hereya-cli 0.94.1 → 0.95.1

package/README.md

@@ -21,7 +21,7 @@ $ npm install -g hereya-cli
 $ hereya COMMAND
 running command...
 $ hereya (--version)
-hereya-cli/0.94.1 linux-x64 node-v24.14.1
+hereya-cli/0.95.1 linux-x64 node-v24.14.1
 $ hereya --help [COMMAND]
 USAGE
   $ hereya COMMAND
@@ -129,7 +129,7 @@ EXAMPLES
   $ hereya add cloudy/docker_postgres
 ```
 
-_See code: [src/commands/add/index.ts](https://github.com/hereya/hereya-cli/blob/v0.94.1/src/commands/add/index.ts)_
+_See code: [src/commands/add/index.ts](https://github.com/hereya/hereya-cli/blob/v0.95.1/src/commands/add/index.ts)_
 
 ## `hereya app deploy NAME`
 
@@ -163,7 +163,7 @@ EXAMPLES
   $ hereya app deploy my-org/my-app -w prod -p organizationId=org-123
 ```
 
-_See code: [src/commands/app/deploy/index.ts](https://github.com/hereya/hereya-cli/blob/v0.94.1/src/commands/app/deploy/index.ts)_
+_See code: [src/commands/app/deploy/index.ts](https://github.com/hereya/hereya-cli/blob/v0.95.1/src/commands/app/deploy/index.ts)_
 
 ## `hereya app deployments NAME`
 
@@ -183,7 +183,7 @@ EXAMPLES
   $ hereya app deployments my-org/my-app
 ```
 
-_See code: [src/commands/app/deployments/index.ts](https://github.com/hereya/hereya-cli/blob/v0.94.1/src/commands/app/deployments/index.ts)_
+_See code: [src/commands/app/deployments/index.ts](https://github.com/hereya/hereya-cli/blob/v0.95.1/src/commands/app/deployments/index.ts)_
 
 ## `hereya app destroy NAME`
 
@@ -212,7 +212,7 @@ EXAMPLES
   $ hereya app destroy my-org/my-app -w my-workspace
 ```
 
-_See code: [src/commands/app/destroy/index.ts](https://github.com/hereya/hereya-cli/blob/v0.94.1/src/commands/app/destroy/index.ts)_
+_See code: [src/commands/app/destroy/index.ts](https://github.com/hereya/hereya-cli/blob/v0.95.1/src/commands/app/destroy/index.ts)_
 
 ## `hereya app env NAME [KEY]`
 
@@ -238,7 +238,7 @@ EXAMPLES
   $ hereya app env my-org/my-app -w my-workspace DATABASE_URL
 ```
 
-_See code: [src/commands/app/env/index.ts](https://github.com/hereya/hereya-cli/blob/v0.94.1/src/commands/app/env/index.ts)_
+_See code: [src/commands/app/env/index.ts](https://github.com/hereya/hereya-cli/blob/v0.95.1/src/commands/app/env/index.ts)_
 
 ## `hereya app list`
 
@@ -255,7 +255,7 @@ EXAMPLES
   $ hereya app list
 ```
 
-_See code: [src/commands/app/list/index.ts](https://github.com/hereya/hereya-cli/blob/v0.94.1/src/commands/app/list/index.ts)_
+_See code: [src/commands/app/list/index.ts](https://github.com/hereya/hereya-cli/blob/v0.95.1/src/commands/app/list/index.ts)_
 
 ## `hereya app new DIRNAME`
 
@@ -281,7 +281,7 @@ EXAMPLES
   $ hereya app new ./my-app -n my-org/my-app --description "An ai-app-builder app"
 ```
 
-_See code: [src/commands/app/new/index.ts](https://github.com/hereya/hereya-cli/blob/v0.94.1/src/commands/app/new/index.ts)_
+_See code: [src/commands/app/new/index.ts](https://github.com/hereya/hereya-cli/blob/v0.95.1/src/commands/app/new/index.ts)_
 
 ## `hereya app status NAME`
 
@@ -304,7 +304,7 @@ EXAMPLES
   $ hereya app status my-org/my-app -w my-workspace
 ```
 
-_See code: [src/commands/app/status/index.ts](https://github.com/hereya/hereya-cli/blob/v0.94.1/src/commands/app/status/index.ts)_
+_See code: [src/commands/app/status/index.ts](https://github.com/hereya/hereya-cli/blob/v0.95.1/src/commands/app/status/index.ts)_
 
 ## `hereya bootstrap INFRASTRUCTURETYPE`
 
@@ -329,7 +329,7 @@ EXAMPLES
   $ hereya bootstrap local
 ```
 
-_See code: [src/commands/bootstrap/index.ts](https://github.com/hereya/hereya-cli/blob/v0.94.1/src/commands/bootstrap/index.ts)_
+_See code: [src/commands/bootstrap/index.ts](https://github.com/hereya/hereya-cli/blob/v0.95.1/src/commands/bootstrap/index.ts)_
 
 ## `hereya clone PROJECT`
 
@@ -354,7 +354,7 @@ EXAMPLES
   $ hereya clone myProject --chdir=./myProject
 ```
 
-_See code: [src/commands/clone/index.ts](https://github.com/hereya/hereya-cli/blob/v0.94.1/src/commands/clone/index.ts)_
+_See code: [src/commands/clone/index.ts](https://github.com/hereya/hereya-cli/blob/v0.95.1/src/commands/clone/index.ts)_
 
 ## `hereya config export-backend [FILE]`
 
@@ -376,7 +376,7 @@ EXAMPLES
   $ hereya config export-backend ./path/to/export.json
 ```
 
-_See code: [src/commands/config/export-backend/index.ts](https://github.com/hereya/hereya-cli/blob/v0.94.1/src/commands/config/export-backend/index.ts)_
+_See code: [src/commands/config/export-backend/index.ts](https://github.com/hereya/hereya-cli/blob/v0.95.1/src/commands/config/export-backend/index.ts)_
 
 ## `hereya config get-backend`
 
@@ -393,7 +393,7 @@ EXAMPLES
   $ hereya config get-backend
 ```
 
-_See code: [src/commands/config/get-backend/index.ts](https://github.com/hereya/hereya-cli/blob/v0.94.1/src/commands/config/get-backend/index.ts)_
+_See code: [src/commands/config/get-backend/index.ts](https://github.com/hereya/hereya-cli/blob/v0.95.1/src/commands/config/get-backend/index.ts)_
 
 ## `hereya config import-backend FILE`
 
@@ -413,7 +413,7 @@ EXAMPLES
   $ hereya config import-backend ./path/to/cloud-backend.json
 ```
 
-_See code: [src/commands/config/import-backend/index.ts](https://github.com/hereya/hereya-cli/blob/v0.94.1/src/commands/config/import-backend/index.ts)_
+_See code: [src/commands/config/import-backend/index.ts](https://github.com/hereya/hereya-cli/blob/v0.95.1/src/commands/config/import-backend/index.ts)_
 
 ## `hereya config use-backend TYPE`
 
@@ -435,7 +435,7 @@ EXAMPLES
   $ hereya config use-backend local
 ```
 
-_See code: [src/commands/config/use-backend/index.ts](https://github.com/hereya/hereya-cli/blob/v0.94.1/src/commands/config/use-backend/index.ts)_
+_See code: [src/commands/config/use-backend/index.ts](https://github.com/hereya/hereya-cli/blob/v0.95.1/src/commands/config/use-backend/index.ts)_
 
 ## `hereya delete-state`
 
@@ -461,7 +461,7 @@ EXAMPLES
   $ hereya delete-state --workspace staging
 ```
 
-_See code: [src/commands/delete-state/index.ts](https://github.com/hereya/hereya-cli/blob/v0.94.1/src/commands/delete-state/index.ts)_
+_See code: [src/commands/delete-state/index.ts](https://github.com/hereya/hereya-cli/blob/v0.95.1/src/commands/delete-state/index.ts)_
 
 ## `hereya deploy`
 
@@ -487,7 +487,7 @@ EXAMPLES
   $ hereya deploy
 ```
 
-_See code: [src/commands/deploy/index.ts](https://github.com/hereya/hereya-cli/blob/v0.94.1/src/commands/deploy/index.ts)_
+_See code: [src/commands/deploy/index.ts](https://github.com/hereya/hereya-cli/blob/v0.95.1/src/commands/deploy/index.ts)_
 
 ## `hereya devenv config`
 
@@ -507,7 +507,7 @@ EXAMPLES
   $ hereya devenv config -w my-workspace
 ```
 
-_See code: [src/commands/devenv/config/index.ts](https://github.com/hereya/hereya-cli/blob/v0.94.1/src/commands/devenv/config/index.ts)_
+_See code: [src/commands/devenv/config/index.ts](https://github.com/hereya/hereya-cli/blob/v0.95.1/src/commands/devenv/config/index.ts)_
 
 ## `hereya devenv install`
 
@@ -534,7 +534,7 @@ EXAMPLES
   $ hereya devenv install -w my-workspace -p instanceType=t3.large
 ```
 
-_See code: [src/commands/devenv/install/index.ts](https://github.com/hereya/hereya-cli/blob/v0.94.1/src/commands/devenv/install/index.ts)_
+_See code: [src/commands/devenv/install/index.ts](https://github.com/hereya/hereya-cli/blob/v0.95.1/src/commands/devenv/install/index.ts)_
 
 ## `hereya devenv project init PROJECT`
 
@@ -566,7 +566,7 @@ EXAMPLES
   $ hereya devenv project init my-app -w my-workspace -t acme/node-starter -p region=us-east-1
 ```
 
-_See code: [src/commands/devenv/project/init/index.ts](https://github.com/hereya/hereya-cli/blob/v0.94.1/src/commands/devenv/project/init/index.ts)_
+_See code: [src/commands/devenv/project/init/index.ts](https://github.com/hereya/hereya-cli/blob/v0.95.1/src/commands/devenv/project/init/index.ts)_
 
 ## `hereya devenv project uninit PROJECT`
 
@@ -592,7 +592,7 @@ EXAMPLES
   $ hereya devenv project uninit my-app -w my-workspace --force
 ```
 
-_See code: [src/commands/devenv/project/uninit/index.ts](https://github.com/hereya/hereya-cli/blob/v0.94.1/src/commands/devenv/project/uninit/index.ts)_
+_See code: [src/commands/devenv/project/uninit/index.ts](https://github.com/hereya/hereya-cli/blob/v0.95.1/src/commands/devenv/project/uninit/index.ts)_
 
 ## `hereya devenv sleep`
 
@@ -613,7 +613,7 @@ EXAMPLES
   $ hereya devenv sleep -w my-workspace
 ```
 
-_See code: [src/commands/devenv/sleep/index.ts](https://github.com/hereya/hereya-cli/blob/v0.94.1/src/commands/devenv/sleep/index.ts)_
+_See code: [src/commands/devenv/sleep/index.ts](https://github.com/hereya/hereya-cli/blob/v0.95.1/src/commands/devenv/sleep/index.ts)_
 
 ## `hereya devenv ssh`
 
@@ -633,7 +633,7 @@ EXAMPLES
   $ hereya devenv ssh -w my-workspace
 ```
 
-_See code: [src/commands/devenv/ssh/index.ts](https://github.com/hereya/hereya-cli/blob/v0.94.1/src/commands/devenv/ssh/index.ts)_
+_See code: [src/commands/devenv/ssh/index.ts](https://github.com/hereya/hereya-cli/blob/v0.95.1/src/commands/devenv/ssh/index.ts)_
 
 ## `hereya devenv uninstall`
 
@@ -654,7 +654,7 @@ EXAMPLES
   $ hereya devenv uninstall -w my-workspace
 ```
 
-_See code: [src/commands/devenv/uninstall/index.ts](https://github.com/hereya/hereya-cli/blob/v0.94.1/src/commands/devenv/uninstall/index.ts)_
+_See code: [src/commands/devenv/uninstall/index.ts](https://github.com/hereya/hereya-cli/blob/v0.95.1/src/commands/devenv/uninstall/index.ts)_
 
 ## `hereya doc PACKAGE`
 
@@ -687,7 +687,7 @@ EXAMPLES
   $ hereya doc my-package --no-doc
 ```
 
-_See code: [src/commands/doc/index.ts](https://github.com/hereya/hereya-cli/blob/v0.94.1/src/commands/doc/index.ts)_
+_See code: [src/commands/doc/index.ts](https://github.com/hereya/hereya-cli/blob/v0.95.1/src/commands/doc/index.ts)_
 
 ## `hereya docker run IMAGE`
 
@@ -718,7 +718,7 @@ EXAMPLES
   $ hereya docker run myapp:latest -- --rm -v ./data:/data
 ```
 
-_See code: [src/commands/docker/run/index.ts](https://github.com/hereya/hereya-cli/blob/v0.94.1/src/commands/docker/run/index.ts)_
+_See code: [src/commands/docker/run/index.ts](https://github.com/hereya/hereya-cli/blob/v0.95.1/src/commands/docker/run/index.ts)_
 
 ## `hereya down`
 
@@ -745,7 +745,7 @@ EXAMPLES
   $ hereya down
 ```
 
-_See code: [src/commands/down/index.ts](https://github.com/hereya/hereya-cli/blob/v0.94.1/src/commands/down/index.ts)_
+_See code: [src/commands/down/index.ts](https://github.com/hereya/hereya-cli/blob/v0.95.1/src/commands/down/index.ts)_
 
 ## `hereya env [NAME]`
 
@@ -776,7 +776,7 @@ EXAMPLES
   $ hereya env -w dev -l
 ```
 
-_See code: [src/commands/env/index.ts](https://github.com/hereya/hereya-cli/blob/v0.94.1/src/commands/env/index.ts)_
+_See code: [src/commands/env/index.ts](https://github.com/hereya/hereya-cli/blob/v0.95.1/src/commands/env/index.ts)_
 
 ## `hereya env set [NAME]`
 
@@ -803,7 +803,7 @@ EXAMPLES
   $ hereya env set FOO -v bar -w dev
 ```
 
-_See code: [src/commands/env/set/index.ts](https://github.com/hereya/hereya-cli/blob/v0.94.1/src/commands/env/set/index.ts)_
+_See code: [src/commands/env/set/index.ts](https://github.com/hereya/hereya-cli/blob/v0.95.1/src/commands/env/set/index.ts)_
 
 ## `hereya executor start`
 
@@ -837,7 +837,7 @@ EXAMPLES
   HEREYA_TOKEN=<token> HEREYA_CLOUD_URL=https://my-cloud.example.com hereya executor start -w my-workspace
 ```
 
-_See code: [src/commands/executor/start/index.ts](https://github.com/hereya/hereya-cli/blob/v0.94.1/src/commands/executor/start/index.ts)_
+_See code: [src/commands/executor/start/index.ts](https://github.com/hereya/hereya-cli/blob/v0.95.1/src/commands/executor/start/index.ts)_
 
 ## `hereya flow add PACKAGE`
 
@@ -875,7 +875,7 @@ EXAMPLES
   $ hereya flow add cloudy/docker_postgres -p DB_NAME=mydb -p DB_USER=admin
 ```
 
-_See code: [src/commands/flow/add/index.ts](https://github.com/hereya/hereya-cli/blob/v0.94.1/src/commands/flow/add/index.ts)_
+_See code: [src/commands/flow/add/index.ts](https://github.com/hereya/hereya-cli/blob/v0.95.1/src/commands/flow/add/index.ts)_
 
 ## `hereya flow docker run IMAGE`
 
@@ -905,7 +905,7 @@ EXAMPLES
   $ hereya flow docker run --pin myapp:latest -- --rm
 ```
 
-_See code: [src/commands/flow/docker/run/index.ts](https://github.com/hereya/hereya-cli/blob/v0.94.1/src/commands/flow/docker/run/index.ts)_
+_See code: [src/commands/flow/docker/run/index.ts](https://github.com/hereya/hereya-cli/blob/v0.95.1/src/commands/flow/docker/run/index.ts)_
 
 ## `hereya flow down`
 
@@ -939,7 +939,7 @@ EXAMPLES
   $ hereya flow down --pin
 ```
 
-_See code: [src/commands/flow/down/index.ts](https://github.com/hereya/hereya-cli/blob/v0.94.1/src/commands/flow/down/index.ts)_
+_See code: [src/commands/flow/down/index.ts](https://github.com/hereya/hereya-cli/blob/v0.95.1/src/commands/flow/down/index.ts)_
 
 ## `hereya flow env [NAME]`
 
@@ -973,7 +973,7 @@ EXAMPLES
   $ hereya flow env -l
 ```
 
-_See code: [src/commands/flow/env/index.ts](https://github.com/hereya/hereya-cli/blob/v0.94.1/src/commands/flow/env/index.ts)_
+_See code: [src/commands/flow/env/index.ts](https://github.com/hereya/hereya-cli/blob/v0.95.1/src/commands/flow/env/index.ts)_
 
 ## `hereya flow provid PACKAGE`
 
@@ -1002,7 +1002,7 @@ EXAMPLES
   $ hereya flow provid hereya/postgres --pin
 ```
 
-_See code: [src/commands/flow/provid/index.ts](https://github.com/hereya/hereya-cli/blob/v0.94.1/src/commands/flow/provid/index.ts)_
+_See code: [src/commands/flow/provid/index.ts](https://github.com/hereya/hereya-cli/blob/v0.95.1/src/commands/flow/provid/index.ts)_
 
 ## `hereya flow remove PACKAGE`
 
@@ -1032,7 +1032,7 @@ EXAMPLES
   $ hereya flow remove cloudy/docker_postgres --profile staging
 ```
 
-_See code: [src/commands/flow/remove/index.ts](https://github.com/hereya/hereya-cli/blob/v0.94.1/src/commands/flow/remove/index.ts)_
+_See code: [src/commands/flow/remove/index.ts](https://github.com/hereya/hereya-cli/blob/v0.95.1/src/commands/flow/remove/index.ts)_
 
 ## `hereya flow run CMD`
 
@@ -1061,7 +1061,7 @@ EXAMPLES
   $ hereya flow run --pin -- npm test
 ```
 
-_See code: [src/commands/flow/run/index.ts](https://github.com/hereya/hereya-cli/blob/v0.94.1/src/commands/flow/run/index.ts)_
+_See code: [src/commands/flow/run/index.ts](https://github.com/hereya/hereya-cli/blob/v0.95.1/src/commands/flow/run/index.ts)_
 
 ## `hereya flow up`
 
@@ -1095,7 +1095,7 @@ EXAMPLES
   $ hereya flow up --pin
 ```
 
-_See code: [src/commands/flow/up/index.ts](https://github.com/hereya/hereya-cli/blob/v0.94.1/src/commands/flow/up/index.ts)_
+_See code: [src/commands/flow/up/index.ts](https://github.com/hereya/hereya-cli/blob/v0.95.1/src/commands/flow/up/index.ts)_
 
 ## `hereya help [COMMAND]`
 
@@ -1152,7 +1152,7 @@ EXAMPLES
   $ hereya import org/my-package -f state.tfstate -w my-workspace
 ```
 
-_See code: [src/commands/import/index.ts](https://github.com/hereya/hereya-cli/blob/v0.94.1/src/commands/import/index.ts)_
+_See code: [src/commands/import/index.ts](https://github.com/hereya/hereya-cli/blob/v0.95.1/src/commands/import/index.ts)_
 
 ## `hereya import-repo PROJECT`
 
@@ -1182,7 +1182,7 @@ EXAMPLES
   $ hereya import-repo myProject -w=dev -r=https://github.com/acme/api --clone --chdir=./api
 ```
 
-_See code: [src/commands/import-repo/index.ts](https://github.com/hereya/hereya-cli/blob/v0.94.1/src/commands/import-repo/index.ts)_
+_See code: [src/commands/import-repo/index.ts](https://github.com/hereya/hereya-cli/blob/v0.95.1/src/commands/import-repo/index.ts)_
 
 ## `hereya init PROJECT`
 
@@ -1216,7 +1216,7 @@ EXAMPLES
   $ hereya init myProject -w=dev -t=acme/node-starter -d=prod -p region=us-east-1
 ```
 
-_See code: [src/commands/init/index.ts](https://github.com/hereya/hereya-cli/blob/v0.94.1/src/commands/init/index.ts)_
+_See code: [src/commands/init/index.ts](https://github.com/hereya/hereya-cli/blob/v0.95.1/src/commands/init/index.ts)_
 
 ## `hereya list`
 
@@ -1233,7 +1233,7 @@ EXAMPLES
   $ hereya list
 ```
 
-_See code: [src/commands/list/index.ts](https://github.com/hereya/hereya-cli/blob/v0.94.1/src/commands/list/index.ts)_
+_See code: [src/commands/list/index.ts](https://github.com/hereya/hereya-cli/blob/v0.95.1/src/commands/list/index.ts)_
 
 ## `hereya login [URL]`
 
@@ -1262,7 +1262,7 @@ EXAMPLES
   $ hereya login --token=your-token https://cloud.hereya.dev
 ```
 
-_See code: [src/commands/login/index.ts](https://github.com/hereya/hereya-cli/blob/v0.94.1/src/commands/login/index.ts)_
+_See code: [src/commands/login/index.ts](https://github.com/hereya/hereya-cli/blob/v0.95.1/src/commands/login/index.ts)_
 
 ## `hereya logout`
 
@@ -1279,7 +1279,7 @@ EXAMPLES
   $ hereya logout
 ```
 
-_See code: [src/commands/logout/index.ts](https://github.com/hereya/hereya-cli/blob/v0.94.1/src/commands/logout/index.ts)_
+_See code: [src/commands/logout/index.ts](https://github.com/hereya/hereya-cli/blob/v0.95.1/src/commands/logout/index.ts)_
 
 ## `hereya provid PACKAGE`
 
@@ -1307,7 +1307,7 @@ EXAMPLES
   $ hereya provid hereya/postgres --workspace staging
 ```
 
-_See code: [src/commands/provid/index.ts](https://github.com/hereya/hereya-cli/blob/v0.94.1/src/commands/provid/index.ts)_
+_See code: [src/commands/provid/index.ts](https://github.com/hereya/hereya-cli/blob/v0.95.1/src/commands/provid/index.ts)_
 
 ## `hereya publish`
 
@@ -1330,7 +1330,7 @@ EXAMPLES
   $ hereya publish --chdir=/path/to/package
 ```
 
-_See code: [src/commands/publish/index.ts](https://github.com/hereya/hereya-cli/blob/v0.94.1/src/commands/publish/index.ts)_
+_See code: [src/commands/publish/index.ts](https://github.com/hereya/hereya-cli/blob/v0.95.1/src/commands/publish/index.ts)_
 
 ## `hereya remove PACKAGE`
 
@@ -1358,7 +1358,7 @@ EXAMPLES
   $ hereya remove cloudy/docker_postgres
 ```
 
-_See code: [src/commands/remove/index.ts](https://github.com/hereya/hereya-cli/blob/v0.94.1/src/commands/remove/index.ts)_
+_See code: [src/commands/remove/index.ts](https://github.com/hereya/hereya-cli/blob/v0.95.1/src/commands/remove/index.ts)_
 
 ## `hereya run CMD`
 
@@ -1384,7 +1384,7 @@ EXAMPLES
   $ hereya run -w uat -- node index.js
 ```
 
-_See code: [src/commands/run/index.ts](https://github.com/hereya/hereya-cli/blob/v0.94.1/src/commands/run/index.ts)_
+_See code: [src/commands/run/index.ts](https://github.com/hereya/hereya-cli/blob/v0.95.1/src/commands/run/index.ts)_
 
 ## `hereya search QUERY`
 
@@ -1415,7 +1415,7 @@ EXAMPLES
   $ hereya search database --json
 ```
 
-_See code: [src/commands/search/index.ts](https://github.com/hereya/hereya-cli/blob/v0.94.1/src/commands/search/index.ts)_
+_See code: [src/commands/search/index.ts](https://github.com/hereya/hereya-cli/blob/v0.95.1/src/commands/search/index.ts)_
 
 ## `hereya unbootstrap INFRASTRUCTURETYPE`
 
@@ -1440,7 +1440,7 @@ EXAMPLES
   $ hereya unbootstrap local
 ```
 
-_See code: [src/commands/unbootstrap/index.ts](https://github.com/hereya/hereya-cli/blob/v0.94.1/src/commands/unbootstrap/index.ts)_
+_See code: [src/commands/unbootstrap/index.ts](https://github.com/hereya/hereya-cli/blob/v0.95.1/src/commands/unbootstrap/index.ts)_
 
 ## `hereya undeploy`
 
@@ -1466,7 +1466,7 @@ EXAMPLES
   $ hereya undeploy
 ```
 
-_See code: [src/commands/undeploy/index.ts](https://github.com/hereya/hereya-cli/blob/v0.94.1/src/commands/undeploy/index.ts)_
+_See code: [src/commands/undeploy/index.ts](https://github.com/hereya/hereya-cli/blob/v0.95.1/src/commands/undeploy/index.ts)_
 
 ## `hereya uninit PROJECT`
 
@@ -1494,7 +1494,7 @@ EXAMPLES
   $ hereya uninit myProject -w dev -p prodWorkspace=prod
 ```
 
-_See code: [src/commands/uninit/index.ts](https://github.com/hereya/hereya-cli/blob/v0.94.1/src/commands/uninit/index.ts)_
+_See code: [src/commands/uninit/index.ts](https://github.com/hereya/hereya-cli/blob/v0.95.1/src/commands/uninit/index.ts)_
 
 ## `hereya up`
 
@@ -1521,7 +1521,7 @@ EXAMPLES
   $ hereya up
 ```
 
-_See code: [src/commands/up/index.ts](https://github.com/hereya/hereya-cli/blob/v0.94.1/src/commands/up/index.ts)_
+_See code: [src/commands/up/index.ts](https://github.com/hereya/hereya-cli/blob/v0.95.1/src/commands/up/index.ts)_
 
 ## `hereya update [VERSION]`
 
@@ -1543,7 +1543,7 @@ EXAMPLES
   $ hereya update 0.75.0
 ```
 
-_See code: [src/commands/update/index.ts](https://github.com/hereya/hereya-cli/blob/v0.94.1/src/commands/update/index.ts)_
+_See code: [src/commands/update/index.ts](https://github.com/hereya/hereya-cli/blob/v0.95.1/src/commands/update/index.ts)_
 
 ## `hereya workspace create NAME`
 
@@ -1568,7 +1568,7 @@ EXAMPLES
   $ hereya workspace create dev
 ```
 
-_See code: [src/commands/workspace/create/index.ts](https://github.com/hereya/hereya-cli/blob/v0.94.1/src/commands/workspace/create/index.ts)_
+_See code: [src/commands/workspace/create/index.ts](https://github.com/hereya/hereya-cli/blob/v0.95.1/src/commands/workspace/create/index.ts)_
 
 ## `hereya workspace delete NAME`
 
@@ -1588,7 +1588,7 @@ EXAMPLES
   $ hereya workspace delete dev
 ```
 
-_See code: [src/commands/workspace/delete/index.ts](https://github.com/hereya/hereya-cli/blob/v0.94.1/src/commands/workspace/delete/index.ts)_
+_See code: [src/commands/workspace/delete/index.ts](https://github.com/hereya/hereya-cli/blob/v0.95.1/src/commands/workspace/delete/index.ts)_
 
 ## `hereya workspace env [NAME]`
 
@@ -1614,7 +1614,7 @@ EXAMPLES
   $ hereya workspace env myEnv -w dev
 ```
 
-_See code: [src/commands/workspace/env/index.ts](https://github.com/hereya/hereya-cli/blob/v0.94.1/src/commands/workspace/env/index.ts)_
+_See code: [src/commands/workspace/env/index.ts](https://github.com/hereya/hereya-cli/blob/v0.95.1/src/commands/workspace/env/index.ts)_
 
 ## `hereya workspace env set`
 
@@ -1638,7 +1638,7 @@ EXAMPLES
   $ hereya workspace env set -w my-workspace -n myVar -v my-value -i aws -s
 ```
 
-_See code: [src/commands/workspace/env/set/index.ts](https://github.com/hereya/hereya-cli/blob/v0.94.1/src/commands/workspace/env/set/index.ts)_
+_See code: [src/commands/workspace/env/set/index.ts](https://github.com/hereya/hereya-cli/blob/v0.95.1/src/commands/workspace/env/set/index.ts)_
 
 ## `hereya workspace env unset`
 
@@ -1659,7 +1659,7 @@ EXAMPLES
   $ hereya workspace env unset -w my-workspace -n myVar
 ```
 
-_See code: [src/commands/workspace/env/unset/index.ts](https://github.com/hereya/hereya-cli/blob/v0.94.1/src/commands/workspace/env/unset/index.ts)_
+_See code: [src/commands/workspace/env/unset/index.ts](https://github.com/hereya/hereya-cli/blob/v0.95.1/src/commands/workspace/env/unset/index.ts)_
 
 ## `hereya workspace executor install`
 
@@ -1686,7 +1686,7 @@ DESCRIPTION
   - ephemeral: ASG scaled to 0 with a broker Lambda + OIDC for on-demand wake.
 ```
 
-_See code: [src/commands/workspace/executor/install/index.ts](https://github.com/hereya/hereya-cli/blob/v0.94.1/src/commands/workspace/executor/install/index.ts)_
+_See code: [src/commands/workspace/executor/install/index.ts](https://github.com/hereya/hereya-cli/blob/v0.95.1/src/commands/workspace/executor/install/index.ts)_
 
 ## `hereya workspace executor token`
 
@@ -1703,7 +1703,7 @@ DESCRIPTION
   Generate a workspace-scoped executor token for the remote executor
 ```
 
-_See code: [src/commands/workspace/executor/token/index.ts](https://github.com/hereya/hereya-cli/blob/v0.94.1/src/commands/workspace/executor/token/index.ts)_
+_See code: [src/commands/workspace/executor/token/index.ts](https://github.com/hereya/hereya-cli/blob/v0.95.1/src/commands/workspace/executor/token/index.ts)_
 
 ## `hereya workspace executor uninstall`
 
@@ -1727,7 +1727,7 @@ DESCRIPTION
   controls log output.
 ```
 
-_See code: [src/commands/workspace/executor/uninstall/index.ts](https://github.com/hereya/hereya-cli/blob/v0.94.1/src/commands/workspace/executor/uninstall/index.ts)_
+_See code: [src/commands/workspace/executor/uninstall/index.ts](https://github.com/hereya/hereya-cli/blob/v0.95.1/src/commands/workspace/executor/uninstall/index.ts)_
 
 ## `hereya workspace install PACKAGE`
 
@@ -1754,7 +1754,7 @@ EXAMPLES
   $ hereya workspace install hereya/aws-cognito
 ```
 
-_See code: [src/commands/workspace/install/index.ts](https://github.com/hereya/hereya-cli/blob/v0.94.1/src/commands/workspace/install/index.ts)_
+_See code: [src/commands/workspace/install/index.ts](https://github.com/hereya/hereya-cli/blob/v0.95.1/src/commands/workspace/install/index.ts)_
 
 ## `hereya workspace list`
 
@@ -1778,7 +1778,7 @@ EXAMPLES
   $ hereya workspace list --org personal
 ```
 
-_See code: [src/commands/workspace/list/index.ts](https://github.com/hereya/hereya-cli/blob/v0.94.1/src/commands/workspace/list/index.ts)_
+_See code: [src/commands/workspace/list/index.ts](https://github.com/hereya/hereya-cli/blob/v0.95.1/src/commands/workspace/list/index.ts)_
 
 ## `hereya workspace set-profile PROFILE`
 
@@ -1802,7 +1802,7 @@ EXAMPLES
   $ hereya workspace set-profile prod-profile -w production
 ```
 
-_See code: [src/commands/workspace/set-profile/index.ts](https://github.com/hereya/hereya-cli/blob/v0.94.1/src/commands/workspace/set-profile/index.ts)_
+_See code: [src/commands/workspace/set-profile/index.ts](https://github.com/hereya/hereya-cli/blob/v0.95.1/src/commands/workspace/set-profile/index.ts)_
 
 ## `hereya workspace uninstall PACKAGE`
 
@@ -1829,5 +1829,5 @@ EXAMPLES
   $ hereya workspace uninstall hereya/aws-cognito
 ```
 
-_See code: [src/commands/workspace/uninstall/index.ts](https://github.com/hereya/hereya-cli/blob/v0.94.1/src/commands/workspace/uninstall/index.ts)_
+_See code: [src/commands/workspace/uninstall/index.ts](https://github.com/hereya/hereya-cli/blob/v0.95.1/src/commands/workspace/uninstall/index.ts)_
 <!-- commandsstop -->

package/dist/commands/devenv/install/index.js

@@ -85,8 +85,13 @@ export default class DevenvInstall extends Command {
                                     workspace: flags.workspace,
                                 });
                                 if (token) {
-                                    ctx.tokenParams = { hereyaCloudUrl: token.cloudUrl, hereyaToken: token.token };
+                                    ctx.tokenParams = {
+                                        hereyaCloudUrl: token.cloudUrl,
+                                        hereyaToken: token.token,
+                                        ownerUserId: token.ownerUserId,
+                                    };
                                     ctx.tokenOwnerEmail = token.ownerEmail;
+                                    ctx.tokenOwnerUserId = token.ownerUserId;
                                 }
                             },
                             title: 'Generating Hereya token for dev environment',
@@ -117,9 +122,22 @@ export default class DevenvInstall extends Command {
                         {
                             async task(ctx) {
                                 const { env, metadata } = ctx.provisionOutput;
+                                // Augment provision env with the recorded owner identity so we
+                                // can gate later devenv ssh / sleep / uninstall commands by
+                                // comparing the caller's JWT.sub against env.devEnvOwnerUserId.
+                                // These are non-sensitive plain strings — the existing infra
+                                // prefix added by addPackageToWorkspace resolves cleanly back
+                                // to the raw value via resolveEnvValues.
+                                const augmentedEnv = { ...env };
+                                if (ctx.tokenOwnerUserId) {
+                                    augmentedEnv.devEnvOwnerUserId = ctx.tokenOwnerUserId;
+                                }
+                                if (ctx.tokenOwnerEmail) {
+                                    augmentedEnv.devEnvOwnerEmail = ctx.tokenOwnerEmail;
+                                }
                                 const backend = await getBackend();
                                 const output = await backend.addPackageToWorkspace({
-                                    env,
+                                    env: augmentedEnv,
                                     infra: metadata.infra,
                                     package: ctx.provisionOutput.pkgName,
                                     parameters: ctx.parameters,

package/dist/commands/devenv/sleep/index.js

@@ -2,6 +2,7 @@ import { Command, Flags } from '@oclif/core';
 import { Listr, ListrLogger, ListrLogLevels } from 'listr2';
 import { getBackend } from '../../../backend/index.js';
 import { getExecutorForWorkspace } from '../../../executor/context.js';
+import { assertDevenvOwner, getCallerAccessToken } from '../../../lib/devenv-wake.js';
 import { getLogPath, isDebug, setDebug } from '../../../lib/log.js';
 export default class DevenvSleep extends Command {
     static description = 'Stop the dev environment instance for a workspace (lifecycle=on-demand only).';
@@ -41,15 +42,33 @@ export default class DevenvSleep extends Command {
                                 if (!env.devEnvWakeUrl) {
                                     throw new Error(`Workspace ${flags.workspace} was not provisioned with lifecycle=on-demand; nothing to sleep.`);
                                 }
+                                // Resolve the caller's hereya access token. Sleep is owner-
+                                // only — admins/owners don't need to sleep someone else's
+                                // box (they redeploy). The wake-broker /sleep endpoint
+                                // server-enforces this too.
+                                const accessToken = await getCallerAccessToken();
+                                // Client-side owner gate. On legacy devenvs (no
+                                // `devEnvOwnerUserId`) emits a warning and proceeds.
+                                if (accessToken) {
+                                    assertDevenvOwner(env, accessToken);
+                                }
                                 ctx.wakeUrl = env.devEnvWakeUrl;
-                                ctx.wakeToken = env.devEnvWakeToken;
+                                // Auth-token selection mirrors `resolveDevenvSshHost` in
+                                // devenv-wake.ts: prefer the access token (fresh install,
+                                // dev-env-aws ≥ 0.10.0); fall back to the static
+                                // `devEnvWakeToken` when the workspace is legacy
+                                // (devEnvOwnerUserId absent — dev-env-aws ≤ 0.9.x).
+                                ctx.authToken = env.devEnvOwnerUserId ? accessToken ?? undefined : env.devEnvWakeToken;
+                                if (!ctx.authToken) {
+                                    throw new Error('No bearer available for /sleep. Run `hereya cloud login` to refresh credentials.');
+                                }
                             },
                             title: `Loading workspace ${flags.workspace}`,
                         },
                         {
                             async task(ctx) {
                                 const response = await fetch(`${ctx.wakeUrl}/sleep`, {
-                                    headers: { Authorization: `Bearer ${ctx.wakeToken}` },
+                                    headers: { Authorization: `Bearer ${ctx.authToken}` },
                                     method: 'POST',
                                 });
                                 if (!response.ok) {

package/dist/commands/devenv/uninstall/index.js

@@ -1,9 +1,64 @@
 import { Command, Flags } from '@oclif/core';
 import { Listr, ListrLogger, ListrLogLevels } from 'listr2';
+import { getCloudCredentials, loadBackendConfig } from '../../../backend/config.js';
 import { getBackend } from '../../../backend/index.js';
 import { getExecutorForWorkspace } from '../../../executor/context.js';
+import { decodeJwtPayload } from '../../../lib/devenv-wake.js';
 import { getLogger, getLogPath, isDebug, setDebug } from '../../../lib/log.js';
+import { extractOrgPrefix } from '../../../lib/org-utils.js';
 import { delay } from '../../../lib/shell.js';
+/**
+ * Look up the calling user's role in the workspace's organisation.
+ *
+ * Returns null when no cloud backend is configured (local-only setup), when
+ * the workspace name has no org prefix, or when the cloud call fails for any
+ * reason. Callers must treat null as "couldn't determine — fall back to
+ * legacy behaviour".
+ */
+async function getCallerRoleInWorkspaceOrg(workspaceName) {
+    const backendConfig = await loadBackendConfig();
+    if (!backendConfig.cloud)
+        return null;
+    const { org: orgSlug } = extractOrgPrefix(workspaceName);
+    if (!orgSlug)
+        return null;
+    const credentials = await getCloudCredentials(backendConfig.cloud.clientId);
+    if (!credentials)
+        return null;
+    const url = `${backendConfig.cloud.url}/api/organizations/${encodeURIComponent(orgSlug)}/me`;
+    // The cloud accepts either an org slug or an org id at `:id`. We pass the
+    // slug we extracted from the workspace name; the cloud route resolves it
+    // server-side. See `hereya-cloud/app/routes/api/organizations/$id.me.ts`.
+    let response;
+    try {
+        response = await fetch(url, {
+            headers: { Authorization: `Bearer ${credentials.accessToken}` },
+            method: 'GET',
+        });
+    }
+    catch {
+        return null;
+    }
+    if (!response.ok)
+        return null;
+    const body = (await response.json().catch(() => null));
+    const role = body?.role;
+    if (role === 'OWNER' || role === 'ADMIN' || role === 'DEVELOPER' || role === 'MEMBER') {
+        return role;
+    }
+    return null;
+}
+/**
+ * Workspace env values are stored prefixed (`local:foo` / `aws:foo`). Strip
+ * the prefix to recover the plain string. Used for the owner identity fields
+ * (`devEnvOwnerUserId`, `devEnvOwnerEmail`) which are plain strings — no
+ * resolver layer.
+ */
+function stripInfraPrefix(value) {
+    if (!value)
+        return value;
+    return value.split(':').slice(1).join(':') || value;
+}
 export default class DevenvUninstall extends Command {
     static description = 'Destroy and remove the dev environment from a workspace.';
     static examples = ['<%= config.bin %> <%= command.id %> -w my-workspace'];
@@ -48,6 +103,56 @@ export default class DevenvUninstall extends Command {
                             },
                             title: `Loading workspace ${flags.workspace}`,
                         },
+                        {
+                            async task() {
+                                // Owner-or-admin gate. Fast-path resolves the caller's
+                                // identity from the workspace env's `devEnvOwnerUserId`; if
+                                // that's missing the workspace is legacy (Phase 2 or
+                                // earlier) and we allow with a warning. If the caller is
+                                // the recorded owner, allow. Otherwise consult the cloud
+                                // for org role.
+                                const backend = await getBackend();
+                                const envOutput = await backend.getWorkspaceEnv({ workspace: flags.workspace });
+                                if (!envOutput.success) {
+                                    // No env / can't reach — let later steps surface the
+                                    // canonical error rather than gating here.
+                                    return;
+                                }
+                                const rawEnv = envOutput.env;
+                                const ownerUserId = stripInfraPrefix(rawEnv.devEnvOwnerUserId);
+                                const ownerEmail = stripInfraPrefix(rawEnv.devEnvOwnerEmail);
+                                if (!ownerUserId) {
+                                    process.stderr.write('warning: this devenv predates owner-binding; allowing uninstall without role check.\n');
+                                    return;
+                                }
+                                const backendConfig = await loadBackendConfig();
+                                if (!backendConfig.cloud) {
+                                    // No cloud — local-only flow, no role concept. Allow.
+                                    return;
+                                }
+                                const credentials = await getCloudCredentials(backendConfig.cloud.clientId);
+                                if (!credentials) {
+                                    throw new Error('No hereya cloud credentials found. Run `hereya cloud login` to authenticate.');
+                                }
+                                let callerSub;
+                                try {
+                                    callerSub = decodeJwtPayload(credentials.accessToken).sub;
+                                }
+                                catch {
+                                    throw new Error('Could not decode hereya access token. Run `hereya cloud login` to refresh credentials.');
+                                }
+                                if (callerSub === ownerUserId) {
+                                    return; // owner — allow
+                                }
+                                const role = await getCallerRoleInWorkspaceOrg(flags.workspace);
+                                if (role === 'OWNER' || role === 'ADMIN') {
+                                    return; // org admin override — allow
+                                }
+                                const ownerLabel = ownerEmail || ownerUserId;
+                                throw new Error(`This devenv is bound to ${ownerLabel}; only they or an OWNER/ADMIN of the org can uninstall it.`);
+                            },
+                            title: 'Verifying uninstall permissions',
+                        },
                         {
                             async task(ctx) {
                                 const parameters = {

package/dist/lib/devenv-wake.d.ts

@@ -1,13 +1,58 @@
+interface JwtPayload {
+    [key: string]: unknown;
+    email?: string;
+    sub?: string;
+}
+/**
+ * Decode the payload of an HS256 JWT without verifying the signature.
+ *
+ * The CLI uses this to read `sub` (caller userId) and `email` for the
+ * client-side ownership pre-check. Server-side verification still happens at
+ * the cloud (when the CLI calls cloud APIs) and at the wake broker (which
+ * delegates to /api/auth/verify-token).
+ */
+export declare function decodeJwtPayload(token: string): JwtPayload;
+/**
+ * Client-side gate ensuring only the recorded on-behalf-of user can interact
+ * with a devenv (ssh, sleep). The wake broker server-side check is the
+ * authoritative gate; this is a fast UX layer that errors before any network
+ * call.
+ *
+ * Throws on mismatch. Returns silently on owner match. For legacy devenvs (no
+ * `devEnvOwnerUserId` recorded) emits a one-line warning to stderr and allows.
+ */
+export declare function assertDevenvOwner(env: Record<string, string>, accessToken: string): void;
+/**
+ * Resolve the caller's hereya access token from the configured cloud backend.
+ * Returns null when no cloud backend is configured (local-only setup, never
+ * has on-demand devenvs in practice).
+ */
+export declare function getCallerAccessToken(): Promise<null | string>;
 /**
  * Resolve the SSH host to use for a devenv workspace.
  *
- * - On-demand devenvs (devEnvWakeUrl + devEnvWakeToken set): wake the instance
- *   if it's not already running, poll the broker until it reports a public IP,
- *   probe TCP :22 until sshd accepts connections, then return the fresh IP.
+ * - On-demand devenvs (devEnvWakeUrl set): wake the instance if it's not
+ *   already running, poll the broker until it reports a public IP, probe TCP
+ *   :22 until sshd accepts connections, then return the fresh IP.
  * - Always-on devenvs (no wake URL): return the cached devEnvSshHostDns or
  *   devEnvSshHost from workspace env unchanged. No wake, no probe.
  *
+ * Owner gating:
+ *  - `assertDevenvOwner` runs first (errors immediately on non-owner — even
+ *    before checking for the SSH key).
+ *  - If the cloud filtered out `devEnvSshPrivateKey` for the caller, this
+ *    function also throws — defence in depth in case `assertDevenvOwner`
+ *    accidentally passes (e.g. legacy workspace with a stale ownerUserId set
+ *    by a manual edit).
+ *
+ * Wake auth:
+ *  - Fresh installs (devEnvOwnerUserId present): bearer = caller's access
+ *    token. Broker authorizer verifies via `/api/auth/verify-token`.
+ *  - Legacy installs (devEnvOwnerUserId absent, devEnvWakeToken present):
+ *    bearer = `devEnvWakeToken`. Old broker accepts the static secret.
+ *
  * The Listr UI ("Waking dev environment", "Waiting for SSH to accept
  * connections") only renders on the on-demand path.
  */
 export declare function resolveDevenvSshHost(env: Record<string, string>): Promise<string>;
+export {};

package/dist/lib/devenv-wake.js

@@ -1,5 +1,7 @@
 import { Listr } from 'listr2';
+import { Buffer } from 'node:buffer';
 import { Socket } from 'node:net';
+import { getCloudCredentials, loadBackendConfig } from '../backend/config.js';
 // Polling cadence and overall timeout for the wake broker. Overridable via env
 // vars purely to keep tests fast — the defaults are the production values.
 function getWakePollIntervalMs() {
@@ -58,9 +60,87 @@ async function waitForSshReady(host, port, totalTimeoutMs, attemptIntervalMs) {
     }
     throw new Error(`SSH at ${host}:${port} did not accept connections within ${totalTimeoutMs / 1000}s`);
 }
-async function fetchStatus(wakeUrl, wakeToken) {
+/**
+ * Decode the payload of an HS256 JWT without verifying the signature.
+ *
+ * The CLI uses this to read `sub` (caller userId) and `email` for the
+ * client-side ownership pre-check. Server-side verification still happens at
+ * the cloud (when the CLI calls cloud APIs) and at the wake broker (which
+ * delegates to /api/auth/verify-token).
+ */
+export function decodeJwtPayload(token) {
+    const parts = token.split('.');
+    if (parts.length < 2) {
+        throw new Error('malformed access token');
+    }
+    const payloadSegment = parts[1];
+    // base64url decode — Node 20+ supports 'base64url' directly.
+    const json = Buffer.from(payloadSegment, 'base64url').toString('utf8');
+    return JSON.parse(json);
+}
+/**
+ * Client-side gate ensuring only the recorded on-behalf-of user can interact
+ * with a devenv (ssh, sleep). The wake broker server-side check is the
+ * authoritative gate; this is a fast UX layer that errors before any network
+ * call.
+ *
+ * Throws on mismatch. Returns silently on owner match. For legacy devenvs (no
+ * `devEnvOwnerUserId` recorded) emits a one-line warning to stderr and allows.
+ */
+export function assertDevenvOwner(env, accessToken) {
+    const ownerUserId = env.devEnvOwnerUserId;
+    if (!ownerUserId) {
+        if (env.devEnvWakeUrl) {
+            // Phase 2 / 0.94.x on-demand devenv: the install hit the on-behalf-of
+            // endpoint so the baked-in token is some specific user's identity, but
+            // this CLI version didn't yet record `devEnvOwnerUserId` in workspace
+            // env. The legacy warn-and-allow fallback would silently let any
+            // workspace member SSH in as the on-behalf-of user. Refuse instead.
+            throw new Error('This devenv was installed by an older CLI version and is missing its owner binding.\n' +
+                'For security, access is blocked. Ask an OWNER or ADMIN to reinstall:\n' +
+                '  hereya devenv uninstall -w <workspace>\n' +
+                '  hereya devenv install -w <workspace> [--on-behalf-of <email>]');
+        }
+        // True always-on legacy devenv (no wake URL): predates Phase 2 entirely.
+        // The token in the box is the installer's identity, no on-behalf-of
+        // binding to enforce. Warn + allow.
+        process.stderr.write('warning: this devenv predates owner-binding; uninstall + reinstall to enable per-user access.\n');
+        return;
+    }
+    let payload;
+    try {
+        payload = decodeJwtPayload(accessToken);
+    }
+    catch {
+        throw new Error('Could not decode hereya access token. Run `hereya cloud login` to refresh credentials.');
+    }
+    if (payload.sub === ownerUserId) {
+        return;
+    }
+    const ownerLabel = env.devEnvOwnerEmail || ownerUserId;
+    const callerLabel = payload.email ? `as ${payload.email}` : 'as your account';
+    throw new Error(`This devenv is bound to ${ownerLabel}.\n` +
+        `You're signed in ${callerLabel}. Only the owner can connect.\n` +
+        `To re-target the devenv, ask an OWNER or ADMIN to run:\n` +
+        `  hereya devenv uninstall -w <workspace>\n` +
+        `  hereya devenv install -w <workspace> --on-behalf-of <new-email>`);
+}
+/**
+ * Resolve the caller's hereya access token from the configured cloud backend.
+ * Returns null when no cloud backend is configured (local-only setup, never
+ * has on-demand devenvs in practice).
+ */
+export async function getCallerAccessToken() {
+    const backendConfig = await loadBackendConfig();
+    if (!backendConfig.cloud) {
+        return null;
+    }
+    const credentials = await getCloudCredentials(backendConfig.cloud.clientId);
+    return credentials?.accessToken ?? null;
+}
+async function fetchStatus(wakeUrl, authToken) {
     const response = await fetch(`${wakeUrl}/status`, {
-        headers: { Authorization: `Bearer ${wakeToken}` },
+        headers: { Authorization: `Bearer ${authToken}` },
         method: 'GET',
     });
     if (!response.ok) {
@@ -69,9 +149,9 @@ async function fetchStatus(wakeUrl, wakeToken) {
     }
     return response.json();
 }
-async function postWake(wakeUrl, wakeToken) {
+async function postWake(wakeUrl, authToken) {
     const response = await fetch(`${wakeUrl}/wake`, {
-        headers: { Authorization: `Bearer ${wakeToken}` },
+        headers: { Authorization: `Bearer ${authToken}` },
         method: 'POST',
     });
     if (!response.ok) {
@@ -80,7 +160,18 @@ async function postWake(wakeUrl, wakeToken) {
     }
     return response.json();
 }
-async function wakeAndProbe(wakeUrl, wakeToken) {
+/**
+ * Wake the on-demand devenv via the broker and probe sshd readiness.
+ *
+ * `authToken` is whichever bearer the broker accepts:
+ *  - Fresh installs (dev-env-aws ≥ 0.10.0): the caller's hereya access token.
+ *    The broker authorizer Lambda calls `/api/auth/verify-token` on hereya-cloud
+ *    and compares the verified userId to its OWNER_USER_ID env.
+ *  - Legacy installs (dev-env-aws ≤ 0.9.x): the static `devEnvWakeToken`
+ *    Secrets Manager secret. Detected by `resolveDevenvSshHost` via the
+ *    absence of `devEnvOwnerUserId` in workspace env.
+ */
+async function wakeAndProbe(wakeUrl, authToken) {
     const pollIntervalMs = getWakePollIntervalMs();
     const timeoutMs = getWakeTimeoutMs();
     const sshReadyTimeoutMs = getSshReadyTimeoutMs();
@@ -88,12 +179,12 @@ async function wakeAndProbe(wakeUrl, wakeToken) {
     const task = new Listr([
         {
             async task(ctx) {
-                const initial = await fetchStatus(wakeUrl, wakeToken);
+                const initial = await fetchStatus(wakeUrl, authToken);
                 if (initial.state === 'running' && initial.host) {
                     ctx.host = initial.host;
                     return;
                 }
-                await postWake(wakeUrl, wakeToken);
+                await postWake(wakeUrl, authToken);
                 const start = Date.now();
                 let done = false;
                 while (!done) {
@@ -103,7 +194,7 @@ async function wakeAndProbe(wakeUrl, wakeToken) {
                     // eslint-disable-next-line no-await-in-loop
                     await sleep(pollIntervalMs);
                     // eslint-disable-next-line no-await-in-loop
-                    const status = await fetchStatus(wakeUrl, wakeToken);
+                    const status = await fetchStatus(wakeUrl, authToken);
                     if (status.state === 'running' && status.host) {
                         ctx.host = status.host;
                         done = true;
@@ -129,20 +220,67 @@ async function wakeAndProbe(wakeUrl, wakeToken) {
 /**
  * Resolve the SSH host to use for a devenv workspace.
  *
- * - On-demand devenvs (devEnvWakeUrl + devEnvWakeToken set): wake the instance
- *   if it's not already running, poll the broker until it reports a public IP,
- *   probe TCP :22 until sshd accepts connections, then return the fresh IP.
+ * - On-demand devenvs (devEnvWakeUrl set): wake the instance if it's not
+ *   already running, poll the broker until it reports a public IP, probe TCP
+ *   :22 until sshd accepts connections, then return the fresh IP.
  * - Always-on devenvs (no wake URL): return the cached devEnvSshHostDns or
  *   devEnvSshHost from workspace env unchanged. No wake, no probe.
  *
+ * Owner gating:
+ *  - `assertDevenvOwner` runs first (errors immediately on non-owner — even
+ *    before checking for the SSH key).
+ *  - If the cloud filtered out `devEnvSshPrivateKey` for the caller, this
+ *    function also throws — defence in depth in case `assertDevenvOwner`
+ *    accidentally passes (e.g. legacy workspace with a stale ownerUserId set
+ *    by a manual edit).
+ *
+ * Wake auth:
+ *  - Fresh installs (devEnvOwnerUserId present): bearer = caller's access
+ *    token. Broker authorizer verifies via `/api/auth/verify-token`.
+ *  - Legacy installs (devEnvOwnerUserId absent, devEnvWakeToken present):
+ *    bearer = `devEnvWakeToken`. Old broker accepts the static secret.
+ *
  * The Listr UI ("Waking dev environment", "Waiting for SSH to accept
  * connections") only renders on the on-demand path.
  */
 export async function resolveDevenvSshHost(env) {
     const wakeUrl = env.devEnvWakeUrl;
-    const wakeToken = env.devEnvWakeToken;
-    if (wakeUrl && wakeToken) {
-        return wakeAndProbe(wakeUrl, wakeToken);
+    if (wakeUrl) {
+        const accessToken = await getCallerAccessToken();
+        const isLegacy = !env.devEnvOwnerUserId;
+        // Fresh installs (devEnvOwnerUserId present) require a hereya access
+        // token: the broker authorizer verifies it against /api/auth/verify-token
+        // and the client-side gate compares its `sub` to the recorded owner.
+        if (!isLegacy && !accessToken) {
+            throw new Error('No hereya cloud credentials found. Run `hereya cloud login` to authenticate.');
+        }
+        // Client-side owner gate. Throws on mismatch, warns on legacy. Skipped
+        // when there's no accessToken AND the workspace is legacy — the legacy
+        // path uses the static wake token and predates owner binding entirely.
+        if (accessToken) {
+            assertDevenvOwner(env, accessToken);
+        }
+        // Defence in depth: if the cloud filtered out the SSH private key for a
+        // non-owner, the assertDevenvOwner check would also have failed in normal
+        // operation. But if a stale local cache or manual edit somehow lands us
+        // here without the key, fail with the same friendly message instead of
+        // letting ssh later die with a confusing error. Skipped on legacy
+        // workspaces where the cloud doesn't filter (no `devEnvOwnerUserId` set).
+        if (!isLegacy && !env.devEnvSshPrivateKey) {
+            const ownerLabel = env.devEnvOwnerEmail || env.devEnvOwnerUserId || 'someone else';
+            throw new Error(`This devenv is bound to ${ownerLabel}; the SSH private key was not provided to your account. ` +
+                `Only the owner can connect.`);
+        }
+        // Auth-token selection: prefer access token (fresh install). Fall back to
+        // the static wake token only when the workspace env lacks the new
+        // `devEnvOwnerUserId` AND has a legacy `devEnvWakeToken` (dev-env-aws
+        // 0.9.x). This makes pre-Phase-3 devenvs continue to work until they're
+        // reinstalled.
+        const authToken = isLegacy ? env.devEnvWakeToken : accessToken;
+        if (!authToken) {
+            throw new Error('devEnvWakeToken must be set for legacy devenvs without devEnvOwnerUserId');
+        }
+        return wakeAndProbe(wakeUrl, authToken);
     }
     const cachedDns = env.devEnvSshHostDns;
     const cachedHost = env.devEnvSshHost;

package/dist/lib/hereya-token.d.ts

@@ -13,6 +13,7 @@ export declare const hereyaTokenUtils: {
     }): Promise<null | {
         cloudUrl: string;
         ownerEmail: string;
+        ownerUserId: string;
         token: string;
     }>;
     /**

package/dist/lib/hereya-token.js

@@ -46,7 +46,12 @@ export const hereyaTokenUtils = {
             throw new Error(`Failed to generate Hereya token (HTTP ${response.status}): ${detail}`);
         }
         const result = (await response.json());
-        return { cloudUrl: url, ownerEmail: result.ownerEmail, token: result.token };
+        return {
+            cloudUrl: url,
+            ownerEmail: result.ownerEmail,
+            ownerUserId: result.ownerUserId,
+            token: result.token,
+        };
     },
     /**
      * Issue a plain personal Hereya token via POST /api/personal-tokens.

package/oclif.manifest.json

@@ -688,6 +688,30 @@
         "index.js"
       ]
     },
+    "logout": {
+      "aliases": [],
+      "args": {},
+      "description": "Logout from Hereya Cloud",
+      "examples": [
+        "<%= config.bin %> <%= command.id %>"
+      ],
+      "flags": {},
+      "hasDynamicHelp": false,
+      "hiddenAliases": [],
+      "id": "logout",
+      "pluginAlias": "hereya-cli",
+      "pluginName": "hereya-cli",
+      "pluginType": "core",
+      "strict": true,
+      "enableJsonFlag": false,
+      "isESM": true,
+      "relativePath": [
+        "dist",
+        "commands",
+        "logout",
+        "index.js"
+      ]
+    },
     "login": {
       "aliases": [],
       "args": {
@@ -732,30 +756,6 @@
         "index.js"
       ]
     },
-    "logout": {
-      "aliases": [],
-      "args": {},
-      "description": "Logout from Hereya Cloud",
-      "examples": [
-        "<%= config.bin %> <%= command.id %>"
-      ],
-      "flags": {},
-      "hasDynamicHelp": false,
-      "hiddenAliases": [],
-      "id": "logout",
-      "pluginAlias": "hereya-cli",
-      "pluginName": "hereya-cli",
-      "pluginType": "core",
-      "strict": true,
-      "enableJsonFlag": false,
-      "isESM": true,
-      "relativePath": [
-        "dist",
-        "commands",
-        "logout",
-        "index.js"
-      ]
-    },
     "provid": {
       "aliases": [],
       "args": {
@@ -1490,33 +1490,24 @@
         "index.js"
       ]
     },
-    "app:new": {
+    "app:status": {
       "aliases": [],
       "args": {
-        "dirname": {
-          "description": "directory to create the app skeleton in",
-          "name": "dirname",
+        "name": {
+          "description": "app name in org/name format",
+          "name": "name",
           "required": true
         }
       },
-      "description": "Scaffold a new hereya-app directory with starter hereyarc.yaml + hereya.yaml.",
+      "description": "Show the deployment status of a hereya-app on a workspace.",
       "examples": [
-        "<%= config.bin %> <%= command.id %> ./my-app -n my-org/my-app",
-        "<%= config.bin %> <%= command.id %> ./my-app -n my-org/my-app --description \"An ai-app-builder app\""
+        "<%= config.bin %> <%= command.id %> my-org/my-app -w my-workspace"
       ],
       "flags": {
-        "description": {
-          "description": "description of the app",
-          "name": "description",
-          "required": false,
-          "hasDynamicHelp": false,
-          "multiple": false,
-          "type": "option"
-        },
-        "name": {
-          "char": "n",
-          "description": "app name in org/name format (e.g. my-org/my-app)",
-          "name": "name",
+        "workspace": {
+          "char": "w",
+          "description": "workspace to read deployment status from",
+          "name": "workspace",
           "required": true,
           "hasDynamicHelp": false,
           "multiple": false,
@@ -1525,7 +1516,7 @@
       },
       "hasDynamicHelp": false,
       "hiddenAliases": [],
-      "id": "app:new",
+      "id": "app:status",
       "pluginAlias": "hereya-cli",
       "pluginName": "hereya-cli",
       "pluginType": "core",
@@ -1536,28 +1527,37 @@
         "dist",
         "commands",
         "app",
-        "new",
+        "status",
         "index.js"
       ]
     },
-    "app:status": {
+    "app:new": {
       "aliases": [],
       "args": {
-        "name": {
-          "description": "app name in org/name format",
-          "name": "name",
+        "dirname": {
+          "description": "directory to create the app skeleton in",
+          "name": "dirname",
           "required": true
         }
       },
-      "description": "Show the deployment status of a hereya-app on a workspace.",
+      "description": "Scaffold a new hereya-app directory with starter hereyarc.yaml + hereya.yaml.",
       "examples": [
-        "<%= config.bin %> <%= command.id %> my-org/my-app -w my-workspace"
+        "<%= config.bin %> <%= command.id %> ./my-app -n my-org/my-app",
+        "<%= config.bin %> <%= command.id %> ./my-app -n my-org/my-app --description \"An ai-app-builder app\""
       ],
       "flags": {
-        "workspace": {
-          "char": "w",
-          "description": "workspace to read deployment status from",
-          "name": "workspace",
+        "description": {
+          "description": "description of the app",
+          "name": "description",
+          "required": false,
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "name": {
+          "char": "n",
+          "description": "app name in org/name format (e.g. my-org/my-app)",
+          "name": "name",
           "required": true,
           "hasDynamicHelp": false,
           "multiple": false,
@@ -1566,7 +1566,7 @@
       },
       "hasDynamicHelp": false,
       "hiddenAliases": [],
-      "id": "app:status",
+      "id": "app:new",
       "pluginAlias": "hereya-cli",
       "pluginName": "hereya-cli",
       "pluginType": "core",
@@ -1577,7 +1577,7 @@
         "dist",
         "commands",
         "app",
-        "status",
+        "new",
         "index.js"
       ]
     },
@@ -3369,5 +3369,5 @@
       ]
     }
   },
-  "version": "0.94.1"
+  "version": "0.95.1"
 }

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "hereya-cli",
   "description": "Infrastructure as Package",
-  "version": "0.94.1",
+  "version": "0.95.1",
   "author": "Hereya Developers",
   "bin": {
     "hereya": "./bin/run.js"