hereya-cli 0.83.2 → 0.84.0

package/dist/commands/publish/index.js

@@ -3,6 +3,7 @@ import { existsSync, readFileSync } from 'node:fs';
 import { join } from 'node:path';
 import { simpleGit } from 'simple-git';
 import * as yaml from 'yaml';
+import { CloudBackend } from '../../backend/cloud/cloud-backend.js';
 import { getBackend } from '../../backend/index.js';
 export default class Publish extends Command {
     static description = 'Publish a package to the Hereya registry';
@@ -165,6 +166,11 @@ export default class Publish extends Command {
         try {
             // Load and validate configuration
             const config = await this.loadConfig(packageDir);
+            const isApp = config.kind === 'app';
+            if (isApp) {
+                await this.publishApp(packageDir, config);
+                return;
+            }
             // Display package info
             this.log(`\n📦 Preparing package ${config.name}@${config.version}`);
             this.log(`   Description: ${config.description}`);
@@ -226,6 +232,10 @@ export default class Publish extends Command {
         if (!config.version) {
             this.error('Missing required field "version" in hereyarc.yaml');
         }
+        if (config.kind === 'app') {
+            // Apps don't require iac/infra; description optional but recommended.
+            return;
+        }
         if (!config.description) {
             this.error('Missing required field "description" in hereyarc.yaml');
         }
@@ -236,4 +246,69 @@ export default class Publish extends Command {
             this.error('Missing required field "infra" in hereyarc.yaml');
         }
     }
+    async publishApp(packageDir, config) {
+        this.log(`\n📦 Preparing app ${config.name}@${config.version}`);
+        if (config.description) {
+            this.log(`   Description: ${config.description}`);
+        }
+        if (config.visibility) {
+            this.log(`   Visibility: ${config.visibility}`);
+        }
+        // Validate hereya.yaml shape: must exist; must NOT contain `project:` or `workspace:`.
+        const hereyaYamlPath = ['hereya.yaml', 'hereya.yml']
+            .map((name) => join(packageDir, name))
+            .find((p) => existsSync(p));
+        if (!hereyaYamlPath) {
+            this.error('Apps must have a hereya.yaml file in the package directory');
+        }
+        const hereyaYamlContent = readFileSync(hereyaYamlPath, 'utf8');
+        let parsedHereyaYaml = null;
+        try {
+            parsedHereyaYaml = (yaml.parse(hereyaYamlContent) ?? {});
+        }
+        catch (error) {
+            this.error(`Failed to parse hereya.yaml: ${error instanceof Error ? error.message : String(error)}`);
+        }
+        if (parsedHereyaYaml && typeof parsedHereyaYaml === 'object') {
+            if ('project' in parsedHereyaYaml) {
+                this.error('App hereya.yaml must not contain a "project:" key (it is set at deploy time)');
+            }
+            if ('workspace' in parsedHereyaYaml) {
+                this.error('App hereya.yaml must not contain a "workspace:" key (it is set at deploy time)');
+            }
+        }
+        this.log('\n🔍 Analyzing repository...');
+        const gitInfo = await this.getGitInfo(packageDir);
+        const { commit, repository, sha256 } = gitInfo;
+        this.log(`   Repository: ${repository}`);
+        this.log(`   Commit: ${commit.slice(0, 8)}`);
+        this.log(`   SHA256: ${sha256.slice(0, 16)}...`);
+        this.log('\n🔐 Checking authentication...');
+        const backend = await getBackend();
+        if (!(backend instanceof CloudBackend) || typeof backend.publishAppVersion !== 'function') {
+            this.log('\n❌ Authentication failed\n');
+            this.error('Publishing apps is only supported with the cloud backend. Please run `hereya login` first.');
+        }
+        this.log('   ✓ Authenticated with Hereya Cloud');
+        this.log('\n📤 Publishing app version to registry...');
+        const result = await backend.publishAppVersion({
+            commit: commit.trim(),
+            description: config.description,
+            hereyaYaml: hereyaYamlContent,
+            name: config.name,
+            repository,
+            sha256,
+            version: config.version,
+            visibility: config.visibility?.toLowerCase(),
+        });
+        if (!result.success) {
+            this.displayPublishError(result.reason, config);
+            return;
+        }
+        this.log(`\n✅ Successfully published app ${result.app.name}@${result.app.version}`);
+        if (result.app.id) {
+            this.log(`   App Version ID: ${result.app.id}`);
+        }
+        this.log('');
+    }
 }

package/dist/lib/app-source.d.ts

@@ -0,0 +1,21 @@
+import { Logger } from './log.js';
+export interface DownloadAppSourceInput {
+    commit?: string;
+    logger?: Logger;
+    repository: string;
+    sha256?: string;
+}
+export interface DownloadAppSourceOutput {
+    cleanup: () => Promise<void>;
+    rootDir: string;
+}
+/**
+ * Clone an app's source repository (by repo URL + commit SHA) into a fresh
+ * temp dir under ~/.hereya/downloads/<id>. Returns the rootDir path along
+ * with a cleanup() helper.
+ *
+ * Validates the git archive sha256 matches when provided.
+ */
+export declare const appSource: {
+    download(input: DownloadAppSourceInput): Promise<DownloadAppSourceOutput>;
+};

package/dist/lib/app-source.js

@@ -0,0 +1,55 @@
+import { createHash, randomUUID } from 'node:crypto';
+import fs from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+/**
+ * Clone an app's source repository (by repo URL + commit SHA) into a fresh
+ * temp dir under ~/.hereya/downloads/<id>. Returns the rootDir path along
+ * with a cleanup() helper.
+ *
+ * Validates the git archive sha256 matches when provided.
+ */
+export const appSource = {
+    async download(input) {
+        const downloadId = randomUUID();
+        const downloadsRoot = path.join(os.homedir(), '.hereya', 'downloads');
+        await fs.mkdir(downloadsRoot, { recursive: true });
+        const rootDir = path.join(downloadsRoot, downloadId);
+        const cleanup = async () => {
+            try {
+                await fs.rm(rootDir, { force: true, recursive: true });
+            }
+            catch {
+                // best-effort cleanup
+            }
+        };
+        try {
+            const { simpleGit } = await import('simple-git');
+            const git = simpleGit();
+            input.logger?.debug?.(`Cloning app source from ${input.repository}${input.commit ? `@${input.commit}` : ''} into ${rootDir}`);
+            if (input.commit) {
+                await git.clone(input.repository, rootDir, ['--no-checkout']);
+                const repoGit = simpleGit(rootDir);
+                await repoGit.checkout(input.commit);
+            }
+            else {
+                await git.clone(input.repository, rootDir, ['--depth=1']);
+            }
+            if (input.sha256) {
+                const repoGit = simpleGit(rootDir);
+                const archiveBuffer = await repoGit.raw(['archive', '--format=tar', input.commit ?? 'HEAD']);
+                const hash = createHash('sha256');
+                hash.update(archiveBuffer);
+                const actualChecksum = hash.digest('hex');
+                if (actualChecksum !== input.sha256) {
+                    throw new Error(`Checksum mismatch for app source ${input.repository}@${input.commit}. Expected: ${input.sha256}, Got: ${actualChecksum}`);
+                }
+            }
+            return { cleanup, rootDir };
+        }
+        catch (error) {
+            await cleanup();
+            throw error;
+        }
+    },
+};

package/dist/lib/app-vars.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Write per-deployment hereyavars overrides into <appRootDir>/hereyaconfig/hereyavars/.
+ *
+ * `hereyaVarsYaml` is a YAML string mapping filename -> YAML body (string).
+ * Each filename is validated against a safe pattern (no path traversal, must
+ * end in `.yaml`/`.yml`). Each body must be a string.
+ */
+export declare function applyHereyaVars(appRootDir: string, hereyaVarsYaml: string | undefined): Promise<{
+    filesWritten: string[];
+}>;

package/dist/lib/app-vars.js

@@ -0,0 +1,45 @@
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import * as yaml from 'yaml';
+const HEREYAVARS_FILENAME_PATTERN = /^[\w.-]+\.ya?ml$/;
+/**
+ * Write per-deployment hereyavars overrides into <appRootDir>/hereyaconfig/hereyavars/.
+ *
+ * `hereyaVarsYaml` is a YAML string mapping filename -> YAML body (string).
+ * Each filename is validated against a safe pattern (no path traversal, must
+ * end in `.yaml`/`.yml`). Each body must be a string.
+ */
+export async function applyHereyaVars(appRootDir, hereyaVarsYaml) {
+    if (!hereyaVarsYaml || hereyaVarsYaml.trim() === '') {
+        return { filesWritten: [] };
+    }
+    let parsed;
+    try {
+        parsed = yaml.parse(hereyaVarsYaml);
+    }
+    catch (error) {
+        throw new Error(`Failed to parse hereyaVarsYaml: ${error.message}`);
+    }
+    if (parsed === null || parsed === undefined) {
+        return { filesWritten: [] };
+    }
+    if (typeof parsed !== 'object' || Array.isArray(parsed)) {
+        throw new TypeError('hereyaVarsYaml must be a YAML mapping of filename -> body string');
+    }
+    const targetDir = path.join(appRootDir, 'hereyaconfig', 'hereyavars');
+    await fs.mkdir(targetDir, { recursive: true });
+    const filesWritten = [];
+    for (const [filename, body] of Object.entries(parsed)) {
+        if (!HEREYAVARS_FILENAME_PATTERN.test(filename)) {
+            throw new Error(`Invalid hereyavars filename '${filename}'. Expected a name matching ${HEREYAVARS_FILENAME_PATTERN.source}`);
+        }
+        if (typeof body !== 'string') {
+            throw new TypeError(`hereyavars value for '${filename}' must be a string (YAML body)`);
+        }
+        const filePath = path.join(targetDir, filename);
+        // eslint-disable-next-line no-await-in-loop
+        await fs.writeFile(filePath, body, { encoding: 'utf8' });
+        filesWritten.push(filePath);
+    }
+    return { filesWritten };
+}

package/dist/lib/package/index.d.ts

@@ -29,6 +29,8 @@ export type ResolvePackageOutput = {
     found: false;
     reason: string;
 };
+export declare const PackageKind: z.ZodDefault<z.ZodEnum<["app", "package"]>>;
+export type PackageKindType = z.infer<typeof PackageKind>;
 export declare const PackageMetadata: z.ZodObject<{
     dependencies: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
     deploy: z.ZodOptional<z.ZodBoolean>;
@@ -36,6 +38,7 @@ export declare const PackageMetadata: z.ZodObject<{
     iac: z.ZodNativeEnum<typeof IacType>;
     infra: z.ZodNativeEnum<typeof InfrastructureType>;
     inputs: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{}, "passthrough", z.ZodTypeAny, z.objectOutputType<{}, z.ZodTypeAny, "passthrough">, z.objectInputType<{}, z.ZodTypeAny, "passthrough">>>>;
+    kind: z.ZodOptional<z.ZodDefault<z.ZodEnum<["app", "package"]>>>;
     onDeploy: z.ZodOptional<z.ZodObject<{
         pkg: z.ZodString;
         version: z.ZodString;
@@ -53,6 +56,7 @@ export declare const PackageMetadata: z.ZodObject<{
     infra: InfrastructureType;
     iac: IacType;
     dependencies?: Record<string, string> | undefined;
+    kind?: "package" | "app" | undefined;
     deploy?: boolean | undefined;
     devDeploy?: boolean | undefined;
     inputs?: Record<string, z.objectOutputType<{}, z.ZodTypeAny, "passthrough">> | undefined;
@@ -67,6 +71,7 @@ export declare const PackageMetadata: z.ZodObject<{
     infra: InfrastructureType;
     iac: IacType;
     dependencies?: Record<string, string> | undefined;
+    kind?: "package" | "app" | undefined;
     deploy?: boolean | undefined;
     devDeploy?: boolean | undefined;
     inputs?: Record<string, z.objectInputType<{}, z.ZodTypeAny, "passthrough">> | undefined;

package/dist/lib/package/index.js

@@ -74,6 +74,7 @@ export async function downloadPackage(pkgUrl, destPath) {
     const packageManager = await getPackageManager(protocol);
     return packageManager.downloadPackage(pkgUrl, destPath);
 }
+export const PackageKind = z.enum(['app', 'package']).default('package');
 export const PackageMetadata = z.object({
     dependencies: z.record(z.string()).optional(),
     deploy: z.boolean().optional(),
@@ -81,6 +82,7 @@ export const PackageMetadata = z.object({
     iac: z.nativeEnum(IacType),
     infra: z.nativeEnum(InfrastructureType),
     inputs: z.record(z.object({}).passthrough()).optional(),
+    kind: PackageKind.optional(),
     onDeploy: z
         .object({
         pkg: z.string(),

package/oclif.manifest.json

@@ -1185,24 +1185,217 @@
         "index.js"
       ]
     },
-    "config:export-backend": {
+    "app:deploy": {
       "aliases": [],
       "args": {
-        "file": {
-          "description": "Path to save the export file. Defaults to cloud-backend.json in current directory",
-          "name": "file",
+        "name": {
+          "description": "app name in org/name format",
+          "name": "name",
+          "required": true
+        }
+      },
+      "description": "Deploy a hereya-app to a workspace.",
+      "examples": [
+        "<%= config.bin %> <%= command.id %> my-org/my-app -w my-workspace",
+        "<%= config.bin %> <%= command.id %> my-org/my-app -w prod --version 1.2.0",
+        "<%= config.bin %> <%= command.id %> my-org/my-app -w prod -V 'app.yaml: \"key: value\"'",
+        "<%= config.bin %> <%= command.id %> my-org/my-app -w prod --vars-file ./hereyavars.yaml"
+      ],
+      "flags": {
+        "parameter": {
+          "char": "p",
+          "description": "parameter for the app deployment, in the form of key=value (repeatable)",
+          "name": "parameter",
+          "default": [],
+          "hasDynamicHelp": false,
+          "multiple": true,
+          "type": "option"
+        },
+        "vars": {
+          "char": "V",
+          "description": "YAML string mapping hereyavars filename -> YAML body (mutually exclusive with --vars-file)",
+          "exclusive": [
+            "vars-file"
+          ],
+          "name": "vars",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "vars-file": {
+          "description": "path to a YAML file mapping hereyavars filename -> YAML body (mutually exclusive with --vars)",
+          "exclusive": [
+            "vars"
+          ],
+          "name": "vars-file",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "version": {
+          "description": "specific app version to deploy (defaults to latest)",
+          "name": "version",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "workspace": {
+          "char": "w",
+          "description": "name of the workspace to deploy the app to",
+          "name": "workspace",
+          "required": true,
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        }
+      },
+      "hasDynamicHelp": false,
+      "hiddenAliases": [],
+      "id": "app:deploy",
+      "pluginAlias": "hereya-cli",
+      "pluginName": "hereya-cli",
+      "pluginType": "core",
+      "strict": true,
+      "enableJsonFlag": false,
+      "isESM": true,
+      "relativePath": [
+        "dist",
+        "commands",
+        "app",
+        "deploy",
+        "index.js"
+      ]
+    },
+    "app:deployments": {
+      "aliases": [],
+      "args": {
+        "name": {
+          "description": "app name in org/name format",
+          "name": "name",
+          "required": true
+        }
+      },
+      "description": "List workspaces a hereya-app has been deployed to.",
+      "examples": [
+        "<%= config.bin %> <%= command.id %> my-org/my-app"
+      ],
+      "flags": {},
+      "hasDynamicHelp": false,
+      "hiddenAliases": [],
+      "id": "app:deployments",
+      "pluginAlias": "hereya-cli",
+      "pluginName": "hereya-cli",
+      "pluginType": "core",
+      "strict": true,
+      "enableJsonFlag": false,
+      "isESM": true,
+      "relativePath": [
+        "dist",
+        "commands",
+        "app",
+        "deployments",
+        "index.js"
+      ]
+    },
+    "app:destroy": {
+      "aliases": [],
+      "args": {
+        "name": {
+          "description": "app name in org/name format",
+          "name": "name",
+          "required": true
+        }
+      },
+      "description": "Destroy a hereya-app deployment from a workspace.",
+      "examples": [
+        "<%= config.bin %> <%= command.id %> my-org/my-app -w my-workspace"
+      ],
+      "flags": {
+        "workspace": {
+          "char": "w",
+          "description": "workspace where the app is currently deployed",
+          "name": "workspace",
+          "required": true,
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        }
+      },
+      "hasDynamicHelp": false,
+      "hiddenAliases": [],
+      "id": "app:destroy",
+      "pluginAlias": "hereya-cli",
+      "pluginName": "hereya-cli",
+      "pluginType": "core",
+      "strict": true,
+      "enableJsonFlag": false,
+      "isESM": true,
+      "relativePath": [
+        "dist",
+        "commands",
+        "app",
+        "destroy",
+        "index.js"
+      ]
+    },
+    "app:env": {
+      "aliases": [],
+      "args": {
+        "name": {
+          "description": "app name in org/name format",
+          "name": "name",
+          "required": true
+        },
+        "key": {
+          "description": "optional env var key to print (omit to print all)",
+          "name": "key",
           "required": false
         }
       },
-      "description": "Export the cloud backend configuration to a file",
+      "description": "Print environment variables exported by a hereya-app deployment.",
       "examples": [
-        "<%= config.bin %> <%= command.id %>",
-        "<%= config.bin %> <%= command.id %> ./path/to/export.json"
+        "<%= config.bin %> <%= command.id %> my-org/my-app -w my-workspace",
+        "<%= config.bin %> <%= command.id %> my-org/my-app -w my-workspace DATABASE_URL"
+      ],
+      "flags": {
+        "workspace": {
+          "char": "w",
+          "description": "workspace to read env outputs from",
+          "name": "workspace",
+          "required": true,
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        }
+      },
+      "hasDynamicHelp": false,
+      "hiddenAliases": [],
+      "id": "app:env",
+      "pluginAlias": "hereya-cli",
+      "pluginName": "hereya-cli",
+      "pluginType": "core",
+      "strict": true,
+      "enableJsonFlag": false,
+      "isESM": true,
+      "relativePath": [
+        "dist",
+        "commands",
+        "app",
+        "env",
+        "index.js"
+      ]
+    },
+    "app:list": {
+      "aliases": [],
+      "args": {},
+      "description": "List hereya-apps available to your account.",
+      "examples": [
+        "<%= config.bin %> <%= command.id %>"
       ],
       "flags": {},
       "hasDynamicHelp": false,
       "hiddenAliases": [],
-      "id": "config:export-backend",
+      "id": "app:list",
       "pluginAlias": "hereya-cli",
       "pluginName": "hereya-cli",
       "pluginType": "core",
@@ -1212,8 +1405,99 @@
       "relativePath": [
         "dist",
         "commands",
-        "config",
-        "export-backend",
+        "app",
+        "list",
+        "index.js"
+      ]
+    },
+    "app:new": {
+      "aliases": [],
+      "args": {
+        "dirname": {
+          "description": "directory to create the app skeleton in",
+          "name": "dirname",
+          "required": true
+        }
+      },
+      "description": "Scaffold a new hereya-app directory with starter hereyarc.yaml + hereya.yaml.",
+      "examples": [
+        "<%= config.bin %> <%= command.id %> ./my-app -n my-org/my-app",
+        "<%= config.bin %> <%= command.id %> ./my-app -n my-org/my-app --description \"An ai-app-builder app\""
+      ],
+      "flags": {
+        "description": {
+          "description": "description of the app",
+          "name": "description",
+          "required": false,
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "name": {
+          "char": "n",
+          "description": "app name in org/name format (e.g. my-org/my-app)",
+          "name": "name",
+          "required": true,
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        }
+      },
+      "hasDynamicHelp": false,
+      "hiddenAliases": [],
+      "id": "app:new",
+      "pluginAlias": "hereya-cli",
+      "pluginName": "hereya-cli",
+      "pluginType": "core",
+      "strict": true,
+      "enableJsonFlag": false,
+      "isESM": true,
+      "relativePath": [
+        "dist",
+        "commands",
+        "app",
+        "new",
+        "index.js"
+      ]
+    },
+    "app:status": {
+      "aliases": [],
+      "args": {
+        "name": {
+          "description": "app name in org/name format",
+          "name": "name",
+          "required": true
+        }
+      },
+      "description": "Show the deployment status of a hereya-app on a workspace.",
+      "examples": [
+        "<%= config.bin %> <%= command.id %> my-org/my-app -w my-workspace"
+      ],
+      "flags": {
+        "workspace": {
+          "char": "w",
+          "description": "workspace to read deployment status from",
+          "name": "workspace",
+          "required": true,
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        }
+      },
+      "hasDynamicHelp": false,
+      "hiddenAliases": [],
+      "id": "app:status",
+      "pluginAlias": "hereya-cli",
+      "pluginName": "hereya-cli",
+      "pluginType": "core",
+      "strict": true,
+      "enableJsonFlag": false,
+      "isESM": true,
+      "relativePath": [
+        "dist",
+        "commands",
+        "app",
+        "status",
         "index.js"
       ]
     },
@@ -1242,6 +1526,38 @@
         "index.js"
       ]
     },
+    "config:export-backend": {
+      "aliases": [],
+      "args": {
+        "file": {
+          "description": "Path to save the export file. Defaults to cloud-backend.json in current directory",
+          "name": "file",
+          "required": false
+        }
+      },
+      "description": "Export the cloud backend configuration to a file",
+      "examples": [
+        "<%= config.bin %> <%= command.id %>",
+        "<%= config.bin %> <%= command.id %> ./path/to/export.json"
+      ],
+      "flags": {},
+      "hasDynamicHelp": false,
+      "hiddenAliases": [],
+      "id": "config:export-backend",
+      "pluginAlias": "hereya-cli",
+      "pluginName": "hereya-cli",
+      "pluginType": "core",
+      "strict": true,
+      "enableJsonFlag": false,
+      "isESM": true,
+      "relativePath": [
+        "dist",
+        "commands",
+        "config",
+        "export-backend",
+        "index.js"
+      ]
+    },
     "config:import-backend": {
       "aliases": [],
       "args": {
@@ -2881,5 +3197,5 @@
       ]
     }
   },
-  "version": "0.83.2"
+  "version": "0.84.0"
 }

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "hereya-cli",
   "description": "Infrastructure as Package",
-  "version": "0.83.2",
+  "version": "0.84.0",
   "author": "Hereya Developers",
   "bin": {
     "hereya": "./bin/run.js"