
     console.log('  hypequery deployment:validate analytics/hypequery-deployment');
     console.log('  hypequery deployment:release analytics/hypequery-deployment --project my-project --environment production');
-    console.log('  hypequery deploy analytics/hypequery-deployment --release analytics/hypequery-deployment.release.json');
+    console.log('  hypequery deployment:submit analytics/hypequery-deployment --release analytics/hypequery-deployment.release.json');
     console.log('');
     console.log('Docs: https://hypequery.com/docs');
 });

package/dist/commands/deploy.d.ts

@@ -1,11 +1,26 @@
 import { createHttpDeploymentUploadTransport, type DeploymentSubmissionResponse } from '../utils/deployment-upload.js';
-export interface DeployOptions {
+import { type StoredCloudCredential } from '../utils/cloud-credential-store.js';
+import { buildDeploymentCommand, prepareDeploymentReleaseCommand } from './deployment.js';
+export interface SubmitDeploymentOptions {
     release?: string;
     endpoint?: string;
 }
-export interface DeployDependencies {
+export interface DeployOptions extends SubmitDeploymentOptions {
+    project?: string;
+    environment?: string;
+    bundleOutput?: string;
+    releaseOutput?: string;
+}
+export interface SubmitDeploymentDependencies {
     readonly env?: Readonly<Record<string, string | undefined>>;
     readonly createTransport?: typeof createHttpDeploymentUploadTransport;
+    readonly loadCredential?: () => Promise<StoredCloudCredential | null>;
+}
+export interface DeployDependencies extends SubmitDeploymentDependencies {
+    readonly buildDeployment?: typeof buildDeploymentCommand;
+    readonly prepareDeploymentRelease?: typeof prepareDeploymentReleaseCommand;
+    readonly submitDeployment?: typeof submitDeploymentCommand;
 }
-export declare function deployCommand(bundlePath: string | undefined, options?: DeployOptions, dependencies?: DeployDependencies): Promise<DeploymentSubmissionResponse>;
+export declare function submitDeploymentCommand(bundlePath: string | undefined, options?: SubmitDeploymentOptions, dependencies?: SubmitDeploymentDependencies): Promise<DeploymentSubmissionResponse>;
+export declare function deployCommand(sourcePath: string | undefined, options?: DeployOptions, dependencies?: DeployDependencies): Promise<DeploymentSubmissionResponse>;
 //# sourceMappingURL=deploy.d.ts.map

package/dist/commands/deploy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"deploy.d.ts","sourceRoot":"","sources":["../../src/commands/deploy.ts"],"names":[],"mappings":"AAKA,OAAO,EACL,mCAAmC,EAEnC,KAAK,4BAA4B,EAElC,MAAM,+BAA+B,CAAC;AAMvC,MAAM,WAAW,aAAa;IAC5B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,GAAG,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC;IAC5D,QAAQ,CAAC,eAAe,CAAC,EAAE,OAAO,mCAAmC,CAAC;CACvE;AA4DD,wBAAsB,aAAa,CACjC,UAAU,EAAE,MAAM,GAAG,SAAS,EAC9B,OAAO,GAAE,aAAkB,EAC3B,YAAY,GAAE,kBAAuB,GACpC,OAAO,CAAC,4BAA4B,CAAC,CA0DvC"}
+{"version":3,"file":"deploy.d.ts","sourceRoot":"","sources":["../../src/commands/deploy.ts"],"names":[],"mappings":"AASA,OAAO,EACL,mCAAmC,EAEnC,KAAK,4BAA4B,EAElC,MAAM,+BAA+B,CAAC;AAEvC,OAAO,EAEL,KAAK,qBAAqB,EAC3B,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EACL,sBAAsB,EACtB,+BAA+B,EAChC,MAAM,iBAAiB,CAAC;AAMzB,MAAM,WAAW,uBAAuB;IACtC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,aAAc,SAAQ,uBAAuB;IAC5D,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,4BAA4B;IAC3C,QAAQ,CAAC,GAAG,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC;IAC5D,QAAQ,CAAC,eAAe,CAAC,EAAE,OAAO,mCAAmC,CAAC;IACtE,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,OAAO,CAAC,qBAAqB,GAAG,IAAI,CAAC,CAAC;CACvE;AAED,MAAM,WAAW,kBAAmB,SAAQ,4BAA4B;IACtE,QAAQ,CAAC,eAAe,CAAC,EAAE,OAAO,sBAAsB,CAAC;IACzD,QAAQ,CAAC,wBAAwB,CAAC,EAAE,OAAO,+BAA+B,CAAC;IAC3E,QAAQ,CAAC,gBAAgB,CAAC,EAAE,OAAO,uBAAuB,CAAC;CAC5D;AA8GD,wBAAsB,uBAAuB,CAC3C,UAAU,EAAE,MAAM,GAAG,SAAS,EAC9B,OAAO,GAAE,uBAA4B,EACrC,YAAY,GAAE,4BAAiC,GAC9C,OAAO,CAAC,4BAA4B,CAAC,CAwDvC;AAmDD,wBAAsB,aAAa,CACjC,UAAU,EAAE,MAAM,GAAG,SAAS,EAC9B,OAAO,GAAE,aAAkB,EAC3B,YAAY,GAAE,kBAAuB,GACpC,OAAO,CAAC,4BAA4B,CAAC,CAmDvC"}

package/dist/commands/deploy.js

@@ -1,9 +1,13 @@
-import { constants, open } from 'node:fs/promises';
+import { access, constants, open } from 'node:fs/promises';
+import path from 'node:path';
 import { prepareProtocolDeploymentReleaseEnvelope, } from '@hypequery/protocol';
-import { verifyDeploymentBundle } from '../utils/deployment-bundle.js';
+import { DEPLOYMENT_BUNDLE_MANIFEST, verifyDeploymentBundle, } from '../utils/deployment-bundle.js';
 import { createHttpDeploymentUploadTransport, DeploymentUploadError, } from '../utils/deployment-upload.js';
 import { logger } from '../utils/logger.js';
+import { loadCloudCredential, } from '../utils/cloud-credential-store.js';
+import { buildDeploymentCommand, prepareDeploymentReleaseCommand, } from './deployment.js';
 const MAX_RELEASE_FILE_BYTES = 16 * 1024;
+const DEFAULT_BUNDLE_PATH = 'analytics/hypequery-deployment';
 const utf8Decoder = new TextDecoder('utf-8', { fatal: true });
 async function readReleaseFile(releasePath) {
     let handle;
@@ -60,16 +64,47 @@ function requiredConfiguration(value, message) {
         throw new Error(message);
     return value;
 }
-export async function deployCommand(bundlePath, options = {}, dependencies = {}) {
+/**
+ * Resolves the submission endpoint and token. Kept separate from
+ * `submitDeploymentCommand` so `deployCommand` can run it as a preflight
+ * before the bundle build.
+ */
+async function resolveDeploymentCredential(endpointOption, dependencies) {
+    const env = dependencies.env ?? process.env;
+    let deploymentEndpoint = endpointOption ?? env.HYPEQUERY_DEPLOYMENT_ENDPOINT;
+    let token = env.HYPEQUERY_API_TOKEN;
+    const hasExplicitEndpoint = Boolean(deploymentEndpoint);
+    const hasExplicitToken = Boolean(token);
+    if (hasExplicitEndpoint !== hasExplicitToken) {
+        throw new Error(hasExplicitEndpoint
+            ? 'An explicit deployment endpoint requires HYPEQUERY_API_TOKEN.'
+            : 'HYPEQUERY_API_TOKEN requires --endpoint or HYPEQUERY_DEPLOYMENT_ENDPOINT.\n\n'
+                + 'If you meant to use `hypequery login`, unset HYPEQUERY_API_TOKEN — '
+                + 'the CLI also reads it from a project .env file.');
+    }
+    if (!hasExplicitEndpoint) {
+        const credential = await (dependencies.loadCredential ?? loadCloudCredential)();
+        if (credential) {
+            if (Date.parse(credential.expiresAt) <= Date.now()) {
+                throw new Error('The stored Cloud credential has expired. Run `hypequery login` again.');
+            }
+            deploymentEndpoint = credential.deploymentEndpoint;
+            token = credential.token;
+        }
+    }
+    return {
+        endpoint: requiredConfiguration(deploymentEndpoint, 'Missing deployment endpoint. Run `hypequery login`, pass --endpoint, or set HYPEQUERY_DEPLOYMENT_ENDPOINT.'),
+        token: requiredConfiguration(token, 'Missing deployment credential. Run `hypequery login` or set HYPEQUERY_API_TOKEN.'),
+    };
+}
+export async function submitDeploymentCommand(bundlePath, options = {}, dependencies = {}) {
     if (!bundlePath) {
         throw new Error('Missing deployment bundle path.\n\n'
-            + 'Usage: hypequery deploy analytics/hypequery-deployment '
+            + 'Usage: hypequery deployment:submit analytics/hypequery-deployment '
             + '--release analytics/hypequery-deployment.release.json');
     }
     const releasePath = requiredConfiguration(options.release, 'Missing required --release <path>.');
-    const env = dependencies.env ?? process.env;
-    const endpoint = requiredConfiguration(options.endpoint ?? env.HYPEQUERY_DEPLOYMENT_ENDPOINT, 'Missing deployment endpoint. Pass --endpoint or set HYPEQUERY_DEPLOYMENT_ENDPOINT.');
-    const token = requiredConfiguration(env.HYPEQUERY_API_TOKEN, 'Missing HYPEQUERY_API_TOKEN.');
+    const { endpoint: deploymentEndpoint, token } = await resolveDeploymentCredential(options.endpoint, dependencies);
     let bundle;
     try {
         bundle = await verifyDeploymentBundle(bundlePath);
@@ -91,7 +126,10 @@ export async function deployCommand(bundlePath, options = {}, dependencies = {})
         throw new DeploymentUploadError('HQ_UPLOAD_IDENTITY_MISMATCH', 'Release bundle identity does not match the verified deployment bundle.');
     }
     const createTransport = dependencies.createTransport ?? createHttpDeploymentUploadTransport;
-    const transportOptions = { endpoint, token };
+    const transportOptions = {
+        endpoint: deploymentEndpoint,
+        token,
+    };
     const result = await createTransport(transportOptions).submit(bundle, release);
     logger.success(result.status === 'accepted'
         ? 'Deployment release accepted'
@@ -100,3 +138,87 @@ export async function deployCommand(bundlePath, options = {}, dependencies = {})
     logger.info(`Bundle identity: ${result.bundleIdentity}`);
     return result;
 }
+/**
+ * `deploy` takes an API module, but the deprecated form took a bundle
+ * directory. Dropping `--release` from an existing script would otherwise hand
+ * a bundle to the module loader and fail inside esbuild.
+ */
+async function rejectBundleDirectorySource(sourcePath) {
+    try {
+        await access(path.join(sourcePath, DEPLOYMENT_BUNDLE_MANIFEST));
+    }
+    catch {
+        return;
+    }
+    throw new Error(`Cannot deploy a prebuilt bundle directory: ${sourcePath}\n\n`
+        + '`hypequery deploy` takes the API module to build, for example '
+        + '`hypequery deploy analytics/api.ts`.\n'
+        + 'To upload this bundle, use `hypequery deployment:submit '
+        + `${sourcePath} --release <file>\`.`);
+}
+/**
+ * `deploy` exposes no runtime flags, so a runtime error from the shared build
+ * command would otherwise point at flags this command does not accept.
+ */
+function withRuntimeFlagHint(error) {
+    if (!(error instanceof Error) || !error.message.includes('--runtime'))
+        return error;
+    return new Error(`${error.message}\n\n`
+        + 'Runtime overrides are not available on `hypequery deploy`. Build with '
+        + '`hypequery deployment:build` (which accepts --runtime, --runtime-artifact, '
+        + 'and --runtime-file), then upload with `hypequery deployment:submit`.');
+}
+function rejectLegacyOrchestrationOptions(options) {
+    if (options.project !== undefined
+        || options.environment !== undefined
+        || options.bundleOutput !== undefined
+        || options.releaseOutput !== undefined) {
+        throw new Error('--release selects prebuilt submission mode and cannot be combined with '
+            + '--project, --environment, --bundle-output, or --release-output. '
+            + 'Use `hypequery deployment:submit` for explicit prebuilt uploads.');
+    }
+}
+export async function deployCommand(sourcePath, options = {}, dependencies = {}) {
+    if (!sourcePath) {
+        throw new Error('Missing API module path.\n\n'
+            + 'Usage: hypequery deploy analytics/api.ts');
+    }
+    if (options.release !== undefined) {
+        rejectLegacyOrchestrationOptions(options);
+        logger.warn('`hypequery deploy <bundle> --release <file>` is deprecated. '
+            + 'Use `hypequery deployment:submit <bundle> --release <file>` instead.');
+        return submitDeploymentCommand(sourcePath, {
+            release: options.release,
+            endpoint: options.endpoint,
+        }, dependencies);
+    }
+    await rejectBundleDirectorySource(sourcePath);
+    const bundlePath = options.bundleOutput ?? DEFAULT_BUNDLE_PATH;
+    const releasePath = options.releaseOutput
+        ?? `${bundlePath.replace(/[\\/]+$/, '')}.release.json`;
+    const build = dependencies.buildDeployment ?? buildDeploymentCommand;
+    const prepareRelease = dependencies.prepareDeploymentRelease
+        ?? prepareDeploymentReleaseCommand;
+    const submit = dependencies.submitDeployment ?? submitDeploymentCommand;
+    // Resolve credentials up front. Submission is the last step, so without this
+    // a missing or expired login only surfaces after a full bundle build.
+    await resolveDeploymentCredential(options.endpoint, dependencies);
+    try {
+        await build(sourcePath, { bundleOutput: bundlePath });
+    }
+    catch (error) {
+        throw withRuntimeFlagHint(error);
+    }
+    await prepareRelease(bundlePath, {
+        project: options.project,
+        environment: options.environment,
+        output: releasePath,
+    }, {
+        loadCredential: dependencies.loadCredential,
+        outputFlagLabel: '--release-output',
+    });
+    return submit(bundlePath, {
+        release: releasePath,
+        endpoint: options.endpoint,
+    }, dependencies);
+}

package/dist/commands/deployment.d.ts

@@ -1,4 +1,5 @@
 import { type ProtocolDeploymentContract, type ProtocolDeploymentReleaseEnvelope } from '@hypequery/protocol';
+import { type StoredCloudCredential } from '../utils/cloud-credential-store.js';
 export interface BuildDeploymentOptions {
     bundleOutput?: string;
     output?: string;
@@ -14,7 +15,15 @@ export interface PrepareDeploymentReleaseOptions {
     environment?: string;
     output?: string;
 }
+export interface PrepareDeploymentReleaseDependencies {
+    loadCredential?: () => Promise<StoredCloudCredential | null>;
+    /**
+     * Flag name to quote in output-path errors. `hypequery deploy` delegates
+     * here but spells the same option `--release-output`.
+     */
+    outputFlagLabel?: string;
+}
 export declare function buildDeploymentCommand(apiPath: string | undefined, options?: BuildDeploymentOptions): Promise<ProtocolDeploymentContract>;
 export declare function validateDeploymentCommand(artifactPath: string | undefined): Promise<ProtocolDeploymentContract>;
-export declare function prepareDeploymentReleaseCommand(bundlePath: string | undefined, options?: PrepareDeploymentReleaseOptions): Promise<ProtocolDeploymentReleaseEnvelope>;
+export declare function prepareDeploymentReleaseCommand(bundlePath: string | undefined, options?: PrepareDeploymentReleaseOptions, dependencies?: PrepareDeploymentReleaseDependencies): Promise<ProtocolDeploymentReleaseEnvelope>;
 //# sourceMappingURL=deployment.d.ts.map

package/dist/commands/deployment.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"deployment.d.ts","sourceRoot":"","sources":["../../src/commands/deployment.ts"],"names":[],"mappings":"AAGA,OAAO,EAGL,KAAK,0BAA0B,EAC/B,KAAK,iCAAiC,EACvC,MAAM,qBAAqB,CAAC;AAiB7B,MAAM,WAAW,sBAAsB;IACrC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,GAAG,QAAQ,CAAC;IAC5B,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,+BAA+B;IAC9C,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAoDD,wBAAsB,sBAAsB,CAC1C,OAAO,EAAE,MAAM,GAAG,SAAS,EAC3B,OAAO,GAAE,sBAA2B,GACnC,OAAO,CAAC,0BAA0B,CAAC,CAwIrC;AAED,wBAAsB,yBAAyB,CAC7C,YAAY,EAAE,MAAM,GAAG,SAAS,GAC/B,OAAO,CAAC,0BAA0B,CAAC,CA2ErC;AA0DD,wBAAsB,+BAA+B,CACnD,UAAU,EAAE,MAAM,GAAG,SAAS,EAC9B,OAAO,GAAE,+BAAoC,GAC5C,OAAO,CAAC,iCAAiC,CAAC,CA8C5C"}
+{"version":3,"file":"deployment.d.ts","sourceRoot":"","sources":["../../src/commands/deployment.ts"],"names":[],"mappings":"AAGA,OAAO,EAGL,KAAK,0BAA0B,EAC/B,KAAK,iCAAiC,EACvC,MAAM,qBAAqB,CAAC;AAc7B,OAAO,EAEL,KAAK,qBAAqB,EAC3B,MAAM,oCAAoC,CAAC;AAI5C,MAAM,WAAW,sBAAsB;IACrC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,GAAG,QAAQ,CAAC;IAC5B,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,+BAA+B;IAC9C,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,oCAAoC;IACnD,cAAc,CAAC,EAAE,MAAM,OAAO,CAAC,qBAAqB,GAAG,IAAI,CAAC,CAAC;IAC7D;;;OAGG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAoDD,wBAAsB,sBAAsB,CAC1C,OAAO,EAAE,MAAM,GAAG,SAAS,EAC3B,OAAO,GAAE,sBAA2B,GACnC,OAAO,CAAC,0BAA0B,CAAC,CAwIrC;AAED,wBAAsB,yBAAyB,CAC7C,YAAY,EAAE,MAAM,GAAG,SAAS,GAC/B,OAAO,CAAC,0BAA0B,CAAC,CA2ErC;AAiED,wBAAsB,+BAA+B,CACnD,UAAU,EAAE,MAAM,GAAG,SAAS,EAC9B,OAAO,GAAE,+BAAoC,EAC7C,YAAY,GAAE,oCAAyC,GACtD,OAAO,CAAC,iCAAiC,CAAC,CAkE5C"}

package/dist/commands/deployment.js

@@ -6,6 +6,7 @@ import { writeDeploymentBundle, verifyDeploymentBundle, readDeploymentRuntimeFil
 import { buildNodeRuntimeArtifact, getDeploymentRuntimeEntrypoints, } from '../utils/deployment-runtime-artifact.js';
 import { loadApiModule } from '../utils/load-api.js';
 import { logger } from '../utils/logger.js';
+import { loadCloudCredential, } from '../utils/cloud-credential-store.js';
 const SHA256_PATTERN = /^[0-9a-f]{64}$/;
 const DEFAULT_BUNDLE_OUTPUT = 'analytics/hypequery-deployment';
 function runtimeName(options) {
@@ -217,7 +218,7 @@ export async function validateDeploymentCommand(artifactPath) {
     logger.info(`Identity: ${digest}`);
     return contract;
 }
-function assertOutputOutsideBundle(bundlePath, outputPath) {
+function assertOutputOutsideBundle(bundlePath, outputPath, outputFlag) {
     const bundle = path.resolve(bundlePath);
     const output = path.resolve(outputPath);
     const relative = path.relative(bundle, output);
@@ -225,10 +226,10 @@ function assertOutputOutsideBundle(bundlePath, outputPath) {
         || relative.startsWith(`..${path.sep}`)
         || path.isAbsolute(relative);
     if (relative === '' || !outside) {
-        throw new Error('--output must be outside the closed deployment bundle directory.');
+        throw new Error(`${outputFlag} must be outside the closed deployment bundle directory.`);
     }
 }
-async function prospectiveRealPath(inputPath) {
+async function prospectiveRealPath(inputPath, outputFlag) {
     let current = path.resolve(inputPath);
     const missingSegments = [];
     for (;;) {
@@ -243,7 +244,7 @@ async function prospectiveRealPath(inputPath) {
             try {
                 const stat = await lstat(current);
                 if (stat.isSymbolicLink()) {
-                    throw new Error('--output must not traverse a dangling symbolic link.');
+                    throw new Error(`${outputFlag} must not traverse a dangling symbolic link.`);
                 }
             }
             catch (lstatError) {
@@ -260,11 +261,11 @@ async function prospectiveRealPath(inputPath) {
         }
     }
 }
-async function assertOutputIsNotSymbolicLink(outputPath) {
+async function assertOutputIsNotSymbolicLink(outputPath, outputFlag) {
     try {
         const outputStat = await lstat(outputPath);
         if (outputStat.isSymbolicLink()) {
-            throw new Error('--output must not be a symbolic link.');
+            throw new Error(`${outputFlag} must not be a symbolic link.`);
         }
     }
     catch (error) {
@@ -274,20 +275,37 @@ async function assertOutputIsNotSymbolicLink(outputPath) {
         }
     }
 }
-export async function prepareDeploymentReleaseCommand(bundlePath, options = {}) {
+export async function prepareDeploymentReleaseCommand(bundlePath, options = {}, dependencies = {}) {
     if (!bundlePath) {
         throw new Error('Missing deployment bundle path.\n\n'
-            + 'Usage: hypequery deployment:release analytics/hypequery-deployment '
-            + '--project <project> --environment <environment>');
-    }
-    if (options.project === undefined) {
-        throw new Error('Missing required --project <project>.');
-    }
-    if (options.environment === undefined) {
-        throw new Error('Missing required --environment <environment>.');
+            + 'Usage: hypequery deployment:release analytics/hypequery-deployment');
+    }
+    // Passing either flag opts out of the logged-in target entirely. Completing
+    // a half-specified override from the stored profile would silently retarget
+    // the release — `--project "$P" --environment "$E"` with an unset variable
+    // must fail loudly, not bind to whatever the last login used.
+    let project;
+    let environment;
+    if (options.project !== undefined || options.environment !== undefined) {
+        if (!options.project)
+            throw new Error('Missing required --project <project>.');
+        if (!options.environment)
+            throw new Error('Missing required --environment <environment>.');
+        project = options.project;
+        environment = options.environment;
+    }
+    else {
+        const credential = await (dependencies.loadCredential ?? loadCloudCredential)();
+        project = credential?.target?.project;
+        environment = credential?.target?.environment;
+        if (!project || !environment) {
+            throw new Error('Missing deployment target. Run `hypequery login` or pass both '
+                + '--project <project> and --environment <environment>.');
+        }
     }
+    const outputFlag = dependencies.outputFlagLabel ?? '--output';
     const outputPath = options.output ?? `${bundlePath.replace(/[\\/]+$/, '')}.release.json`;
-    assertOutputOutsideBundle(bundlePath, outputPath);
+    assertOutputOutsideBundle(bundlePath, outputPath, outputFlag);
     let bundle;
     try {
         bundle = await verifyDeploymentBundle(bundlePath);
@@ -296,20 +314,21 @@ export async function prepareDeploymentReleaseCommand(bundlePath, options = {})
         throw new Error(`Cannot prepare a release from an invalid deployment bundle: ${bundlePath}\n\n`
             + (error instanceof Error ? error.message : String(error)));
     }
-    assertOutputOutsideBundle(bundle.directory, await prospectiveRealPath(outputPath));
+    assertOutputOutsideBundle(bundle.directory, await prospectiveRealPath(outputPath, outputFlag), outputFlag);
     const prepared = prepareProtocolDeploymentReleaseEnvelope({
         kind: 'hypequery-deployment-release',
         version: 1,
         bundleIdentity: bundle.identity,
         target: {
-            project: options.project,
-            environment: options.environment,
+            project,
+            environment,
         },
     });
     await mkdir(path.dirname(outputPath), { recursive: true });
-    await assertOutputIsNotSymbolicLink(outputPath);
+    await assertOutputIsNotSymbolicLink(outputPath, outputFlag);
     await writeFile(outputPath, `${prepared.canonical}\n`, 'utf8');
     logger.success(`Deployment release written to ${outputPath}`);
+    logger.info(`Target: ${project}/${environment}`);
     logger.info(`Release identity: ${prepared.identity}`);
     logger.info(`Bundle identity: ${bundle.identity}`);
     return prepared.release;