hereya-cli 0.86.1 → 0.86.3

package/README.md

@@ -21,7 +21,7 @@ $ npm install -g hereya-cli
 $ hereya COMMAND
 running command...
 $ hereya (--version)
-hereya-cli/0.86.1 linux-x64 node-v24.14.1
+hereya-cli/0.86.3 linux-x64 node-v24.14.1
 $ hereya --help [COMMAND]
 USAGE
   $ hereya COMMAND
@@ -127,7 +127,7 @@ EXAMPLES
   $ hereya add cloudy/docker_postgres
 ```
 
-_See code: [src/commands/add/index.ts](https://github.com/hereya/hereya-cli/blob/v0.86.1/src/commands/add/index.ts)_
+_See code: [src/commands/add/index.ts](https://github.com/hereya/hereya-cli/blob/v0.86.3/src/commands/add/index.ts)_
 
 ## `hereya app deploy NAME`
 
@@ -165,7 +165,7 @@ EXAMPLES
   $ hereya app deploy my-org/my-app -w prod -p organizationId=org-123
 ```
 
-_See code: [src/commands/app/deploy/index.ts](https://github.com/hereya/hereya-cli/blob/v0.86.1/src/commands/app/deploy/index.ts)_
+_See code: [src/commands/app/deploy/index.ts](https://github.com/hereya/hereya-cli/blob/v0.86.3/src/commands/app/deploy/index.ts)_
 
 ## `hereya app deployments NAME`
 
@@ -189,7 +189,7 @@ EXAMPLES
   $ hereya app deployments my-org/my-app
 ```
 
-_See code: [src/commands/app/deployments/index.ts](https://github.com/hereya/hereya-cli/blob/v0.86.1/src/commands/app/deployments/index.ts)_
+_See code: [src/commands/app/deployments/index.ts](https://github.com/hereya/hereya-cli/blob/v0.86.3/src/commands/app/deployments/index.ts)_
 
 ## `hereya app destroy NAME`
 
@@ -221,7 +221,7 @@ EXAMPLES
   $ hereya app destroy my-org/my-app -w my-workspace
 ```
 
-_See code: [src/commands/app/destroy/index.ts](https://github.com/hereya/hereya-cli/blob/v0.86.1/src/commands/app/destroy/index.ts)_
+_See code: [src/commands/app/destroy/index.ts](https://github.com/hereya/hereya-cli/blob/v0.86.3/src/commands/app/destroy/index.ts)_
 
 ## `hereya app env NAME [KEY]`
 
@@ -250,7 +250,7 @@ EXAMPLES
   $ hereya app env my-org/my-app -w my-workspace DATABASE_URL
 ```
 
-_See code: [src/commands/app/env/index.ts](https://github.com/hereya/hereya-cli/blob/v0.86.1/src/commands/app/env/index.ts)_
+_See code: [src/commands/app/env/index.ts](https://github.com/hereya/hereya-cli/blob/v0.86.3/src/commands/app/env/index.ts)_
 
 ## `hereya app list`
 
@@ -271,7 +271,7 @@ EXAMPLES
   $ hereya app list
 ```
 
-_See code: [src/commands/app/list/index.ts](https://github.com/hereya/hereya-cli/blob/v0.86.1/src/commands/app/list/index.ts)_
+_See code: [src/commands/app/list/index.ts](https://github.com/hereya/hereya-cli/blob/v0.86.3/src/commands/app/list/index.ts)_
 
 ## `hereya app new DIRNAME`
 
@@ -297,7 +297,7 @@ EXAMPLES
   $ hereya app new ./my-app -n my-org/my-app --description "An ai-app-builder app"
 ```
 
-_See code: [src/commands/app/new/index.ts](https://github.com/hereya/hereya-cli/blob/v0.86.1/src/commands/app/new/index.ts)_
+_See code: [src/commands/app/new/index.ts](https://github.com/hereya/hereya-cli/blob/v0.86.3/src/commands/app/new/index.ts)_
 
 ## `hereya app status NAME`
 
@@ -323,7 +323,7 @@ EXAMPLES
   $ hereya app status my-org/my-app -w my-workspace
 ```
 
-_See code: [src/commands/app/status/index.ts](https://github.com/hereya/hereya-cli/blob/v0.86.1/src/commands/app/status/index.ts)_
+_See code: [src/commands/app/status/index.ts](https://github.com/hereya/hereya-cli/blob/v0.86.3/src/commands/app/status/index.ts)_
 
 ## `hereya bootstrap INFRASTRUCTURETYPE`
 
@@ -348,7 +348,7 @@ EXAMPLES
   $ hereya bootstrap local
 ```
 
-_See code: [src/commands/bootstrap/index.ts](https://github.com/hereya/hereya-cli/blob/v0.86.1/src/commands/bootstrap/index.ts)_
+_See code: [src/commands/bootstrap/index.ts](https://github.com/hereya/hereya-cli/blob/v0.86.3/src/commands/bootstrap/index.ts)_
 
 ## `hereya clone PROJECT`
 
@@ -373,7 +373,7 @@ EXAMPLES
   $ hereya clone myProject --chdir=./myProject
 ```
 
-_See code: [src/commands/clone/index.ts](https://github.com/hereya/hereya-cli/blob/v0.86.1/src/commands/clone/index.ts)_
+_See code: [src/commands/clone/index.ts](https://github.com/hereya/hereya-cli/blob/v0.86.3/src/commands/clone/index.ts)_
 
 ## `hereya config export-backend [FILE]`
 
@@ -395,7 +395,7 @@ EXAMPLES
   $ hereya config export-backend ./path/to/export.json
 ```
 
-_See code: [src/commands/config/export-backend/index.ts](https://github.com/hereya/hereya-cli/blob/v0.86.1/src/commands/config/export-backend/index.ts)_
+_See code: [src/commands/config/export-backend/index.ts](https://github.com/hereya/hereya-cli/blob/v0.86.3/src/commands/config/export-backend/index.ts)_
 
 ## `hereya config get-backend`
 
@@ -412,7 +412,7 @@ EXAMPLES
   $ hereya config get-backend
 ```
 
-_See code: [src/commands/config/get-backend/index.ts](https://github.com/hereya/hereya-cli/blob/v0.86.1/src/commands/config/get-backend/index.ts)_
+_See code: [src/commands/config/get-backend/index.ts](https://github.com/hereya/hereya-cli/blob/v0.86.3/src/commands/config/get-backend/index.ts)_
 
 ## `hereya config import-backend FILE`
 
@@ -432,7 +432,7 @@ EXAMPLES
   $ hereya config import-backend ./path/to/cloud-backend.json
 ```
 
-_See code: [src/commands/config/import-backend/index.ts](https://github.com/hereya/hereya-cli/blob/v0.86.1/src/commands/config/import-backend/index.ts)_
+_See code: [src/commands/config/import-backend/index.ts](https://github.com/hereya/hereya-cli/blob/v0.86.3/src/commands/config/import-backend/index.ts)_
 
 ## `hereya config use-backend TYPE`
 
@@ -454,7 +454,7 @@ EXAMPLES
   $ hereya config use-backend local
 ```
 
-_See code: [src/commands/config/use-backend/index.ts](https://github.com/hereya/hereya-cli/blob/v0.86.1/src/commands/config/use-backend/index.ts)_
+_See code: [src/commands/config/use-backend/index.ts](https://github.com/hereya/hereya-cli/blob/v0.86.3/src/commands/config/use-backend/index.ts)_
 
 ## `hereya delete-state`
 
@@ -480,7 +480,7 @@ EXAMPLES
   $ hereya delete-state --workspace staging
 ```
 
-_See code: [src/commands/delete-state/index.ts](https://github.com/hereya/hereya-cli/blob/v0.86.1/src/commands/delete-state/index.ts)_
+_See code: [src/commands/delete-state/index.ts](https://github.com/hereya/hereya-cli/blob/v0.86.3/src/commands/delete-state/index.ts)_
 
 ## `hereya deploy`
 
@@ -509,7 +509,7 @@ EXAMPLES
   $ hereya deploy
 ```
 
-_See code: [src/commands/deploy/index.ts](https://github.com/hereya/hereya-cli/blob/v0.86.1/src/commands/deploy/index.ts)_
+_See code: [src/commands/deploy/index.ts](https://github.com/hereya/hereya-cli/blob/v0.86.3/src/commands/deploy/index.ts)_
 
 ## `hereya devenv config`
 
@@ -529,7 +529,7 @@ EXAMPLES
   $ hereya devenv config -w my-workspace
 ```
 
-_See code: [src/commands/devenv/config/index.ts](https://github.com/hereya/hereya-cli/blob/v0.86.1/src/commands/devenv/config/index.ts)_
+_See code: [src/commands/devenv/config/index.ts](https://github.com/hereya/hereya-cli/blob/v0.86.3/src/commands/devenv/config/index.ts)_
 
 ## `hereya devenv install`
 
@@ -554,7 +554,7 @@ EXAMPLES
   $ hereya devenv install -w my-workspace -p instanceType=t3.large
 ```
 
-_See code: [src/commands/devenv/install/index.ts](https://github.com/hereya/hereya-cli/blob/v0.86.1/src/commands/devenv/install/index.ts)_
+_See code: [src/commands/devenv/install/index.ts](https://github.com/hereya/hereya-cli/blob/v0.86.3/src/commands/devenv/install/index.ts)_
 
 ## `hereya devenv project init PROJECT`
 
@@ -586,7 +586,7 @@ EXAMPLES
   $ hereya devenv project init my-app -w my-workspace -t acme/node-starter -p region=us-east-1
 ```
 
-_See code: [src/commands/devenv/project/init/index.ts](https://github.com/hereya/hereya-cli/blob/v0.86.1/src/commands/devenv/project/init/index.ts)_
+_See code: [src/commands/devenv/project/init/index.ts](https://github.com/hereya/hereya-cli/blob/v0.86.3/src/commands/devenv/project/init/index.ts)_
 
 ## `hereya devenv project uninit PROJECT`
 
@@ -612,7 +612,7 @@ EXAMPLES
   $ hereya devenv project uninit my-app -w my-workspace --force
 ```
 
-_See code: [src/commands/devenv/project/uninit/index.ts](https://github.com/hereya/hereya-cli/blob/v0.86.1/src/commands/devenv/project/uninit/index.ts)_
+_See code: [src/commands/devenv/project/uninit/index.ts](https://github.com/hereya/hereya-cli/blob/v0.86.3/src/commands/devenv/project/uninit/index.ts)_
 
 ## `hereya devenv ssh`
 
@@ -632,7 +632,7 @@ EXAMPLES
   $ hereya devenv ssh -w my-workspace
 ```
 
-_See code: [src/commands/devenv/ssh/index.ts](https://github.com/hereya/hereya-cli/blob/v0.86.1/src/commands/devenv/ssh/index.ts)_
+_See code: [src/commands/devenv/ssh/index.ts](https://github.com/hereya/hereya-cli/blob/v0.86.3/src/commands/devenv/ssh/index.ts)_
 
 ## `hereya devenv uninstall`
 
@@ -653,7 +653,7 @@ EXAMPLES
   $ hereya devenv uninstall -w my-workspace
 ```
 
-_See code: [src/commands/devenv/uninstall/index.ts](https://github.com/hereya/hereya-cli/blob/v0.86.1/src/commands/devenv/uninstall/index.ts)_
+_See code: [src/commands/devenv/uninstall/index.ts](https://github.com/hereya/hereya-cli/blob/v0.86.3/src/commands/devenv/uninstall/index.ts)_
 
 ## `hereya doc PACKAGE`
 
@@ -686,7 +686,7 @@ EXAMPLES
   $ hereya doc my-package --no-doc
 ```
 
-_See code: [src/commands/doc/index.ts](https://github.com/hereya/hereya-cli/blob/v0.86.1/src/commands/doc/index.ts)_
+_See code: [src/commands/doc/index.ts](https://github.com/hereya/hereya-cli/blob/v0.86.3/src/commands/doc/index.ts)_
 
 ## `hereya docker run IMAGE`
 
@@ -717,7 +717,7 @@ EXAMPLES
   $ hereya docker run myapp:latest -- --rm -v ./data:/data
 ```
 
-_See code: [src/commands/docker/run/index.ts](https://github.com/hereya/hereya-cli/blob/v0.86.1/src/commands/docker/run/index.ts)_
+_See code: [src/commands/docker/run/index.ts](https://github.com/hereya/hereya-cli/blob/v0.86.3/src/commands/docker/run/index.ts)_
 
 ## `hereya down`
 
@@ -744,7 +744,7 @@ EXAMPLES
   $ hereya down
 ```
 
-_See code: [src/commands/down/index.ts](https://github.com/hereya/hereya-cli/blob/v0.86.1/src/commands/down/index.ts)_
+_See code: [src/commands/down/index.ts](https://github.com/hereya/hereya-cli/blob/v0.86.3/src/commands/down/index.ts)_
 
 ## `hereya env [NAME]`
 
@@ -775,7 +775,7 @@ EXAMPLES
   $ hereya env -w dev -l
 ```
 
-_See code: [src/commands/env/index.ts](https://github.com/hereya/hereya-cli/blob/v0.86.1/src/commands/env/index.ts)_
+_See code: [src/commands/env/index.ts](https://github.com/hereya/hereya-cli/blob/v0.86.3/src/commands/env/index.ts)_
 
 ## `hereya env set [NAME]`
 
@@ -802,7 +802,7 @@ EXAMPLES
   $ hereya env set FOO -v bar -w dev
 ```
 
-_See code: [src/commands/env/set/index.ts](https://github.com/hereya/hereya-cli/blob/v0.86.1/src/commands/env/set/index.ts)_
+_See code: [src/commands/env/set/index.ts](https://github.com/hereya/hereya-cli/blob/v0.86.3/src/commands/env/set/index.ts)_
 
 ## `hereya executor start`
 
@@ -835,7 +835,7 @@ EXAMPLES
   HEREYA_TOKEN=<token> HEREYA_CLOUD_URL=https://my-cloud.example.com hereya executor start -w my-workspace
 ```
 
-_See code: [src/commands/executor/start/index.ts](https://github.com/hereya/hereya-cli/blob/v0.86.1/src/commands/executor/start/index.ts)_
+_See code: [src/commands/executor/start/index.ts](https://github.com/hereya/hereya-cli/blob/v0.86.3/src/commands/executor/start/index.ts)_
 
 ## `hereya flow add PACKAGE`
 
@@ -873,7 +873,7 @@ EXAMPLES
   $ hereya flow add cloudy/docker_postgres -p DB_NAME=mydb -p DB_USER=admin
 ```
 
-_See code: [src/commands/flow/add/index.ts](https://github.com/hereya/hereya-cli/blob/v0.86.1/src/commands/flow/add/index.ts)_
+_See code: [src/commands/flow/add/index.ts](https://github.com/hereya/hereya-cli/blob/v0.86.3/src/commands/flow/add/index.ts)_
 
 ## `hereya flow docker run IMAGE`
 
@@ -903,7 +903,7 @@ EXAMPLES
   $ hereya flow docker run --pin myapp:latest -- --rm
 ```
 
-_See code: [src/commands/flow/docker/run/index.ts](https://github.com/hereya/hereya-cli/blob/v0.86.1/src/commands/flow/docker/run/index.ts)_
+_See code: [src/commands/flow/docker/run/index.ts](https://github.com/hereya/hereya-cli/blob/v0.86.3/src/commands/flow/docker/run/index.ts)_
 
 ## `hereya flow down`
 
@@ -937,7 +937,7 @@ EXAMPLES
   $ hereya flow down --pin
 ```
 
-_See code: [src/commands/flow/down/index.ts](https://github.com/hereya/hereya-cli/blob/v0.86.1/src/commands/flow/down/index.ts)_
+_See code: [src/commands/flow/down/index.ts](https://github.com/hereya/hereya-cli/blob/v0.86.3/src/commands/flow/down/index.ts)_
 
 ## `hereya flow env [NAME]`
 
@@ -971,7 +971,7 @@ EXAMPLES
   $ hereya flow env -l
 ```
 
-_See code: [src/commands/flow/env/index.ts](https://github.com/hereya/hereya-cli/blob/v0.86.1/src/commands/flow/env/index.ts)_
+_See code: [src/commands/flow/env/index.ts](https://github.com/hereya/hereya-cli/blob/v0.86.3/src/commands/flow/env/index.ts)_
 
 ## `hereya flow provid PACKAGE`
 
@@ -1000,7 +1000,7 @@ EXAMPLES
   $ hereya flow provid hereya/postgres --pin
 ```
 
-_See code: [src/commands/flow/provid/index.ts](https://github.com/hereya/hereya-cli/blob/v0.86.1/src/commands/flow/provid/index.ts)_
+_See code: [src/commands/flow/provid/index.ts](https://github.com/hereya/hereya-cli/blob/v0.86.3/src/commands/flow/provid/index.ts)_
 
 ## `hereya flow remove PACKAGE`
 
@@ -1030,7 +1030,7 @@ EXAMPLES
   $ hereya flow remove cloudy/docker_postgres --profile staging
 ```
 
-_See code: [src/commands/flow/remove/index.ts](https://github.com/hereya/hereya-cli/blob/v0.86.1/src/commands/flow/remove/index.ts)_
+_See code: [src/commands/flow/remove/index.ts](https://github.com/hereya/hereya-cli/blob/v0.86.3/src/commands/flow/remove/index.ts)_
 
 ## `hereya flow run CMD`
 
@@ -1059,7 +1059,7 @@ EXAMPLES
   $ hereya flow run --pin -- npm test
 ```
 
-_See code: [src/commands/flow/run/index.ts](https://github.com/hereya/hereya-cli/blob/v0.86.1/src/commands/flow/run/index.ts)_
+_See code: [src/commands/flow/run/index.ts](https://github.com/hereya/hereya-cli/blob/v0.86.3/src/commands/flow/run/index.ts)_
 
 ## `hereya flow up`
 
@@ -1093,7 +1093,7 @@ EXAMPLES
   $ hereya flow up --pin
 ```
 
-_See code: [src/commands/flow/up/index.ts](https://github.com/hereya/hereya-cli/blob/v0.86.1/src/commands/flow/up/index.ts)_
+_See code: [src/commands/flow/up/index.ts](https://github.com/hereya/hereya-cli/blob/v0.86.3/src/commands/flow/up/index.ts)_
 
 ## `hereya help [COMMAND]`
 
@@ -1150,7 +1150,7 @@ EXAMPLES
   $ hereya import org/my-package -f state.tfstate -w my-workspace
 ```
 
-_See code: [src/commands/import/index.ts](https://github.com/hereya/hereya-cli/blob/v0.86.1/src/commands/import/index.ts)_
+_See code: [src/commands/import/index.ts](https://github.com/hereya/hereya-cli/blob/v0.86.3/src/commands/import/index.ts)_
 
 ## `hereya init PROJECT`
 
@@ -1188,7 +1188,7 @@ EXAMPLES
   $ hereya init myProject -w=dev -t=acme/node-starter -d=prod -p region=us-east-1
 ```
 
-_See code: [src/commands/init/index.ts](https://github.com/hereya/hereya-cli/blob/v0.86.1/src/commands/init/index.ts)_
+_See code: [src/commands/init/index.ts](https://github.com/hereya/hereya-cli/blob/v0.86.3/src/commands/init/index.ts)_
 
 ## `hereya list`
 
@@ -1205,7 +1205,7 @@ EXAMPLES
   $ hereya list
 ```
 
-_See code: [src/commands/list/index.ts](https://github.com/hereya/hereya-cli/blob/v0.86.1/src/commands/list/index.ts)_
+_See code: [src/commands/list/index.ts](https://github.com/hereya/hereya-cli/blob/v0.86.3/src/commands/list/index.ts)_
 
 ## `hereya login [URL]`
 
@@ -1234,7 +1234,7 @@ EXAMPLES
   $ hereya login --token=your-token https://cloud.hereya.dev
 ```
 
-_See code: [src/commands/login/index.ts](https://github.com/hereya/hereya-cli/blob/v0.86.1/src/commands/login/index.ts)_
+_See code: [src/commands/login/index.ts](https://github.com/hereya/hereya-cli/blob/v0.86.3/src/commands/login/index.ts)_
 
 ## `hereya logout`
 
@@ -1251,7 +1251,7 @@ EXAMPLES
   $ hereya logout
 ```
 
-_See code: [src/commands/logout/index.ts](https://github.com/hereya/hereya-cli/blob/v0.86.1/src/commands/logout/index.ts)_
+_See code: [src/commands/logout/index.ts](https://github.com/hereya/hereya-cli/blob/v0.86.3/src/commands/logout/index.ts)_
 
 ## `hereya provid PACKAGE`
 
@@ -1279,7 +1279,7 @@ EXAMPLES
   $ hereya provid hereya/postgres --workspace staging
 ```
 
-_See code: [src/commands/provid/index.ts](https://github.com/hereya/hereya-cli/blob/v0.86.1/src/commands/provid/index.ts)_
+_See code: [src/commands/provid/index.ts](https://github.com/hereya/hereya-cli/blob/v0.86.3/src/commands/provid/index.ts)_
 
 ## `hereya publish`
 
@@ -1304,7 +1304,7 @@ EXAMPLES
   $ hereya publish --chdir=/path/to/package
 ```
 
-_See code: [src/commands/publish/index.ts](https://github.com/hereya/hereya-cli/blob/v0.86.1/src/commands/publish/index.ts)_
+_See code: [src/commands/publish/index.ts](https://github.com/hereya/hereya-cli/blob/v0.86.3/src/commands/publish/index.ts)_
 
 ## `hereya remove PACKAGE`
 
@@ -1332,7 +1332,7 @@ EXAMPLES
   $ hereya remove cloudy/docker_postgres
 ```
 
-_See code: [src/commands/remove/index.ts](https://github.com/hereya/hereya-cli/blob/v0.86.1/src/commands/remove/index.ts)_
+_See code: [src/commands/remove/index.ts](https://github.com/hereya/hereya-cli/blob/v0.86.3/src/commands/remove/index.ts)_
 
 ## `hereya run CMD`
 
@@ -1361,7 +1361,7 @@ EXAMPLES
   $ hereya run -w uat -- node index.js
 ```
 
-_See code: [src/commands/run/index.ts](https://github.com/hereya/hereya-cli/blob/v0.86.1/src/commands/run/index.ts)_
+_See code: [src/commands/run/index.ts](https://github.com/hereya/hereya-cli/blob/v0.86.3/src/commands/run/index.ts)_
 
 ## `hereya search QUERY`
 
@@ -1394,7 +1394,7 @@ EXAMPLES
   $ hereya search database --json
 ```
 
-_See code: [src/commands/search/index.ts](https://github.com/hereya/hereya-cli/blob/v0.86.1/src/commands/search/index.ts)_
+_See code: [src/commands/search/index.ts](https://github.com/hereya/hereya-cli/blob/v0.86.3/src/commands/search/index.ts)_
 
 ## `hereya unbootstrap INFRASTRUCTURETYPE`
 
@@ -1419,7 +1419,7 @@ EXAMPLES
   $ hereya unbootstrap local
 ```
 
-_See code: [src/commands/unbootstrap/index.ts](https://github.com/hereya/hereya-cli/blob/v0.86.1/src/commands/unbootstrap/index.ts)_
+_See code: [src/commands/unbootstrap/index.ts](https://github.com/hereya/hereya-cli/blob/v0.86.3/src/commands/unbootstrap/index.ts)_
 
 ## `hereya undeploy`
 
@@ -1448,7 +1448,7 @@ EXAMPLES
   $ hereya undeploy
 ```
 
-_See code: [src/commands/undeploy/index.ts](https://github.com/hereya/hereya-cli/blob/v0.86.1/src/commands/undeploy/index.ts)_
+_See code: [src/commands/undeploy/index.ts](https://github.com/hereya/hereya-cli/blob/v0.86.3/src/commands/undeploy/index.ts)_
 
 ## `hereya uninit PROJECT`
 
@@ -1476,7 +1476,7 @@ EXAMPLES
   $ hereya uninit myProject -w dev -p prodWorkspace=prod
 ```
 
-_See code: [src/commands/uninit/index.ts](https://github.com/hereya/hereya-cli/blob/v0.86.1/src/commands/uninit/index.ts)_
+_See code: [src/commands/uninit/index.ts](https://github.com/hereya/hereya-cli/blob/v0.86.3/src/commands/uninit/index.ts)_
 
 ## `hereya up`
 
@@ -1506,7 +1506,7 @@ EXAMPLES
   $ hereya up
 ```
 
-_See code: [src/commands/up/index.ts](https://github.com/hereya/hereya-cli/blob/v0.86.1/src/commands/up/index.ts)_
+_See code: [src/commands/up/index.ts](https://github.com/hereya/hereya-cli/blob/v0.86.3/src/commands/up/index.ts)_
 
 ## `hereya update [VERSION]`
 
@@ -1528,7 +1528,7 @@ EXAMPLES
   $ hereya update 0.75.0
 ```
 
-_See code: [src/commands/update/index.ts](https://github.com/hereya/hereya-cli/blob/v0.86.1/src/commands/update/index.ts)_
+_See code: [src/commands/update/index.ts](https://github.com/hereya/hereya-cli/blob/v0.86.3/src/commands/update/index.ts)_
 
 ## `hereya workspace create NAME`
 
@@ -1553,7 +1553,7 @@ EXAMPLES
   $ hereya workspace create dev
 ```
 
-_See code: [src/commands/workspace/create/index.ts](https://github.com/hereya/hereya-cli/blob/v0.86.1/src/commands/workspace/create/index.ts)_
+_See code: [src/commands/workspace/create/index.ts](https://github.com/hereya/hereya-cli/blob/v0.86.3/src/commands/workspace/create/index.ts)_
 
 ## `hereya workspace delete NAME`
 
@@ -1573,7 +1573,7 @@ EXAMPLES
   $ hereya workspace delete dev
 ```
 
-_See code: [src/commands/workspace/delete/index.ts](https://github.com/hereya/hereya-cli/blob/v0.86.1/src/commands/workspace/delete/index.ts)_
+_See code: [src/commands/workspace/delete/index.ts](https://github.com/hereya/hereya-cli/blob/v0.86.3/src/commands/workspace/delete/index.ts)_
 
 ## `hereya workspace env [NAME]`
 
@@ -1599,7 +1599,7 @@ EXAMPLES
   $ hereya workspace env myEnv -w dev
 ```
 
-_See code: [src/commands/workspace/env/index.ts](https://github.com/hereya/hereya-cli/blob/v0.86.1/src/commands/workspace/env/index.ts)_
+_See code: [src/commands/workspace/env/index.ts](https://github.com/hereya/hereya-cli/blob/v0.86.3/src/commands/workspace/env/index.ts)_
 
 ## `hereya workspace env set`
 
@@ -1623,7 +1623,7 @@ EXAMPLES
   $ hereya workspace env set -w my-workspace -n myVar -v my-value -i aws -s
 ```
 
-_See code: [src/commands/workspace/env/set/index.ts](https://github.com/hereya/hereya-cli/blob/v0.86.1/src/commands/workspace/env/set/index.ts)_
+_See code: [src/commands/workspace/env/set/index.ts](https://github.com/hereya/hereya-cli/blob/v0.86.3/src/commands/workspace/env/set/index.ts)_
 
 ## `hereya workspace env unset`
 
@@ -1644,7 +1644,7 @@ EXAMPLES
   $ hereya workspace env unset -w my-workspace -n myVar
 ```
 
-_See code: [src/commands/workspace/env/unset/index.ts](https://github.com/hereya/hereya-cli/blob/v0.86.1/src/commands/workspace/env/unset/index.ts)_
+_See code: [src/commands/workspace/env/unset/index.ts](https://github.com/hereya/hereya-cli/blob/v0.86.3/src/commands/workspace/env/unset/index.ts)_
 
 ## `hereya workspace executor install`
 
@@ -1666,7 +1666,7 @@ DESCRIPTION
   Install a remote executor into a workspace
 ```
 
-_See code: [src/commands/workspace/executor/install/index.ts](https://github.com/hereya/hereya-cli/blob/v0.86.1/src/commands/workspace/executor/install/index.ts)_
+_See code: [src/commands/workspace/executor/install/index.ts](https://github.com/hereya/hereya-cli/blob/v0.86.3/src/commands/workspace/executor/install/index.ts)_
 
 ## `hereya workspace executor token`
 
@@ -1686,7 +1686,7 @@ DESCRIPTION
   Generate a workspace-scoped executor token for the remote executor
 ```
 
-_See code: [src/commands/workspace/executor/token/index.ts](https://github.com/hereya/hereya-cli/blob/v0.86.1/src/commands/workspace/executor/token/index.ts)_
+_See code: [src/commands/workspace/executor/token/index.ts](https://github.com/hereya/hereya-cli/blob/v0.86.3/src/commands/workspace/executor/token/index.ts)_
 
 ## `hereya workspace executor uninstall`
 
@@ -1707,7 +1707,7 @@ DESCRIPTION
   Uninstall the remote executor from a workspace
 ```
 
-_See code: [src/commands/workspace/executor/uninstall/index.ts](https://github.com/hereya/hereya-cli/blob/v0.86.1/src/commands/workspace/executor/uninstall/index.ts)_
+_See code: [src/commands/workspace/executor/uninstall/index.ts](https://github.com/hereya/hereya-cli/blob/v0.86.3/src/commands/workspace/executor/uninstall/index.ts)_
 
 ## `hereya workspace install PACKAGE`
 
@@ -1734,7 +1734,7 @@ EXAMPLES
   $ hereya workspace install hereya/aws-cognito
 ```
 
-_See code: [src/commands/workspace/install/index.ts](https://github.com/hereya/hereya-cli/blob/v0.86.1/src/commands/workspace/install/index.ts)_
+_See code: [src/commands/workspace/install/index.ts](https://github.com/hereya/hereya-cli/blob/v0.86.3/src/commands/workspace/install/index.ts)_
 
 ## `hereya workspace list`
 
@@ -1758,7 +1758,7 @@ EXAMPLES
   $ hereya workspace list --org personal
 ```
 
-_See code: [src/commands/workspace/list/index.ts](https://github.com/hereya/hereya-cli/blob/v0.86.1/src/commands/workspace/list/index.ts)_
+_See code: [src/commands/workspace/list/index.ts](https://github.com/hereya/hereya-cli/blob/v0.86.3/src/commands/workspace/list/index.ts)_
 
 ## `hereya workspace set-profile PROFILE`
 
@@ -1782,7 +1782,7 @@ EXAMPLES
   $ hereya workspace set-profile prod-profile -w production
 ```
 
-_See code: [src/commands/workspace/set-profile/index.ts](https://github.com/hereya/hereya-cli/blob/v0.86.1/src/commands/workspace/set-profile/index.ts)_
+_See code: [src/commands/workspace/set-profile/index.ts](https://github.com/hereya/hereya-cli/blob/v0.86.3/src/commands/workspace/set-profile/index.ts)_
 
 ## `hereya workspace uninstall PACKAGE`
 
@@ -1809,5 +1809,5 @@ EXAMPLES
   $ hereya workspace uninstall hereya/aws-cognito
 ```
 
-_See code: [src/commands/workspace/uninstall/index.ts](https://github.com/hereya/hereya-cli/blob/v0.86.1/src/commands/workspace/uninstall/index.ts)_
+_See code: [src/commands/workspace/uninstall/index.ts](https://github.com/hereya/hereya-cli/blob/v0.86.3/src/commands/workspace/uninstall/index.ts)_
 <!-- commandsstop -->

package/dist/commands/deploy/index.js

@@ -2,12 +2,12 @@ import { Command, Flags } from '@oclif/core';
 import { getRendererClass, Listr, ListrLogger, ListrLogLevels } from 'listr2';
 import path from 'node:path';
 import { CloudBackend } from '../../backend/cloud/cloud-backend.js';
-import { getCloudCredentials, loadBackendConfig } from '../../backend/config.js';
 import { getBackend } from '../../backend/index.js';
 import { getExecutor } from '../../executor/index.js';
+import { getActiveCloudAuth } from '../../lib/active-cloud.js';
 import { getConfigManager } from '../../lib/config/index.js';
 import { getEnvManager } from '../../lib/env/index.js';
-import { getEphemeralToken, withEphemeralToken } from '../../lib/ephemeral-token.js';
+import { withEphemeralToken } from '../../lib/ephemeral-token.js';
 import { gitUtils } from '../../lib/git-utils.js';
 import { getDefaultLogger, getLogger, getLogPath, isDebug, setDebug } from '../../lib/log.js';
 import { getParameterManager } from '../../lib/parameter/index.js';
@@ -65,41 +65,19 @@ export default class Deploy extends Command {
             this.error(cleanCheck.reason);
         }
         myLogger.log(ListrLogLevels.STARTED, `Deploying to ${input.workspace} via remote executor (branch: ${input.gitBranch})`);
-        // 2. Get cloud backend for job submission. If we are inside an ephemeral
-        // token scope (set by --token), use that token directly without touching
-        // the keychain or persisted credentials. Otherwise fall back to the
-        // standard "load credentials from disk + keychain" path.
-        const ephemeral = getEphemeralToken();
-        const resolvedWorkspaceName = resolveWorkspaceName(input.workspace, input.project);
-        let cloudBackend;
-        if (ephemeral) {
-            const url = ephemeral.cloudUrl
-                ?? process.env.HEREYA_CLOUD_URL
-                ?? (await loadBackendConfig()).cloud?.url
-                ?? 'https://cloud.hereya.dev';
-            cloudBackend = new CloudBackend({
-                accessToken: ephemeral.token,
-                clientId: '',
-                refreshToken: '',
-                url,
-            });
-        }
-        else {
-            const backendConfig = await loadBackendConfig();
-            if (!backendConfig.cloud) {
-                this.error('Remote deployment requires cloud backend. Run `hereya login` first.');
-            }
-            const credentials = await getCloudCredentials(backendConfig.cloud.clientId);
-            if (!credentials) {
-                this.error('Cloud credentials not found. Run `hereya login` first.');
-            }
-            cloudBackend = new CloudBackend({
-                accessToken: credentials.accessToken,
-                clientId: backendConfig.cloud.clientId,
-                refreshToken: credentials.refreshToken,
-                url: backendConfig.cloud.url,
-            });
+        // 2. Resolve cloud auth (ephemeral --token first, then persisted creds)
+        // and build a CloudBackend for job submission + polling.
+        const auth = await getActiveCloudAuth();
+        if (!auth) {
+            this.error('Remote deployment requires cloud backend. Run `hereya login` or pass `--token <token>`.');
         }
+        const resolvedWorkspaceName = resolveWorkspaceName(input.workspace, input.project);
+        const cloudBackend = new CloudBackend({
+            accessToken: auth.accessToken,
+            clientId: auth.clientId ?? '',
+            refreshToken: auth.refreshToken ?? '',
+            url: auth.cloudUrl,
+        });
         // 3. Submit deploy job
         const submitResult = await cloudBackend.submitExecutorJob({
             payload: {

package/dist/commands/undeploy/index.js

@@ -2,12 +2,12 @@ import { Command, Flags } from '@oclif/core';
 import { getRendererClass, Listr, ListrLogger, ListrLogLevels } from 'listr2';
 import path from 'node:path';
 import { CloudBackend } from '../../backend/cloud/cloud-backend.js';
-import { getCloudCredentials, loadBackendConfig } from '../../backend/config.js';
 import { getBackend } from '../../backend/index.js';
 import { getExecutor } from '../../executor/index.js';
+import { getActiveCloudAuth } from '../../lib/active-cloud.js';
 import { getConfigManager } from '../../lib/config/index.js';
 import { getEnvManager } from '../../lib/env/index.js';
-import { getEphemeralToken, withEphemeralToken } from '../../lib/ephemeral-token.js';
+import { withEphemeralToken } from '../../lib/ephemeral-token.js';
 import { gitUtils } from '../../lib/git-utils.js';
 import { getDefaultLogger, getLogger, getLogPath, isDebug, setDebug } from '../../lib/log.js';
 import { getParameterManager } from '../../lib/parameter/index.js';
@@ -338,41 +338,19 @@ See ${getLogPath()} for more details`);
             this.error(cleanCheck.reason);
         }
         myLogger.log(ListrLogLevels.STARTED, `Undeploying ${input.workspace} via remote executor (branch: ${input.gitBranch})`);
-        // 2. Get cloud backend for job submission. If we are inside an ephemeral
-        // token scope (set by --token), use that token directly without touching
-        // the keychain or persisted credentials. Otherwise fall back to the
-        // standard "load credentials from disk + keychain" path.
-        const ephemeral = getEphemeralToken();
-        const resolvedWorkspaceName = resolveWorkspaceName(input.workspace, input.project);
-        let cloudBackend;
-        if (ephemeral) {
-            const url = ephemeral.cloudUrl
-                ?? process.env.HEREYA_CLOUD_URL
-                ?? (await loadBackendConfig()).cloud?.url
-                ?? 'https://cloud.hereya.dev';
-            cloudBackend = new CloudBackend({
-                accessToken: ephemeral.token,
-                clientId: '',
-                refreshToken: '',
-                url,
-            });
-        }
-        else {
-            const backendConfig = await loadBackendConfig();
-            if (!backendConfig.cloud) {
-                this.error('Remote undeployment requires cloud backend. Run `hereya login` first.');
-            }
-            const credentials = await getCloudCredentials(backendConfig.cloud.clientId);
-            if (!credentials) {
-                this.error('Cloud credentials not found. Run `hereya login` first.');
-            }
-            cloudBackend = new CloudBackend({
-                accessToken: credentials.accessToken,
-                clientId: backendConfig.cloud.clientId,
-                refreshToken: credentials.refreshToken,
-                url: backendConfig.cloud.url,
-            });
+        // 2. Resolve cloud auth (ephemeral --token first, then persisted creds)
+        // and build a CloudBackend for job submission + polling.
+        const auth = await getActiveCloudAuth();
+        if (!auth) {
+            this.error('Remote undeployment requires cloud backend. Run `hereya login` or pass `--token <token>`.');
         }
+        const resolvedWorkspaceName = resolveWorkspaceName(input.workspace, input.project);
+        const cloudBackend = new CloudBackend({
+            accessToken: auth.accessToken,
+            clientId: auth.clientId ?? '',
+            refreshToken: auth.refreshToken ?? '',
+            url: auth.cloudUrl,
+        });
         // 3. Submit undeploy job
         const submitResult = await cloudBackend.submitExecutorJob({
             payload: {

package/dist/executor/context.js

@@ -1,16 +1,17 @@
-import { getCloudCredentials, loadBackendConfig } from '../backend/config.js';
-import { BackendType, getBackend } from '../backend/index.js';
+import { getBackend } from '../backend/index.js';
+import { getActiveCloudAuth } from '../lib/active-cloud.js';
 import { resolveWorkspaceName } from '../lib/workspace-utils.js';
 import { getExecutor } from './index.js';
 export async function getExecutorForWorkspace(workspaceName, project) {
     if (!workspaceName) {
         return getExecutor();
     }
-    const backendConfig = await loadBackendConfig();
-    if (backendConfig.current !== BackendType.Cloud) {
-        return getExecutor();
-    }
-    if (!backendConfig.cloud) {
+    // Honors both `hereya login` (persisted on disk) and an in-scope
+    // ephemeral `--token`. Without this, `--token` invocations silently
+    // fell through to the local executor regardless of whether the
+    // workspace actually has a remote executor.
+    const auth = await getActiveCloudAuth();
+    if (!auth) {
         return getExecutor();
     }
     const resolvedName = resolveWorkspaceName(workspaceName, project);
@@ -23,16 +24,12 @@ export async function getExecutorForWorkspace(workspaceName, project) {
     if (!workspace.hasExecutor) {
         return getExecutor();
     }
-    const credentials = await getCloudCredentials(backendConfig.cloud.clientId);
-    if (!credentials) {
-        return getExecutor();
-    }
     return getExecutor({
         cloudConfig: {
-            accessToken: credentials.accessToken,
-            clientId: backendConfig.cloud.clientId,
-            refreshToken: credentials.refreshToken,
-            url: backendConfig.cloud.url,
+            accessToken: auth.accessToken,
+            clientId: auth.clientId ?? '',
+            refreshToken: auth.refreshToken ?? '',
+            url: auth.cloudUrl,
         },
         workspace: resolvedName,
     });

package/dist/lib/active-cloud.d.ts

@@ -0,0 +1,31 @@
+/**
+ * The active cloud auth credentials for this CLI invocation.
+ *
+ * Either sourced from an ephemeral `--token` (in which case `clientId` and
+ * `refreshToken` are `null` because there is no persisted client identity
+ * and the token cannot be refreshed) or from the persisted `backend.yaml`
+ * + keychain credentials.
+ */
+export interface ActiveCloudAuth {
+    accessToken: string;
+    clientId: null | string;
+    cloudUrl: string;
+    refreshToken: null | string;
+}
+/**
+ * Returns the active cloud auth, preferring an in-scope ephemeral `--token`
+ * over the persisted `backend.yaml` + keychain credentials. Returns `null`
+ * when neither is available.
+ *
+ * **This is the single source of truth for "are we authenticated to
+ * hereya-cloud right now?"** — every code path that previously read from
+ * `loadBackendConfig()` + `getCloudCredentials()` directly (and therefore
+ * silently ignored an ephemeral `--token`) should call this instead.
+ */
+export declare function getActiveCloudAuth(): Promise<ActiveCloudAuth | null>;
+/**
+ * Whether the cloud backend is "active" — either via `hereya login` or via
+ * an in-scope ephemeral `--token`. Used to decide whether to consult the
+ * cloud package registry, the remote executor, etc.
+ */
+export declare function isCloudBackendActive(): Promise<boolean>;

package/dist/lib/active-cloud.js

@@ -0,0 +1,55 @@
+import { getCloudCredentials, loadBackendConfig } from '../backend/config.js';
+import { BackendType } from '../backend/index.js';
+import { getEphemeralToken } from './ephemeral-token.js';
+const DEFAULT_CLOUD_URL = 'https://cloud.hereya.dev';
+/**
+ * Returns the active cloud auth, preferring an in-scope ephemeral `--token`
+ * over the persisted `backend.yaml` + keychain credentials. Returns `null`
+ * when neither is available.
+ *
+ * **This is the single source of truth for "are we authenticated to
+ * hereya-cloud right now?"** — every code path that previously read from
+ * `loadBackendConfig()` + `getCloudCredentials()` directly (and therefore
+ * silently ignored an ephemeral `--token`) should call this instead.
+ */
+export async function getActiveCloudAuth() {
+    const ephemeral = getEphemeralToken();
+    if (ephemeral) {
+        const cloudUrl = ephemeral.cloudUrl
+            ?? process.env.HEREYA_CLOUD_URL
+            ?? (await loadBackendConfig()).cloud?.url
+            ?? DEFAULT_CLOUD_URL;
+        return {
+            accessToken: ephemeral.token,
+            clientId: null,
+            cloudUrl,
+            refreshToken: null,
+        };
+    }
+    const config = await loadBackendConfig();
+    if (config.current !== BackendType.Cloud || !config.cloud) {
+        return null;
+    }
+    const credentials = await getCloudCredentials(config.cloud.clientId);
+    if (!credentials) {
+        return null;
+    }
+    return {
+        accessToken: credentials.accessToken,
+        clientId: config.cloud.clientId,
+        cloudUrl: config.cloud.url,
+        refreshToken: credentials.refreshToken,
+    };
+}
+/**
+ * Whether the cloud backend is "active" — either via `hereya login` or via
+ * an in-scope ephemeral `--token`. Used to decide whether to consult the
+ * cloud package registry, the remote executor, etc.
+ */
+export async function isCloudBackendActive() {
+    if (getEphemeralToken()) {
+        return true;
+    }
+    const config = await loadBackendConfig();
+    return config.current === BackendType.Cloud;
+}

package/dist/lib/ephemeral-token.d.ts

@@ -16,17 +16,24 @@ export interface EphemeralTokenContext {
 /**
  * Returns the active ephemeral token context, or `undefined` if no
  * `withEphemeralToken` scope is currently in flight.
+ *
+ * Falls back to the `HEREYA_EPHEMERAL_TOKEN` env var when no async-local-
+ * storage context is set — that's how subprocesses (the credential helper
+ * grandchild, etc.) inherit the ephemeral context across process
+ * boundaries. The env var is set automatically by `withEphemeralToken`.
  */
 export declare function getEphemeralToken(): EphemeralTokenContext | undefined;
 /**
  * Run `fn` inside an ephemeral-token scope. While `fn` is executing,
- * `getEphemeralToken()` returns the supplied token (and optional cloudUrl).
+ * `getEphemeralToken()` returns the supplied token (and optional cloudUrl),
+ * and `process.env.HEREYA_EPHEMERAL_TOKEN` is set so subprocesses inherit
+ * the same ephemeral context.
  *
  * Critical guarantees:
  * - The token is held in-memory only. It is NEVER passed to the secret
  *   manager or written to disk.
  * - After `fn` returns or throws, `getEphemeralToken()` returns `undefined`
- *   again.
+ *   again and `HEREYA_EPHEMERAL_TOKEN` is restored to its prior value.
  * - The cached backend in `src/backend/index.ts` is cleared before and after
  *   the scope so that a stale, persisted-credential-backed CloudBackend is
  *   never used while the scope is active, and the scope's in-memory backend

package/dist/lib/ephemeral-token.js

@@ -1,22 +1,52 @@
 import { AsyncLocalStorage } from 'node:async_hooks';
 import { clearBackend } from '../backend/index.js';
 const storage = new AsyncLocalStorage();
+/**
+ * Env-var names used to propagate the ephemeral token to **subprocesses**
+ * (e.g. the `git` invocation that triggers the `hereya credential-helper`
+ * grandchild). Async-local-storage doesn't cross process boundaries, so we
+ * also stash the token in the environment for the duration of the scope.
+ *
+ * These are deliberately named differently from `HEREYA_TOKEN` because the
+ * existing `HEREYA_TOKEN` semantics call `loginWithToken()` (exchange +
+ * keychain persist), which is exactly what ephemeral mode must NOT do.
+ */
+const EPHEMERAL_TOKEN_ENV = 'HEREYA_EPHEMERAL_TOKEN';
+const EPHEMERAL_CLOUD_URL_ENV = 'HEREYA_EPHEMERAL_CLOUD_URL';
 /**
  * Returns the active ephemeral token context, or `undefined` if no
  * `withEphemeralToken` scope is currently in flight.
+ *
+ * Falls back to the `HEREYA_EPHEMERAL_TOKEN` env var when no async-local-
+ * storage context is set — that's how subprocesses (the credential helper
+ * grandchild, etc.) inherit the ephemeral context across process
+ * boundaries. The env var is set automatically by `withEphemeralToken`.
  */
 export function getEphemeralToken() {
-    return storage.getStore();
+    const fromAsyncStorage = storage.getStore();
+    if (fromAsyncStorage) {
+        return fromAsyncStorage;
+    }
+    const fromEnv = process.env[EPHEMERAL_TOKEN_ENV];
+    if (fromEnv) {
+        return {
+            cloudUrl: process.env[EPHEMERAL_CLOUD_URL_ENV] || undefined,
+            token: fromEnv,
+        };
+    }
+    return undefined;
 }
 /**
  * Run `fn` inside an ephemeral-token scope. While `fn` is executing,
- * `getEphemeralToken()` returns the supplied token (and optional cloudUrl).
+ * `getEphemeralToken()` returns the supplied token (and optional cloudUrl),
+ * and `process.env.HEREYA_EPHEMERAL_TOKEN` is set so subprocesses inherit
+ * the same ephemeral context.
  *
  * Critical guarantees:
  * - The token is held in-memory only. It is NEVER passed to the secret
  *   manager or written to disk.
  * - After `fn` returns or throws, `getEphemeralToken()` returns `undefined`
- *   again.
+ *   again and `HEREYA_EPHEMERAL_TOKEN` is restored to its prior value.
  * - The cached backend in `src/backend/index.ts` is cleared before and after
  *   the scope so that a stale, persisted-credential-backed CloudBackend is
  *   never used while the scope is active, and the scope's in-memory backend
@@ -26,10 +56,33 @@ export function getEphemeralToken() {
 export async function withEphemeralToken(token, fn, options) {
     // Drop any cached backend so the next getBackend() call sees the ephemeral context.
     clearBackend();
+    // Snapshot existing env-var values so we can restore them on exit.
+    const priorTokenEnv = process.env[EPHEMERAL_TOKEN_ENV];
+    const priorCloudUrlEnv = process.env[EPHEMERAL_CLOUD_URL_ENV];
+    process.env[EPHEMERAL_TOKEN_ENV] = token;
+    if (options?.cloudUrl) {
+        process.env[EPHEMERAL_CLOUD_URL_ENV] = options.cloudUrl;
+    }
+    else {
+        delete process.env[EPHEMERAL_CLOUD_URL_ENV];
+    }
     try {
         return await storage.run({ cloudUrl: options?.cloudUrl, token }, fn);
     }
     finally {
+        // Restore prior env-var state (no leakage between sibling invocations).
+        if (priorTokenEnv === undefined) {
+            delete process.env[EPHEMERAL_TOKEN_ENV];
+        }
+        else {
+            process.env[EPHEMERAL_TOKEN_ENV] = priorTokenEnv;
+        }
+        if (priorCloudUrlEnv === undefined) {
+            delete process.env[EPHEMERAL_CLOUD_URL_ENV];
+        }
+        else {
+            process.env[EPHEMERAL_CLOUD_URL_ENV] = priorCloudUrlEnv;
+        }
         // Drop the in-memory backend bound to the ephemeral token before yielding control.
         clearBackend();
     }

package/dist/lib/hereya-token.js

@@ -1,22 +1,21 @@
-import { getCloudCredentials, loadBackendConfig } from '../backend/config.js';
+import { getActiveCloudAuth } from './active-cloud.js';
 export const hereyaTokenUtils = {
     async generateHereyaToken(description) {
-        const backendConfig = await loadBackendConfig();
-        if (!backendConfig.cloud) {
-            return null;
-        }
-        const { clientId, url } = backendConfig.cloud;
-        const credentials = await getCloudCredentials(clientId);
-        if (!credentials) {
+        // Honors both `hereya login` (persisted) and an in-scope ephemeral
+        // `--token`. Note: workspace-scoped CLI tokens (kind:"cli") are
+        // intentionally rejected by the cloud's /api/personal-tokens route —
+        // only user-level tokens can mint long-lived personal tokens.
+        const auth = await getActiveCloudAuth();
+        if (!auth) {
             return null;
         }
         const formData = new FormData();
         formData.append('description', description);
         formData.append('expiresInDays', '365');
-        const response = await fetch(`${url}/api/personal-tokens`, {
+        const response = await fetch(`${auth.cloudUrl}/api/personal-tokens`, {
             body: formData,
             headers: {
-                Authorization: `Bearer ${credentials.accessToken}`,
+                Authorization: `Bearer ${auth.accessToken}`,
             },
             method: 'POST',
         });
@@ -24,6 +23,6 @@ export const hereyaTokenUtils = {
             return null;
         }
         const result = await response.json();
-        return { cloudUrl: url, token: result.data.token };
+        return { cloudUrl: auth.cloudUrl, token: result.data.token };
     },
 };

package/dist/lib/package/index.d.ts

@@ -8,18 +8,6 @@ import { LocalPackageManager } from './local.js';
 export declare const githubPackageManager: PackageManager;
 export declare const localPackageManager: LocalPackageManager;
 export declare function getPackageManager(protocol: string, logger?: Logger): Promise<PackageManager>;
-/**
- * Whether the cloud package registry should be consulted on this invocation.
- *
- * Returns true when either:
- *  - the persisted backend type (from `~/.hereya/backend.yaml`) is `Cloud`, or
- *  - an ephemeral `--token` is in scope (set via `withEphemeralToken`).
- *
- * The ephemeral-token branch is what makes `--token` work for fresh users who
- * have never run `hereya login` — without it, the on-disk backend type stays
- * `Local` and cloud-only packages fail to resolve.
- */
-export declare function isCloudBackendActive(): Promise<boolean>;
 export declare function resolvePackage(input: ResolvePackageInput): Promise<ResolvePackageOutput>;
 export declare function getPackageCanonicalName(packageName: string): string;
 export declare function downloadPackage(pkgUrl: string, destPath: string): Promise<string>;

package/dist/lib/package/index.js

@@ -1,10 +1,9 @@
 import * as yaml from 'yaml';
 import { z } from 'zod';
-import { getCurrentBackendType } from '../../backend/config.js';
-import { BackendType, getBackend } from '../../backend/index.js';
+import { getBackend } from '../../backend/index.js';
 import { IacType } from '../../iac/common.js';
 import { InfrastructureType } from '../../infrastructure/common.js';
-import { getEphemeralToken } from '../ephemeral-token.js';
+import { isCloudBackendActive } from '../active-cloud.js';
 import { CloudPackageManager } from './cloud.js';
 import { GitHubPackageManager } from './github.js';
 import { LocalPackageManager } from './local.js';
@@ -21,23 +20,6 @@ export async function getPackageManager(protocol, logger) {
     // Default to GitHub
     return githubPackageManager;
 }
-/**
- * Whether the cloud package registry should be consulted on this invocation.
- *
- * Returns true when either:
- *  - the persisted backend type (from `~/.hereya/backend.yaml`) is `Cloud`, or
- *  - an ephemeral `--token` is in scope (set via `withEphemeralToken`).
- *
- * The ephemeral-token branch is what makes `--token` work for fresh users who
- * have never run `hereya login` — without it, the on-disk backend type stays
- * `Local` and cloud-only packages fail to resolve.
- */
-export async function isCloudBackendActive() {
-    if (getEphemeralToken()) {
-        return true;
-    }
-    return (await getCurrentBackendType()) === BackendType.Cloud;
-}
 export async function resolvePackage(input) {
     // Parse package spec to extract name and version
     const { packageName, version } = parsePackageSpec(input.package);

package/oclif.manifest.json

@@ -3342,5 +3342,5 @@
       ]
     }
   },
-  "version": "0.86.1"
+  "version": "0.86.3"
 }

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "hereya-cli",
   "description": "Infrastructure as Package",
-  "version": "0.86.1",
+  "version": "0.86.3",
   "author": "Hereya Developers",
   "bin": {
     "hereya": "./bin/run.js"