hereya-cli 0.85.6 → 0.86.1

package/dist/backend/index.js

@@ -1,4 +1,5 @@
 import { getAwsConfig } from '../infrastructure/aws-config.js';
+import { getEphemeralToken } from '../lib/ephemeral-token.js';
 import { CloudBackend } from './cloud/cloud-backend.js';
 import { loginWithToken, refreshToken } from './cloud/login.js';
 import { getCloudCredentials, loadBackendConfig, saveCloudCredentials } from './config.js';
@@ -66,6 +67,29 @@ export async function getBackend(typeOrOptions) {
     if (backend) {
         return backend;
     }
+    // Ephemeral, in-memory-only token (typically set via the --token flag or by
+    // an embedding integration). We use the supplied token directly as the
+    // bearer for cloud API calls and explicitly do NOT exchange it via
+    // `loginWithToken` — that would mint a long-lived refresh token and we
+    // want this code path to never persist anything to disk or the keychain.
+    const ephemeral = getEphemeralToken();
+    if (ephemeral) {
+        const url = ephemeral.cloudUrl
+            ?? process.env.HEREYA_CLOUD_URL
+            ?? (await loadBackendConfig()).cloud?.url
+            ?? 'https://cloud.hereya.dev';
+        backend = new CloudBackend({
+            accessToken: ephemeral.token,
+            // We have no client/refresh identity for an ephemeral token. Use empty
+            // strings — the CloudBackend never uses these for the request bearer
+            // (it only uses accessToken), and we never call refreshToken() in this
+            // mode.
+            clientId: '',
+            refreshToken: '',
+            url,
+        });
+        return backend;
+    }
     // Handle token-based auth
     if (typeOrOptions && typeof typeOrOptions === 'object' && typeOrOptions.token) {
         const url = typeOrOptions.url || 'https://cloud.hereya.dev';

package/dist/commands/app/deploy/index.d.ts

@@ -9,10 +9,12 @@ export default class AppDeploy extends Command {
         chdir: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
         local: import("@oclif/core/interfaces").BooleanFlag<boolean>;
         parameter: import("@oclif/core/interfaces").OptionFlag<string[], import("@oclif/core/interfaces").CustomOptions>;
+        token: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
         version: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
         workspace: import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
     };
     run(): Promise<void>;
+    private runInner;
     private runLocal;
     private runRemote;
 }

package/dist/commands/app/deploy/index.js

@@ -8,6 +8,8 @@ import { getBackend } from '../../../backend/index.js';
 import { LocalExecutor } from '../../../executor/local.js';
 import { resolveAndSubstituteAppParams, resolveAppParameters } from '../../../lib/app-parameters.js';
 import { getEnvManager } from '../../../lib/env/index.js';
+import { withEphemeralToken } from '../../../lib/ephemeral-token.js';
+import { getDefaultLogger } from '../../../lib/log.js';
 import { arrayOfStringToObject } from '../../../lib/object-utils.js';
 import { stripOrgPrefix } from '../../../lib/org-utils.js';
 import { getProfileFromWorkspace } from '../../../lib/profile-utils.js';
@@ -88,6 +90,10 @@ export default class AppDeploy extends Command {
             description: 'parameter for the app deployment, in the form of key=value (repeatable)',
             multiple: true,
         }),
+        token: Flags.string({
+            description: 'Ephemeral cloud access token used for this invocation only. Held in memory; never written to the keychain or `~/.hereya/secrets/`. Takes precedence over the HEREYA_TOKEN environment variable.',
+            required: false,
+        }),
         version: Flags.string({
             description: 'specific app version to deploy (defaults to latest)',
         }),
@@ -98,6 +104,17 @@ export default class AppDeploy extends Command {
         }),
     };
     async run() {
+        const { flags } = await this.parse(AppDeploy);
+        // Precedence: --token flag > HEREYA_TOKEN env var > keychain.
+        if (flags.token) {
+            if (process.env.HEREYA_TOKEN) {
+                getDefaultLogger().debug('[app deploy] --token flag overrides HEREYA_TOKEN environment variable.');
+            }
+            return withEphemeralToken(flags.token, () => this.runInner());
+        }
+        return this.runInner();
+    }
+    async runInner() {
         const { args, flags } = await this.parse(AppDeploy);
         const forceLocal = flags.local || process.env.HEREYA_LOCAL_EXECUTION === 'true';
         if (forceLocal) {

package/dist/commands/app/deployments/index.d.ts

@@ -5,5 +5,9 @@ export default class AppDeployments extends Command {
     };
     static description: string;
     static examples: string[];
+    static flags: {
+        token: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+    };
     run(): Promise<void>;
+    private runInner;
 }

package/dist/commands/app/deployments/index.js

@@ -1,13 +1,32 @@
-import { Args, Command } from '@oclif/core';
+import { Args, Command, Flags } from '@oclif/core';
 import { CloudBackend } from '../../../backend/cloud/cloud-backend.js';
 import { getBackend } from '../../../backend/index.js';
+import { withEphemeralToken } from '../../../lib/ephemeral-token.js';
+import { getDefaultLogger } from '../../../lib/log.js';
 export default class AppDeployments extends Command {
     static args = {
         name: Args.string({ description: 'app name in org/name format', required: true }),
     };
     static description = 'List workspaces a hereya-app has been deployed to.';
     static examples = ['<%= config.bin %> <%= command.id %> my-org/my-app'];
+    static flags = {
+        token: Flags.string({
+            description: 'Ephemeral cloud access token used for this invocation only. Held in memory; never written to the keychain or `~/.hereya/secrets/`. Takes precedence over the HEREYA_TOKEN environment variable.',
+            required: false,
+        }),
+    };
     async run() {
+        const { flags } = await this.parse(AppDeployments);
+        // Precedence: --token flag > HEREYA_TOKEN env var > keychain.
+        if (flags.token) {
+            if (process.env.HEREYA_TOKEN) {
+                getDefaultLogger().debug('[app deployments] --token flag overrides HEREYA_TOKEN environment variable.');
+            }
+            return withEphemeralToken(flags.token, () => this.runInner());
+        }
+        return this.runInner();
+    }
+    async runInner() {
         const { args } = await this.parse(AppDeployments);
         const backend = await getBackend();
         if (!(backend instanceof CloudBackend)) {

package/dist/commands/app/destroy/index.d.ts

@@ -9,9 +9,11 @@ export default class AppDestroy extends Command {
         chdir: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
         local: import("@oclif/core/interfaces").BooleanFlag<boolean>;
         parameter: import("@oclif/core/interfaces").OptionFlag<string[], import("@oclif/core/interfaces").CustomOptions>;
+        token: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
         workspace: import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
     };
     run(): Promise<void>;
+    private runInner;
     private runLocal;
     private runRemote;
 }

package/dist/commands/app/destroy/index.js

@@ -8,6 +8,8 @@ import { getBackend } from '../../../backend/index.js';
 import { LocalExecutor } from '../../../executor/local.js';
 import { resolveAndSubstituteAppParams } from '../../../lib/app-parameters.js';
 import { getEnvManager } from '../../../lib/env/index.js';
+import { withEphemeralToken } from '../../../lib/ephemeral-token.js';
+import { getDefaultLogger } from '../../../lib/log.js';
 import { arrayOfStringToObject } from '../../../lib/object-utils.js';
 import { stripOrgPrefix } from '../../../lib/org-utils.js';
 import { getProfileFromWorkspace } from '../../../lib/profile-utils.js';
@@ -76,6 +78,10 @@ export default class AppDestroy extends Command {
             description: 'parameter for the app deployment, in the form of key=value (repeatable)',
             multiple: true,
         }),
+        token: Flags.string({
+            description: 'Ephemeral cloud access token used for this invocation only. Held in memory; never written to the keychain or `~/.hereya/secrets/`. Takes precedence over the HEREYA_TOKEN environment variable.',
+            required: false,
+        }),
         workspace: Flags.string({
             char: 'w',
             description: 'workspace where the app is currently deployed',
@@ -83,6 +89,17 @@ export default class AppDestroy extends Command {
         }),
     };
     async run() {
+        const { flags } = await this.parse(AppDestroy);
+        // Precedence: --token flag > HEREYA_TOKEN env var > keychain.
+        if (flags.token) {
+            if (process.env.HEREYA_TOKEN) {
+                getDefaultLogger().debug('[app destroy] --token flag overrides HEREYA_TOKEN environment variable.');
+            }
+            return withEphemeralToken(flags.token, () => this.runInner());
+        }
+        return this.runInner();
+    }
+    async runInner() {
         const { args, flags } = await this.parse(AppDestroy);
         const forceLocal = flags.local || process.env.HEREYA_LOCAL_EXECUTION === 'true';
         if (forceLocal) {

package/dist/commands/app/env/index.d.ts

@@ -7,7 +7,9 @@ export default class AppEnv extends Command {
     static description: string;
     static examples: string[];
     static flags: {
+        token: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
         workspace: import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
     };
     run(): Promise<void>;
+    private runInner;
 }

package/dist/commands/app/env/index.js

@@ -1,6 +1,8 @@
 import { Args, Command, Flags } from '@oclif/core';
 import { CloudBackend } from '../../../backend/cloud/cloud-backend.js';
 import { getBackend } from '../../../backend/index.js';
+import { withEphemeralToken } from '../../../lib/ephemeral-token.js';
+import { getDefaultLogger } from '../../../lib/log.js';
 export default class AppEnv extends Command {
     static args = {
         name: Args.string({ description: 'app name in org/name format', required: true }),
@@ -13,6 +15,10 @@ export default class AppEnv extends Command {
         '<%= config.bin %> <%= command.id %> my-org/my-app -w my-workspace DATABASE_URL',
     ];
     static flags = {
+        token: Flags.string({
+            description: 'Ephemeral cloud access token used for this invocation only. Held in memory; never written to the keychain or `~/.hereya/secrets/`. Takes precedence over the HEREYA_TOKEN environment variable.',
+            required: false,
+        }),
         workspace: Flags.string({
             char: 'w',
             description: 'workspace to read env outputs from',
@@ -20,6 +26,17 @@ export default class AppEnv extends Command {
         }),
     };
     async run() {
+        const { flags } = await this.parse(AppEnv);
+        // Precedence: --token flag > HEREYA_TOKEN env var > keychain.
+        if (flags.token) {
+            if (process.env.HEREYA_TOKEN) {
+                getDefaultLogger().debug('[app env] --token flag overrides HEREYA_TOKEN environment variable.');
+            }
+            return withEphemeralToken(flags.token, () => this.runInner());
+        }
+        return this.runInner();
+    }
+    async runInner() {
         const { args, flags } = await this.parse(AppEnv);
         const backend = await getBackend();
         if (!(backend instanceof CloudBackend)) {

package/dist/commands/app/list/index.d.ts

@@ -2,5 +2,9 @@ import { Command } from '@oclif/core';
 export default class AppList extends Command {
     static description: string;
     static examples: string[];
+    static flags: {
+        token: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+    };
     run(): Promise<void>;
+    private runInner;
 }

package/dist/commands/app/list/index.js

@@ -1,10 +1,29 @@
-import { Command } from '@oclif/core';
+import { Command, Flags } from '@oclif/core';
 import { CloudBackend } from '../../../backend/cloud/cloud-backend.js';
 import { getBackend } from '../../../backend/index.js';
+import { withEphemeralToken } from '../../../lib/ephemeral-token.js';
+import { getDefaultLogger } from '../../../lib/log.js';
 export default class AppList extends Command {
     static description = 'List hereya-apps available to your account.';
     static examples = ['<%= config.bin %> <%= command.id %>'];
+    static flags = {
+        token: Flags.string({
+            description: 'Ephemeral cloud access token used for this invocation only. Held in memory; never written to the keychain or `~/.hereya/secrets/`. Takes precedence over the HEREYA_TOKEN environment variable.',
+            required: false,
+        }),
+    };
     async run() {
+        const { flags } = await this.parse(AppList);
+        // Precedence: --token flag > HEREYA_TOKEN env var > keychain.
+        if (flags.token) {
+            if (process.env.HEREYA_TOKEN) {
+                getDefaultLogger().debug('[app list] --token flag overrides HEREYA_TOKEN environment variable.');
+            }
+            return withEphemeralToken(flags.token, () => this.runInner());
+        }
+        return this.runInner();
+    }
+    async runInner() {
         const backend = await getBackend();
         if (!(backend instanceof CloudBackend)) {
             this.error('Listing apps requires the cloud backend. Run `hereya login` first.');

package/dist/commands/app/status/index.d.ts

@@ -6,7 +6,9 @@ export default class AppStatus extends Command {
     static description: string;
     static examples: string[];
     static flags: {
+        token: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
         workspace: import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
     };
     run(): Promise<void>;
+    private runInner;
 }

package/dist/commands/app/status/index.js

@@ -1,6 +1,8 @@
 import { Args, Command, Flags } from '@oclif/core';
 import { CloudBackend } from '../../../backend/cloud/cloud-backend.js';
 import { getBackend } from '../../../backend/index.js';
+import { withEphemeralToken } from '../../../lib/ephemeral-token.js';
+import { getDefaultLogger } from '../../../lib/log.js';
 export default class AppStatus extends Command {
     static args = {
         name: Args.string({ description: 'app name in org/name format', required: true }),
@@ -8,6 +10,10 @@ export default class AppStatus extends Command {
     static description = 'Show the deployment status of a hereya-app on a workspace.';
     static examples = ['<%= config.bin %> <%= command.id %> my-org/my-app -w my-workspace'];
     static flags = {
+        token: Flags.string({
+            description: 'Ephemeral cloud access token used for this invocation only. Held in memory; never written to the keychain or `~/.hereya/secrets/`. Takes precedence over the HEREYA_TOKEN environment variable.',
+            required: false,
+        }),
         workspace: Flags.string({
             char: 'w',
             description: 'workspace to read deployment status from',
@@ -15,6 +21,17 @@ export default class AppStatus extends Command {
         }),
     };
     async run() {
+        const { flags } = await this.parse(AppStatus);
+        // Precedence: --token flag > HEREYA_TOKEN env var > keychain.
+        if (flags.token) {
+            if (process.env.HEREYA_TOKEN) {
+                getDefaultLogger().debug('[app status] --token flag overrides HEREYA_TOKEN environment variable.');
+            }
+            return withEphemeralToken(flags.token, () => this.runInner());
+        }
+        return this.runInner();
+    }
+    async runInner() {
         const { args, flags } = await this.parse(AppStatus);
         const backend = await getBackend();
         if (!(backend instanceof CloudBackend)) {

package/dist/commands/deploy/index.d.ts

@@ -6,8 +6,10 @@ export default class Deploy extends Command {
         chdir: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
         debug: import("@oclif/core/interfaces").BooleanFlag<boolean>;
         local: import("@oclif/core/interfaces").BooleanFlag<boolean>;
+        token: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
         workspace: import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
     };
     run(): Promise<void>;
     private deployRemotely;
+    private runInner;
 }

package/dist/commands/deploy/index.js

@@ -7,8 +7,9 @@ import { getBackend } from '../../backend/index.js';
 import { getExecutor } from '../../executor/index.js';
 import { getConfigManager } from '../../lib/config/index.js';
 import { getEnvManager } from '../../lib/env/index.js';
+import { getEphemeralToken, withEphemeralToken } from '../../lib/ephemeral-token.js';
 import { gitUtils } from '../../lib/git-utils.js';
-import { getLogger, getLogPath, isDebug, setDebug } from '../../lib/log.js';
+import { getDefaultLogger, getLogger, getLogPath, isDebug, setDebug } from '../../lib/log.js';
 import { getParameterManager } from '../../lib/parameter/index.js';
 import { getProfileFromWorkspace } from '../../lib/profile-utils.js';
 import { pollExecutorJob } from '../../lib/remote-job-utils.js';
@@ -35,6 +36,10 @@ export default class Deploy extends Command {
             default: false,
             description: 'force local execution (skip remote executor)',
         }),
+        token: Flags.string({
+            description: 'Ephemeral cloud access token used for this invocation only. Held in memory; never written to the keychain or `~/.hereya/secrets/`. Takes precedence over the HEREYA_TOKEN environment variable.',
+            required: false,
+        }),
         workspace: Flags.string({
             char: 'w',
             description: 'name of the workspace to deploy the packages for',
@@ -42,6 +47,90 @@ export default class Deploy extends Command {
         }),
     };
     async run() {
+        const { flags } = await this.parse(Deploy);
+        // Precedence: --token flag > HEREYA_TOKEN env var > keychain.
+        if (flags.token) {
+            if (process.env.HEREYA_TOKEN) {
+                getDefaultLogger().debug('[deploy] --token flag overrides HEREYA_TOKEN environment variable.');
+            }
+            return withEphemeralToken(flags.token, () => this.runInner());
+        }
+        return this.runInner();
+    }
+    async deployRemotely(input) {
+        const myLogger = new ListrLogger({ useIcons: false });
+        // 1. Ensure clean working tree
+        const cleanCheck = await gitUtils.ensureCleanAndPushed({ cwd: input.projectRootDir });
+        if (!cleanCheck.clean) {
+            this.error(cleanCheck.reason);
+        }
+        myLogger.log(ListrLogLevels.STARTED, `Deploying to ${input.workspace} via remote executor (branch: ${input.gitBranch})`);
+        // 2. Get cloud backend for job submission. If we are inside an ephemeral
+        // token scope (set by --token), use that token directly without touching
+        // the keychain or persisted credentials. Otherwise fall back to the
+        // standard "load credentials from disk + keychain" path.
+        const ephemeral = getEphemeralToken();
+        const resolvedWorkspaceName = resolveWorkspaceName(input.workspace, input.project);
+        let cloudBackend;
+        if (ephemeral) {
+            const url = ephemeral.cloudUrl
+                ?? process.env.HEREYA_CLOUD_URL
+                ?? (await loadBackendConfig()).cloud?.url
+                ?? 'https://cloud.hereya.dev';
+            cloudBackend = new CloudBackend({
+                accessToken: ephemeral.token,
+                clientId: '',
+                refreshToken: '',
+                url,
+            });
+        }
+        else {
+            const backendConfig = await loadBackendConfig();
+            if (!backendConfig.cloud) {
+                this.error('Remote deployment requires cloud backend. Run `hereya login` first.');
+            }
+            const credentials = await getCloudCredentials(backendConfig.cloud.clientId);
+            if (!credentials) {
+                this.error('Cloud credentials not found. Run `hereya login` first.');
+            }
+            cloudBackend = new CloudBackend({
+                accessToken: credentials.accessToken,
+                clientId: backendConfig.cloud.clientId,
+                refreshToken: credentials.refreshToken,
+                url: backendConfig.cloud.url,
+            });
+        }
+        // 3. Submit deploy job
+        const submitResult = await cloudBackend.submitExecutorJob({
+            payload: {
+                gitBranch: input.gitBranch,
+                project: input.project,
+                workspace: input.workspace,
+            },
+            type: 'deploy',
+            workspace: resolvedWorkspaceName,
+        });
+        if (!submitResult.success) {
+            this.error(`Failed to submit remote deploy job: ${submitResult.reason}`);
+        }
+        // 4. Poll for results
+        const logger = {
+            debug: (msg) => myLogger.log(ListrLogLevels.OUTPUT, msg),
+            error: (msg) => myLogger.log(ListrLogLevels.OUTPUT, msg),
+            info: (msg) => myLogger.log(ListrLogLevels.OUTPUT, msg),
+        };
+        const pollResult = await pollExecutorJob({
+            cloudBackend,
+            jobId: submitResult.jobId,
+            logger,
+            workspace: resolvedWorkspaceName,
+        });
+        if (!pollResult.success) {
+            this.error(pollResult.reason);
+        }
+        myLogger.log(ListrLogLevels.COMPLETED, 'Remote deployment completed successfully');
+    }
+    async runInner() {
         const { flags } = await this.parse(Deploy);
         setDebug(flags.debug);
         const projectRootDir = path.resolve(flags.chdir || process.env.HEREYA_PROJECT_ROOT_DIR || process.cwd());
@@ -454,58 +543,4 @@ export default class Deploy extends Command {
 See ${getLogPath()} for more details`);
         }
     }
-    async deployRemotely(input) {
-        const myLogger = new ListrLogger({ useIcons: false });
-        // 1. Ensure clean working tree
-        const cleanCheck = await gitUtils.ensureCleanAndPushed({ cwd: input.projectRootDir });
-        if (!cleanCheck.clean) {
-            this.error(cleanCheck.reason);
-        }
-        myLogger.log(ListrLogLevels.STARTED, `Deploying to ${input.workspace} via remote executor (branch: ${input.gitBranch})`);
-        // 2. Get cloud backend for job submission
-        const backendConfig = await loadBackendConfig();
-        if (!backendConfig.cloud) {
-            this.error('Remote deployment requires cloud backend. Run `hereya login` first.');
-        }
-        const credentials = await getCloudCredentials(backendConfig.cloud.clientId);
-        if (!credentials) {
-            this.error('Cloud credentials not found. Run `hereya login` first.');
-        }
-        const resolvedWorkspaceName = resolveWorkspaceName(input.workspace, input.project);
-        const cloudBackend = new CloudBackend({
-            accessToken: credentials.accessToken,
-            clientId: backendConfig.cloud.clientId,
-            refreshToken: credentials.refreshToken,
-            url: backendConfig.cloud.url,
-        });
-        // 3. Submit deploy job
-        const submitResult = await cloudBackend.submitExecutorJob({
-            payload: {
-                gitBranch: input.gitBranch,
-                project: input.project,
-                workspace: input.workspace,
-            },
-            type: 'deploy',
-            workspace: resolvedWorkspaceName,
-        });
-        if (!submitResult.success) {
-            this.error(`Failed to submit remote deploy job: ${submitResult.reason}`);
-        }
-        // 4. Poll for results
-        const logger = {
-            debug: (msg) => myLogger.log(ListrLogLevels.OUTPUT, msg),
-            error: (msg) => myLogger.log(ListrLogLevels.OUTPUT, msg),
-            info: (msg) => myLogger.log(ListrLogLevels.OUTPUT, msg),
-        };
-        const pollResult = await pollExecutorJob({
-            cloudBackend,
-            jobId: submitResult.jobId,
-            logger,
-            workspace: resolvedWorkspaceName,
-        });
-        if (!pollResult.success) {
-            this.error(pollResult.reason);
-        }
-        myLogger.log(ListrLogLevels.COMPLETED, 'Remote deployment completed successfully');
-    }
 }

package/dist/commands/init/index.d.ts

@@ -10,7 +10,9 @@ export default class Init extends Command {
         'deploy-workspace': import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
         parameter: import("@oclif/core/interfaces").OptionFlag<string[], import("@oclif/core/interfaces").CustomOptions>;
         template: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        token: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
         workspace: import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
     };
     run(): Promise<void>;
+    private runInner;
 }

package/dist/commands/init/index.js

@@ -5,9 +5,10 @@ import path from 'node:path';
 import { getBackend } from '../../backend/index.js';
 import { getExecutorForWorkspace } from '../../executor/context.js';
 import { getConfigManager } from '../../lib/config/index.js';
+import { withEphemeralToken } from '../../lib/ephemeral-token.js';
 import { gitUtils } from '../../lib/git-utils.js';
 import { hereyaTokenUtils } from '../../lib/hereya-token.js';
-import { getLogger, getLogPath } from '../../lib/log.js';
+import { getDefaultLogger, getLogger, getLogPath } from '../../lib/log.js';
 import { arrayOfStringToObject } from '../../lib/object-utils.js';
 export default class Init extends Command {
     static args = {
@@ -41,6 +42,10 @@ export default class Init extends Command {
             description: 'template package name (e.g. owner/repo)',
             required: false,
         }),
+        token: Flags.string({
+            description: 'Ephemeral cloud access token used for this invocation only. Held in memory; never written to the keychain or `~/.hereya/secrets/`. Takes precedence over the HEREYA_TOKEN environment variable.',
+            required: false,
+        }),
         workspace: Flags.string({
             char: 'w',
             description: 'workspace to set as default',
@@ -48,6 +53,18 @@ export default class Init extends Command {
         }),
     };
     async run() {
+        const { flags } = await this.parse(Init);
+        // Precedence: --token flag > HEREYA_TOKEN env var > keychain.
+        // The flag wins; emit a debug log if both are present.
+        if (flags.token) {
+            if (process.env.HEREYA_TOKEN) {
+                getDefaultLogger().debug('[init] --token flag overrides HEREYA_TOKEN environment variable.');
+            }
+            return withEphemeralToken(flags.token, () => this.runInner());
+        }
+        return this.runInner();
+    }
+    async runInner() {
         const { args, flags } = await this.parse(Init);
         const projectRootDir = flags.chdir || process.env.HEREYA_PROJECT_ROOT_DIR;
         // Template flow

package/dist/commands/login/index.js

@@ -17,6 +17,11 @@ export default class Login extends Command {
         '$ hereya login --token=your-token https://cloud.hereya.dev',
     ];
     static flags = {
+        // NOTE: `login --token` intentionally exchanges the supplied token for a
+        // long-lived refresh token via `loginWithToken` and PERSISTS the result
+        // to the keychain / `~/.hereya/secrets/`. This is the right behavior for
+        // an explicit `login` step. Other commands accept a `--token` flag with
+        // ephemeral, in-memory-only semantics (see `withEphemeralToken`).
         token: Flags.string({
             char: 't',
             description: 'Token to use for login',

package/dist/commands/publish/index.d.ts

@@ -19,6 +19,7 @@ export default class Publish extends Command {
     static examples: string[];
     static flags: {
         chdir: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        token: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
     };
     calculateGitArchiveSha256(packageDir: string): Promise<string>;
     displayPublishError(reason: string, config: HereyarcConfig): void;
@@ -30,6 +31,7 @@ export default class Publish extends Command {
     loadConfig(packageDir: string): Promise<HereyarcConfig>;
     loadReadme(packageDir: string): string | undefined;
     run(): Promise<void>;
+    runInner(): Promise<void>;
     validateAppParameters(rawParameters: unknown): Record<string, IParameterSpec>;
     validateConfig(config: HereyarcConfig): void;
     private publishApp;

package/dist/commands/publish/index.js

@@ -5,6 +5,8 @@ import { simpleGit } from 'simple-git';
 import * as yaml from 'yaml';
 import { CloudBackend } from '../../backend/cloud/cloud-backend.js';
 import { getBackend } from '../../backend/index.js';
+import { withEphemeralToken } from '../../lib/ephemeral-token.js';
+import { getDefaultLogger } from '../../lib/log.js';
 import { PARAMETER_NAME_PATTERN, ParameterSpec } from '../../lib/package/index.js';
 export default class Publish extends Command {
     static description = 'Publish a package to the Hereya registry';
@@ -20,6 +22,10 @@ export default class Publish extends Command {
       `,
             required: false,
         }),
+        token: Flags.string({
+            description: 'Ephemeral cloud access token used for this invocation only. Held in memory; never written to the keychain or `~/.hereya/secrets/`. Takes precedence over the HEREYA_TOKEN environment variable.',
+            required: false,
+        }),
     };
     async calculateGitArchiveSha256(packageDir) {
         const { exec } = await import('node:child_process');
@@ -162,6 +168,17 @@ export default class Publish extends Command {
         return undefined;
     }
     async run() {
+        const { flags } = await this.parse(Publish);
+        // Precedence: --token flag > HEREYA_TOKEN env var > keychain.
+        if (flags.token) {
+            if (process.env.HEREYA_TOKEN) {
+                getDefaultLogger().debug('[publish] --token flag overrides HEREYA_TOKEN environment variable.');
+            }
+            return withEphemeralToken(flags.token, () => this.runInner());
+        }
+        return this.runInner();
+    }
+    async runInner() {
         const { flags } = await this.parse(Publish);
         const packageDir = flags.chdir || process.cwd();
         try {

package/dist/commands/run/index.d.ts

@@ -7,8 +7,10 @@ export default class Run extends Command {
     static examples: string[];
     static flags: {
         chdir: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        token: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
         workspace: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
     };
     static strict: boolean;
     run(): Promise<void>;
+    private runInner;
 }