@hypequery/cli 1.15.0 → 1.16.1

package/README.md

@@ -251,6 +251,34 @@ Options:
 
 ## Non-interactive Setup
 
+### Cloud deployment targets in CI
+
+Login selects a stable Cloud deployment target. The deployment itself captures
+the checked-out Git branch, commit, and dirty state as source provenance; none
+of those values select or create an environment. Select the destination
+explicitly when the same branch or commit deploys to more than one environment:
+
+```bash
+npx hypequery login --environment development
+```
+
+For CI, create a target-scoped API key in Cloud for each environment and store
+it as a separate secret. The explicit release target and its matching key make
+the destination independent of the source branch:
+
+```bash
+HYPEQUERY_API_TOKEN="$HYPEQUERY_DEV_TOKEN" npx hypequery deploy analytics/api.ts \
+  --project acme:analytics \
+  --environment development
+
+HYPEQUERY_API_TOKEN="$HYPEQUERY_PROD_TOKEN" npx hypequery deploy analytics/api.ts \
+  --project acme:analytics \
+  --environment production
+```
+
+Set `HYPEQUERY_DEPLOYMENT_ENDPOINT` for both jobs. A key is scoped to one target,
+so a production key cannot submit a development release or vice versa.
+
 For ClickHouse, `hypequery init --no-interactive` reads:
 
 - `CLICKHOUSE_URL` or deprecated `CLICKHOUSE_HOST`

package/dist/cli.js

@@ -34,7 +34,7 @@ program
     .command('login')
     .description('Authorize this machine with Hypequery Cloud')
     .option('--cloud-url <url>', 'Cloud origin (or HYPEQUERY_CLOUD_URL)')
-    .option('--no-branch', 'Do not send the current Git branch (or HYPEQUERY_CLI_SEND_BRANCH=0)')
+    .option('--environment <environment>', 'Stable deployment target')
     .action(runCommand(async (options) => {
     await loginCommand(options);
 }));

package/dist/commands/login.d.ts

@@ -1,12 +1,11 @@
 import { deleteCloudCredential, loadCloudCredential, saveCloudCredential } from '../utils/cloud-credential-store.js';
 export interface LoginOptions {
     readonly cloudUrl?: string;
-    /** Commander sets this to false for `--no-branch`. */
-    readonly branch?: boolean;
+    /** Stable Cloud deployment target. */
+    readonly environment?: string;
 }
 export interface LoginDependencies {
     readonly fetch?: typeof fetch;
-    readonly getGitBranch?: () => Promise<string | null>;
     readonly openBrowser?: (url: string) => Promise<unknown>;
     readonly now?: () => number;
     readonly requestTimeoutMs?: number;

package/dist/commands/login.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"login.d.ts","sourceRoot":"","sources":["../../src/commands/login.ts"],"names":[],"mappings":"AAMA,OAAO,EAEL,qBAAqB,EACrB,mBAAmB,EAGnB,mBAAmB,EAEpB,MAAM,oCAAoC,CAAC;AAiB5C,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,sDAAsD;IACtD,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC;CAC3B;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;IAC9B,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IACrD,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IACzD,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IAC5B,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,cAAc,CAAC,EAAE,OAAO,mBAAmB,CAAC;IACrD,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B;AAaD,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;IAC9B,QAAQ,CAAC,cAAc,CAAC,EAAE,OAAO,mBAAmB,CAAC;IACrD,QAAQ,CAAC,gBAAgB,CAAC,EAAE,OAAO,qBAAqB,CAAC;IACzD,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;CACpC;AAsJD,wBAAsB,YAAY,CAChC,OAAO,GAAE,YAAiB,EAC1B,YAAY,GAAE,iBAAsB,iBAkErC;AAED,wBAAsB,aAAa,CAAC,YAAY,GAAE,kBAAuB,iBAoCxE"}
+{"version":3,"file":"login.d.ts","sourceRoot":"","sources":["../../src/commands/login.ts"],"names":[],"mappings":"AAMA,OAAO,EAEL,qBAAqB,EACrB,mBAAmB,EAGnB,mBAAmB,EAEpB,MAAM,oCAAoC,CAAC;AAgB5C,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,sCAAsC;IACtC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;IAC9B,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IACzD,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IAC5B,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,cAAc,CAAC,EAAE,OAAO,mBAAmB,CAAC;IACrD,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;IAC9B,QAAQ,CAAC,cAAc,CAAC,EAAE,OAAO,mBAAmB,CAAC;IACrD,QAAQ,CAAC,gBAAgB,CAAC,EAAE,OAAO,qBAAqB,CAAC;IACzD,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;CACpC;AAsJD,wBAAsB,YAAY,CAChC,OAAO,GAAE,YAAiB,EAC1B,YAAY,GAAE,iBAAsB,iBAyErC;AAED,wBAAsB,aAAa,CAAC,YAAY,GAAE,kBAAuB,iBAoCxE"}

package/dist/commands/login.js

@@ -3,7 +3,6 @@ import { createServer } from 'node:http';
 import open from 'open';
 import { validateProtocolDeploymentReleaseTarget } from '@hypequery/protocol';
 import { CLOUD_DEPLOYMENT_SCOPE, deleteCloudCredential, loadCloudCredential, normalizeCloudDeploymentEndpoint, normalizeCloudOrigin, saveCloudCredential, } from '../utils/cloud-credential-store.js';
-import { currentGitBranch } from '../utils/git-branch.js';
 import { logger } from '../utils/logger.js';
 const DEFAULT_CLOUD_URL = 'https://cloud.hypequery.com';
 const LOGIN_TIMEOUT_MS = 5 * 60_000;
@@ -17,17 +16,6 @@ const MAX_TOKEN_LIFETIME_MS = 13 * 60 * 60_000;
 // CLI the day Cloud rotates its token format.
 const TOKEN_PATTERN = /^hqdp_[A-Za-z0-9_-]{16,512}$/;
 const utf8Decoder = new TextDecoder('utf-8', { fatal: true });
-/**
- * Branch names carry internal detail (customer names, embargoed identifiers),
- * so both an explicit `--no-branch` and the environment variable suppress the
- * parameter. The flag wins because it is the more specific signal.
- */
-function branchContextEnabled(options) {
-    if (options.branch === false)
-        return false;
-    const configured = process.env.HYPEQUERY_CLI_SEND_BRANCH?.trim().toLowerCase();
-    return configured !== '0' && configured !== 'false' && configured !== 'no';
-}
 function callbackHtml(success) {
     const title = success ? 'CLI authorized' : 'Authorization failed';
     const message = success
@@ -174,20 +162,26 @@ export async function loginCommand(options = {}, dependencies = {}) {
     const state = randomBytes(24).toString('base64url');
     const verifier = randomBytes(32).toString('base64url');
     const challenge = createHash('sha256').update(verifier).digest('base64url');
-    // Resolve branch context before the loopback listener opens: shelling out to
-    // git should not hold a server socket, and a caller-supplied resolver that
-    // rejects must not leak one.
-    const branch = branchContextEnabled(options)
-        ? await (dependencies.getGitBranch ?? currentGitBranch)()
-        : null;
+    let environment;
+    if (options.environment !== undefined) {
+        try {
+            environment = validateProtocolDeploymentReleaseTarget({
+                project: 'target',
+                environment: options.environment,
+            }).environment;
+        }
+        catch {
+            throw new Error('Invalid deployment environment. Use letters, numbers, dots, underscores, colons, or hyphens.');
+        }
+    }
     const callback = await callbackServer(state, dependencies.timeoutMs ?? LOGIN_TIMEOUT_MS);
     const authorizeUrl = new URL('/cli/authorize', origin);
     authorizeUrl.searchParams.set('redirect_uri', callback.redirectUri);
     authorizeUrl.searchParams.set('code_challenge', challenge);
     authorizeUrl.searchParams.set('code_challenge_method', 'S256');
     authorizeUrl.searchParams.set('state', state);
-    if (branch)
-        authorizeUrl.searchParams.set('branch', branch);
+    if (environment)
+        authorizeUrl.searchParams.set('environment', environment);
     try {
         logger.info('Opening your browser to authorize Hypequery CLI…');
         await (dependencies.openBrowser ?? open)(authorizeUrl.toString());
@@ -215,8 +209,8 @@ export async function loginCommand(options = {}, dependencies = {}) {
         const credential = tokenResponse(body, origin, (dependencies.now ?? Date.now)());
         await (dependencies.saveCredential ?? saveCloudCredential)(credential);
         logger.success('Logged in to Hypequery Cloud');
-        // Cloud resolves the target, and branch context only expresses intent, so
-        // print what was actually issued rather than what was requested.
+        // Cloud resolves the target, so print what was actually issued rather than
+        // what was requested.
         if (credential.target) {
             logger.info(`Deployments target ${credential.target.project} / ${credential.target.environment}`);
         }

package/dist/utils/deployment-bundle.d.ts

@@ -19,6 +19,7 @@ export interface DeploymentBundleSourceSnapshot {
         readonly kind: 'git';
         readonly commit: string;
         readonly dirty: boolean;
+        readonly branch?: string;
     };
 }
 export interface WrittenDeploymentBundle {

package/dist/utils/deployment-bundle.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"deployment-bundle.d.ts","sourceRoot":"","sources":["../../src/utils/deployment-bundle.ts"],"names":[],"mappings":"AAYA,OAAO,EAGL,KAAK,kCAAkC,EACvC,KAAK,gCAAgC,EACrC,KAAK,0BAA0B,EAChC,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,0BAA0B,EAC1B,0BAA0B,EAC1B,sBAAsB,EACvB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAC;AAGtE,OAAO,EACL,0BAA0B,EAC1B,0BAA0B,EAC1B,sBAAsB,GACvB,CAAC;AACF,YAAY,EAAE,wBAAwB,EAAE,CAAC;AAEzC,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,QAAQ,CAAC;IACpC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC;CAC5B;AAED,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC;CAC5B;AAED,MAAM,WAAW,8BAA8B;IAC7C,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,KAAK,EAAE,SAAS,0BAA0B,EAAE,CAAC;IACtD,QAAQ,CAAC,QAAQ,CAAC,EAAE;QAClB,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC;QACrB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;QACxB,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;KACzB,CAAC;CACH;AAED,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,QAAQ,EAAE,gCAAgC,CAAC;IACpD,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,0BAA0B,CAAC;CAC/C;AA0ID,wBAAsB,qBAAqB,CACzC,eAAe,EAAE,MAAM,EACvB,QAAQ,EAAE,kCAAkC,EAC5C,YAAY,EAAE,SAAS,2BAA2B,EAAE,EACpD,cAAc,CAAC,EAAE,8BAA8B,GAC9C,OAAO,CAAC,uBAAuB,CAAC,CA+FlC;AAoCD,wBAAsB,yBAAyB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAMrF"}
+{"version":3,"file":"deployment-bundle.d.ts","sourceRoot":"","sources":["../../src/utils/deployment-bundle.ts"],"names":[],"mappings":"AAYA,OAAO,EAGL,KAAK,kCAAkC,EACvC,KAAK,gCAAgC,EACrC,KAAK,0BAA0B,EAChC,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,0BAA0B,EAC1B,0BAA0B,EAC1B,sBAAsB,EACvB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAC;AAGtE,OAAO,EACL,0BAA0B,EAC1B,0BAA0B,EAC1B,sBAAsB,GACvB,CAAC;AACF,YAAY,EAAE,wBAAwB,EAAE,CAAC;AAEzC,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,QAAQ,CAAC;IACpC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC;CAC5B;AAED,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC;CAC5B;AAED,MAAM,WAAW,8BAA8B;IAC7C,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,KAAK,EAAE,SAAS,0BAA0B,EAAE,CAAC;IACtD,QAAQ,CAAC,QAAQ,CAAC,EAAE;QAClB,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC;QACrB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;QACxB,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;QACxB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;KAC1B,CAAC;CACH;AAED,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,QAAQ,EAAE,gCAAgC,CAAC;IACpD,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,0BAA0B,CAAC;CAC/C;AA0ID,wBAAsB,qBAAqB,CACzC,eAAe,EAAE,MAAM,EACvB,QAAQ,EAAE,kCAAkC,EAC5C,YAAY,EAAE,SAAS,2BAA2B,EAAE,EACpD,cAAc,CAAC,EAAE,8BAA8B,GAC9C,OAAO,CAAC,uBAAuB,CAAC,CA+FlC;AAoCD,wBAAsB,yBAAyB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAMrF"}

package/dist/utils/deployment-source-snapshot.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"deployment-source-snapshot.d.ts","sourceRoot":"","sources":["../../src/utils/deployment-source-snapshot.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAEV,8BAA8B,EAC/B,MAAM,wBAAwB,CAAC;AAqEhC,wBAAsB,+BAA+B,CACnD,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,8BAA8B,CAAC,CAkDzC"}
+{"version":3,"file":"deployment-source-snapshot.d.ts","sourceRoot":"","sources":["../../src/utils/deployment-source-snapshot.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAEV,8BAA8B,EAC/B,MAAM,wBAAwB,CAAC;AA0EhC,wBAAsB,+BAA+B,CACnD,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,8BAA8B,CAAC,CAkDzC"}

package/dist/utils/deployment-source-snapshot.js

@@ -3,6 +3,7 @@ import { constants, lstat, open, realpath } from 'node:fs/promises';
 import path from 'node:path';
 import { DEFAULT_PROTOCOL_DEPLOYMENT_BUNDLE_LIMITS, } from '@hypequery/protocol';
 import { build } from 'esbuild';
+import { currentGitBranch } from './git-branch.js';
 import { findNearestTsconfig } from './load-api.js';
 function portableProjectPath(projectRoot, absolutePath) {
     const relative = path.relative(projectRoot, absolutePath);
@@ -47,7 +48,10 @@ function gitOutput(projectRoot, arguments_) {
     });
 }
 async function sourceRevision(projectRoot) {
-    const commit = await gitOutput(projectRoot, ['rev-parse', 'HEAD']);
+    const [commit, branch] = await Promise.all([
+        gitOutput(projectRoot, ['rev-parse', 'HEAD']),
+        currentGitBranch(projectRoot),
+    ]);
     if (!commit || !/^(?:[0-9a-f]{40}|[0-9a-f]{64})$/.test(commit))
         return undefined;
     const status = await gitOutput(projectRoot, ['status', '--porcelain', '--untracked-files=all']);
@@ -57,6 +61,7 @@ async function sourceRevision(projectRoot) {
         kind: 'git',
         commit,
         dirty: status.length > 0,
+        ...(branch ? { branch } : {}),
     });
 }
 export async function captureDeploymentSourceSnapshot(apiPath) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hypequery/cli",
-  "version": "1.15.0",
+  "version": "1.16.1",
   "description": "Command-line interface for hypequery",
   "license": "Apache-2.0",
   "type": "module",
@@ -19,8 +19,8 @@
     "open": "^10.0.0",
     "ora": "^8.0.1",
     "prompts": "^2.4.2",
-    "@hypequery/deployment": "0.7.0",
-    "@hypequery/protocol": "0.10.0"
+    "@hypequery/deployment": "0.7.1",
+    "@hypequery/protocol": "0.10.1"
   },
   "optionalDependencies": {
     "@napi-rs/keyring": "1.3.0"